@mmerterden/multi-agent-pipeline 10.7.2 → 10.7.3

package/CHANGELOG.md

@@ -14,6 +14,20 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [10.7.3] - 2026-07-02
+
+### Changed
+
+- **Zero external-tool residue.** Genericized every remaining editor/tool citation
+  in the pipeline's own files (Windsurf Cascade / Cursor Plan Mode / Cursor Bugbot /
+  Cline / Devin) across schemas, lib comments, refs, and the task-clarifier persona —
+  feature behavior is unchanged, only the third-party naming is dropped. (Vendored
+  `shared/external` knowledge and the `~/.codex` prune path in `update` are unaffected.)
+- **README** gained a **Tokens & integrations** table (keychain-mapping model + the
+  services the pipeline talks to: Jira, GitHub, Bitbucket, Confluence, Figma, Fortify,
+  Firebase, Jenkins, npm) and an explicit **Platform support** section (macOS / Linux /
+  Windows, keychain backends).
+
 ## [10.7.2] - 2026-07-02
 
 ### Changed

package/README.md

@@ -84,11 +84,27 @@ The pipeline runs natively on **Claude Code** and **Copilot CLI** — both insta
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-## Setup notes
+## Tokens & integrations
 
-- **Tokens** stay in the OS keychain (macOS Keychain / Windows Credential Manager / Linux libsecret) and are never committed or logged. `setup` maps them into `~/.claude/multi-agent-preferences.json`.
-- **Secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a commit on a hit) and as a pre-push check elsewhere.
-- **All tokens are optional** — the pipeline asks for any it needs at Phase 0.
+`setup` scans your OS keychain and maps each token by a **logical name** (e.g. `jira`) to its real keychain entry — the pipeline resolves tokens through that mapping (`credential-store.sh`), so literal keychain names never appear in synced files. Tokens stay in the keychain (macOS Keychain / Windows Credential Manager / Linux libsecret), are **never committed or logged**, and are all **optional** — the pipeline asks for any it needs at Phase 0.
+
+| Token | Used for | Phase |
+|---|---|---|
+| `jira` | fetch the issue · post the report comment | 0, 7 |
+| `github` | issues · PRs · `gh` auth | 0, 6 |
+| `bitbucket` | PR create/update (reviewer-preserving) · diff | 6 |
+| `confluence` | publish analysis / wiki pages | 7 |
+| `figma` + `figma_mcp` | fetch design context | analysis only |
+| `fortify` | security-scan findings gate | 4 |
+| `firebase` | Firebase config (base64 JSON) for Firebase projects | as needed |
+| `jenkins` | CI trigger / status | build / deploy |
+| `npm` | package publish (mostly CI) | release |
+
+The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a commit on a hit) and as a pre-push check elsewhere.
+
+## Platform support
+
+Runs on **macOS**, **Linux**, and **Windows** (Git Bash / WSL). Shell and credential access go through a platform-agnostic layer — the keychain resolves automatically to **macOS Keychain**, **Linux libsecret** (`secret-tool`), or **Windows Credential Manager**, and scripts fall back between BSD and GNU tool variants. Node.js 18 / 20 / 22.
 
 ## Companion repos
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "10.7.2",
+  "version": "10.7.3",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI, Cursor, Antigravity, and VS Code Copilot Chat. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Opus triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/agents/task-clarifier.md

@@ -7,7 +7,7 @@ modelRationale: "Ambiguity scoring is a low-stakes classification + targeted que
 
 # Task Clarifier Agent  -  Phase 0 Step 9
 
-You score how clearly the task is specified and, when score is below the threshold, emit up to N clarifying questions the user must answer before Phase 1 (Analysis) begins. Pattern source: Devin's clarifying-question loop documented at <https://docs.devin.ai/work-with-devin/devin-review> and the Devin Knowledge pattern (<https://docs.devin.ai/product-guides/knowledge>).
+You score how clearly the task is specified and, when score is below the threshold, emit up to N clarifying questions the user must answer before Phase 1 (Analysis) begins.
 
 **You do NOT solve the task.** You only assess whether the task is solvable as stated. The user is the one who answers; you produce the questions.
 
@@ -108,6 +108,4 @@ Cost expectation on Haiku (input ~1.5k tokens issue body, output ~400 tokens JSO
 
 ## Pattern citation
 
-- Devin docs (clarifying via Knowledge triggers + Ask Devin sessions): <https://docs.devin.ai/work-with-devin/devin-review>
-- Cursor Plan Mode (asks clarifying questions before producing the plan): <https://cursor.com/docs/agent/planning>
 - Anthropic Building Effective Agents  -  orchestrator-workers pattern, prefer cheap classification before expensive synthesis: <https://www.anthropic.com/engineering/building-effective-agents>

package/pipeline/commands/multi-agent/refs/features/shadow-git.md

@@ -1,6 +1,6 @@
 # Feature: Shadow-Git Checkpoints (Phase 3)
 
-**Gated by `prefs.global.shadowGit.enabled`** (default: `false`). The orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without polluting the project's real `.git` history. Pattern source: Cline checkpoints (<https://docs.cline.bot/features/checkpoints>).
+**Gated by `prefs.global.shadowGit.enabled`** (default: `false`). The orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without polluting the project's real `.git` history.
 
 ```bash
 # Phase 0 (one-time per task): initialize shadow repo + baseline snapshot.

package/pipeline/commands/multi-agent/refs/phases/phase-0-init.md

@@ -508,7 +508,7 @@ Log: `Phase 0 Step 7: taskType = {component|bugfix|feature|refactor|chore}`
 
 **Cost:** ~$0.0025 per Haiku call. The pipeline's other expensive phases (Phase 4 reviewers, Phase 3 Sonnet codegen) far outweigh this  -  the value is avoiding the ~30 min wasted when Phase 3 builds the wrong thing because Phase 0 didn't ask.
 
-**Reference:** see `pipeline/agents/task-clarifier.md` for the full scoring rubric, question quality rules, and prior-art citations (Devin Knowledge / Cursor Plan Mode).
+**Reference:** see `pipeline/agents/task-clarifier.md` for the full scoring rubric and question-quality rules.
 
 **Why this fits Phase 0 (not a new phase):** clarification doesn't change what code gets written  -  it changes what gets understood before code is written. Phase 0 already collects identity / project / branch / maturity; ambiguity scoring fits naturally as the last contextual gate.
 

package/pipeline/commands/multi-agent/refs/phases/phase-2-planning.md

@@ -124,7 +124,7 @@ Log: "Phase 2: Plan  -  {N} tasks created, {M} with architecture review, validat
 
 #### Step 4.5  -  Emit Plan Todo List (opt-in)
 
-**Gated by `prefs.global.planTodos.enabled`** (default: `false`). When enabled, after the planning-output JSON validates and BEFORE the approval gate, transform `tasks[]` into a structured Todo list conforming to `pipeline/schemas/plan-todos.schema.json` and persist into `agent-state.plan`. Pattern source: Windsurf Cascade's always-visible Todo list (<https://docs.windsurf.com/windsurf/cascade>) and Cursor Plan Mode's reviewable plan (<https://cursor.com/docs/agent/planning>).
+**Gated by `prefs.global.planTodos.enabled`** (default: `false`). When enabled, after the planning-output JSON validates and BEFORE the approval gate, transform `tasks[]` into a structured Todo list conforming to `pipeline/schemas/plan-todos.schema.json` and persist into `agent-state.plan`. The plan is rendered as a live, always-visible Todo list.
 
 ```bash
 TODO_BLOB=$(jq '

package/pipeline/commands/multi-agent/refs/phases/phase-3-dev.md

@@ -41,7 +41,7 @@ Phase 3 consumes the Phase 2 output object conforming to `pipeline/schemas/plann
 
 **Plan Todo iteration (opt-in)**: gated by `prefs.global.planTodos.enabled` (default: `false`). When enabled and Phase 2 Step 4.5 emitted a `plan.todos[]`, Phase 3 iterates via `pipeline/lib/plan-todos.sh next/start/complete/fail` instead of walking `tasks[]` directly. When disabled, the loop walks `tasks[]` from `planning-output`  -  TDD contract is unchanged. Full helper loop + state semantics: `refs/features/plan-todos.md`.
 
-**Shadow-Git checkpoints (opt-in)**: gated by `prefs.global.shadowGit.enabled` (default: `false`). When enabled, the orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without touching the project's real `.git` history. Cline-style. Lifecycle: `shadow-git.sh init` (Phase 0 baseline), `shadow-git.sh snapshot` (per step after `plan-todos complete`), `shadow-git.sh restore <sha> --files` (rollback). Modes: `per-todo-step` (default) or `per-tool-call`. Full wiring + storage cap: `refs/features/shadow-git.md`.
+**Shadow-Git checkpoints (opt-in)**: gated by `prefs.global.shadowGit.enabled` (default: `false`). When enabled, the orchestrator snapshots the worktree via `pipeline/lib/shadow-git.sh` so sub-phase rollback is possible without touching the project's real `.git` history. Lifecycle: `shadow-git.sh init` (Phase 0 baseline), `shadow-git.sh snapshot` (per step after `plan-todos complete`), `shadow-git.sh restore <sha> --files` (rollback). Modes: `per-todo-step` (default) or `per-tool-call`. Full wiring + storage cap: `refs/features/shadow-git.md`.
 
 #### Component tasks  -  delegated dispatch (taskType === "component")
 

package/pipeline/commands/multi-agent/refs/tracker-contract.md

@@ -25,7 +25,6 @@ The agent detects which CLI it's running in and uses the appropriate visual mech
 1. system prompt mentions "Claude Code"             → claude-code
 2. system prompt mentions "Copilot" / "GitHub Copilot" → copilot
 3. system prompt mentions "Cursor"                   → cursor
-4. system prompt mentions "Cascade" / "Windsurf"     → windsurf
 5. None of the above                                 → generic (bash stdout)
 ```
 

package/pipeline/lib/plan-todos.sh

@@ -2,11 +2,8 @@
 #
 # plan-todos.sh  -  manage the Phase 2 plan as a live Todo list.
 #
-# Pattern source:
-#   - Windsurf Cascade  -  https://docs.windsurf.com/windsurf/cascade
-#       "renders a Todo list inside the conversation that updates as it works"
-#   - Cursor Plan Mode  -  https://cursor.com/docs/agent/planning
-#       "creates a detailed, reviewable, editable plan before writing any code"
+# The Phase 2 plan is broken into a live, reviewable Todo list that updates
+# step-by-step as Phase 3 works through it.
 #
 # State lives in `agent-state.json` under `.plan.todos[]` per
 # pipeline/schemas/plan-todos.schema.json. Phase 2 (Planning) emits the

package/pipeline/lib/post-pr-review.sh

@@ -137,7 +137,7 @@ render_inline_body() {
     printf '_%s_\n\n' "$rule_id"
   fi
   printf -- '---\n🤖 _Multi-Agent Review · iteration #%s_\n' "$ITERATION"
-  # Dedupe marker  -  Bugbot-style. Re-runs of /multi-agent:review skip a
+  # Dedupe marker  -  dedupe-style. Re-runs of /multi-agent:review skip a
   # finding when an existing comment carries the same fingerprint.
   if [ -n "$fingerprint" ]; then
     printf '<!-- multi-agent-finding: %s -->\n' "$fingerprint"
@@ -229,7 +229,7 @@ post_github() {
     rc_body="See inline comments above."
   fi
 
-  # Dedupe gate  -  read pref, default ON (Bugbot-style). Loads existing
+  # Dedupe gate  -  read pref, default ON (dedupe-style). Loads existing
   # comments once if needed; per-finding check is in-process.
   local DEDUPE_ENABLED
   DEDUPE_ENABLED=$(jq -r '.global.review.dedupeInlineComments // true' \

package/pipeline/lib/review-watch.sh

@@ -3,12 +3,8 @@
 # review-watch.sh  -  poll watched GitHub repos for incoming PRs and
 # dispatch `/multi-agent:review` on each new/updated PR.
 #
-# Pattern source:
-#   - Cursor Bugbot  -  https://cursor.com/docs/bugbot
-#       "Bugbot automatically reviews every PR update; reads existing PR
-#       comments to avoid duplicate feedback."
-#   - Devin Review  -  https://docs.devin.ai/work-with-devin/devin-review
-#       "Auto-Review on PR open / new commit / draft-ready / reviewer-add."
+# Auto-reviews every new/updated PR the user did not author, reading existing
+# PR comments to avoid duplicate feedback.
 #
 # What it does:
 #   - Reads watched repos from prefs.global.reviewWatch.repos[] (or --repos).

package/pipeline/lib/shadow-git.sh

@@ -2,11 +2,9 @@
 #
 # shadow-git.sh  -  per-tool-call checkpoints in a separate git repo.
 #
-# Pattern source:
-#   - Cline checkpoints  -  https://docs.cline.bot/features/checkpoints
-#       "Cline maintains a shadow Git repository separate from your project's
-#        actual Git history... After each tool use, Cline commits the current
-#        state of your files to this shadow repo."
+# A shadow git repo, separate from the project's real .git, records a snapshot
+# of the working tree after each tool use so a sub-phase can be rolled back
+# without polluting the user's semantic commit history.
 #
 # Why a SHADOW repo (not the real .git): the real git tree holds the user's
 # semantic commits  -  clean history, intentional messages. Shadow snapshots

package/pipeline/schemas/clarify-output.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://example.com/pipeline/clarify-output.schema.json",
   "title": "Clarification Output",
-  "description": "Schema for Phase 0 Step 9 task-clarifier sub-agent output. Source: pipeline/agents/task-clarifier.md. Pattern reference: Devin clarifying-question loop (https://docs.devin.ai/work-with-devin/devin-review) and Cursor Plan Mode (https://cursor.com/docs/agent/planning).",
+  "description": "Schema for Phase 0 Step 9 task-clarifier sub-agent output. Source: pipeline/agents/task-clarifier.md. A clarifying-question loop that runs before planning.",
   "type": "object",
   "additionalProperties": false,
   "required": ["clarityScore", "questions", "stopAndAsk"],

package/pipeline/schemas/plan-todos.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://example.com/pipeline/plan-todos.schema.json",
   "title": "Plan Todo List",
-  "description": "Structured representation of Phase 2's plan. Persists into agent-state under `.plan.todos[]` and survives across phases. Phase 3 (Dev) iterates step-by-step; Phase 4 (Review) verifies completed steps against criteria; Phase 7 (Report) renders a per-step rollup. Pattern source: Windsurf Cascade (https://docs.windsurf.com/windsurf/cascade) renders a live Todo list inside the conversation; Cursor Plan Mode (https://cursor.com/docs/agent/planning) builds an editable plan before any code.",
+  "description": "Structured representation of Phase 2's plan. Persists into agent-state under `.plan.todos[]` and survives across phases. Phase 3 (Dev) iterates step-by-step; Phase 4 (Review) verifies completed steps against criteria; Phase 7 (Report) renders a per-step rollup. The plan is broken into a live, structured Todo list for step-by-step tracking across phases.",
   "type": "object",
   "additionalProperties": false,
   "required": ["title", "todos"],

package/pipeline/schemas/prefs.schema.json

@@ -709,7 +709,7 @@
             "dedupeInlineComments": {
               "type": "boolean",
               "default": true,
-              "description": "Bugbot/Devin Review behaviour: before posting an inline comment, scan existing PR comments for a stable fingerprint marker (sha-16 of path|line|issue). If a comment with the same marker exists, skip  -  preserves audit trail without flooding the PR on re-runs. Provider-agnostic: GitHub /pulls/{n}/comments + /issues/{n}/comments and Bitbucket Server /pull-requests/{id}/activities?fromType=COMMENT are both checked. Set to false to restore the pre-v8.6 behavior (every run posts fresh comments, original spec)."
+              "description": "Deduplicated PR review comments: before posting an inline comment, scan existing PR comments for a stable fingerprint marker (sha-16 of path|line|issue). If a comment with the same marker exists, skip  -  preserves audit trail without flooding the PR on re-runs. Provider-agnostic: GitHub /pulls/{n}/comments + /issues/{n}/comments and Bitbucket Server /pull-requests/{id}/activities?fromType=COMMENT are both checked. Set to false to restore the pre-v8.6 behavior (every run posts fresh comments, original spec)."
             }
           }
         },
@@ -727,7 +727,7 @@
               "type": "string",
               "enum": ["per-tool-call", "per-todo-step", "off"],
               "default": "per-todo-step",
-              "description": "Snapshot frequency. per-tool-call mirrors Cline (one snapshot after each Edit/Write/Bash mutation); per-todo-step snapshots once per plan-todos.sh step boundary (cheaper, recommended). off is equivalent to enabled=false."
+              "description": "Snapshot frequency. per-tool-call snapshots after each Edit/Write/Bash mutation; per-todo-step snapshots once per plan-todos.sh step boundary (cheaper, recommended). off is equivalent to enabled=false."
             },
             "pruneAfterDays": {
               "type": "integer",
@@ -741,7 +741,7 @@
         "planTodos": {
           "type": "object",
           "additionalProperties": false,
-          "description": "v8.6+  -  Plan-as-live-Todo-list. Phase 2 emits agent-state.plan.todos[] conforming to pipeline/schemas/plan-todos.schema.json; Phase 3 iterates step-by-step via pipeline/lib/plan-todos.sh next/start/complete; Phase 7 renders the rollup into agent-log.md and the PR body. Pattern source: Windsurf Cascade (https://docs.windsurf.com/windsurf/cascade) Todo list inside the conversation; Cursor Plan Mode (https://cursor.com/docs/agent/planning) reviewable plan. Off by default  -  opt in to add status-transition writes per Phase 3 step in exchange for sub-step visibility + per-step notes.",
+          "description": "v8.6+  -  Plan-as-live-Todo-list. Phase 2 emits agent-state.plan.todos[] conforming to pipeline/schemas/plan-todos.schema.json; Phase 3 iterates step-by-step via pipeline/lib/plan-todos.sh next/start/complete; Phase 7 renders the rollup into agent-log.md and the PR body. The plan is broken into a live, structured Todo list. Off by default  -  opt in to add status-transition writes per Phase 3 step in exchange for sub-step visibility + per-step notes.",
           "properties": {
             "enabled": {
               "type": "boolean",
@@ -753,7 +753,7 @@
         "clarifyAmbiguous": {
           "type": "object",
           "additionalProperties": false,
-          "description": "v8.6+  -  Phase 0 Step 9 clarifying-question loop. Before Phase 1 starts, a cheap Haiku classifier scores task ambiguity (0-10) and emits up to N questions if score < threshold. Pattern source: Devin Knowledge / Ask Devin (https://docs.devin.ai/work-with-devin/devin-review) and Cursor Plan Mode clarifying questions (https://cursor.com/docs/agent/planning). Cost: ~$0.0025 per Haiku call. Off by default  -  flip on for teams burned by ambiguity-driven rework or when working on cross-team issues where the spec lives in someone else's head.",
+          "description": "v8.6+  -  Phase 0 Step 9 clarifying-question loop. Before Phase 1 starts, a cheap Haiku classifier scores task ambiguity (0-10) and emits up to N questions if score < threshold. Cost: ~$0.0025 per Haiku call. Off by default  -  flip on for teams burned by ambiguity-driven rework or when working on cross-team issues where the spec lives in someone else's head.",
           "properties": {
             "enabled": {
               "type": "boolean",
@@ -840,7 +840,7 @@
         "reviewWatch": {
           "type": "object",
           "additionalProperties": false,
-          "description": "v8.6+  -  Auto-review incoming PRs via gh CLI polling. Inspired by Cursor Bugbot (https://cursor.com/docs/bugbot) and Devin Review (https://docs.devin.ai/work-with-devin/devin-review): trigger /multi-agent:review on PRs the user did NOT author. Disabled by default. Configure repos via .repos[] then either run pipeline/lib/review-watch.sh --watch as a background process or schedule it via cron.",
+          "description": "v8.6+  -  Auto-review incoming PRs via gh CLI polling. Auto-triggers /multi-agent:review on PRs the user did NOT author. Disabled by default. Configure repos via .repos[] then either run pipeline/lib/review-watch.sh --watch as a background process or schedule it via cron.",
           "properties": {
             "enabled": {
               "type": "boolean",

package/pipeline/scripts/smoke-review-watch.sh

@@ -8,7 +8,7 @@
 #   4. State directory is created
 #   5. prefs schema exposes global.reviewWatch.{enabled,repos,intervalSeconds,labelFilter}
 #   6. global.reviewWatch.enabled defaults to false (opt-in)
-#   7. global.review.dedupeInlineComments default is true (Bugbot parity)
+#   7. global.review.dedupeInlineComments default is true (dedupe parity)
 #   8. post-pr-review.sh exposes finding_fingerprint + comment_exists_with_fingerprint
 #   9. render_inline_body accepts a 5th fingerprint arg and embeds the marker
 #  10. Unknown command exits non-zero
@@ -81,7 +81,7 @@ fi
 # 7. dedupeInlineComments default true
 if jq -e '.properties.global.properties.review.properties.dedupeInlineComments
           | has("default") and .default == true' "$SCHEMA" >/dev/null 2>&1; then
-  record_pass "review.dedupeInlineComments defaults to true (Bugbot parity)"
+  record_pass "review.dedupeInlineComments defaults to true (dedupe parity)"
 else
   record_fail "review.dedupeInlineComments should default to true"
 fi

package/pipeline/scripts/smoke-shadow-git.sh

@@ -32,7 +32,7 @@ failures=()
 record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
 record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
 
-printf '→ smoke-shadow-git: Cline-style per-tool-call checkpoint contract\n'
+printf '→ smoke-shadow-git: per-tool-call checkpoint contract\n'
 
 # 1. Script exists + parses
 if [ ! -f "$SG" ]; then