@mmerterden/multi-agent-pipeline 11.2.0 → 11.3.1

package/CHANGELOG.md

@@ -14,6 +14,74 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [11.3.1] - 2026-07-10
+
+Self-audit patch (found by running `/multi-agent:refactor` on the pipeline itself): a data-loss fix, a latent gate regression, supply-chain hardening, and a few correctness fixes.
+
+- **Fix (data-loss): uninstall no longer deletes `~/.claude/rules/`.** Install
+  treats `rules/` as user-owned (write-if-missing, never overwritten), but the
+  uninstaller recursively removed the whole tree, destroying personal rules
+  (including the git-attribution rule). Uninstall now preserves `rules/`, and
+  lists it in the PRESERVED summary.
+- **Fix (gate regression): `lint-skills` scoped to `pipeline/skills`.** The
+  v11.3.0 command-layout migration made command files match `find pipeline -name
+  SKILL.md`; slash commands have no `name:` frontmatter, so the skill linter
+  started erroring on all 37 of them (latent because CI is billing-paused and
+  releases were published manually). The linter now only checks actual skills.
+- **Fix: `.skills-index.json` is idempotent** - dropped the `generatedAt`
+  timestamp so regenerating an unchanged skill set produces no diff.
+- **Fix: uninstall strips the Copilot pipeline block regardless of file size** -
+  removed the 50 KB fallback cap that orphaned the block in large
+  `copilot-instructions.md` files.
+- **Fix: install "dev-only excluded" count** is now the real file count (the
+  `fixtures/` directory was under-counted as one entry).
+- **Security (supply-chain):** `release.yml` publishes with `npm publish
+  --provenance` (`id-token: write`); all GitHub Actions pinned to commit SHAs;
+  added `.github/dependabot.yml` (actions + npm dev deps); `credential-store.sh`
+  escapes single quotes in the Windows PowerShell paths.
+- **New: `eval-mine-corpus.mjs`** turns recorded triage decisions
+  (`triage-corpus.jsonl`) into review-gated candidate triage-eval fixtures.
+- **Tests:** added node unit tests for the Phase 4 diff-risk gates
+  (`test/phase4-gates.test.mjs`) so they run in the release lane, not only the
+  bash smoke; `lint-skills` now warns (non-fatal) on terse skill descriptions.
+
+## [11.3.0] - 2026-07-10
+
+Single-source skill management, an upgraded `refactor` command, and two new Phase 4 diff-risk gates.
+
+- **Component/Figma work is plugin-only.** The pipeline no longer bundles the
+  `figma-ios` / `figma-android` / `figma-common` skill trees. Phase 3 dispatches
+  component and Figma-to-code work to the per-stack marketplace plugins
+  (`ai-ios-engineering-toolkit` / `ai-android-engineering-toolkit`) via the Skill
+  tool, so component skills live in one place. The 3-tier Figma design-access
+  fallback still governs the analysis phase.
+- **Command layout migrated to `<name>/SKILL.md`.** Each subcommand is now its own
+  directory with a `SKILL.md`, and the dispatcher is `commands/multi-agent/SKILL.md`.
+  This restores subcommand registration in the `/` picker on current Claude Code
+  (the older flat `commands/multi-agent/<name>.md` files stopped registering). The
+  slash surface (`/multi-agent:<name>`) is unchanged.
+- **Refs are non-invocable.** The 46 reference docs + internal pickers moved out of
+  `commands/` into `multi-agent-refs/`, so Claude Code no longer registers them as
+  `/multi-agent:refs:*` slash commands. Commands read them by absolute path.
+- **`refactor` upgraded.** `/multi-agent:refactor` now (A) researches field
+  best-practices from GitHub + X/Twitter + Reddit + web and produces an adapted
+  plan fitted to the repo's stack, (B) runs an explicit bug hunt (real defects with
+  file:line + failure scenario, verified before reporting), and (C) checks upstream
+  drift of derived skills, configured via `global.derivedSkillSources` in local
+  preferences (never synced, so it can reference private sources). All four bands
+  (best-practice / bug / improvement / drift) merge into one prioritized plan.
+- **New: Phase 4 diff-risk gates.** `test-integrity-gate.mjs` is an
+  anti-reward-hacking gate that turns removed/weakened tests into a blocking review
+  finding, and `review-scope.mjs` scales the reviewer count to diff complexity
+  (trivial diffs get a single reviewer, high-stakes or large churn gets the full
+  panel). Both are deterministic pure functions of the diff-risk JSON, covered by
+  `smoke-phase4-gates.sh`.
+- **Cleanup + hardening.** Removed stale flat/`refs/` paths from the Copilot core
+  skills and `copilot-instructions`, pruned the orphaned `figma-to-component`
+  install dir, broadened the personal-data leak detector to catch private
+  marketplace/plugin names, and refreshed the docs (README, features, architecture,
+  Figma pipeline) to the plugin-dispatch model.
+
 ## [11.2.0] - 2026-07-07
 
 Skill mining + an install-safety fix.

package/README.md

@@ -5,7 +5,7 @@
 [![Node.js](https://img.shields.io/badge/Node.js-18%20%7C%2020%20%7C%2022-green)](https://nodejs.org)
 [![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](https://github.com/mmerterden/multi-agent-pipeline/blob/main/package.json)
 
-An 8-phase AI development pipeline for **Claude Code** and **Copilot CLI**. Drives a Jira issue or GitHub URL to a merged PR in one command — analysis → plan → TDD → review → test → commit → PR — with multi-repo orchestration, a plan-approval gate, CLI-aware parallel review, and store-compliance checks. Includes a generic Figma-to-Component pipeline for iOS (SwiftUI) and Android (Jetpack Compose).
+An 8-phase AI development pipeline for **Claude Code** and **Copilot CLI**. Drives a Jira issue or GitHub URL to a merged PR in one command — analysis → plan → TDD → review → test → commit → PR — with multi-repo orchestration, a plan-approval gate, CLI-aware parallel review, and store-compliance checks. Component and Figma-to-code work is dispatched to the per-stack marketplace plugins (iOS/SwiftUI, Android/Compose) rather than bundled, so component skills live in one place.
 
 Runs natively on Claude Code and Copilot CLI. macOS / Linux / Windows. Zero runtime dependencies.
 
@@ -63,7 +63,7 @@ The discipline behind all of this — bounded loops, evidence gates, token-budge
 | Local | `/multi-agent:local "task"` | Full pipeline, current branch (no worktree) |
 | Finish | `/multi-agent:finish` | Run the review→test→commit→report tail over local work |
 
-Helpers: `setup`, `status`, `resume #N`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `jira`, `issue`, `analysis`, `generate-task`, `generate-bug`. Full list: `/multi-agent:help`.
+Helpers: `setup`, `status`, `resume #N`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `generate-task`, `generate-bug`. Full list: `/multi-agent:help`.
 
 ## Stacks
 

package/docs/FIGMA_PIPELINE.md

@@ -2,6 +2,8 @@
 
 End-to-end guide for generating production-ready UI components from Figma designs through the multi-agent pipeline. Covers iOS (SwiftUI) and Android (Jetpack Compose) with the same workflow shape.
 
+> Note: Component and Figma-to-code skills are no longer bundled in this repo. Phase 3 dispatches component work to the per-stack marketplace plugins (`ai-ios-engineering-toolkit` / `ai-android-engineering-toolkit` in the `multi-agent-plugins` marketplace) via the Skill tool. The workflow, subphases, and skill names described below are what those plugin skills run internally, not pipeline-bundled code. The 3-tier Figma design-access fallback still governs the analysis phase in this repo.
+
 ## What you get
 
 - **One command** — `/multi-agent <figma-url-or-issue>` — produces a complete component: Configuration + View + Modifiers + Preview + README + three layers of tests + Code Connect + wiki doc.
@@ -13,7 +15,7 @@ End-to-end guide for generating production-ready UI components from Figma design
 
 ## How it runs
 
-When multi-agent Phase 0 classifies a task as `component` (Figma URL in description, or figma-driven instruction path), Phase 3 delegates the entire phase to the `figma-to-component` orchestrator skill under `pipeline/skills/figma-{ios|android}/`. That skill owns subphases 3.0–3.8 and writes them to `state.phases["3"].subphases[]` — multi-agent's phase-tracker reads that array with no special case.
+When multi-agent Phase 0 classifies a task as `component` (Figma URL in description, or figma-driven instruction path), Phase 3 delegates the entire phase to the enabled `ai-<platform>-engineering-toolkit` marketplace plugin's component skill (`create-component`, fallback `create-ui-component`) via the Skill tool. Component skills live in the plugin marketplace, not the pipeline. The dispatch layer records a coarse component-build row in `state.phases["3"].subphases[]` — multi-agent's phase-tracker reads that array with no special case. The subphase list below describes the flow the plugin skill runs internally.
 
 ### Internal phase order
 
@@ -88,7 +90,7 @@ When a GitHub issue triggers the pipeline and has no Jira link:
 3. Phase 7 Step 3.5 runs component wiki capture.
 4. Phase 7 posts a humanizer'd wiki summary back to the linked Jira (`wikiToJiraComment`, default `true`).
 
-Full contract: [`pipeline/commands/multi-agent/refs/issue-jira-triad.md`](../pipeline/commands/multi-agent/refs/issue-jira-triad.md).
+Full contract: [`pipeline/multi-agent-refs/issue-jira-triad.md`](../pipeline/multi-agent-refs/issue-jira-triad.md).
 
 ## Wiki modes (pick one per project)
 
@@ -99,7 +101,7 @@ Full contract: [`pipeline/commands/multi-agent/refs/issue-jira-triad.md`](../pip
 | `github-wiki` | `{owner}/{repo}.wiki.git/{Category}/{Name}.md` | Clone the `.wiki.git`, commit, push |
 | `separate-repo` | Remote repo's configured branch | Clone to cache, commit, push |
 
-Full contract: [`pipeline/commands/multi-agent/refs/wiki-capture.md`](../pipeline/commands/multi-agent/refs/wiki-capture.md).
+Full contract: [`pipeline/multi-agent-refs/wiki-capture.md`](../pipeline/multi-agent-refs/wiki-capture.md).
 
 ## Preferences
 
@@ -116,35 +118,20 @@ Global settings that affect the figma pipeline:
 | `confluenceDefault` | bool | `false` | Phase 7 Confluence auto-yes |
 | `jiraCommentDefault` | bool | `true` | Phase 7 test-scenarios Jira comment auto-yes |
 
-## Upstream sync (for teams maintaining a source project)
-
-If your team maintains a separate figma-to-component source repo, set:
-
-```json
-"figmaSource": {
-  "path":   "/absolute/path/to/source",
-  "branch": "develop"
-}
-```
-
-Then run `pipeline/scripts/sync-figma-source.sh` (directly or through the planned WS-9b `/multi-agent:sync` delegation). Changes since the last sync watermark are imported with the placeholder transform applied automatically.
-
 ## Troubleshooting
 
 | Symptom | Likely cause | Fix |
 |---|---|---|
-| Phase 3 halts with "orchestrator skill missing" | Skill dir removed after import | Re-run import or `sync-figma-source.sh --force-full` |
-| `smoke-figma-skill-import` fails on frontmatter | Local edits stripped the `---` header | Restore frontmatter; all figma-android/figma-ios skills need name + status + sourced-from |
-| `smoke-personal-data` fails after import | New hardcoded value slipped through | Add a rule to `pipeline/scripts/figma-placeholder-map.json` and re-run import |
+| Phase 3 halts with "plugin not enabled" | The `ai-<platform>-engineering-toolkit` plugin is not enabled in this repo | Enable it in the repo's `.claude/settings.local.json` (`"ai-ios-engineering-toolkit@<marketplace>": true`) and reload the session |
+| `multi-agent:create-component` not found | Marketplace not installed / plugin disabled | Install the marketplace and enable the platform toolkit; dispatch tries `create-component` then `create-ui-component` |
 | Wiki adapter failure | Remote unreachable (separate-repo mode) | Adapter caches pending output; next run retries. Non-blocking — Phase 7 continues. |
 | Jira auto-create hits 5xx | Transient Jira outage | Non-blocking — pipeline continues without link. User can run `/multi-agent:channels` post-hoc to add it. |
 | Android gradle unresolved | `figmaConfig.build.gradleModule` not set | Populate the config; halt is intentional (no guessing) |
 
 ## Further reading
 
-- [`pipeline/commands/multi-agent/refs/component-dispatch.md`](../pipeline/commands/multi-agent/refs/component-dispatch.md) — Phase 3 delegation contract.
-- [`pipeline/commands/multi-agent/refs/wiki-capture.md`](../pipeline/commands/multi-agent/refs/wiki-capture.md) — Phase 7 wiki contract.
-- [`pipeline/commands/multi-agent/refs/issue-jira-triad.md`](../pipeline/commands/multi-agent/refs/issue-jira-triad.md) — issue → jira → wiki triad contract.
-- [`pipeline/commands/multi-agent/refs/progress-contract.md`](../pipeline/commands/multi-agent/refs/progress-contract.md) — live progress-line emission contract.
-- [`pipeline/commands/multi-agent/refs/cross-cli-contract.md`](../pipeline/commands/multi-agent/refs/cross-cli-contract.md) — Claude ↔ Copilot CLI parity.
-- [`pipeline/skills/figma-ios/REVIEW_CHECKLIST.md`](../pipeline/skills/figma-ios/REVIEW_CHECKLIST.md) — per-skill review gate after import.
+- [`pipeline/multi-agent-refs/component-dispatch.md`](../pipeline/multi-agent-refs/component-dispatch.md) — Phase 3 delegation contract.
+- [`pipeline/multi-agent-refs/wiki-capture.md`](../pipeline/multi-agent-refs/wiki-capture.md) — Phase 7 wiki contract.
+- [`pipeline/multi-agent-refs/issue-jira-triad.md`](../pipeline/multi-agent-refs/issue-jira-triad.md) — issue → jira → wiki triad contract.
+- [`pipeline/multi-agent-refs/progress-contract.md`](../pipeline/multi-agent-refs/progress-contract.md) — live progress-line emission contract.
+- [`pipeline/multi-agent-refs/cross-cli-contract.md`](../pipeline/multi-agent-refs/cross-cli-contract.md) — Claude ↔ Copilot CLI parity.

package/docs/architecture.md

@@ -71,7 +71,7 @@ graph TD
 
 ## Figma SubPhase Integration (Phase 3)
 
-When `figmaConfigPath` is set, Phase 3 dispatches the Figma-to-SwiftUI pipeline:
+When a task is classified `component`, Phase 3 dispatches to the marketplace component plugin (`ai-<platform>-engineering-toolkit`) via the Skill tool. Component skills are not bundled in this repo; the subphases below describe the flow the plugin skill runs internally:
 
 ```mermaid
 graph TD
@@ -120,9 +120,8 @@ graph TB
         CMD[commands/<br/>39 command files<br/>(34 user-facing)]
         AGT[agents/<br/>8 agent personas]
         RUL[rules/<br/>12 domain rules]
-        PHS[refs/phases/<br/>8 phase specs + 3 contracts]
-        FIG[skills/figma-{ios,android,common}/<br/>41 figma skills]
-        CMP[skills/shared/core/<br/>38 orchestration skills<br/>incl. compliance]
+        PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
+        CMP[skills/shared/core/<br/>orchestration skills<br/>incl. compliance]
         EXT[skills/shared/external/<br/>143 curated skills<br/>(authoring source for the<br/>multi-agent-plugins marketplace)]
     end
 
@@ -137,7 +136,6 @@ graph TB
     INS -->|copies to ~/.claude/| AGT
     INS -->|copies to ~/.claude/| RUL
     CMD --> PHS
-    CMD --> FIG
     SCH --> EVL
     SCH --> SMK
 ```

package/docs/features.md

@@ -19,7 +19,7 @@ Phase 7: Report   External: Jira comment · Wiki + Figma screenshots · Confluen
                    Internal: agent-log.md + Quality & Metrics + knowledge + memory
 ```
 
-Each phase reads its own spec file under `pipeline/commands/multi-agent/refs/phases/phase-N-*.md` — lazy-loaded so the orchestrator only pays the token cost for the phase it's currently in.
+Each phase reads its own spec file under `pipeline/multi-agent-refs/phases/phase-N-*.md` — lazy-loaded so the orchestrator only pays the token cost for the phase it's currently in.
 
 ### Modifier Flags (orthogonal, combinable)
 
@@ -65,7 +65,7 @@ Result persisted to `agent-state.taskType`:
 
 | Type        | Downstream effects                                                            |
 | ----------- | ----------------------------------------------------------------------------- |
-| `component` | Phase 3 loads figma-to-swiftui skill with SubPhase dispatch                   |
+| `component` | Phase 3 dispatches to the marketplace component plugin (create-component) with SubPhase reporting |
 | `bugfix`    | Phase 4 emphasizes test coverage + regression; Phase 6 uses `fix(...)` prefix |
 | `feature`   | Standard TDD flow; Phase 6 uses `feat(...)` prefix                            |
 | `refactor`  | Phase 4 emphasizes behavior preservation; Phase 6 uses `refactor(...)` prefix |
@@ -180,7 +180,7 @@ Pure code analysis — no simulator needed. Device-level audits run in Phase 5 w
 
 ### Status Enforcement
 
-Phase 3 marks issue-tracker status update as MANDATORY with a post-mutation verify step that re-reads the field and retries once on silent `VALIDATION` failures (e.g. stale Projects V2 option IDs after a board rebuild).
+Phase 3 treats the issue-tracker status update as a required step with a post-mutation verify step that re-reads the field and retries once on silent `VALIDATION` failures (e.g. stale Projects V2 option IDs after a board rebuild).
 
 ## Safety & Hygiene
 
@@ -209,7 +209,7 @@ All critical state files are schema-validated at read and write time:
 
 ### Sync Parity Check
 
-Detects drift between Claude Code instructions (`~/.claude/commands/multi-agent.md`), Copilot CLI instructions (`~/.copilot/copilot-instructions.md`), and the repo's pipeline spec files. Reports discrepancies during Phase 0 Init.
+Detects drift between Claude Code instructions (`~/.claude/commands/multi-agent/SKILL.md`), Copilot CLI instructions (`~/.copilot/copilot-instructions.md`), and the repo's pipeline spec files. Reports discrepancies during Phase 0 Init.
 
 ### Token Budget Enforcement
 
@@ -251,11 +251,11 @@ Pipeline learns behavioral signals (feedback corrections, project constraints, e
 
 ## Integrations
 
-### Figma → SwiftUI
+### Figma / Component Generation (dispatched to marketplace plugins)
 
-Full component generation pipeline from a Figma URL. Generates `{Name}Configuration.swift`, `{Name}View.swift`, `{Name}+Modifiers.swift`, `{Name}.figma.swift`, `FIGMA.md` with variant matrix. 14-item pre-commit checklist covers design tokens, accessibility, tests, Code Connect.
+Component + Figma-to-code work is no longer bundled in this repo. When Phase 0 classifies a task as `component`, Phase 3 dispatches it to the per-stack marketplace plugins (`ai-ios-engineering-toolkit` / `ai-android-engineering-toolkit` in the `multi-agent-plugins` marketplace) via the Skill tool. The plugin's component skill generates `{Name}Configuration.swift`, `{Name}View.swift`, `{Name}+Modifiers.swift`, `{Name}.figma.swift`, and `FIGMA.md` with a variant matrix, then runs a 14-item pre-commit checklist covering design tokens, accessibility, tests, and Code Connect.
 
-Cross-cutting integration skills feed Phase 3D detection + Phase 4B implementation when the design triggers them — content: `figma-form-integration`, `figma-price-integration`, `figma-ui-patterns`; interaction: `figma-navigation`, `figma-overlays`, `figma-bottom-sheets`. Each is **native-SwiftUI-first** and reads project specifics (token namespaces, component paths, and UI systems) from `figma-config` — including the optional `ui.navigationSystem` / `ui.overlaySystem` / `ui.sheetSystem` hooks (absent → stock SwiftUI). So the same capabilities work on any SwiftUI codebase, not just one app. `figma-evolve-component` reconciles an existing component against current Figma (drift-heal) and additively extends it, behind a human gate.
+The plugin's cross-cutting integration skills feed component detection + implementation when the design triggers them (content: form / price / ui-patterns; interaction: navigation / overlays / bottom-sheets). Each is native-SwiftUI-first and reads project specifics (token namespaces, component paths, UI systems) from `figma-config`, including the optional `ui.navigationSystem` / `ui.overlaySystem` / `ui.sheetSystem` hooks (absent -> stock SwiftUI), so the same capabilities work on any SwiftUI codebase. The plugin's evolve-component skill reconciles an existing component against current Figma (drift-heal) and additively extends it, behind a human gate.
 
 ### UI Bug Hunter + Audits
 
@@ -290,4 +290,4 @@ Token registry maps logical names (`jira`, `bitbucket`, `github`, `confluence`)
 
 ## File Layout
 
-`commands/multi-agent/{add-detail,setup,help}.md` → slash commands. `commands/multi-agent/refs/**` → guides, phase specs, rules (`refs:` prefix signals "not an action"). Modifier flags and ops stay inline in `multi-agent.md`.
+Each subcommand is its own directory: `commands/multi-agent/<name>/SKILL.md` → slash command; the dispatcher is `commands/multi-agent/SKILL.md`. The user-facing invocation `/multi-agent:<name>` is unchanged. Guides, phase specs, and rules live under `pipeline/multi-agent-refs/**` (kept out of `commands/` so they are not invocable as slash commands). Modifier flags and ops stay inline in the dispatcher SKILL.

package/install/_dev-only-files.mjs

@@ -10,14 +10,8 @@
  */
 
 export const DEV_ONLY_SCRIPTS = Object.freeze([
-  "figma-placeholder-map.json",
-  "sync-figma-source.sh",
-  "import-figma-skills.sh",
-  "smoke-figma-skill-import.sh",
   "smoke-figma-config-schema.sh",
   "smoke-personal-data.sh", // scanner contains the patterns it detects
   "smoke-install-leak-gate.sh", // same — scanner shadows the install pipeline
-  "README-figma-smokes.md",
   "fixtures", // smoke test fixtures live in the repo only, never ship to users
-  ".last-figma-sync-plan.json", // figma-sync runtime plan artifact, contains maintainer paths
 ]);

package/install/claude.mjs

@@ -12,7 +12,7 @@
  * @module install/claude
  */
 
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, rmSync } from "fs";
 import { join } from "path";
 import { execSync } from "child_process";
 
@@ -49,8 +49,10 @@ export function installClaude(ctx) {
   const CLAUDE_SKILLS = join(home, ".claude", "skills");
   const CLAUDE_SCHEMAS = join(home, ".claude", "schemas");
   const CLAUDE_LIB = join(home, ".claude", "lib");
+  const CLAUDE_MA_REFS = join(home, ".claude", "multi-agent-refs");
 
   installCommands(pipelineSrc, CLAUDE_COMMANDS, useSymlinks);
+  installMultiAgentRefs(pipelineSrc, CLAUDE_MA_REFS, useSymlinks);
   installScripts(pipelineSrc, CLAUDE_SCRIPTS, useSymlinks);
   installAgents(pipelineSrc, CLAUDE_AGENTS, useSymlinks);
   installRules(pipelineSrc, CLAUDE_RULES, useSymlinks);
@@ -80,6 +82,20 @@ function installCommands(pipelineSrc, dest, useSymlinks) {
   console.log(`    -> ${countFiles(commandsSrc)} files copied to ${dest}`);
 }
 
+// The pipeline's reference docs (refs/) + internal pickers live OUTSIDE the
+// commands/ tree so Claude Code does NOT register them as invocable
+// `/multi-agent:refs:*` slash commands. Commands read them by absolute path
+// ($HOME/.claude/multi-agent-refs/...). Wipe-before-copy so renamed/removed
+// refs don't linger.
+function installMultiAgentRefs(pipelineSrc, dest, useSymlinks) {
+  const refsSrc = join(pipelineSrc, "multi-agent-refs");
+  if (!existsSync(refsSrc)) return;
+  console.log("  [Claude Code] Installing multi-agent refs (non-command)...");
+  wipeDir(dest);
+  copyDir(refsSrc, dest, { useSymlinks });
+  console.log(`    -> ${countFiles(refsSrc)} ref files copied to ${dest}`);
+}
+
 function installScripts(pipelineSrc, dest, useSymlinks) {
   console.log("  [Claude Code] Installing scripts...");
   const scriptsSrc = join(pipelineSrc, "scripts");
@@ -89,9 +105,13 @@ function installScripts(pipelineSrc, dest, useSymlinks) {
   // removed upstream should not linger.
   wipeDir(dest);
   copyDir(scriptsSrc, dest, { exclude: DEV_ONLY_SCRIPTS, useSymlinks });
-  const scriptCount = countFiles(scriptsSrc) - DEV_ONLY_SCRIPTS.length;
+  // Count files actually excluded, not the array length: DEV_ONLY_SCRIPTS mixes
+  // individual .sh files with the `fixtures` directory (many files), so the
+  // array length under-counts the real exclusion.
+  const excludedCount = DEV_ONLY_SCRIPTS.reduce((n, name) => n + countFiles(join(scriptsSrc, name)), 0);
+  const scriptCount = countFiles(scriptsSrc) - excludedCount;
   console.log(
-    `    -> ${scriptCount} files copied to ${dest} (${DEV_ONLY_SCRIPTS.length} dev-only excluded)`,
+    `    -> ${scriptCount} files copied to ${dest} (${excludedCount} dev-only excluded)`,
   );
 }
 
@@ -200,9 +220,6 @@ function installSkills(opts) {
 
   const sharedCoreSrc = join(pipelineSrc, "skills", "shared", "core");
   const sharedExternalSrc = join(pipelineSrc, "skills", "shared", "external");
-  const figmaIosSrc = join(pipelineSrc, "skills", "figma-ios");
-  const figmaAndroidSrc = join(pipelineSrc, "skills", "figma-android");
-  const figmaCommonSrc = join(pipelineSrc, "skills", "figma-common");
 
   let claudeSkillCount = 0;
 
@@ -235,17 +252,22 @@ function installSkills(opts) {
     }
   }
 
-  for (const [label, src, sub] of [
-    ["figma-ios", figmaIosSrc, "figma-ios"],
-    ["figma-android", figmaAndroidSrc, "figma-android"],
-    ["figma-common", figmaCommonSrc, "figma-common"],
-  ]) {
-    if (!existsSync(src)) continue;
-    const dst = join(dest, sub);
-    copyDir(src, dst, { useSymlinks });
-    const count = countFiles(src);
-    claudeSkillCount += count;
-    console.log(`    -> ${label}: ${count} files -> ${dst}`);
+  // Figma component skills moved to the ai-<platform>-engineering-toolkit marketplace
+  // plugin and are no longer bundled here. Prune any stale copies left by a
+  // pre-migration install so the installed tree stays consistent.
+  for (const sub of ["figma-ios", "figma-android", "figma-common", "figma-to-component"]) {
+    const stale = join(dest, sub);
+    if (!existsSync(stale)) continue;
+    if (isDryRun()) {
+      console.log(`    [dry-run] would prune stale ${stale} (moved to plugin)`);
+      continue;
+    }
+    try {
+      rmSync(stale, { recursive: true, force: true });
+      console.log(`    -> pruned stale ${sub}/ (moved to marketplace plugin)`);
+    } catch {
+      /* non-fatal */
+    }
   }
 
   console.log(`    -> ${claudeSkillCount} skill files installed to ${dest}`);

package/install/copilot.mjs

@@ -119,9 +119,13 @@ function installScripts(pipelineSrc, dest, useSymlinks) {
   if (!existsSync(scriptsSrc)) return;
   wipeDir(dest);
   copyDir(scriptsSrc, dest, { exclude: DEV_ONLY_SCRIPTS, useSymlinks });
-  const scriptCount = countFiles(scriptsSrc) - DEV_ONLY_SCRIPTS.length;
+  // Count files actually excluded, not the array length: DEV_ONLY_SCRIPTS mixes
+  // individual .sh files with the `fixtures` directory (many files), so the
+  // array length under-counts the real exclusion.
+  const excludedCount = DEV_ONLY_SCRIPTS.reduce((n, name) => n + countFiles(join(scriptsSrc, name)), 0);
+  const scriptCount = countFiles(scriptsSrc) - excludedCount;
   console.log(
-    `    -> ${scriptCount} files copied to ${dest} (${DEV_ONLY_SCRIPTS.length} dev-only excluded)`,
+    `    -> ${scriptCount} files copied to ${dest} (${excludedCount} dev-only excluded)`,
   );
 }
 
@@ -173,9 +177,6 @@ function installSkills(opts) {
 
   const sharedCoreSrc = join(pipelineSrc, "skills", "shared", "core");
   const sharedExternalSrc = join(pipelineSrc, "skills", "shared", "external");
-  const figmaIosSrc = join(pipelineSrc, "skills", "figma-ios");
-  const figmaAndroidSrc = join(pipelineSrc, "skills", "figma-android");
-  const figmaCommonSrc = join(pipelineSrc, "skills", "figma-common");
   let copilotSkillCount = 0;
 
   // Wipe stale multi-agent-* skill dirs that were removed upstream.
@@ -229,17 +230,22 @@ function installSkills(opts) {
     }
   }
 
-  for (const [label, src, sub] of [
-    ["figma-ios", figmaIosSrc, "figma-ios"],
-    ["figma-android", figmaAndroidSrc, "figma-android"],
-    ["figma-common", figmaCommonSrc, "figma-common"],
-  ]) {
-    if (!existsSync(src)) continue;
-    const dst = join(dest, sub);
-    copyDir(src, dst, { useSymlinks });
-    const count = countFiles(src);
-    copilotSkillCount += count;
-    console.log(`    -> ${label}: ${count} files -> ${dst}`);
+  // Figma component skills moved to the ai-<platform>-engineering-toolkit marketplace
+  // plugin and are no longer bundled here. Prune any stale copies left by a
+  // pre-migration install so the installed tree stays consistent.
+  for (const sub of ["figma-ios", "figma-android", "figma-common", "figma-to-component"]) {
+    const stale = join(dest, sub);
+    if (!existsSync(stale)) continue;
+    if (isDryRun()) {
+      console.log(`    [dry-run] would prune stale ${stale} (moved to plugin)`);
+      continue;
+    }
+    try {
+      rmSync(stale, { recursive: true, force: true });
+      console.log(`    -> pruned stale ${sub}/ (moved to marketplace plugin)`);
+    } catch {
+      /* non-fatal */
+    }
   }
 
   console.log(`    -> ${copilotSkillCount} skill files installed to ${dest}`);

package/install/templates/copilot-instructions.md

@@ -100,9 +100,9 @@ so execute ALL of these explicitly before touching code:
    for back-compat with single-repo phases.
 
 Full contract (recents schema, token resolution order, GitHub-issue → Jira auto-create policy):
-https://github.com/mmerterden/multi-agent-pipeline/blob/main/pipeline/commands/multi-agent/refs/phases/phase-0-init.md
+https://github.com/mmerterden/multi-agent-pipeline/blob/main/pipeline/multi-agent-refs/phases/phase-0-init.md
 or, on machines with Claude Code also installed:
-`~/.claude/commands/multi-agent/refs/phases/phase-0-init.md`
+`~/.claude/multi-agent-refs/phases/phase-0-init.md`
 
 ## Progress Tracking — required
 
@@ -300,7 +300,7 @@ fi
 ```
 
 Full contract: `~/.copilot/skills/multi-agent/refs/multi-repo-integration-build.md`
-(or on GitHub: https://github.com/mmerterden/multi-agent-pipeline/blob/main/pipeline/commands/multi-agent/refs/multi-repo-integration-build.md)
+(or on GitHub: https://github.com/mmerterden/multi-agent-pipeline/blob/main/pipeline/multi-agent-refs/multi-repo-integration-build.md)
 
 ## Permissions Expectation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "11.2.0",
+  "version": "11.3.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",