@mmerterden/multi-agent-pipeline 11.3.0 → 11.3.1

package/CHANGELOG.md

@@ -14,6 +14,37 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [11.3.1] - 2026-07-10
+
+Self-audit patch (found by running `/multi-agent:refactor` on the pipeline itself): a data-loss fix, a latent gate regression, supply-chain hardening, and a few correctness fixes.
+
+- **Fix (data-loss): uninstall no longer deletes `~/.claude/rules/`.** Install
+  treats `rules/` as user-owned (write-if-missing, never overwritten), but the
+  uninstaller recursively removed the whole tree, destroying personal rules
+  (including the git-attribution rule). Uninstall now preserves `rules/`, and
+  lists it in the PRESERVED summary.
+- **Fix (gate regression): `lint-skills` scoped to `pipeline/skills`.** The
+  v11.3.0 command-layout migration made command files match `find pipeline -name
+  SKILL.md`; slash commands have no `name:` frontmatter, so the skill linter
+  started erroring on all 37 of them (latent because CI is billing-paused and
+  releases were published manually). The linter now only checks actual skills.
+- **Fix: `.skills-index.json` is idempotent** - dropped the `generatedAt`
+  timestamp so regenerating an unchanged skill set produces no diff.
+- **Fix: uninstall strips the Copilot pipeline block regardless of file size** -
+  removed the 50 KB fallback cap that orphaned the block in large
+  `copilot-instructions.md` files.
+- **Fix: install "dev-only excluded" count** is now the real file count (the
+  `fixtures/` directory was under-counted as one entry).
+- **Security (supply-chain):** `release.yml` publishes with `npm publish
+  --provenance` (`id-token: write`); all GitHub Actions pinned to commit SHAs;
+  added `.github/dependabot.yml` (actions + npm dev deps); `credential-store.sh`
+  escapes single quotes in the Windows PowerShell paths.
+- **New: `eval-mine-corpus.mjs`** turns recorded triage decisions
+  (`triage-corpus.jsonl`) into review-gated candidate triage-eval fixtures.
+- **Tests:** added node unit tests for the Phase 4 diff-risk gates
+  (`test/phase4-gates.test.mjs`) so they run in the release lane, not only the
+  bash smoke; `lint-skills` now warns (non-fatal) on terse skill descriptions.
+
 ## [11.3.0] - 2026-07-10
 
 Single-source skill management, an upgraded `refactor` command, and two new Phase 4 diff-risk gates.

package/install/claude.mjs

@@ -105,9 +105,13 @@ function installScripts(pipelineSrc, dest, useSymlinks) {
   // removed upstream should not linger.
   wipeDir(dest);
   copyDir(scriptsSrc, dest, { exclude: DEV_ONLY_SCRIPTS, useSymlinks });
-  const scriptCount = countFiles(scriptsSrc) - DEV_ONLY_SCRIPTS.length;
+  // Count files actually excluded, not the array length: DEV_ONLY_SCRIPTS mixes
+  // individual .sh files with the `fixtures` directory (many files), so the
+  // array length under-counts the real exclusion.
+  const excludedCount = DEV_ONLY_SCRIPTS.reduce((n, name) => n + countFiles(join(scriptsSrc, name)), 0);
+  const scriptCount = countFiles(scriptsSrc) - excludedCount;
   console.log(
-    `    -> ${scriptCount} files copied to ${dest} (${DEV_ONLY_SCRIPTS.length} dev-only excluded)`,
+    `    -> ${scriptCount} files copied to ${dest} (${excludedCount} dev-only excluded)`,
   );
 }
 

package/install/copilot.mjs

@@ -119,9 +119,13 @@ function installScripts(pipelineSrc, dest, useSymlinks) {
   if (!existsSync(scriptsSrc)) return;
   wipeDir(dest);
   copyDir(scriptsSrc, dest, { exclude: DEV_ONLY_SCRIPTS, useSymlinks });
-  const scriptCount = countFiles(scriptsSrc) - DEV_ONLY_SCRIPTS.length;
+  // Count files actually excluded, not the array length: DEV_ONLY_SCRIPTS mixes
+  // individual .sh files with the `fixtures` directory (many files), so the
+  // array length under-counts the real exclusion.
+  const excludedCount = DEV_ONLY_SCRIPTS.reduce((n, name) => n + countFiles(join(scriptsSrc, name)), 0);
+  const scriptCount = countFiles(scriptsSrc) - excludedCount;
   console.log(
-    `    -> ${scriptCount} files copied to ${dest} (${DEV_ONLY_SCRIPTS.length} dev-only excluded)`,
+    `    -> ${scriptCount} files copied to ${dest} (${excludedCount} dev-only excluded)`,
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "11.3.0",
+  "version": "11.3.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/lib/credential-store.sh

@@ -105,9 +105,11 @@ do_get() {
       val=$(secret-tool lookup service "$key" 2>/dev/null || true)
       ;;
     windows)
+      # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
+      local key_esc="${key//\'/\'\'}"
       val=$(ps_run "
 \$ErrorActionPreference='SilentlyContinue'
-\$c = Get-StoredCredential -Target '$key'
+\$c = Get-StoredCredential -Target '$key_esc'
 if (\$c) { \$c.GetNetworkCredential().Password }
 " 2>/dev/null | tr -d '\r' || true)
       ;;
@@ -137,11 +139,13 @@ do_set() {
       printf '%s' "$val" | secret-tool store --label="$key" service "$key" >/dev/null
       ;;
     windows)
+      # Escape single quotes for PowerShell single-quoted strings ('' = literal ').
+      local key_esc="${key//\'/\'\'}" val_esc="${val//\'/\'\'}"
       # CredentialManager module: New-StoredCredential
       ps_run "
 \$ErrorActionPreference='Stop'
-\$pwd = ConvertTo-SecureString '$val' -AsPlainText -Force
-New-StoredCredential -Target '$key' -UserName '${USER:-${USERNAME:-claude}}' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
+\$pwd = ConvertTo-SecureString '$val_esc' -AsPlainText -Force
+New-StoredCredential -Target '$key_esc' -UserName '${USER:-${USERNAME:-claude}}' -SecurePassword \$pwd -Persist LocalMachine | Out-Null
 " >/dev/null
       ;;
     *)
@@ -159,7 +163,7 @@ do_delete() {
   case "$PLATFORM" in
     macos)   security delete-generic-password -s "$key" >/dev/null 2>&1 || true ;;
     linux)   secret-tool clear service "$key" >/dev/null 2>&1 || true ;;
-    windows) ps_run "Remove-StoredCredential -Target '$key' -ErrorAction SilentlyContinue" >/dev/null 2>&1 || true ;;
+    windows) local key_esc="${key//\'/\'\'}"; ps_run "Remove-StoredCredential -Target '$key_esc' -ErrorAction SilentlyContinue" >/dev/null 2>&1 || true ;;
   esac
 }
 

package/pipeline/scripts/build-skills-index.mjs

@@ -13,8 +13,7 @@
 //   name           -  frontmatter `name:` (fallback: directory name)
 //   description    -  frontmatter `description:` (first 300 chars)
 //   platform       -  frontmatter `platform:` if set (ios / android / generic)
-//   group          -  derived from path: core / figma-ios / figma-android /
-//                    figma-common / external
+//   group          -  derived from path: core / external
 //   triggerKeywords  -  frontmatter `trigger-keywords:` (comma-separated
 //                    values lowercased)  -  authors can add these to tighten
 //                    match score. Missing → empty list.
@@ -66,9 +65,6 @@ function parseFrontmatter(raw) {
 function groupFromPath(rel) {
   if (rel.startsWith("shared/core/")) return "core";
   if (rel.startsWith("shared/external/")) return "external";
-  if (rel.startsWith("figma-ios/")) return "figma-ios";
-  if (rel.startsWith("figma-android/")) return "figma-android";
-  if (rel.startsWith("figma-common/")) return "figma-common";
   return "other";
 }
 
@@ -107,7 +103,8 @@ entries.sort((a, b) => a.name.localeCompare(b.name));
 
 const json = {
   schemaVersion: "1.0.0",
-  generatedAt: new Date().toISOString(),
+  // No generatedAt timestamp: the index is a committed build artifact and must
+  // be idempotent, so regenerating on an unchanged skill set produces no diff.
   skillCount: entries.length,
   entries,
 };

package/pipeline/scripts/eval-mine-corpus.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+// eval-mine-corpus.mjs  -  grow the triage eval set from real production runs.
+//
+// The pipeline already records every Phase 4 triage decision to
+// `~/.claude/logs/multi-agent/triage-corpus.jsonl` (one line per finding:
+// severity/file/line/issue/fix/reviewer + the classification the run gave it,
+// plus an optional human `reason`/`reviewer`). Hand-authoring eval fixtures is
+// the bottleneck; this closes the loop by turning those real decisions into
+// CANDIDATE regression fixtures in the exact shape `eval-triage.mjs` consumes.
+//
+// It is review-gated on purpose: candidates land in
+// `pipeline/eval/triage-candidates/<task_id>/` (which eval-triage does NOT
+// walk), each validated against the triage schema. A maintainer reviews them,
+// fills scope/diffSummary, and moves the good ones into
+// `pipeline/eval/triage/<NN>-<name>/` to adopt them.
+//
+// Highest-signal cases (a human left a `reason` or `reviewer`) are emitted
+// first and marked, since those encode a deliberate triage judgement.
+//
+// Usage:
+//   node pipeline/scripts/eval-mine-corpus.mjs                 # default corpus path
+//   node pipeline/scripts/eval-mine-corpus.mjs --corpus <path>
+//   node pipeline/scripts/eval-mine-corpus.mjs --limit 20      # cap candidates
+//   node pipeline/scripts/eval-mine-corpus.mjs --dry-run       # report, write nothing
+//
+// Exit codes: 0 ok (including "nothing to mine"), 2 usage/setup error.
+
+import { readdirSync, readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+import { spawnSync } from "node:child_process";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, "..", "..");
+const evalTriageDir = join(root, "pipeline", "eval", "triage");
+const candidatesDir = join(root, "pipeline", "eval", "triage-candidates");
+const validator = join(root, "pipeline", "scripts", "validate-triage.mjs");
+
+const args = process.argv.slice(2);
+const opts = { corpus: null, limit: Infinity, dryRun: false };
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--corpus") opts.corpus = args[++i];
+  else if (args[i] === "--limit") opts.limit = Number(args[++i]) || Infinity;
+  else if (args[i] === "--dry-run") opts.dryRun = true;
+  else if (args[i] === "-h" || args[i] === "--help") {
+    console.log("Usage: eval-mine-corpus.mjs [--corpus <path>] [--limit N] [--dry-run]");
+    process.exit(0);
+  }
+}
+
+const corpusPath =
+  opts.corpus || join(homedir(), ".claude", "logs", "multi-agent", "triage-corpus.jsonl");
+
+if (!existsSync(corpusPath)) {
+  console.log(`eval-mine-corpus: no corpus at ${corpusPath} - nothing to mine.`);
+  process.exit(0);
+}
+
+// Parse the JSONL corpus, skipping blank/malformed lines (never crash on data).
+const rows = [];
+for (const line of readFileSync(corpusPath, "utf-8").split("\n")) {
+  const s = line.trim();
+  if (!s) continue;
+  try {
+    const r = JSON.parse(s);
+    if (r && r.task_id && r.issue && r.classification) rows.push(r);
+  } catch {
+    /* skip malformed line */
+  }
+}
+
+if (rows.length === 0) {
+  console.log("eval-mine-corpus: corpus has no usable rows - nothing to mine.");
+  process.exit(0);
+}
+
+// task_ids that already have an adopted fixture: skip so we only propose new cases.
+const adopted = new Set();
+if (existsSync(evalTriageDir)) {
+  for (const name of readdirSync(evalTriageDir)) {
+    const inputPath = join(evalTriageDir, name, "input.json");
+    if (existsSync(inputPath)) {
+      try {
+        const meta = JSON.parse(readFileSync(join(evalTriageDir, name, "meta.json"), "utf-8"));
+        if (meta.task_id) adopted.add(meta.task_id);
+      } catch {
+        /* no meta.json -> can't dedup by task_id, that's fine */
+      }
+    }
+  }
+}
+
+// Group corpus rows by task_id.
+const byTask = new Map();
+for (const r of rows) {
+  if (!byTask.has(r.task_id)) byTask.set(r.task_id, []);
+  byTask.get(r.task_id).push(r);
+}
+
+const toFinding = (r) => ({
+  severity: r.severity,
+  file: r.file,
+  // Triage contract requires an integer line >= 0; corpus may carry null for a
+  // file-level finding, so coerce to 0 (the schema's file-level sentinel).
+  line: Number.isInteger(r.line) ? r.line : 0,
+  issue: r.issue,
+  fix: r.fix ?? null,
+  reviewer: r.reviewer ?? null,
+});
+
+// Build a candidate per task. Highest-signal first (has a human reason/reviewer).
+const candidates = [];
+for (const [taskId, findings] of byTask) {
+  if (adopted.has(taskId)) continue;
+  const rawFindings = findings.map(toFinding);
+  const accepted = [];
+  const deferred = [];
+  const rejected = [];
+  for (const r of findings) {
+    if (r.classification === "accepted") accepted.push(toFinding(r));
+    else if (r.classification === "deferred")
+      deferred.push({ finding: toFinding(r), reason: r.reason || "TODO: reason (from corpus)" });
+    else if (r.classification === "rejected")
+      rejected.push({ finding: toFinding(r), reason: r.reason || "TODO: reason (from corpus)" });
+  }
+  const hasHumanSignal = findings.some((r) => r.reason || r.reviewer);
+  const title = findings.find((f) => f.task_title)?.task_title || taskId;
+  candidates.push({
+    taskId,
+    hasHumanSignal,
+    input: {
+      rawFindings,
+      // Corpus does not record scope/diff; a maintainer fills these before adopting.
+      scope: `TODO: scope for ${title}`,
+      diffSummary: "TODO: diff summary",
+    },
+    expected: {
+      accepted,
+      deferred,
+      rejected,
+      // Blockers loop back to dev, so a run with an accepted blocker is not approved.
+      approved: accepted.every((f) => f.severity !== "blocking"),
+    },
+  });
+}
+
+candidates.sort((a, b) => Number(b.hasHumanSignal) - Number(a.hasHumanSignal));
+const selected = candidates.slice(0, opts.limit);
+
+if (selected.length === 0) {
+  console.log("eval-mine-corpus: no new task_ids to propose (all already adopted).");
+  process.exit(0);
+}
+
+let written = 0;
+let invalid = 0;
+for (const c of selected) {
+  const safe = c.taskId.replace(/[^A-Za-z0-9._-]/g, "_");
+  const dir = join(candidatesDir, safe);
+  const tag = c.hasHumanSignal ? " [human-signal]" : "";
+  if (opts.dryRun) {
+    console.log(`  would emit candidate: ${safe} (${c.input.rawFindings.length} findings)${tag}`);
+    continue;
+  }
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "input.json"), JSON.stringify(c.input, null, 2) + "\n");
+  writeFileSync(join(dir, "expected.json"), JSON.stringify(c.expected, null, 2) + "\n");
+  writeFileSync(
+    join(dir, "meta.json"),
+    JSON.stringify({ task_id: c.taskId, source: "eval-mine-corpus", hasHumanSignal: c.hasHumanSignal }, null, 2) + "\n",
+  );
+  // Validate the emitted expected.json against the triage contract; flag if bad.
+  const res = spawnSync("node", [validator, join(dir, "expected.json")], { encoding: "utf-8" });
+  const ok = res.status === 0;
+  if (!ok) invalid++;
+  console.log(`  emitted: triage-candidates/${safe}${tag} ${ok ? "(schema OK)" : "(SCHEMA FAIL - review)"}`);
+  written++;
+}
+
+if (!opts.dryRun) {
+  console.log("");
+  console.log(`eval-mine-corpus: ${written} candidate(s) written to pipeline/eval/triage-candidates/`);
+  if (invalid > 0) console.log(`  ${invalid} failed schema validation - fix before adopting.`);
+  console.log("  Review each, fill scope/diffSummary, then move good ones into");
+  console.log("  pipeline/eval/triage/<NN>-<name>/ to add them to the eval suite.");
+}

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -6,12 +6,12 @@
 .claude/multi-agent-refs	50
 .claude/rules	12
 .claude/schemas	23
-.claude/scripts	177
+.claude/scripts	178
 .claude/settings.json	1
 .claude/skills	428
 .copilot/agents	8
 .copilot/copilot-instructions.md	1
 .copilot/lib	24
 .copilot/schemas	23
-.copilot/scripts	177
+.copilot/scripts	178
 .copilot/skills	465

package/pipeline/scripts/lint-skills.mjs

@@ -21,7 +21,11 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const files = execSync("find pipeline -name SKILL.md", { cwd: repoRoot, encoding: "utf-8" })
+// Scope to pipeline/skills only. Slash commands under pipeline/commands also use
+// the <name>/SKILL.md layout now, but they are command definitions
+// (description + allowed-tools, name derived from the dir), NOT skills, so the
+// skill frontmatter contract (required `name:`) does not apply to them.
+const files = execSync("find pipeline/skills -name SKILL.md", { cwd: repoRoot, encoding: "utf-8" })
   .trim()
   .split("\n")
   .filter(Boolean)
@@ -29,6 +33,10 @@ const files = execSync("find pipeline -name SKILL.md", { cwd: repoRoot, encoding
 
 const errors = [];
 const fail = (file, msg) => errors.push(`${file}: ${msg}`);
+// Non-fatal quality signals (a terse description routes poorly). Warnings never
+// fail the gate; they surface skills whose frontmatter could trigger better.
+const warnings = [];
+const warn = (file, msg) => warnings.push(`${file}: ${msg}`);
 
 for (const file of files) {
   const raw = readFileSync(join(repoRoot, file), "utf-8");
@@ -61,6 +69,18 @@ for (const file of files) {
     fail(file, "description is empty");
   } else if (fields.description.length > 1024) {
     fail(file, `description exceeds 1024 chars (${fields.description.length})`);
+  } else {
+    // Routing quality: a description of a few words rarely says what the skill
+    // does AND when to use it, so the model cannot decide to trigger it.
+    // Skip YAML block scalars (`description: |` / `>`): this line-based parser
+    // only sees the indicator, not the real multi-line text, so a word count
+    // would be a false positive.
+    const desc = fields.description;
+    const isBlockScalar = /^[|>][+-]?\d*$/.test(desc);
+    const words = desc.split(/\s+/).filter(Boolean).length;
+    if (!isBlockScalar && words < 6) {
+      warn(file, `description is terse (${words} words) - say what it does AND when to use it`);
+    }
   }
 
   if ("user-invocable" in fields && !["true", "false"].includes(fields["user-invocable"])) {
@@ -72,6 +92,11 @@ for (const file of files) {
   }
 }
 
+if (warnings.length > 0) {
+  console.warn(`lint-skills: ${warnings.length} warning(s) (non-fatal):`);
+  for (const w of warnings) console.warn("  " + w);
+}
+
 if (errors.length > 0) {
   console.error(`lint-skills: ${errors.length} error(s) across ${files.length} SKILL.md files`);
   for (const e of errors) console.error("  " + e);

package/pipeline/scripts/uninstall.mjs

@@ -134,8 +134,13 @@ function stripManagedBlock(filePath) {
   const re =
     /\s*<!-- multi-agent-pipeline:begin -->[\s\S]*?<!-- multi-agent-pipeline:end -->\s*/m;
   if (!re.test(content)) {
-    // Legacy: maybe the whole file is ours (Copilot wrote it before markers)
-    if (content.includes("# Multi-Agent Development Pipeline") && content.length < 50000) {
+    // Copilot's install (install/copilot.mjs) does not wrap the block in
+    // begin/end markers; it always writes the pipeline section LAST, from the
+    // `# Multi-Agent Development Pipeline` heading to EOF, keeping any user
+    // content ABOVE it. So slicing from that heading to EOF reliably removes
+    // only our section regardless of file size (no arbitrary size cap - a cap
+    // used to orphan the block in files >50 KB).
+    if (content.includes("# Multi-Agent Development Pipeline")) {
       // Heuristic: Copilot's generateCopilotInstructions output. Only strip the
       // pipeline section, not the whole file.
       const marker = "# Multi-Agent Development Pipeline";
@@ -244,8 +249,9 @@ async function main() {
   console.log("  PRESERVED (never touched):");
   console.log("    - Personal access tokens in OS credential store (Keychain / Credential Manager / libsecret)");
   console.log("    - ~/.claude/CLAUDE.md (your customizations)");
+  console.log("    - ~/.claude/rules/ (user-owned; installed write-if-missing, never overwritten)");
   console.log("    - ~/.claude/multi-agent-preferences.json (your settings)");
-  console.log("    - User content outside <!-- multi-agent-pipeline:begin/end --> markers");
+  console.log("    - Your own content in copilot-instructions.md above the pipeline section");
   console.log("");
 
   if (!(await confirm("  Proceed? (y/N) "))) {
@@ -259,7 +265,12 @@ async function main() {
     const CLAUDE = join(HOME, ".claude");
     rmIfExists(join(CLAUDE, "commands", "multi-agent"));
     rmIfExists(join(CLAUDE, "scripts"));
-    rmIfExists(join(CLAUDE, "rules"));
+    // NOTE: ~/.claude/rules/ is USER-OWNED. install lays baseline rules down
+    // write-if-missing and NEVER overwrites them (install/claude.mjs
+    // installRules, skipExisting) so users can evolve their global rules
+    // locally. Deleting the tree here would destroy those personal edits
+    // (e.g. the git-attribution rule) -- asymmetric data loss. Leave rules
+    // in place on uninstall, exactly like CLAUDE.md and preferences.
     const skills = join(CLAUDE, "skills");
     let n = rmMatchingDirs(skills, (name) => name === "multi-agent" || name.startsWith("multi-agent-"));
     n += rmMatchingDirs(skills, (name) => name === "figma-ios" || name === "figma-android" || name === "figma-common" || name === "figma-to-component");

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,5 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-07-09T19:01:45.304Z",
   "skillCount": 187,
   "entries": [
     {
@@ -968,7 +967,7 @@
     },
     {
       "name": "multi-agent-refactor",
-      "description": "Analyse the project, score it, draft an improvement plan, take approval, develop, then ask whether to sync.",
+      "description": "Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, draft one plan, take approval, develop, then ask whether to sync.",
       "platform": null,
       "group": "core",
       "triggerKeywords": [],

package/pipeline/skills/skills-index.md

@@ -114,7 +114,7 @@
 | core | `multi-agent-manual-test` |  -  | Switch to the active task's branch and prepare it for manual testing in Xcode. Phase 5 standalone (the UI Bug Hunter lives at multi-agent-te |
 | core | `multi-agent-prune-logs` |  -  | Delete per-task project logs under ~/.claude/logs/multi-agent (filter by age/project/task). Audit trail + metrics are preserved. Dry-run fir |
 | core | `multi-agent-purge` |  -  | ⚠️ Wipes every worktree, branch, log, and state file. Irreversible; asks for double confirmation. |
-| core | `multi-agent-refactor` |  -  | Analyse the project, score it, draft an improvement plan, take approval, develop, then ask whether to sync. |
+| core | `multi-agent-refactor` |  -  | Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, draft one p |
 | core | `multi-agent-resume` |  -  | Resume a stopped or failed task from the phase where it left off. |
 | core | `multi-agent-review` |  -  | Run parallel review on the current branch's diff: 2 models on Claude Code (Fable + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonnet). R |
 | core | `multi-agent-scan` |  -  | Skill security scan: walks local skill directories against a tiered pattern catalog. |