@mmerterden/multi-agent-pipeline 12.0.0 → 12.1.1

package/CHANGELOG.md

@@ -14,6 +14,34 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [12.1.1] - 2026-07-21
+
+### Changed
+- **Channel outputs no longer carry decorative/emotive emoji or smileys.** Jira/issue comments, Confluence & Wiki pages, and PR bodies are plain technical prose. Added an explicit no-emoji hard-rule to each channel template (`multi-agent-refs/channels/{jira,issue-comment,confluence,wiki}.md`) and an emoji-stripping pattern to the humanizer (`shared/external/humanizer`). Functional status/severity marks a fixed template defines (`✅/⏳` phase ticks, `🔴/🟡` severity labels) are unaffected.
+
+---
+
+## [12.1.0] - 2026-07-21
+
+### Security
+- **`agent-guard.sh` is now wired by the default installer** (was opt-in via the setup template). A plain `install` now OS-enforces the two load-bearing git gates on every `Bash` tool call: no AI/assistant attribution in commit messages, and no force-push to a protected branch (`main`/`master`/`develop`).
+- **Force-push protection now fails CLOSED.** A detected force-push that can't be tokenized, or a bare force-push while the current branch can't be confirmed non-protected, is blocked rather than allowed. (The general guard stays fail-open; only the data-loss path is fail-closed.)
+- **Multi-repo clone hardening.** `cmd_prepare` disables git's `ext::`/`fd::` remote helpers (`protocol.ext.allow=never`, `protocol.fd.allow=never`) and ends options with `--`, closing an arbitrary-command-execution / option-injection vector on repo URLs sourced from `.gitmodules` suggestions. Local/file/https/ssh clones are unaffected.
+
+### Changed
+- **Node floor raised to 20** (`.nvmrc`, `engines.node` → `>=20.0.0`). Node 18 was EOL and untested by CI; the matrix already covers 20/22.
+
+### Refactored
+- **Token-cost pricing is now a single source.** The per-Mtok cost formula, previously copy-pasted across ~6 bash/mjs scripts, lives in `cost-lib.sh` (bash) + `_cost.mjs` (Node), both reading the shared `cost-table.json`. Zero runtime dependencies preserved.
+
+### Added
+- **`smoke-source-parity.sh`** — guards feature-set drift between the two source trees (`commands/multi-agent/<name>` vs `skills/shared/core/multi-agent-<name>`); fails if a feature exists in one tree but not the other.
+
+### Docs
+- Refreshed post-v12 doc drift: `SECURITY.md` + `ROADMAP.md` support/version markers → 12.x; `docs/features.md` smoke-suite count `10` → `100+`; ADR index now lists 0008 and 0008 carries a v10.7.0 amendment (the `_adapters.mjs` module was removed); `CONTRIBUTING.md` coverage claim clarified (local-only) and the stale phase-docs path corrected to `pipeline/multi-agent-refs/phases/`.
+
+---
+
 ## [12.0.0] - 2026-07-20
 
 Command rename (breaking), a full-cleanup uninstall mode, outputLanguage-aware

package/docs/adr/0008-installer-modularization-and-secret-leak-defense.md

@@ -2,6 +2,8 @@
 
 **Status:** Accepted · 2026-04-27 (v8.0.0)
 
+> **Amended v10.7.0:** the `_adapters.mjs` module and its third-party adapter dispatch were removed when the pipeline narrowed to Claude Code + Copilot CLI (see ADR 0007). `install/` now ships **8** modules, not 9; the module list below records the v8.0.0 decision as it shipped at the time.
+
 ## Context
 
 Two pressures collided during the v7.x line:

package/docs/adr/README.md

@@ -17,6 +17,7 @@ Format: lightly adapted from [Michael Nygard's ADR template](https://cognitect.c
 | [0005](./0005-lazy-phase-docs.md)      | Lazy-loaded phase docs with per-phase token budget | Accepted |
 | [0006](./0006-skills-core-external-split.md) | `shared/core/` vs `shared/external/` source org    | Accepted |
 | [0007](./0007-multi-tool-adapter-framework.md) | Multi-tool adapter framework + token-preserving uninstall | Superseded by v10.7.0 (adapters removed; Claude Code + Copilot CLI only) |
+| [0008](./0008-installer-modularization-and-secret-leak-defense.md) | Installer modularization + secret-leak defense | Accepted (amended v10.7.0: adapter module removed) |
 
 ## Writing a New ADR
 

package/docs/features.md

@@ -201,11 +201,11 @@ All critical state files are schema-validated at read and write time:
 
 ### Smoke Test Suites
 
-10 suites: add-detail (14 body-preservation assertions), review-triage (validator exit codes), prefs (schema round-trip), state (agent-state lifecycle), metrics (telemetry emission), sync (instruction parity), secret-scan (hook patterns), phase-banner (terminal UI), token-budget (per-phase limits), phase-tracker (progress tracking).
+100+ suites, auto-discovered from `smoke-*.sh` (no hardcoded list). Representative: add-detail (body-preservation assertions), review-triage (validator exit codes), prefs (schema round-trip), state (agent-state lifecycle), metrics (telemetry emission), sync (instruction parity), secret-scan (hook patterns), phase-banner (terminal UI), token-budget (per-phase limits), phase-tracker (progress tracking).
 
 ### Adversarial Eval Fixtures
 
-10 fixtures that test triage resilience against adversarial reviewer output: over-rejection, hallucinated findings, contradictions, invalid JSON, schema violations, duplicate findings, scope creep, empty results, timeout simulation, and combined edge cases.
+Adversarial fixtures that test triage resilience against adversarial reviewer output: over-rejection, hallucinated findings, contradictions, invalid JSON, schema violations, duplicate findings, scope creep, empty results, timeout simulation, and combined edge cases.
 
 ### Sync Parity Check
 

package/install/claude.mjs

@@ -474,6 +474,32 @@ export function configureSettings(home) {
       settingsChanged = true;
     }
 
+    // agent-guard.sh: the second load-bearing gate - blocks AI/assistant
+    // attribution in commit messages and force-push to a protected branch.
+    // Like pre-commit-check.sh it self-filters on the Bash command via stdin
+    // JSON, so the matcher is the tool name "Bash". Wired by default (was
+    // previously opt-in via the setup template, leaving force-push and
+    // attribution unguarded on a plain install).
+    const isAgentGuardEntry = (h) =>
+      Array.isArray(h.hooks) &&
+      h.hooks.some(
+        (sub) => typeof sub.command === "string" && sub.command.includes("agent-guard.sh"),
+      );
+    if (!settings.hooks.PreToolUse.some(isAgentGuardEntry)) {
+      settings.hooks.PreToolUse.push({
+        matcher: "Bash",
+        hooks: [
+          {
+            type: "command",
+            command: "bash $HOME/.claude/scripts/agent-guard.sh",
+            timeout: 10,
+            statusMessage: "Checking commit/push safety (attribution + force-push)...",
+          },
+        ],
+      });
+      settingsChanged = true;
+    }
+
     if (settingsChanged && isDryRun()) {
       console.log(`    [dry-run] would update ${SETTINGS_PATH} (hooks + env)`);
     } else if (settingsChanged) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "12.0.0",
+  "version": "12.1.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -58,7 +58,7 @@
     "url": "https://github.com/mmerterden/multi-agent-pipeline/issues"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "files": [
     "index.js",

package/pipeline/lib/multi-repo-pipeline.sh

@@ -67,7 +67,12 @@ cmd_prepare() {
       echo "[$name] worktree already present at $target"
     else
       echo "[$name] cloning into $target"
-      git clone --quiet "$url" "$target" || { echo "ERR: clone failed for $name" >&2; return 3; }
+      # Disable git's `ext::`/`fd::` remote helpers (arbitrary command execution
+      # at clone time) in case a repo URL ever comes from an untrusted
+      # .gitmodules suggestion, and end options with `--` so a URL like
+      # `--upload-pack=...` can't inject a clone option. https/ssh/git@ and
+      # local/file paths all still work.
+      git -c protocol.ext.allow=never -c protocol.fd.allow=never clone --quiet -- "$url" "$target" || { echo "ERR: clone failed for $name" >&2; return 3; }
     fi
     cd "$target"
     if git rev-parse --verify "$BRANCH" >/dev/null 2>&1; then

package/pipeline/multi-agent-refs/channels/confluence.md

@@ -149,5 +149,6 @@ Successful POST → URL prepended to `prefs.projects[<project>].confluenceUrls`
 - Section order is fixed: `overview` → `flow` (cond.) → `technical_details` → `api_contracts` (cond.) → `references` (cond.). Conditional sections may be omitted but never reordered.
 - Humanizer pass runs **after** body assembly and **before** storage-XML conversion. Tone: formal, stakeholder-readable. No "we are excited", no first-person plural.
 - Body content language follows `prefs.global.outputLanguage`. Code identifiers, API paths, file paths, type names, JSON keys, and the storage-XML markup stay verbatim. The template (this doc) is English because `promptLanguage="en"` is locked.
+- No decorative/emotive emoji or smileys (😊 🙂 🎉 👍 🚀 ✨) anywhere in the page body. Stakeholder-readable technical prose only.
 - Adapter failures are non-blocking. 401 / network timeout / parent-not-found → `failed` status, loop continues.
 - If `--dry-run`, print the assembled storage XML to stdout and return without POST.

package/pipeline/multi-agent-refs/channels/issue-comment.md

@@ -85,6 +85,7 @@ Ref: #<issueNumber>
 
 - No "Co-Authored-By: Claude" trailer. No "🤖 Generated with ..." footer. No mention of Claude / Copilot / AI / model names anywhere in the body.
 - No em-dashes (` - `) in prose. Use ` · ` or `→` per `feedback_no_em_dash.md`.
+- No decorative/emotive emoji or smileys (😊 🙂 🎉 👍 🚀 ✨) in the body prose. Only a fixed-template functional mark (e.g. a `✅/⏳` scope tick) is allowed; free text carries none.
 - No HTML entities. Use raw markdown.
 - No links to internal `/tmp/*` or local-machine paths.
 - No screenshots embedded as base64  -  link to wiki / Figma instead.

package/pipeline/multi-agent-refs/channels/jira.md

@@ -124,5 +124,6 @@ When the **Wiki** adapter writes pages on the same run AND `prefs.global.wikiToJ
 - UTF-8 in, UTF-8 out  -  the body file is UTF-8 and `--data-binary` ships its bytes verbatim. Never round-trip the body through `unicode_escape`, `latin-1`, or any re-encode step, and never hand-roll a Python/curl helper that re-decodes it: that mangles Turkish chars (ç ş ı ö ü ğ) into mojibake (`Çözüm` → `Ãözüm`). Use the `jq --rawfile` + `--data-binary @file` path above as-is. Same rule for the PR / Confluence / Wiki adapters.
 - Section order is fixed: `summary` → `test_scenarios` → `context_refs`. Never insert sections between them; never reorder.
 - Humanizer pass runs **after** body assembly and **before** wiki-markup conversion. Tone target: informal but technical. No marketing voice, no "we are excited", no "I have...".
+- **No decorative/emotive emoji or smileys** (😊 🙂 🎉 👍 🚀 ✨) anywhere in the comment body. The comment is plain technical prose; emoji do not belong in it.
 - Body content language follows `prefs.global.outputLanguage`. Code identifiers, file paths, type names, branch names, and the wiki-markup syntax stay verbatim. The `promptLanguage="en"` lock means any LLM prompt that produces the body is in English; the body itself is then rendered in the user's language.
 - Adapter failures are non-blocking  -  a missing token or 401 returns `skipped`/`failed`, the loop keeps going for PR / Confluence / Wiki.

package/pipeline/multi-agent-refs/channels/wiki.md

@@ -63,4 +63,5 @@ Adapter implementation chooses the right git push target + commit message format
 - Per the `figma-pipeline.md` rules, every component wiki page must include a variant matrix, accessibility identifiers, analytics events, and 3-layer test summary.
 - Screenshots cover light/dark + LTR/RTL  -  wiki adapter refuses to commit if any quadrant is missing.
 - Body content language follows `prefs.global.outputLanguage`. Code identifiers, file paths, type names, design token names, and wiki markup stay verbatim across languages. The template (this doc) is English because `promptLanguage="en"` is locked.
+- No decorative/emotive emoji or smileys (😊 🙂 🎉 👍 🚀 ✨) in the page prose. Only functional/structural marks a fixed template defines are allowed.
 - Autopilot always pauses at the channels menu (per `phase-7-report.md` autopilot contract)  -  even in autopilot mode the user gets to confirm wiki scope.

package/pipeline/scripts/_cost.mjs

@@ -0,0 +1,35 @@
+/**
+ * @file _cost.mjs  -  shared token-cost pricing math for the .mjs cost scripts
+ * (cost-budget-check.mjs, run-aggregator.mjs).
+ *
+ * The single source of the pricing formula for Node callers. Rate DATA still
+ * lives in cost-table.json; this module owns only the arithmetic so the formula
+ * is not copy-pasted across scripts. Zero runtime dependencies (ADR-0004).
+ *
+ * @module pipeline/scripts/_cost
+ */
+
+/**
+ * USD cost for a token trio given a rate object.
+ *
+ * tokensIn is fresh (cache-exclusive) input; tokensCached is priced at the
+ * discounted cacheReadPerMtok rate, falling back to inPerMtok when absent.
+ * Missing per-Mtok rate fields default to 0. Returns null when `rate` is falsy.
+ *
+ * @param {{inPerMtok?:number,outPerMtok?:number,cacheReadPerMtok?:number}|null|undefined} rate
+ * @param {number} [tokensIn]
+ * @param {number} [tokensOut]
+ * @param {number} [tokensCached]
+ * @returns {number|null}
+ */
+export function costUsd(rate, tokensIn = 0, tokensOut = 0, tokensCached = 0) {
+  if (!rate) return null;
+  const rin = rate.inPerMtok || 0;
+  const rout = rate.outPerMtok || 0;
+  const rcache = rate.cacheReadPerMtok ?? rin;
+  return (
+    ((tokensIn || 0) / 1_000_000) * rin +
+    ((tokensCached || 0) / 1_000_000) * rcache +
+    ((tokensOut || 0) / 1_000_000) * rout
+  );
+}

package/pipeline/scripts/agent-guard.py

@@ -40,7 +40,8 @@ def decide(cmd: str) -> str:
         try:
             toks = shlex.split(cmd)
         except Exception:
-            toks = cmd.split()
+            # A force-push we can't tokenize -> can't prove it's safe -> block.
+            return "BLOCK_FORCE"
         if any(t in PROTECTED or t.split(":")[-1] in PROTECTED for t in toks):
             return "BLOCK_FORCE"
         # non-flag args after `push`; only a remote (or nothing) means a bare push
@@ -52,8 +53,12 @@ def decide(cmd: str) -> str:
             if seen and not t.startswith("-"):
                 args.append(t)
         nonremote = [a for a in args if a not in REMOTES]
-        if not nonremote and os.environ.get("CUR_BRANCH", "") in PROTECTED:
-            return "BLOCK_FORCE"
+        if not nonremote:
+            # Bare force-push: the target is the current branch. Block if it's
+            # protected OR undeterminable (fail-closed for a data-loss guard).
+            cur = os.environ.get("CUR_BRANCH", "")
+            if cur in PROTECTED or cur == "":
+                return "BLOCK_FORCE"
 
     return "OK"
 

package/pipeline/scripts/cost-budget-check.mjs

@@ -34,6 +34,7 @@
 import { readFileSync, existsSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
+import { costUsd } from "./_cost.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -138,7 +139,7 @@ for (const p of Object.values(tracker.phases || {})) {
   tokensOut += Number(p?.tokens_out || 0);
 }
 
-const usd = (tokensIn * rate.inPerMtok + tokensOut * rate.outPerMtok) / 1_000_000;
+const usd = costUsd(rate, tokensIn, tokensOut);
 const pctOfMax = (usd / cfg.maxUsd) * 100;
 const usdStr = `$${usd.toFixed(2)}`;
 const totalTok = tokensIn + tokensOut;

package/pipeline/scripts/cost-lib.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# cost-lib.sh  -  shared token-cost pricing math, sourced by the bash cost
+# renderers (phase-tracker.sh, render-agent-log-cost.sh, render-cost-summary.sh).
+#
+# The single source of the pricing formula for shell callers. Rate DATA still
+# lives in cost-table.json; this file owns only the arithmetic so the formula
+# is not copy-pasted across scripts.
+#
+# COST_JQ_DEFS is a jq prelude string callers prepend to their own jq program:
+#
+#   cost_usd_of($rate; $tin; $tout; $tcached)
+#     -> USD for one row given a rate object (or null) and token counts.
+#        tokens_in is fresh input (cache-exclusive); tokens_cached is priced at
+#        the discounted cacheReadPerMtok rate (falling back to inPerMtok when
+#        absent). Returns null when $rate is null.
+#   cost_floor_cents($u)
+#     -> floor USD to whole cents; null passes through.
+#
+# cost_usd <rate-json> <tin> <tout> [tcached]  -  scalar convenience wrapper
+# that prints the raw (unrounded) USD via jq. Prints nothing when jq is absent.
+
+COST_JQ_DEFS='
+  def cost_usd_of($rate; $tin; $tout; $tcached):
+    if $rate == null then null
+    else ( ($tin / 1000000) * $rate.inPerMtok
+         + ($tcached / 1000000) * ($rate.cacheReadPerMtok // $rate.inPerMtok)
+         + ($tout / 1000000) * $rate.outPerMtok )
+    end;
+  def cost_floor_cents($u):
+    if $u == null then null else (($u * 100) | floor) / 100 end;
+'
+
+cost_usd() {
+  local rate="$1" tin="$2" tout="$3" tcached="${4:-0}"
+  command -v jq >/dev/null 2>&1 || return 0
+  jq -n \
+    --argjson rate "$rate" \
+    --argjson tin "$tin" \
+    --argjson tout "$tout" \
+    --argjson tcached "$tcached" \
+    "$COST_JQ_DEFS"'
+    cost_usd_of($rate; $tin; $tout; $tcached)'
+}

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -7,7 +7,7 @@
 .claude/multi-agent-refs	51
 .claude/rules	12
 .claude/schemas	23
-.claude/scripts	190
+.claude/scripts	193
 .claude/settings.json	1
 .claude/skills	428
 .copilot/.pipeline-version	1
@@ -15,5 +15,5 @@
 .copilot/copilot-instructions.md	1
 .copilot/lib	25
 .copilot/schemas	23
-.copilot/scripts	190
+.copilot/scripts	193
 .copilot/skills	467

package/pipeline/scripts/phase-tracker.sh

@@ -245,12 +245,14 @@ format_elapsed() {
 }
 
 # Cost table ships next to this script in every install tree (repo,
-# ~/.claude/scripts, ~/.copilot/scripts). Pricing math matches
-# render-agent-log-cost.sh exactly: tokens_in is FRESH input (cache-exclusive,
+# ~/.claude/scripts, ~/.copilot/scripts). Pricing math comes from cost-lib.sh
+# (shared with the other renderers): tokens_in is FRESH input (cache-exclusive,
 # per the disjoint token-count contract), tokens_cached is priced at the
 # discounted cacheReadPerMtok rate, floored to cents. A missing/unparseable
 # table never fails a caller - USD simply renders empty / "-".
 COST_TABLE="$(cd "$(dirname "$0")" && pwd)/cost-table.json"
+COST_LIB="$(cd "$(dirname "$0")" && pwd)/cost-lib.sh"
+if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 # Print est. USD ("0.21") for one phase index or, with "total", the sum across
 # priceable phases. Prints "-" when nothing is priceable. Never non-zero exit.
@@ -258,19 +260,13 @@ phase_usd() {
   local selector="$1"  # integer phase index into .phases[], or "total"
   [ -f "$COST_TABLE" ] || { echo "-"; return 0; }
   local state; state="$(load_state)"
-  echo "$state" | jq -r --slurpfile prices "$COST_TABLE" --arg sel "$selector" '
-    def usd_of(p): ($prices[0].prices[p.model // ""] // null) as $rate |
-      if $rate == null then null
-      else ( ((p.tokens_in // 0) / 1000000) * $rate.inPerMtok
-           + ((p.tokens_cached // 0) / 1000000) * ($rate.cacheReadPerMtok // $rate.inPerMtok)
-           + ((p.tokens_out // 0) / 1000000) * $rate.outPerMtok )
-      end;
-    def floor_cents(u): if u == null then null else ((u * 100) | floor) / 100 end;
+  echo "$state" | jq -r --slurpfile prices "$COST_TABLE" --arg sel "$selector" "$COST_JQ_DEFS"'
+    def usd_of(p): cost_usd_of($prices[0].prices[p.model // ""] // null; (p.tokens_in // 0); (p.tokens_out // 0); (p.tokens_cached // 0));
     if $sel == "total" then
-      ([.phases[] | usd_of(.) | select(. != null)] | if length == 0 then "-" else (add | floor_cents(.) | tostring) end)
+      ([.phases[] | usd_of(.) | select(. != null)] | if length == 0 then "-" else (add | cost_floor_cents(.) | tostring) end)
     else
       (.phases[($sel | tonumber)] // null) as $p |
-      if $p == null then "-" else (usd_of($p) | floor_cents(.) | if . == null then "-" else tostring end) end
+      if $p == null then "-" else (usd_of($p) | cost_floor_cents(.) | if . == null then "-" else tostring end) end
     end
   ' 2>/dev/null || echo "-"
 }
@@ -372,13 +368,8 @@ render() {
     echo "$prices_json" | jq empty 2>/dev/null || prices_json='{"prices":{}}'
   fi
   local phase_data
-  phase_data=$(echo "$state" | jq -r --argjson prices "$prices_json" '
-    def usd_of(p): ($prices.prices[p.model // ""] // null) as $rate |
-      if $rate == null then null
-      else ( ((p.tokens_in // 0) / 1000000) * $rate.inPerMtok
-           + ((p.tokens_cached // 0) / 1000000) * ($rate.cacheReadPerMtok // $rate.inPerMtok)
-           + ((p.tokens_out // 0) / 1000000) * $rate.outPerMtok )
-      end;
+  phase_data=$(echo "$state" | jq -r --argjson prices "$prices_json" "$COST_JQ_DEFS"'
+    def usd_of(p): cost_usd_of($prices.prices[p.model // ""] // null; (p.tokens_in // 0); (p.tokens_out // 0); (p.tokens_cached // 0));
     .phases // []
     | sort_by(.id | (tonumber? // 9999))
     | .[] | [

package/pipeline/scripts/render-agent-log-cost.sh

@@ -32,6 +32,8 @@ done
 
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 COST_TABLE="$ROOT/pipeline/scripts/cost-table.json"
+COST_LIB="$ROOT/pipeline/scripts/cost-lib.sh"
+if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 command -v jq >/dev/null 2>&1 || { echo "render-agent-log-cost: jq required" >&2; exit 2; }
 
@@ -94,27 +96,19 @@ if [ "$rows_json" = "[]" ] && [ -n "$SPANS_FILE" ] && [ -f "$SPANS_FILE" ]; then
   ' "$SPANS_FILE")
 fi
 
-joined=$(jq -n --argjson rows "$rows_json" --slurpfile prices "$COST_TABLE" '
+joined=$(jq -n --argjson rows "$rows_json" --slurpfile prices "$COST_TABLE" "$COST_JQ_DEFS"'
   $rows | map(
     . as $r |
     ($prices[0].prices[$r.model] // null) as $p |
     # tokens_in is freshly-billed input (cache-exclusive, matching the host
     # input_tokens field); tokens_cached is the separate prompt-cache-read
-    # count, billed at the discounted cacheReadPerMtok rate (default to
-    # inPerMtok when the field is absent so an old price table still prices it).
-    # The two counts are disjoint - never subtract one from the other - so this
-    # renderer and aggregate-metrics.mjs agree on what "total input" means.
-    $r.tokens_in as $fresh |
+    # count, billed at the discounted cacheReadPerMtok rate. The two counts are
+    # disjoint - never subtract one from the other - so this renderer and
+    # aggregate-metrics.mjs agree on what "total input" means.
     ($r.tokens_cached // 0) as $cached |
     . + {
       tokens_cached: $cached,
-      usd: (
-        if $p == null then null
-        else ( ($fresh / 1000000) * $p.inPerMtok
-             + ($cached / 1000000) * ($p.cacheReadPerMtok // $p.inPerMtok)
-             + ($r.tokens_out / 1000000) * $p.outPerMtok )
-        end
-      )
+      usd: cost_usd_of($p; $r.tokens_in; $r.tokens_out; $cached)
     }
   )
 ')

package/pipeline/scripts/render-cost-summary.sh

@@ -26,6 +26,8 @@ done
 
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 COST_TABLE="$ROOT/pipeline/scripts/cost-table.json"
+COST_LIB="$ROOT/pipeline/scripts/cost-lib.sh"
+if [ -f "$COST_LIB" ]; then . "$COST_LIB"; else COST_JQ_DEFS=""; fi
 
 command -v jq >/dev/null 2>&1 || { echo "render-cost-summary: jq required" >&2; exit 2; }
 
@@ -78,17 +80,12 @@ if [ "$rows_json" = "[]" ] && [ -n "$SPANS_FILE" ] && [ -f "$SPANS_FILE" ]; then
 fi
 
 # Compute USD per row using cost-table
-joined=$(jq -n --argjson rows "$rows_json" --slurpfile prices "$COST_TABLE" '
+joined=$(jq -n --argjson rows "$rows_json" --slurpfile prices "$COST_TABLE" "$COST_JQ_DEFS"'
   $rows | map(
     . as $r |
     ($prices[0].prices[$r.model] // null) as $p |
     . + {
-      usd: (
-        if $p == null then null
-        else ( ($r.tokens_in / 1000000) * $p.inPerMtok
-             + ($r.tokens_out / 1000000) * $p.outPerMtok )
-        end
-      )
+      usd: cost_usd_of($p; $r.tokens_in; $r.tokens_out; 0)
     }
   )
 ')

package/pipeline/scripts/run-aggregator.mjs

@@ -37,6 +37,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { costUsd } from "./_cost.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -135,9 +136,7 @@ function computeCost(modelKey, tokensIn, tokensOut, costTable) {
   if (!price || (typeof price.inPerMtok !== "number" && typeof price.outPerMtok !== "number")) {
     return { cost_usd: 0, cost_unknown_model: true };
   }
-  const usd =
-    ((tokensIn || 0) / 1_000_000) * (price.inPerMtok || 0) +
-    ((tokensOut || 0) / 1_000_000) * (price.outPerMtok || 0);
+  const usd = costUsd(price, tokensIn, tokensOut);
   return { cost_usd: Number(usd.toFixed(6)) };
 }
 

package/pipeline/scripts/smoke-source-parity.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# smoke-source-parity.sh  -  guard the two divergent SOURCE trees of the same
+# feature set from drifting out of alignment.
+#
+# The pipeline ships each sub-command twice, in parallel trees:
+#   1. pipeline/commands/multi-agent/<name>/        (Claude slash commands)
+#   2. pipeline/skills/shared/core/multi-agent-<name>/  (Copilot skills)
+# Both are meant to cover the SAME feature SET. A feature present in one tree
+# but absent from the other is the single biggest maintainability liability
+# here: users on one CLI silently lose a capability the other CLI advertises.
+#
+# This is a STRUCTURAL set-parity check only. It auto-discovers feature names
+# from the directory listings (nothing is hardcoded), strips the
+# 'multi-agent-' prefix from the skills tree, and FAILS if the symmetric
+# difference of the two name sets is non-empty. It deliberately does NOT diff
+# prose / behavior content between a matched command and its skill  -  content
+# drift is a separate concern (see smoke-sync-parity.sh / sync-parity-check).
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+CMDS_DIR="$REPO_ROOT/pipeline/commands/multi-agent"
+SKILLS_DIR="$REPO_ROOT/pipeline/skills/shared/core"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+if [ ! -d "$CMDS_DIR" ]; then
+  echo "FAIL: commands tree missing at $CMDS_DIR" >&2
+  exit 1
+fi
+if [ ! -d "$SKILLS_DIR" ]; then
+  echo "FAIL: skills tree missing at $SKILLS_DIR" >&2
+  exit 1
+fi
+
+echo "→ 1. discover feature names in each source tree"
+
+# Claude slash commands: every immediate sub-directory is a feature.
+CMD_FEATURES=$(find "$CMDS_DIR" -mindepth 1 -maxdepth 1 -type d \
+  -exec basename {} \; | sort -u)
+
+# Copilot skills: multi-agent-<name> sub-directories; strip the prefix.
+# Non-prefixed skill dirs (e.g. apple-archive-compliance) are standalone
+# skills without a slash-command twin, so they are intentionally excluded.
+SKILL_FEATURES=$(find "$SKILLS_DIR" -mindepth 1 -maxdepth 1 -type d \
+  -name 'multi-agent-*' -exec basename {} \; \
+  | sed 's/^multi-agent-//' | sort -u)
+
+CMD_COUNT=$(printf '%s\n' "$CMD_FEATURES" | grep -c . || true)
+SKILL_COUNT=$(printf '%s\n' "$SKILL_FEATURES" | grep -c . || true)
+pass "commands tree: $CMD_COUNT features"
+pass "skills tree:   $SKILL_COUNT features"
+
+echo ""
+echo "→ 2. set symmetric difference must be empty"
+
+# In commands tree but missing from skills tree.
+ONLY_CMD=$(comm -23 \
+  <(printf '%s\n' "$CMD_FEATURES") \
+  <(printf '%s\n' "$SKILL_FEATURES"))
+# In skills tree but missing from commands tree.
+ONLY_SKILL=$(comm -13 \
+  <(printf '%s\n' "$CMD_FEATURES") \
+  <(printf '%s\n' "$SKILL_FEATURES"))
+
+if [ -z "$ONLY_CMD" ]; then
+  pass "no command-only features (all present as skills)"
+else
+  fail "features in commands/ but NOT in skills tree:"
+  printf '      - %s\n' $ONLY_CMD
+fi
+
+if [ -z "$ONLY_SKILL" ]; then
+  pass "no skill-only features (all present as commands)"
+else
+  fail "features in skills tree but NOT in commands/:"
+  printf '      - %s\n' $ONLY_SKILL
+fi
+
+echo ""
+echo "══ source-parity smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/skills/shared/external/humanizer/SKILL.md

@@ -32,6 +32,17 @@ AI inflates importance. Cut it.
 | Vague authority | "Experts believe", "Industry observers note" | Name the source or remove |
 | Formulaic challenges | "Despite challenges... continues to thrive" | State specific challenges |
 
+### Emoji & Decorative Marks
+
+AI sprinkles friendly/emotive emoji into prose. Strip them.
+
+| Pattern | Example | Fix |
+|---------|---------|-----|
+| Emotive / smiley emoji | "Done 🎉", "Hi there 🙂", "😊", "👍 looks good" | Remove the emoji, keep the words |
+| Emoji as decoration/bullet | "✨ Feature:", "🚀 Shipped", "🔥 Fast" | Plain text |
+
+Keep ONLY functional status/severity marks that a fixed template explicitly defines (e.g. a `✅/⏳` phase-tick strip, `🔴/🟡` severity labels). Everywhere else in prose — issue/Jira comments, Confluence/Wiki pages, PR bodies, commit messages — carry **no** emoji.
+
 ### AI Vocabulary
 
 These words appear far more in AI output than human writing. Replace or remove them.