@mmerterden/multi-agent-pipeline 12.1.1 → 12.3.0

package/pipeline/multi-agent-refs/features/external-context-injection.md

@@ -22,6 +22,7 @@ One fetcher per type. Each fetcher emits a normalized JSON view that the analysi
 |---|---|---|
 | `crashlytics` | `~/.claude/lib/fetch-crashlytics.sh <url>` (already invoked in Phase 0 Step 1b.1 for the legacy `state.crashContext` field; Phase 1 reads that field directly) | `state.crashContext` |
 | `fortify` | `~/.claude/lib/fetch-fortify.sh <url>` (already invoked in Phase 0 Step 1b.2 for the legacy `state.fortifyFinding` field; Phase 1 reads that field, Phase 4 reads the full payload for the security gate) | `state.fortifyFinding` |
+| `graylog` | `~/.claude/lib/fetch-graylog.sh --trx <id>` / `--conv <id>` (already invoked in Phase 0 Step 1b.3 for the `state.graylogContext` field; Phase 1 reads that field directly). Diagnostic logs, **advisory only**  -  no Phase 4 gate, no generated task | `state.graylogContext` |
 | `swagger` | `~/.claude/lib/fetch-swagger.sh <url>` → endpoints[], request/response examples | `state.fetchedContext.swagger[]` |
 | `confluence` | `~/.claude/lib/fetch-confluence.sh <url>` → page body, code blocks, extracted API contracts | `state.fetchedContext.confluence[]` |
 | `figma` | no standalone fetcher - resolve via the Figma 3-tier chain (Tier 1 MCP tools, Tier 2 `~/.claude/lib/figma-screenshot.sh` + REST) when the task is a component; otherwise advisory only | `state.fetchedContext.figma[]` |
@@ -36,6 +37,8 @@ One fetcher per type. Each fetcher emits a normalized JSON view that the analysi
 
 Failures are never fatal at Phase 1  -  the agent still runs analysis, just without the referenced source.
 
+**Graylog specifics.** `fetch-graylog.sh` degrades to empty on any network/VPN failure: it emits a normalized empty object and exits `0`, so an unreachable host reads as `{status:"skipped", reason:"vpn-unreachable"}` and never blocks. Only a genuine auth rejection on a reachable host exits `3` (marked `failed`, still non-fatal here). `state.graylogContext` is prepended to the analysis prompt inside the **Referenced External Sources** section as diagnostic context that is **advisory only**  -  the agent may use it to orient on a reported error, but code remains ground truth, and there is no Phase 4 review gate for logs.
+
 ## Prompt injection shape
 
 Added immediately after the knowledge-injection block, before codebase exploration:

package/pipeline/multi-agent-refs/keychain.md

@@ -17,7 +17,7 @@ When a token resolves but the service rejects it (401 / 403), do not silently sk
 
 - **Regenerate** - the existing token is dead; open Save Flow Step B to replace `<KEY_NAME>` in place (same key name, clipboard path), then retry the operation.
 - **Use a different token** - map a new or existing Keychain entry for this service (Save Flow Step B + identity binding), then retry.
-- **Skip and continue** - drop this token's contribution. Non-critical services (Confluence enrichment, Fortify scan, Firebase events, Figma fallback tiers) continue with reduced evidence and a one-line warning. A token that is structurally required for the input (e.g. the Jira PAT for a Jira-ID input) halts instead, since the run cannot proceed without it.
+- **Skip and continue** - drop this token's contribution. Non-critical services (Confluence enrichment, Fortify scan, Graylog log fetch, Firebase events, Figma fallback tiers) continue with reduced evidence and a one-line warning. A token that is structurally required for the input (e.g. the Jira PAT for a Jira-ID input) halts instead, since the run cannot proceed without it.
 
 The question asks a *choice*; the replacement value still flows through the clipboard, never chat. `smoke-no-token-prompt.sh` greps for value-prompts (`enter token`, `paste token`, `API key:`) - decision labels like `Regenerate` / `Skip and continue` do not trip it.
 
@@ -64,6 +64,7 @@ The shell driver auto-delegates to `~/.claude/scripts/keychain.py` on macOS / Li
 | `figma`            | Figma              | `${USER}_Figma_Access_Token`       | PAT               |
 | `figma_mcp`        | Figma MCP          | `${USER}_Figma_Mcp_Access_Token`   | OAuth             |
 | `fortify`          | Fortify            | `${USER}_Fortify_Access_Token`     | API Token         |
+| `graylog`          | Graylog            | `${USER}_Graylog_Access_Token`     | API Token         |
 | `firebase`         | Firebase           | `${USER}_Firebase_Access_Json`     | JSON (base64)     |
 | `jenkins`          | Jenkins CI         | `${USER}_Jenkins_Access_Token`     | API Token         |
 |  -                   | Git Identity       | Stored in preferences JSON         | Not Keychain      |
@@ -82,6 +83,7 @@ The shell driver auto-delegates to `~/.claude/scripts/keychain.py` on macOS / Li
       "figma": "${USER}_Figma_Access_Token",
       "figma_mcp": "${USER}_Figma_Mcp_Access_Token",
       "fortify": "${USER}_Fortify_Access_Token",
+      "graylog": "${USER}_Graylog_Access_Token",
       "firebase": "${USER}_Firebase_Access_Json",
       "jenkins": "${USER}_Jenkins_Access_Token"
     }

package/pipeline/multi-agent-refs/phases/phase-0-init.md

@@ -53,7 +53,7 @@ Then STOP Phase 0  -  do not proceed with a broken token state. This prevents th
 
 **Key design**: Every field is an **array of all historical values** (most recent first) → "recently used" list.
 
-**Token resolution rule**: ALWAYS check `prefs.global.keychainMapping.<service_id>` first for the key name  -  this holds the user's actual Keychain key name (which may differ from the standard convention). Fall back to standard key name ONLY when setup has never run (mapping absent). The standard fallback exists as a safety net, not as the primary path. Service IDs: `jira`, `bitbucket_token`, `bitbucket_user`, `github`, `confluence`, `figma`, `figma_mcp`, `fortify`, `firebase`, `jenkins`.
+**Token resolution rule**: ALWAYS check `prefs.global.keychainMapping.<service_id>` first for the key name  -  this holds the user's actual Keychain key name (which may differ from the standard convention). Fall back to standard key name ONLY when setup has never run (mapping absent). The standard fallback exists as a safety net, not as the primary path. Service IDs: `jira`, `bitbucket_token`, `bitbucket_user`, `github`, `confluence`, `figma`, `figma_mcp`, `fortify`, `firebase`, `jenkins`, `graylog`.
 
 **Jira project key resolution** (first match wins):
 
@@ -196,7 +196,7 @@ Sequential prompts (standard UX pattern with Recent suggestion): Project Key →
 
 **Token pre-check** (after parsing): Jira input → resolve key via `prefs.global.keychainMapping.jira`, verify token with a lightweight API call (e.g. `GET /myself`). GitHub input → verify `gh auth status`. On failure (missing key, 401, 403) → run the **Token Save Flow** from `setup.md` inline. This is the same clipboard-based flow used during setup  -  token never appears in terminal. If user skips and the token is critical for the input type (e.g. Jira token for Jira input), halt Phase 0.
 
-**VPN connectivity check**: Test VPN-dependent services (Jira, Bitbucket, Confluence, Fortify) with `curl --connect-timeout 3`. If unreachable, warn and offer to continue. Fallback: Jira → manual input, Bitbucket → `git push` only, Confluence → skip Phase 7, Fortify → skip scan. Cache in `agent-state.json` → `"vpnServices": {"jira": true, ...}`.
+**VPN connectivity check**: Test VPN-dependent services (Jira, Bitbucket, Confluence, Fortify, Graylog) with `curl --connect-timeout 3`. If unreachable, warn and offer to continue. Fallback: Jira → manual input, Bitbucket → `git push` only, Confluence → skip Phase 7, Fortify → skip scan, Graylog → skip log fetch (advisory only, never blocks). Cache in `agent-state.json` → `"vpnServices": {"jira": true, ...}`.
 
 #### Step 1b  -  URL Enrichment (catalogue + targeted deep fetches)
 
@@ -225,6 +225,7 @@ Output schema (one array entry per URL  -  full contract in `~/.claude/lib/conte
   { "type": "confluence",  "url": "<url>", "metadata": { "host": "<host>", "pageId": "<id|null>", "spaceKey": "<key|null>" } },
   { "type": "crashlytics", "url": "<url>", "metadata": { "projectId": "...", "platform": "ios|android", "bundle": "...", "issueId": "...", "sessionId": "<id|null>" } },
   { "type": "fortify",     "url": "<url>", "metadata": { "host": "<host>", "projectId": "<id|null>" } },
+  { "type": "graylog",     "url": null,    "metadata": { "idType": "trx|conversation", "id": "...", "label": "..." } },
   { "type": "figma",       "url": "<url>", "metadata": { "kind": "design|make|board|slides", "fileKey": "...", "nodeId": "<id|null>" } },
   { "type": "generic-doc", "url": "<url>", "metadata": { "host": "<host>", "kind": "notion|google-docs|gist|github-doc" } }
 ]
@@ -258,7 +259,18 @@ URL pattern (caught by the extractor): `https://<prefs.global.hosts.fortify>/ssc
 - Phase 2 Planning injects `state.fortifyFinding` into the architectural-review prompt under a **Known Security Finding** section, and the generated task breakdown includes a task addressing the finding (naming convention: `sec(fortify-<issueId>): <issueName> at <file>:<line>`).
 - Soft-fail: 401 → re-run Token Save Flow for `fortify`; 403 → warn and skip; network timeout → respect VPN fallback (skip enrichment, mark `state.fortifyFinding = { skipped: "vpn-unreachable" }`).
 
-##### Step 1b.3  -  Other link types (catalogued only at Phase 0; fetched at Phase 1)
+##### Step 1b.3  -  Graylog deep fetch (runs when `type == "graylog"` present in `state.contextLinks[]`)
+
+The extractor emits `graylog` entries from free-text trx / conversation ids (labels like `trx`, `trxId`, `transaction id`, `conversationId`, `convId`, `X-conversationId`), not from a URL  -  so these entries carry `"url": null`. When at least one is present, pull the matching diagnostic logs.
+
+- Host comes from `prefs.global.hosts.graylog` (`GRAYLOG_HOST_OVERRIDE` env forces it for tests/CI); no literal host lives in any source file. Missing host → the fetcher exits `6`; log a setup hint and skip.
+- Token resolution: `prefs.global.keychainMapping.graylog` → `~/.claude/lib/credential-store.sh get "<key>"` → Graylog PAT (fallback key `${USER}_Graylog_Access_Token`). Auth is HTTP Basic with the token as username and the literal `token` as password; the token is fed to `curl` only via a `-K` config file (process substitution), never on argv.
+- Fetch logs (VPN required; respect `vpnServices.graylog`): call `~/.claude/lib/fetch-graylog.sh --trx <id>` (or `--conv <id>` for conversation ids) once per extracted id. The fetcher emits a normalized JSON object of matching log messages.
+- Store as `state.graylogContext = { idType, id, messages[], fetchedAt }` (or an array keyed per id when several were extracted).
+- Phase 1 Analysis prepends `state.graylogContext` to the agent prompt under the **Referenced External Sources** section as **diagnostic context, advisory only** (never contradicts code; no task is generated from it, no Phase 4 gate).
+- Soft-fail (non-blocking, mirrors Crashlytics): unreachable host / VPN down / network timeout → the fetcher emits a normalized empty object and exits `0`; mark `state.graylogContext = { skipped: "vpn-unreachable" }` and continue. Only a genuine auth rejection (4xx on a reachable host, fetcher exit `3`) is logged as `skipped` with the auth reason. A log fetch never blocks the run.
+
+##### Step 1b.4  -  Other link types (catalogued only at Phase 0; fetched at Phase 1)
 
 For `swagger`, `confluence`, `figma`, `generic-doc` entries in `state.contextLinks[]`, no Phase 0 fetch runs. The entries pass through to Phase 1, which dispatches the matching fetcher (Block B work: `fetch-swagger.sh`, `fetch-confluence.sh`, etc.). Until those fetchers land, the entries are surfaced in Phase 1 context as "referenced but not fetched  -  agent should treat the URL as an authoritative external source and read it directly when relevant."
 
@@ -267,11 +279,11 @@ For `swagger`, `confluence`, `figma`, `generic-doc` entries in `state.contextLin
 **Log line shape** (progress contract):
 
 ```
-→ context links: total=<N>, by-type={swagger:<n>, confluence:<n>, crashlytics:<n>, fortify:<n>, figma:<n>, generic-doc:<n>}
-→ URL deep fetch: crashlytics=<hit|miss|skipped>, fortify=<hit|miss|skipped>
+→ context links: total=<N>, by-type={swagger:<n>, confluence:<n>, crashlytics:<n>, fortify:<n>, graylog:<n>, figma:<n>, generic-doc:<n>}
+→ URL deep fetch: crashlytics=<hit|miss|skipped>, fortify=<hit|miss|skipped>, graylog=<hit|miss|skipped>
 ```
 
-Two lines emit at the end of Step 1b. The first reports the catalogue from 1b.0 (always runs). The second reports the deep-fetch outcomes from 1b.1 / 1b.2  -  `miss` = URL type not present in catalogue (normal), `skipped` = URL present but auth/VPN/mismatch skipped the fetch, `hit` = URL-derived context stored in state.
+Two lines emit at the end of Step 1b. The first reports the catalogue from 1b.0 (always runs). The second reports the deep-fetch outcomes from 1b.1 / 1b.2 / 1b.3  -  `miss` = type not present in catalogue (normal), `skipped` = present but auth/VPN/mismatch skipped the fetch (for graylog this includes the non-blocking VPN-unreachable degrade), `hit` = context stored in state.
 
 #### Step 2  -  Project Selection
 
@@ -484,11 +496,12 @@ Single-repo mode (`projects.length === 1` or scalar-only) uses the legacy single
   "inputType": "github-issue-url|github-issue-number|jira-url|jira-id|free-text",
   "jiraId": "PROJ-XXXXX|null", "figmaUrl": "...|null",
   "contextLinks": [
-    { "type": "swagger|confluence|crashlytics|fortify|figma|generic-doc",
-      "url": "<full-url>", "metadata": { } }
+    { "type": "swagger|confluence|crashlytics|fortify|graylog|figma|generic-doc",
+      "url": "<full-url|null>", "metadata": { } }
   ],
   "crashContext": null,
   "fortifyFinding": null,
+  "graylogContext": null,
   "localMode": false, "instructionDriven": true|false, "instructionFiles": {},
   "identity": {"name": "...", "email": "...", "keychainKey": "..."},
   "currentPhase": 0, "status": "in_progress", "startedAt": "{ISO}", "shortId": "#N",

package/pipeline/multi-agent-refs/phases/phase-1-analysis.md

@@ -75,7 +75,7 @@ Progress lines:
 
 #### Step 1.5  -  External Context Injection (`state.contextLinks[]`)
 
-Phase 0 Step 1b catalogued every typed external link from the task description into `state.contextLinks[]`. Phase 1 dispatches each entry to its matching fetcher (crashlytics, fortify, swagger, confluence, figma, generic-doc) and prepends results under a **Referenced External Sources** section in the analysis prompt  -  so the agent doesn't re-discover what the ticket already pointed at. Failures never fatal; pending refs are advisories. Full dispatch table, exit-code handling, prompt injection shape, log line shape: `$HOME/.claude/multi-agent-refs/features/external-context-injection.md`.
+Phase 0 Step 1b catalogued every typed external link from the task description into `state.contextLinks[]`. Phase 1 dispatches each entry to its matching fetcher (crashlytics, fortify, graylog, swagger, confluence, figma, generic-doc) and prepends results under a **Referenced External Sources** section in the analysis prompt  -  so the agent doesn't re-discover what the ticket already pointed at. `state.graylogContext` is injected there too, as diagnostic context (advisory only). Failures never fatal (a non-zero fetcher exit is marked skipped and the analysis still runs, exactly as for crashlytics); pending refs are advisories. Full dispatch table, exit-code handling, prompt injection shape, log line shape: `$HOME/.claude/multi-agent-refs/features/external-context-injection.md`.
 
 **Log line shape** (progress contract):
 

package/pipeline/preferences-template.json

@@ -11,6 +11,7 @@
       "figma": null,
       "figma_mcp": null,
       "fortify": null,
+      "graylog": null,
       "firebase": null,
       "jenkins": null
     },

package/pipeline/schemas/analysis-spec.schema.json

@@ -49,6 +49,24 @@
       "default": "v3",
       "description": "Template version emitted. v3 is the platform-agnostic + Pass B render template (Locked 22)."
     },
+    "options": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Coverage opt-ins captured at Phase 0 Step 5a. Absent = defaults (no UI tests, basic accessibility).",
+      "properties": {
+        "uiTests": {
+          "type": "boolean",
+          "default": false,
+          "description": "When true, Section 15.6 renders UI test scenarios (XCUITest / Compose UI test)."
+        },
+        "a11yDepth": {
+          "type": "string",
+          "enum": ["basic", "full"],
+          "default": "basic",
+          "description": "basic = Section 16.1 checklist only; full = also render the 16.2 VoiceOver/TalkBack walkthrough."
+        }
+      }
+    },
     "evidenceDigest": {
       "type": ["string", "null"],
       "pattern": "^sha256:[0-9a-f]{64}$",
@@ -110,6 +128,8 @@
               "url": { "type": "string", "format": "uri" },
               "fileKey": { "type": ["string", "null"] },
               "nodeId": { "type": ["string", "null"] },
+              "screenshotUrl": { "type": ["string", "null"], "description": "Local PNG path or signed render URL for this node." },
+              "tier": { "type": ["integer", "null"], "enum": [1, 2, 3, null], "description": "Figma access tier used to capture this record (mirrors state.figmaAccess.tier)." },
               "frames": {
                 "type": "array",
                 "items": {
@@ -134,6 +154,64 @@
                     "repoPath": { "type": ["string", "null"] }
                   }
                 }
+              },
+              "codeConnectSnippets": {
+                "type": "array",
+                "description": "Verbatim CodeConnectSnippet blocks captured on Tier 1 (component name + modifier chain).",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "nodeId": { "type": ["string", "null"] },
+                    "component": { "type": "string" },
+                    "snippet": { "type": ["string", "null"] }
+                  }
+                }
+              },
+              "tokens": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "name": { "type": "string" },
+                    "value": { "type": ["string", "null"] }
+                  }
+                }
+              },
+              "textLayers": {
+                "type": "array",
+                "description": "Visible text-layer content. Treated as placeholder copy when an annotation exists for the same node (annotation wins).",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "nodeId": { "type": ["string", "null"] },
+                    "name": { "type": ["string", "null"] },
+                    "text": { "type": "string" }
+                  }
+                }
+              },
+              "annotations": {
+                "type": "array",
+                "description": "Dev Mode annotations captured as authoritative copy ground truth (Phase 1 annotation ingestion). Empty unless annotations.enabled in the project figma-config.",
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["nodeId", "mode"],
+                  "properties": {
+                    "nodeId": { "type": "string" },
+                    "name": { "type": ["string", "null"] },
+                    "designText": { "type": ["string", "null"], "description": "The visible-layer text at this node (often a placeholder)." },
+                    "raw": { "type": ["string", "null"], "description": "The raw annotation label/labelMarkdown before parsing." },
+                    "parsed": {
+                      "type": "object",
+                      "description": "Parsed copy keyed by language code (lowercased), e.g. { tr, en }.",
+                      "additionalProperties": { "type": "string" }
+                    },
+                    "mode": { "type": "string", "enum": ["prefixed", "two-line", "single", "empty"] }
+                  }
+                }
               }
             }
           }

package/pipeline/schemas/figma-project-config.schema.json

@@ -50,6 +50,55 @@
         }
       }
     },
+    "annotations": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Figma Dev Mode annotation ingestion. When enabled, /multi-agent:analysis treats annotations as the authoritative copy for a node (the visible text layer is a placeholder). Absent or disabled = current behavior (visible text layers only).",
+      "properties": {
+        "enabled": { "type": "boolean", "default": false },
+        "langPrefixes": {
+          "type": "array",
+          "items": { "type": "string" },
+          "default": ["TR", "EN"],
+          "description": "Ordered language-code prefixes the annotation parser recognizes, e.g. [\"TR\",\"EN\"]. A `TR: ...\\nEN: ...` label parses by prefix; a two-line label with no prefix maps line 1 -> langPrefixes[0], line 2 -> langPrefixes[1]; a single line -> langPrefixes[0]."
+        },
+        "devModeCategory": {
+          "type": ["string", "null"],
+          "description": "Optional Dev Mode annotation category to filter on (e.g. a copy/UX-writing category). Null = accept all annotations on the node."
+        }
+      }
+    },
+    "localization": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How this project owns localization. Drives Section 10 of /multi-agent:analysis. Default `in-repo` keeps the historical hand-filled per-locale grid; `externally-owned` defers per-locale values to an authoring system (the analysis names key + status + copy source + base value only).",
+      "properties": {
+        "ownership": {
+          "type": "string",
+          "enum": ["in-repo", "externally-owned"],
+          "default": "in-repo"
+        },
+        "authoringPipeline": {
+          "type": ["string", "null"],
+          "description": "Human-readable reference to the owning localization system when ownership = externally-owned (e.g. a workflow or resource-bot name). Rendered as the Ownership column value; never a secret."
+        },
+        "locales": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Supported locale codes for this project (e.g. [\"tr\",\"en\",\"ar\",\"de\",\"es\",\"fr\",\"it\",\"ru\"]). Overrides the built-in default locale set used by Section 10.",
+          "minItems": 1
+        },
+        "baseLanguage": {
+          "type": "string",
+          "default": "en",
+          "description": "Source/base language code. A key missing its base-language value is a defect (renders the raw key at runtime)."
+        },
+        "keyPattern": {
+          "type": ["string", "null"],
+          "description": "Key naming convention hint, e.g. `Namespace.Case`. Documentation only; not enforced."
+        }
+      }
+    },
     "github": {
       "type": "object",
       "additionalProperties": false,

package/pipeline/schemas/prefs.schema.json

@@ -157,6 +157,12 @@
                 "null"
               ]
             },
+            "graylog": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "firebase": {
               "type": [
                 "string",
@@ -482,6 +488,10 @@
               "type": "string",
               "description": "Fortify SSC host without scheme, e.g. ssc.example.com. Used by Phase 0 Step 1b URL enrichment to validate pasted Fortify URLs and for direct SSC REST API calls. Resolves {FORTIFY_HOST}."
             },
+            "graylog": {
+              "type": "string",
+              "description": "Graylog host without scheme, e.g. logs.example.com. Used by the Graylog log-fetch adapter for direct REST API calls. Resolves {GRAYLOG_HOST}."
+            },
             "corpDomain": {
               "type": "string",
               "description": "Corporate email / cookie domain, e.g. example.com. Resolves {CORP_DOMAIN}."
@@ -1248,6 +1258,28 @@
             "figmaConfigPath": {
               "type": "string",
               "description": "Path to per-project figma-config.json (for Figma pipeline projects)."
+            },
+            "standardsFile": {
+              "type": "string",
+              "description": "Filename (or absolute/tilde path) of the canonical home-dir Standards reference for this project, used by /multi-agent:analysis Q5 auto-detect (e.g. ~/<project>-Standards.md)."
+            },
+            "editableRelatedRepos": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 20,
+              "description": "Extra writable repos to offer in the dev-context picker beyond auto-detected submodules (iOS/Android/Backend)."
+            },
+            "frontendRepos": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 20,
+              "description": "Frontend repos for this project, used by /multi-agent:analysis Step 4 (Frontend is rarely in the iOS/Android submodule tree)."
+            },
+            "frontendRoots": {
+              "type": "array",
+              "items": { "type": "string" },
+              "maxItems": 20,
+              "description": "Whitelist source roots for the Frontend repo-evidence scan (overrides the default src/ app/ components/ features/ lib/)."
             }
           }
         }

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -2,18 +2,18 @@
 .claude/CLAUDE.md	1
 .claude/agents	8
 .claude/commands	44
-.claude/lib	25
+.claude/lib	27
 .claude/multi-agent-preferences.json	1
 .claude/multi-agent-refs	51
 .claude/rules	12
 .claude/schemas	23
-.claude/scripts	193
+.claude/scripts	195
 .claude/settings.json	1
 .claude/skills	428
 .copilot/.pipeline-version	1
 .copilot/agents	8
 .copilot/copilot-instructions.md	1
-.copilot/lib	25
+.copilot/lib	27
 .copilot/schemas	23
-.copilot/scripts	193
+.copilot/scripts	195
 .copilot/skills	467

package/pipeline/scripts/smoke-fetchers-offline.sh

@@ -261,6 +261,30 @@ expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
   "$SH" "$LIB/fetch-fortify.sh" "$FORTIFY_URL"
 assert_in_file '"gateOutcome"' "$OUT" "normalized JSON still emitted"
 
+# -----------------------------------------------------------------------------
+note "4b. fetch-graylog.sh"
+# -----------------------------------------------------------------------------
+expect_rc 6 "no host configured exits 6" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-graylog.sh" --trx T123
+expect_rc 4 "host override + no ids exits 4 (usage)" \
+  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
+  "$SH" "$LIB/fetch-graylog.sh"
+
+expect_rc 2 "host override + id reaches credential stage" \
+  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
+  "$SH" "$LIB/fetch-graylog.sh" --trx T123 --conv C456
+assert_in_file "missing-token" "$ERR" "blocked JSON names missing-token"
+
+# Non-blocking contract: with a stub token and a failing curl, the fetch must
+# degrade to an empty normalized result (messages present) and exit 0 so a log
+# fetch never blocks a run.
+expect_rc 0 "stub token + offline curl degrades to empty result (exit 0)" \
+  env HOME="$FAKE_HOME" USER=smoke GRAYLOG_HOST_OVERRIDE=logs.example.com \
+      FAKE_CRED_VALUE=fake-token PATH="$BIN_CURL_FAIL:$PATH" \
+  "$SH" "$LIB/fetch-graylog.sh" --trx T123
+assert_in_file '"messages"' "$OUT" "normalized JSON still emitted"
+
 # -----------------------------------------------------------------------------
 note "5. figma-screenshot.sh"
 # -----------------------------------------------------------------------------
@@ -330,6 +354,46 @@ assert_in_file "^-i" "$WORK/security-argv.log" "security invoked in -i stdin mod
 assert_not_in_file "$SECRET_VALUE" "$WORK/security-argv.log" "secret absent from security argv"
 assert_in_file "$SECRET_VALUE" "$WORK/security-stdin.log" "secret delivered via stdin"
 
+# -----------------------------------------------------------------------------
+note "7b. fetch-figma-annotations.sh (Tier-2 annotation ingestion)"
+# -----------------------------------------------------------------------------
+expect_rc 1 "no args exits 1 (usage)" \
+  "$SH" "$LIB/fetch-figma-annotations.sh"
+
+# Missing token -> blocked JSON + exit 2 (no network).
+expect_rc 2 "missing token exits 2 with blocked JSON" \
+  env HOME="$FAKE_HOME" USER=smoke \
+  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23"
+assert_in_file "missing-token" "$OUT" "blocked JSON names missing-token"
+
+# Fake curl returns a /nodes doc carrying a TR:/EN: annotation; with a stub
+# token the parser must reach + parse it (regression guard for the parser).
+BIN_CURL_ANNOT="$WORK/bin-curl-annot"
+mkdir -p "$BIN_CURL_ANNOT"
+cat > "$BIN_CURL_ANNOT/curl" <<'FAKE'
+#!/bin/bash
+out=""; prev=""
+for a in "$@"; do
+  [ "$prev" = "-o" ] && out="$a"
+  prev="$a"
+done
+if [ -n "$out" ]; then
+  cat > "$out" <<'JSON'
+{"nodes":{"1:23":{"document":{"id":"1:23","name":"Title","type":"TEXT","characters":"Giriniz","annotations":[{"label":"TR: Ucusunuzu secin\nEN: Select your flight"}]}}}}
+JSON
+fi
+printf '200'
+exit 0
+FAKE
+chmod +x "$BIN_CURL_ANNOT/curl"
+
+expect_rc 0 "stub token + annotation doc parses (exit 0)" \
+  env HOME="$FAKE_HOME" USER=smoke FIGMA_PAT=fake-token \
+      PATH="$BIN_CURL_ANNOT:$PATH" \
+  "$SH" "$LIB/fetch-figma-annotations.sh" --file-key ABC --node-id "1:23" --lang-prefixes TR,EN
+assert_in_file "\"mode\": \"prefixed\"" "$OUT" "annotation parsed as prefixed"
+assert_in_file "Select your flight" "$OUT" "EN copy extracted from annotation"
+
 # -----------------------------------------------------------------------------
 note "8. static source checks (bash-3.2 compat + no secrets on argv)"
 # -----------------------------------------------------------------------------
@@ -338,6 +402,8 @@ OWNED_FILES=(
   "$LIB/fetch-crashlytics.sh"
   "$LIB/fetch-swagger.sh"
   "$LIB/fetch-fortify.sh"
+  "$LIB/fetch-graylog.sh"
+  "$LIB/fetch-figma-annotations.sh"
   "$LIB/figma-mcp-refresh.sh"
   "$LIB/figma-screenshot.sh"
   "$LIB/credential-store.sh"

package/pipeline/scripts/smoke-validate-analysis-doc.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# smoke-validate-analysis-doc.sh  -  contract for validate-analysis-doc.mjs,
+# the deterministic gate over an emitted /multi-agent:analysis document.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+V="$SCRIPT_DIR/validate-analysis-doc.mjs"
+
+PASS=0
+FAIL=0
+record_pass() { PASS=$((PASS + 1)); printf '  \342\234\223 %s\n' "$1"; }
+record_fail() { FAIL=$((FAIL + 1)); printf '  \342\234\227 %s\n' "$1"; }
+
+printf '\342\206\222 smoke-validate-analysis-doc: emitted-doc gate\n'
+
+tmp=$(mktemp -d "${TMPDIR:-/tmp}/vdoc.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+
+# A well-formed Full-mode doc (neutral UserProfile domain, BR referenced downstream).
+cat > "$tmp/good.md" <<'MD'
+---
+feature: UserProfile
+platform: ios
+language: tr
+mode: full
+template_version: v3
+---
+## 1. Özet
+Profile screen.
+## 2. Hedefler ve Karşı Hedefler
+goals.
+## 4. Kullanıcı Hikayeleri
+### 4.4 İş Kuralları
+| BR-profile-01 | rule | source | Given/When/Then |
+## 9. API Kontratları
+api.
+## 13. Mimari Plan
+arch.
+## 14. Eklenecek Dosyalar
+files.
+## 15. Test Planı
+BR-profile-01 happy path.
+## 20. Riskler ve Açık Sorular
+risk.
+## 21. Referanslar
+refs.
+MD
+
+if node "$V" "$tmp/good.md" >/dev/null 2>&1; then
+  record_pass "well-formed Full doc passes (exit 0)"
+else
+  record_fail "well-formed doc should pass"
+fi
+
+# Lite doc without Section 15 must still pass (Locked 31 mode-aware).
+cat > "$tmp/lite.md" <<'MD'
+---
+feature: UserProfile
+platform: ios
+language: en
+mode: lite
+template_version: v3
+---
+## 1. Summary
+s
+## 2. Goals and Non-Goals
+g
+## 4. User Stories
+### 4.4 Business Rules
+| BR-profile-01 | rule | source | Given/When/Then |
+## 9. API Contracts
+a
+## 13. Architecture
+x
+## 14. Files to Add
+f
+## 20. Risks and Open Questions
+r
+## 21. References
+ref
+MD
+if node "$V" "$tmp/lite.md" >/dev/null 2>&1; then
+  record_pass "Lite doc (no Section 15) passes - mode-aware Locked 31"
+else
+  record_fail "Lite doc without Section 15 must pass"
+fi
+
+# Missing front-matter -> ERROR.
+printf '## 1. Summary\nno front matter\n' > "$tmp/nofm.md"
+node "$V" "$tmp/nofm.md" >/dev/null 2>&1
+[ "$?" -eq 1 ] && record_pass "missing front-matter fails (exit 1)" || record_fail "missing front-matter should fail"
+
+# Banned punctuation (em-dash) -> ERROR.
+cp "$tmp/good.md" "$tmp/emdash.md"
+printf 'A line with an em-dash \342\200\224 here.\n' >> "$tmp/emdash.md"
+# Capture first (pipefail + node's nonzero exit would poison a direct pipe).
+emdash_out=$(node "$V" "$tmp/emdash.md" 2>&1 || true)
+if printf '%s' "$emdash_out" | grep -q "em-dash"; then
+  record_pass "em-dash flagged (Locked 7)"
+else
+  record_fail "em-dash should be flagged"
+fi
+
+# Missing a never-omitted section (References) -> ERROR.
+grep -v "Referanslar\|References" "$tmp/good.md" > "$tmp/noref.md"
+node "$V" "$tmp/noref.md" >/dev/null 2>&1
+[ "$?" -eq 1 ] && record_pass "missing References section fails" || record_fail "missing References should fail"
+
+# Define-only BR under --strict -> fail (WARN promoted).
+cat > "$tmp/orphan.md" <<'MD'
+---
+feature: UserProfile
+platform: ios
+language: en
+mode: full
+template_version: v3
+---
+## 1. Summary
+s
+## 2. Goals
+g
+## 4. User Stories
+### 4.4 Business Rules
+| BR-profile-42 | rule | source | Given/When/Then |
+## 9. API Contracts
+a
+## 13. Architecture
+x
+## 14. Files to Add
+f
+## 15. Test Plan
+no BR reference here
+## 20. Risks
+r
+## 21. References
+ref
+MD
+node "$V" "$tmp/orphan.md" >/dev/null 2>&1
+[ "$?" -eq 0 ] && record_pass "define-only BR is WARN, not error (default)" || record_fail "orphan BR should not hard-fail by default"
+node "$V" "$tmp/orphan.md" --strict >/dev/null 2>&1
+[ "$?" -eq 1 ] && record_pass "define-only BR fails under --strict" || record_fail "orphan BR should fail under --strict"
+
+# ui_tests: true but no Section 15.6 -> ERROR.
+sed 's/^mode: full/mode: full\nui_tests: true\na11y_depth: basic/' "$tmp/good.md" > "$tmp/uimiss.md"
+node "$V" "$tmp/uimiss.md" >/dev/null 2>&1
+[ "$?" -eq 1 ] && record_pass "ui_tests:true without Section 15.6 fails" || record_fail "ui_tests:true must require 15.6"
+
+# ui_tests: true WITH a Section 15.6 heading -> passes.
+cp "$tmp/uimiss.md" "$tmp/uiok.md"
+printf '## 15.6 UI test senaryolari\nUI-profile-01 flow.\n' >> "$tmp/uiok.md"
+node "$V" "$tmp/uiok.md" >/dev/null 2>&1
+[ "$?" -eq 0 ] && record_pass "ui_tests:true with Section 15.6 passes" || record_fail "ui_tests:true + 15.6 should pass"
+
+# a11y_depth: full but no Section 16.2 walkthrough -> ERROR.
+sed 's/^mode: full/mode: full\nui_tests: false\na11y_depth: full/' "$tmp/good.md" > "$tmp/a11ymiss.md"
+node "$V" "$tmp/a11ymiss.md" >/dev/null 2>&1
+[ "$?" -eq 1 ] && record_pass "a11y_depth:full without Section 16.2 fails" || record_fail "a11y_depth:full must require 16.2"
+
+printf '\n\342\225\220\342\225\220 smoke-validate-analysis-doc: %d passed, %d failed \342\225\220\342\225\220\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ]