@mmerterden/multi-agent-pipeline 12.5.0 → 12.6.0

package/pipeline/scripts/smoke-shadow-git.sh

@@ -59,7 +59,9 @@ fi
 
 # 4-9. Lifecycle on a temp project
 TMP=$(mktemp -d)
-cd "$TMP"
+# A failed cd here would run the relative `rm -rf DerivedData` below in the
+# caller's directory instead of the sandbox.
+cd "$TMP" || { record_fail "cannot cd into sandbox $TMP"; exit 1; }
 git init --quiet
 echo "node_modules/" > .gitignore
 echo "hello" > a.txt
@@ -178,7 +180,7 @@ else
   record_fail "~/.claude/state is GONE after unsafe prune attempts"
 fi
 
-cd - >/dev/null
+cd - >/dev/null || true
 rm -rf "$TMP"
 
 # 10-12. Prefs schema

package/pipeline/scripts/triage-memory.mjs

@@ -63,9 +63,27 @@ function die(msg, code = 1) {
   process.exit(code);
 }
 
+// Resolves to the MAIN repository name even when called from inside a pipeline
+// worktree. `--show-toplevel` returns the worktree root, whose basename is the
+// task id, which would shard the per-repo store one directory per task and make
+// prior-art recall always miss. `--git-common-dir` points at the main
+// repository's .git for every linked worktree.
 function repoSlug() {
   if (flags["repo-slug"]) return String(flags["repo-slug"]);
   if (process.env.MULTI_AGENT_REPO_SLUG) return process.env.MULTI_AGENT_REPO_SLUG;
+  try {
+    const commonDir = execFileSync(
+      "git",
+      ["rev-parse", "--path-format=absolute", "--git-common-dir"],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    ).trim();
+    if (commonDir) {
+      const base = basename(commonDir);
+      const root = base === ".git" ? dirname(commonDir) : commonDir.replace(/\.git$/, "");
+      const slug = basename(root);
+      if (slug) return slug;
+    }
+  } catch { /* not a git repo, or git too old for --path-format */ }
   try {
     const top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
       encoding: "utf8",

package/pipeline/scripts/uninstall.mjs

@@ -305,7 +305,7 @@ async function confirm(question) {
   });
 }
 
-async function main() {
+export async function main() {
   console.log("");
   console.log("  multi-agent-pipeline uninstaller");
   console.log("  ================================");

package/pipeline/skills/.skill-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-07-20T07:34:26Z",
-  "skillCount": 189,
+  "generatedAt": "2026-07-25T10:41:38Z",
+  "skillCount": 193,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
-      "sha256": "38cb4c257f7b2915d1784ec6f355b9a7f14bb32427e09c01872d3c8d6a039a71"
+      "sha256": "d3826905606b6ec7d86d3434b03bfdbbd52a424f7108e58ca12a8cb490f1e4ad"
     },
     {
       "path": "shared/core/google-play-compliance/SKILL.md",
@@ -35,6 +35,10 @@
       "path": "shared/core/multi-agent-create-jira/SKILL.md",
       "sha256": "40caf0489ad8322cd00d792a244e772d4ddb6ccfd7c3807729d6b17590e7f81c"
     },
+    {
+      "path": "shared/core/multi-agent-design-check/SKILL.md",
+      "sha256": "a004cf24661789d2a3595c5246dfebe00b76aaee6ece057b458748f502a8cd5c"
+    },
     {
       "path": "shared/core/multi-agent-dev-autopilot/SKILL.md",
       "sha256": "82b1cf4a4bbd84fcfef54fcdbcdefa27f2747df6d4fac5c86b42e861013c6d58"
@@ -59,13 +63,17 @@
       "path": "shared/core/multi-agent-finish/SKILL.md",
       "sha256": "3e8e430f7aee626be96129a9d0ae6c9ac5ef0dbf80cbe580dde2d7fb5fccfed1"
     },
+    {
+      "path": "shared/core/multi-agent-forget/SKILL.md",
+      "sha256": "68f6a92a00844ed34c336548888d3e623534c12b5e85afe5762e7a9c8d41aae4"
+    },
     {
       "path": "shared/core/multi-agent-garbage-collect/SKILL.md",
       "sha256": "24736f163e645e2bee7d552e555ae6e32cd3fc3d15c844813a75b908a58d52fd"
     },
     {
       "path": "shared/core/multi-agent-help/SKILL.md",
-      "sha256": "00772bab27906cdbdcae72d115c4e1f12ddd914fa7aa274923618a3a906e6caa"
+      "sha256": "330780854ab3b48f788e34f918ecad585bd46ffbb44f14fd38de7b48a4b568aa"
     },
     {
       "path": "shared/core/multi-agent-issue/SKILL.md",
@@ -109,7 +117,7 @@
     },
     {
       "path": "shared/core/multi-agent-refactor/SKILL.md",
-      "sha256": "f8a9495f6aebacba634672d6c9416046521cbdfa769746c9ff3a4a993482a85a"
+      "sha256": "60766ee3a6b974b3872417db5c40d1fc03bfddd99daf4aca11d7a59b57a41b57"
     },
     {
       "path": "shared/core/multi-agent-resume/SKILL.md",
@@ -127,6 +135,14 @@
       "path": "shared/core/multi-agent-review/SKILL.md",
       "sha256": "b1fd57d2b80ee0fe2490439d9f2688fcf415857c2aab60549c5456e27693b9a9"
     },
+    {
+      "path": "shared/core/multi-agent-routines/SKILL.md",
+      "sha256": "91d3bdb15da7addadd1afd0b170057daf3d3fc335da3f6e1feb4feff1af0881e"
+    },
+    {
+      "path": "shared/core/multi-agent-save/SKILL.md",
+      "sha256": "f9c6e2ba1dd1b224b80cabe35f4327b5bcc0b1e05868b378547bec616193ef1b"
+    },
     {
       "path": "shared/core/multi-agent-scan/SKILL.md",
       "sha256": "266e4e7c9b702bc3205b7d926455c5863e144cddb1e4b883aa81e570a362fd3f"
@@ -149,11 +165,11 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "de38486056c99a599d93ae5166a2071875331a7d77f1e34f66d8b72657a73c2f"
+      "sha256": "3a9f7d8caa47d41d1a4759ce6673bfb94a1ef9f62f7113a4cd3b1e9451464601"
     },
     {
       "path": "shared/core/multi-agent-test/SKILL.md",
-      "sha256": "f90c34f71ea6cd5cccbfa128597eaaa221a0ca5f62924eb9cfb6b1ed2d07de04"
+      "sha256": "2b662ecd9497149c4c2e87cc79e906cc1cab7ea4a7d0efe300b0b018559960c4"
     },
     {
       "path": "shared/core/multi-agent-uninstall/SKILL.md",
@@ -425,7 +441,7 @@
     },
     {
       "path": "shared/external/humanizer/SKILL.md",
-      "sha256": "7f9d49b90eba79bf7acd8a5d8d5ae091cbc970188b8ecac310cce04b82add42e"
+      "sha256": "2fc8fe79a5832b9e1316f515c73f0545023153e85aba4645ba42060a0afdd049"
     },
     {
       "path": "shared/external/ios-accessibility/SKILL.md",

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 189,
+  "skillCount": 193,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -794,6 +794,15 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-create-jira/SKILL.md"
     },
+    {
+      "name": "multi-agent-design-check",
+      "description": "Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a countable target set, build Debug in a worktree, launch in mock mode, fetch Figma variants, compare each pixel + px-spacing + typography + color, and export a si",
+      "platform": null,
+      "group": "core",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-design-check/SKILL.md"
+    },
     {
       "name": "multi-agent-dev",
       "description": "Fast development mode: Init → Dev (Opus) → Test → Commit → Report. Analysis, planning, and review phases are skipped.",
@@ -848,6 +857,15 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-finish/SKILL.md"
     },
+    {
+      "name": "multi-agent-forget",
+      "description": "Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one and confirms.",
+      "platform": null,
+      "group": "core",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-forget/SKILL.md"
+    },
     {
       "name": "multi-agent-garbage-collect",
       "description": "Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before deleting.",
@@ -958,7 +976,7 @@
     },
     {
       "name": "multi-agent-refactor",
-      "description": "Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, draft one plan, take approval, develop, then ask whether to sync.",
+      "description": "Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, research the companion dev-toolkit MCP server against current MCP practice, draft one plan, take approval, develop, then ask whether to sync.",
       "platform": null,
       "group": "core",
       "triggerKeywords": [],
@@ -1001,6 +1019,24 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-review-jira/SKILL.md"
     },
+    {
+      "name": "multi-agent-routines",
+      "description": "List your saved /multi-agent routines (from /multi-agent:save) with what each one does, rendered in outputLanguage.",
+      "platform": null,
+      "group": "core",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-routines/SKILL.md"
+    },
+    {
+      "name": "multi-agent-save",
+      "description": "Save a recurring job as a reusable /multi-agent:<name> command. Reviews the conversation + your CLAUDE.md for candidate routines, you pick one and name it; stored local-only, never synced.",
+      "platform": null,
+      "group": "core",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-save/SKILL.md"
+    },
     {
       "name": "multi-agent-scan",
       "description": "Skill security scan: walks local skill directories against a tiered pattern catalog.",
@@ -1048,7 +1084,7 @@
     },
     {
       "name": "multi-agent-sync",
-      "description": "One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, and website.",
+      "description": "One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, website, and the dev-toolkit MCP server.",
       "platform": null,
       "group": "core",
       "triggerKeywords": [],

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 189 skills (41 core + 148 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 193 skills (45 core + 148 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  41 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  45 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  148 iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.
 - Install destination stays flat: both trees flatten into `~/.claude/skills/` and `~/.copilot/skills/`. See ADR-0006 for the rationale.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  41
+- [Pipeline Orchestration](#pipeline-orchestration)  -  45
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  88
 - [Android / Kotlin](#android-kotlin)  -  13
 - [Web / Frontend](#web-frontend)  -  10
@@ -25,7 +25,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 | Skill | Group | Description |
 |-------|-------|-------------|
-| [`apple-archive-compliance`](./core/apple-archive-compliance/) | `core` | Apple App Store Review compliance  -  wraps the dev-toolkit-mcp `ios_app_store_audit` tool (17-rule deep scan) with ITMS error code mapping  |
+| [`apple-archive-compliance`](./core/apple-archive-compliance/) | `core` | Apple App Store Review compliance  -  wraps the dev-toolkit-mcp `ios_app_store_audit` tool (18-rule deep scan) with ITMS error code mapping  |
 | [`google-play-compliance`](./core/google-play-compliance/) | `core` | Google Play Store publication compliance  -  bundletool + aapt2 + apksigner orchestration + 21-rule policy catalog with Play Console error c |
 | [`multi-agent`](./core/multi-agent/) | `core` | Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable  |
 | [`multi-agent-analysis`](./core/multi-agent-analysis/) | `core` | Standalone feature-spec analysis (v3 template). Platform-agnostic concept layer with repo-driven convention extraction and per-platform Pass |
@@ -34,12 +34,14 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-build-optimize`](./core/multi-agent-build-optimize/) | `core` | Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analy |
 | [`multi-agent-channels`](./core/multi-agent-channels/) | `core` | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | [`multi-agent-create-jira`](./core/multi-agent-create-jira/) | `core` | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
+| [`multi-agent-design-check`](./core/multi-agent-design-check/) | `core` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | [`multi-agent-dev`](./core/multi-agent-dev/) | `core` | Fast development mode: Init → Dev (Opus) → Test → Commit → Report. Analysis, planning, and review phases are skipped. |
 | [`multi-agent-dev-autopilot`](./core/multi-agent-dev-autopilot/) | `core` | Fastest mode: Dev (Opus) plus Autopilot. Init → Dev → Commit → Report with zero confirmations. |
 | [`multi-agent-dev-local`](./core/multi-agent-dev-local/) | `core` | Fast mode + local  -  Init → Dev(Opus) → Commit → Report, no worktree. |
 | [`multi-agent-dev-local-autopilot`](./core/multi-agent-dev-local-autopilot/) | `core` | Fastest + local  -  Dev(Opus) + autopilot, no worktree, zero interaction. |
 | [`multi-agent-diff-explain`](./core/multi-agent-diff-explain/) | `core` | Map Phase 4 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
 | [`multi-agent-finish`](./core/multi-agent-finish/) | `core` | Continue already-done LOCAL work through the pipeline tail: Review → Build+Test → Commit/PR → Report (technical analysis + Jira test-scenari |
+| [`multi-agent-forget`](./core/multi-agent-forget/) | `core` | Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one an |
 | [`multi-agent-garbage-collect`](./core/multi-agent-garbage-collect/) | `core` | Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before d |
 | [`multi-agent-help`](./core/multi-agent-help/) | `core` | Multi-agent pipeline usage guide  -  renders in EN or TR per prefs.global.outputLanguage (falls back to promptLanguage for backward compatib |
 | [`multi-agent-issue`](./core/multi-agent-issue/) | `core` | List unassigned GitHub issues, pick one, auto-assign, and launch the multi-agent pipeline. |
@@ -52,17 +54,19 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-manual-test`](./core/multi-agent-manual-test/) | `core` | Switch to the active task's branch and prepare it for manual testing in Xcode. Phase 5 standalone (the UI Bug Hunter lives at multi-agent-te |
 | [`multi-agent-prune-logs`](./core/multi-agent-prune-logs/) | `core` | Delete per-task project logs under ~/.claude/logs/multi-agent (filter by age/project/task). Audit trail + metrics are preserved. Dry-run fir |
 | [`multi-agent-purge`](./core/multi-agent-purge/) | `core` | ⚠️ Wipes every worktree, branch, log, and state file. Irreversible; asks for double confirmation. |
-| [`multi-agent-refactor`](./core/multi-agent-refactor/) | `core` | Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, draft one p |
+| [`multi-agent-refactor`](./core/multi-agent-refactor/) | `core` | Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, research th |
 | [`multi-agent-resume`](./core/multi-agent-resume/) | `core` | Resume a stopped or failed task from the phase where it left off. |
 | [`multi-agent-review`](./core/multi-agent-review/) | `core` | Run parallel review on a branch diff or a Pull Request: 2 models on Claude Code (Fable + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonn |
 | [`multi-agent-review-issue`](./core/multi-agent-review-issue/) | `core` | Assess whether a GitHub issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / sta |
 | [`multi-agent-review-jira`](./core/multi-agent-review-jira/) | `core` | Assess whether a Jira issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / stack |
+| [`multi-agent-routines`](./core/multi-agent-routines/) | `core` | List your saved /multi-agent routines (from /multi-agent:save) with what each one does, rendered in outputLanguage. |
+| [`multi-agent-save`](./core/multi-agent-save/) | `core` | Save a recurring job as a reusable /multi-agent:<name> command. Reviews the conversation + your CLAUDE.md for candidate routines, you pick o |
 | [`multi-agent-scan`](./core/multi-agent-scan/) | `core` | Skill security scan: walks local skill directories against a tiered pattern catalog. |
 | [`multi-agent-search`](./core/multi-agent-search/) | `core` | Log search across every agent-log.md with smart ranking and filters. Optional --semantic flag queries the per-repo triage corpus. |
 | [`multi-agent-setup`](./core/multi-agent-setup/) | `core` | First-run setup wizard: keychain token discovery, Git Identity onboarding, and pipeline preparation. |
 | [`multi-agent-stack`](./core/multi-agent-stack/) | `core` | Select the active stack for this repo by enabling the matching marketplace plugin(s) in .claude/settings.json (ios/android/mobile/backend/fr |
 | [`multi-agent-status`](./core/multi-agent-status/) | `core` | Show every multi-agent task's ID, phase, branch, and status. |
-| [`multi-agent-sync`](./core/multi-agent-sync/) | `core` | One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, and website. |
+| [`multi-agent-sync`](./core/multi-agent-sync/) | `core` | One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, website, and the dev-toolkit MCP server. |
 | [`multi-agent-test`](./core/multi-agent-test/) | `core` | UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb). Auto-detects platform. Screenshot + tap + analyze on the booted device. T |
 | [`multi-agent-uninstall`](./core/multi-agent-uninstall/) | `core` | Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline set |
 | [`multi-agent-update`](./core/multi-agent-update/) | `core` | Update the pipeline to the latest version: git pull, install, migrate. |

package/pipeline/skills/shared/core/apple-archive-compliance/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: apple-archive-compliance
 language: en
-description: "Apple App Store Review compliance  -  wraps the dev-toolkit-mcp `ios_app_store_audit` tool (17-rule deep scan) with ITMS error code mapping + EN/TR humanizer templates. Consumed by: /multi-agent:test 'store-ready' (primary dispatch), Phase 4 Security Auditor (catalog cross-ref on Info.plist / PrivacyInfo / entitlements diffs), /multi-agent:review (PR citation), /multi-agent:channels (PR body auto-augmentation). Wiring enforced by smoke-compliance-skills.sh."
+description: "Apple App Store Review compliance  -  wraps the dev-toolkit-mcp `ios_app_store_audit` tool (18-rule deep scan) with ITMS error code mapping + EN/TR humanizer templates. Consumed by: /multi-agent:test 'store-ready' (primary dispatch), Phase 4 Security Auditor (catalog cross-ref on Info.plist / PrivacyInfo / entitlements diffs), /multi-agent:review (PR citation), /multi-agent:channels (PR body auto-augmentation). Wiring enforced by smoke-compliance-skills.sh."
 user-invocable: true
 argument-hint: '[archive-path] [--threshold=error|warning|info] [--format=markdown|json] [--lang=en|tr]   -  no-arg: picks most recent .xcarchive from ~/Library/Developer/Xcode/Archives/'
 ---
 
 # apple-archive-compliance  -  Apple App Store Review Compliance Skill
 
-Pre-submission compliance check for iOS `.xcarchive` bundles. Wraps the [`ios_app_store_audit`](https://github.com/mmerterden/dev-toolkit-mcp) MCP tool (17-rule deep audit shipped inside `@mmerterden/dev-toolkit-mcp` v2.4+) and humanizes its JSON output into actionable Turkish / English markdown reports. Catches rejection-causing issues (ITMS error codes, App Store Review Guideline violations) **before** uploading to App Store Connect.
+Pre-submission compliance check for iOS `.xcarchive` bundles. Wraps the [`ios_app_store_audit`](https://github.com/mmerterden/dev-toolkit-mcp) MCP tool (18-rule deep audit shipped inside `@mmerterden/dev-toolkit-mcp` v2.9.0+) and humanizes its JSON output into actionable Turkish / English markdown reports. Catches rejection-causing issues (ITMS error codes, App Store Review Guideline violations) **before** uploading to App Store Connect.
 
 **This skill does NOT reimplement the rule engine**  -  it invokes the MCP tool and maps its output through a knowledge catalog. Rule logic stays in dev-toolkit-mcp's `tools/ios-app-store-audit/`; this skill is the orchestration + humanization layer.
 
@@ -25,12 +25,12 @@ Pre-submission compliance check for iOS `.xcarchive` bundles. Wraps the [`ios_ap
 
 ### Prerequisite detection
 
-The 17-rule scan is provided by the `ios_app_store_audit` tool in `@mmerterden/dev-toolkit-mcp` ≥ v2.4. Two invocation modes:
+The 18-rule scan is provided by the `ios_app_store_audit` tool in `@mmerterden/dev-toolkit-mcp` ≥ v2.9.0. Two invocation modes:
 
 **A. Native MCP tool call** (preferred when running inside an MCP-aware editor):
 
 ```text
-mcp__dev_toolkit__ios_app_store_audit({
+mcp__dev-toolkit__ios_app_store_audit({
   archive_path: "<path>",
   rules: "all"          // "all" | "core" | "deep" | csv of ruleIDs
 })
@@ -88,7 +88,7 @@ fi
 RULES="${RULES:-all}"  # all | core | deep | csv of ruleIDs
 
 # Mode A  -  native MCP call (replaces this whole block when running inside Claude Code / Copilot CLI):
-#   mcp__dev_toolkit__ios_app_store_audit({ archive_path: "$ARCHIVE_PATH", rules: "$RULES" })
+#   mcp__dev-toolkit__ios_app_store_audit({ archive_path: "$ARCHIVE_PATH", rules: "$RULES" })
 # Mode B  -  direct Node invocation (fallback):
 node -e "
 import('@mmerterden/dev-toolkit-mcp/tools/ios-app-store-audit/index.js').then(async m => {
@@ -107,7 +107,7 @@ VIOLATIONS=$(jq -c '.violations[]' /tmp/archiveguard-$$.json)
 
 **Cache filename:** writes `/tmp/archiveguard-$$.json` so `/multi-agent:channels` and the skill's downstream consumers can pick it up via the `find /tmp -name 'archiveguard-*.json'` glob.
 
-## 17-Rule Catalog
+## 18-Rule Catalog
 
 Apple App Store Review Guidelines + ITMS upload error codes that the underlying scanner enforces. Rule IDs match the source-of-truth IDs in `dev-toolkit-mcp/tools/ios-app-store-audit/rules/<ruleID>.js` (stable across versions).
 
@@ -130,6 +130,7 @@ Apple App Store Review Guidelines + ITMS upload error codes that the underlying
 | 15 | `production-hygiene` |  -  | `print()` / `NSLog()` / `debugPrint()` symbol presence + mock/test JSON files shipped in bundle | warning |
 | 16 | `duplicate-resource` |  -  | Same asset under multiple paths (bloats bundle) | info |
 | 17 | `dead-reference` |  -  | Files referenced in Xcode proj but absent from archive | warning |
+| 18 | `sdk-floor` | ITMS-90725 | `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28) | error |
 
 ## Severity mapping for consumers
 
@@ -256,12 +257,12 @@ If `:test "store-ready"` ran recently and its JSON is cached, channels command's
 multi-agent-test "store-ready" --format=json --auto-pick
 
 # Direct MCP tool call (any MCP-aware editor)
-mcp__dev_toolkit__ios_app_store_audit({ archive_path: "~/Library/Developer/Xcode/Archives/2026-04-21/MyApp.xcarchive", rules: "all" })
+mcp__dev-toolkit__ios_app_store_audit({ archive_path: "~/Library/Developer/Xcode/Archives/2026-04-21/MyApp.xcarchive", rules: "all" })
 ```
 
 ### Phase 4 Security Auditor (catalog cross-ref, no binary invocation)
 
-When a Phase 4 review diff touches iOS release-relevant paths (`Info.plist`, `PrivacyInfo.xcprivacy`, `*.entitlements`, `AppDelegate.swift`, `project.pbxproj`), the security-auditor persona loads this skill's 17-rule catalog and cites matching ruleIDs next to its findings. No binary invocation at review time  -  catalog reads are free.
+When a Phase 4 review diff touches iOS release-relevant paths (`Info.plist`, `PrivacyInfo.xcprivacy`, `*.entitlements`, `AppDelegate.swift`, `project.pbxproj`), the security-auditor persona loads this skill's 18-rule catalog and cites matching ruleIDs next to its findings. No binary invocation at review time  -  catalog reads are free.
 
 ```
 # Example finding from Phase 4 Security Auditor (wired in v5.8.1):
@@ -313,3 +314,4 @@ The appended section is structured:
 - **v5.8.1**  -  3 additional consumer surfaces wired (Phase 4 Security Auditor cross-ref, `/multi-agent:review` citation, `/multi-agent:channels` PR-body auto-augmentation). Regression-locked by `smoke-compliance-skills.sh` (45 assertions).
 - **v6.0.0**  -  `language: en` frontmatter tag; 4-consumer Examples section expanded.
 - **v8.4.0**  -  Migrated off the standalone ArchiveGuard Swift binary. Backend is now the `ios_app_store_audit` tool inside `@mmerterden/dev-toolkit-mcp` ≥ v2.4 (full Node port of the 17 rules). All four consumer surfaces unchanged; rule IDs and JSON output shape preserved for backward compatibility. Rule catalog now points to `dev-toolkit-mcp/tools/ios-app-store-audit/rules/`. ArchiveGuard repo deprecated.
+- **Unreleased**  -  Catalog grows to 18 rules: adds `sdk-floor` (ITMS-90725, iOS 26 / Xcode 26 build floor in force since 2026-04-28), which nothing previously checked. `embedded-sdk`'s missing-framework-privacy-manifest finding moves from a `5.1.1` WARNING to `ITMS-91061` ERROR, an enforced rejection since 2025-02-12  -  archives that used to pass with a warning now fail. Requires `@mmerterden/dev-toolkit-mcp` ≥ v2.9.0.