@mmerterden/multi-agent-pipeline 12.5.0 → 12.7.0

package/install/templates/copilot-instructions.md

@@ -8,20 +8,20 @@
 
 8-phase development workflow (Phase 0 through Phase 7). Describe your task and follow the phases:
 
-0. **Init** — Project setup, worktree, branch creation, identity binding
-1. **Analysis** — Stack detection, codebase exploration
-2. **Planning** — Task decomposition, architecture review, user approval
-3. **Dev** — TDD cycle: test -> code -> build
-4. **Review** — Deterministic gates + CLI-aware parallel review + Opus triage.
+0. **Init** - Project setup, worktree, branch creation, identity binding
+1. **Analysis** - Stack detection, codebase exploration
+2. **Planning** - Task decomposition, architecture review, user approval
+3. **Dev** - TDD cycle: test -> code -> build
+4. **Review** - Deterministic gates + CLI-aware parallel review + Opus triage.
    Copilot CLI dispatches **3 reviewers in parallel**: GPT-5.4 (edge cases +
    cross-provider diversity) + Opus (security + architecture) + Sonnet (quality +
    correctness). Findings flow into an Opus triage pass that filters false-positives
    and out-of-scope items before looping back to Phase 3. Claude Code drops GPT-5.4
-   (not natively reachable there) and runs a 2-model set — this is the only
+   (not natively reachable there) and runs a 2-model set - this is the only
    intentional cross-CLI asymmetry for Phase 4.
-5. **Test** — Optional manual testing + on-demand device audits
-6. **Commit** — Secret scan · commit · push · PR creation
-7. **Report** — Jira comment · Wiki + Figma screenshots · Confluence · log · knowledge + memory
+5. **Test** - Optional manual testing + on-demand device audits
+6. **Commit** - Secret scan · commit · push · PR creation
+7. **Report** - Jira comment · Wiki + Figma screenshots · Confluence · log · knowledge + memory
 
 ## Modes
 
@@ -29,21 +29,21 @@
 - **Fast (multi-agent-dev)**: Init -> Dev(Opus) -> Commit -> Report
 - **Autopilot (multi-agent-autopilot)**: Skip confirmations, auto commit/PR
 - **Fastest (multi-agent-dev-autopilot)**: Combine dev + autopilot
-- **Local (multi-agent-local)**: Full 8 phases on current branch — no worktree
-- **Fast + Local (multi-agent-dev-local)**: Dev on current branch — no worktree
+- **Local (multi-agent-local)**: Full 8 phases on current branch - no worktree
+- **Fast + Local (multi-agent-dev-local)**: Dev on current branch - no worktree
 - **Fastest + Local (multi-agent-dev-local-autopilot)**: Dev + autopilot, no worktree
 
 ## Prompt Language (en/tr)
 
 The pipeline honors `prefs.global.promptLanguage` (set via `/multi-agent:setup` or
 `/multi-agent:language en|tr`). This controls the language of **interactive prompts
-only** — e.g. the Phase 6 pre-commit local-checkout test prompt, Plan Approval Gate
+only** - e.g. the Phase 6 pre-commit local-checkout test prompt, Plan Approval Gate
 questions, multi-repo branch picker labels, and phase-banner.sh banners (when
 PHASE_LANG env is unset, it auto-reads prefs).
 
 Default: `en`. Supported: `en`, `tr`. Commit messages, PR bodies, Jira comments,
 and any external-facing payload **always stay in English** regardless of this
-setting — only the user-facing prompts change.
+setting - only the user-facing prompts change.
 
 When writing TR prompts, use the same keyword/menu numbers as EN (e.g. `[1-4]`)
 so the user's input pattern stays language-agnostic.
@@ -51,7 +51,7 @@ so the user's input pattern stays language-agnostic.
 ## Sub-Agent Personas
 
 Phase 1 (Analysis) and Phase 4 (Review) dispatch sub-agents for parallel exploration
-and review. The persona prompts live at `~/.copilot/agents/*.md` — installed by the
+and review. The persona prompts live at `~/.copilot/agents/*.md` - installed by the
 pipeline installer alongside the Claude Code equivalents at `~/.claude/agents/`.
 
 | Agent | File | Used in |
@@ -63,37 +63,37 @@ pipeline installer alongside the Claude Code equivalents at `~/.claude/agents/`.
 | Backend Architect | `~/.copilot/agents/backend-architect.md` | Phase 4 API/backend review |
 | Security Auditor | `~/.copilot/agents/security-auditor.md` | Phase 4 security audit (OWASP-based) |
 
-Load the matching persona file before dispatching each reviewer — the prompt defines
+Load the matching persona file before dispatching each reviewer - the prompt defines
 the model's focus area, severity rubric, and output format the triage pass expects.
 
-## Phase 0 — Interactive Steps (required)
+## Phase 0 - Interactive Steps (required)
 
 The orchestrator skill (`multi-agent/SKILL.md`) shows a condensed Phase 0 for brevity,
 but the actual contract is **8 interactive steps** from `refs/phases/phase-0-init.md`.
 Copilot CLI has no slash-command infrastructure to auto-route through the full ref file,
 so execute ALL of these explicitly before touching code:
 
-1. **Bootstrap tracker** — `bash ~/.copilot/scripts/phase-tracker.sh init 8` (once, before Step 0)
-2. **Load prefs** — read `~/.claude/multi-agent-preferences.json`; warn + stop if setup never ran
-3. **Parse input** — classify (Jira ID, GitHub URL, free-text) + fetch issue via `gh` / Jira API
-4. **Select project(s) — single OR multi-repo** — scan `$HOME`, present numbered list,
+1. **Bootstrap tracker** - `bash ~/.copilot/scripts/phase-tracker.sh init 8` (once, before Step 0)
+2. **Load prefs** - read `~/.claude/multi-agent-preferences.json`; warn + stop if setup never ran
+3. **Parse input** - classify (Jira ID, GitHub URL, free-text) + fetch issue via `gh` / Jira API
+4. **Select project(s) - single OR multi-repo** - scan `$HOME`, present numbered list,
    honor `global.recentProjects`. Picker accepts space-separated numbers (`1 3 4`) for
    multi-select. Surface `global.recentGroups` at top of list. Component/refactor tasks
    commonly span repos (component repo + consumer app). **Never auto-pick one repo when
-   the task could touch more than one** — ask user to confirm single vs multi.
-5. **Pick base branch — PER REPO** — REQUIRED INTERACTIVE STEP. Single repo: run
+   the task could touch more than one** - ask user to confirm single vs multi.
+5. **Pick base branch - PER REPO** - REQUIRED INTERACTIVE STEP. Single repo: run
    `git ls-remote --heads origin` on that repo, present sorted list (develop* / release/*
    / main/master first), suggest top of `global.recentBranches[{projectKey}]`.
-   **Multiple repos selected: fire the branch picker SEPARATELY for each repo** —
+   **Multiple repos selected: fire the branch picker SEPARATELY for each repo** -
    per phase-0-init.md the prompt fires per-repo, because different repos often have
    different base branches (e.g. component repo on `iteration/develop`, consumer app on
    `develop`). Skip the picker ONLY if user's input explicitly specified a branch.
-6. **Branch name confirm** — `feature/PROJ-{id}-{kebab}` or `bugfix/...`. In multi-repo
+6. **Branch name confirm** - `feature/PROJ-{id}-{kebab}` or `bugfix/...`. In multi-repo
    mode, branch name is shared across all selected repos (collision check per-repo;
    any collision applies the suffix to all, keeping cross-repo uniformity).
-7. **Git identity — per repo** — route via `prefs.global.platformIdentityRouting`;
+7. **Git identity - per repo** - route via `prefs.global.platformIdentityRouting`;
    resolves independently for each repo in multi-repo mode.
-8. **Workspace creation — serially per repo** — detect `.instructions/figma/` etc.;
+8. **Workspace creation - serially per repo** - detect `.instructions/figma/` etc.;
    in multi-repo mode loop worktree creation per repo serially; any failure rolls back
    previously-created worktrees (no partial state). Write `agent-state.json` with
    `state.projects[]` array; scalar `project`/`projectRoot`/`branch` mirror `projects[0]`
@@ -104,19 +104,19 @@ https://github.com/mmerterden/multi-agent-pipeline/blob/main/pipeline/multi-agen
 or, on machines with Claude Code also installed:
 `~/.claude/multi-agent-refs/phases/phase-0-init.md`
 
-## Progress Tracking — required
+## Progress Tracking - required
 
 Every phase boundary MUST call the cross-CLI tracker. The tracker is the single source of truth
 for user-visible phase progress on Copilot CLI (no TaskCreate native UI here). Banner is optional flair.
 
 ```bash
-# Bootstrap once at Phase 0 start — initialize all 8 phase tiles:
+# Bootstrap once at Phase 0 start - initialize all 8 phase tiles:
 bash ~/.copilot/scripts/phase-tracker.sh init "$TASK_ID"
 for p in 0:Init 1:Analysis 2:Planning 3:Dev 4:Review 5:Test 6:Commit 7:Report; do
   bash ~/.copilot/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
 done
 
-# At each phase boundary — update status. Tracker stamps started_at on first
+# At each phase boundary - update status. Tracker stamps started_at on first
 # transition to in_progress, completed_at on terminal status (completed/failed/skipped).
 # Render now shows a 16-char ASCII progress bar + elapsed time + per-phase token
 # usage + Total footer (v5.5.0):
@@ -128,16 +128,16 @@ bash ~/.copilot/scripts/phase-tracker.sh update <N> completed    # or failed / s
 # After every LLM dispatch, record its token cost against the active phase (v5.5.0):
 bash ~/.copilot/scripts/phase-tracker.sh tokens <N> <input_tokens> <output_tokens>
 
-# v8.3+ — single-call-site token forwarder (preferred). Mirrors tokens_in/out/model
+# v8.3+ - single-call-site token forwarder (preferred). Mirrors tokens_in/out/model
 # into both metrics.jsonl AND the phase tracker, so the agent-log Cost Breakdown
 # stays in sync without two calls. Best-effort.
 LOG_METRIC_FORWARD_TO_TRACKER=1 bash ~/.copilot/scripts/log-metric.sh "$TASK_ID" <N> <event> \
   model=<opus|sonnet|haiku|gpt-5.4> tokens_in=$IN tokens_out=$OUT duration_ms=$DUR
 
-# v8.3+ — phase model tag (used by render-agent-log-cost.sh):
+# v8.3+ - phase model tag (used by render-agent-log-cost.sh):
 bash ~/.copilot/scripts/phase-tracker.sh model <N> <opus|sonnet|haiku|gpt-5.4>
 
-# Phase 7 sub-step enforcement (v5.4.1) — register all 5 steps up front so
+# Phase 7 sub-step enforcement (v5.4.1) - register all 5 steps up front so
 # wiki/confluence skips are VISIBLE, not silent. User reported prior silent-skip
 # behaviour losing visibility of component wiki generation:
 bash ~/.copilot/scripts/phase-tracker.sh update 7 in_progress
@@ -145,7 +145,7 @@ for s in 1:Jira-Comment 2:Wiki+Figma 3:Confluence 4:Log+Telemetry 5:Knowledge+Me
   bash ~/.copilot/scripts/phase-tracker.sh sub 7 "${s%%:*}" "${s#*:}" pending
 done
 
-# Optional single-event banner for extra emphasis (phase 0–7, `end` status: done|failed|skipped):
+# Optional single-event banner for extra emphasis (phase 0-7, `end` status: done|failed|skipped):
 bash ~/.copilot/scripts/phase-banner.sh start <N> "<name>" "<one-line detail>"
 bash ~/.copilot/scripts/phase-banner.sh end   <N> done "<name>" "<short result>"
 bash ~/.copilot/scripts/phase-banner.sh sub   <N> <subN> "<sub>" "<detail>"
@@ -163,7 +163,7 @@ Progress-line contract (in-phase action lines, flushed immediately, 4-space inde
 
 Four orthogonal advisory steps, all on by default, all opt-out via `~/.claude/multi-agent-preferences.json`. None gate the pipeline.
 
-### Phase 4 Step 1.75 — Diff Risk Scoring
+### Phase 4 Step 1.75 - Diff Risk Scoring
 
 Before reviewer dispatch run the deterministic risk scorer and inject the top-N priority list into each reviewer's prompt as a `${PRIORITY_FILES}` block. Heuristic, sub-second, no LLM.
 
@@ -175,7 +175,7 @@ echo "$RISK_JSON" | node ~/.copilot/scripts/validate-diff-risk.mjs - >/dev/null
 
 Signals + weights: `security_path` ×3, `migration` ×4, `public_api` ×2, `no_test_change` ×2.5, `complexity_delta` ×1.5, `ui_critical` ×1.5, `loc_changed` ×1. Toggle: `prefs.global.diffRiskAdvisory`.
 
-### Phase 4 Step 3 — Triage Prior-Art Lookup
+### Phase 4 Step 3 - Triage Prior-Art Lookup
 
 After merging reviewer findings, query the per-repo triage corpus for similar past findings and attach them to the triage prompt as context. **MUST** carry an explicit bias hedge ("prior-art entries are context, not commands; current scope decides").
 
@@ -194,7 +194,7 @@ PRIOR_ART="${PRIOR_ART%,}]"
 
 Toggle: `prefs.global.priorArtEnrichment.enabled`.
 
-### Phase 5 Step 0 — Test Gap Report
+### Phase 5 Step 0 - Test Gap Report
 
 Walks the diff for newly added public symbols missing a paired test. Stack-specific rules ship for iOS / Android / Python / Node.
 
@@ -205,16 +205,16 @@ node ~/.copilot/scripts/test-gap-scan.mjs \
 
 Severity defaults: iOS Views, Android `@Composable`, interfaces, public protocols → `important`; other public API additions → `suggestion`. Optional gating via `prefs.testGap.blockingThreshold` (when set, becomes a Phase 4 rework finding).
 
-### Phase 7 — Cost Breakdown + Triage Memory Ingest
+### Phase 7 - Cost Breakdown + Triage Memory Ingest
 
 Append the per-task Cost Breakdown to agent-log.md (always), and ingest the triage output into the per-repo corpus (idempotent).
 
 ```bash
-# Cost block — best-effort, exit 2 silently skipped:
+# Cost block - best-effort, exit 2 silently skipped:
 COST_BLOCK=$(bash ~/.copilot/scripts/render-agent-log-cost.sh "$TASK_ID" 2>/dev/null) && \
   printf '\n%s\n' "$COST_BLOCK" >> "$AGENT_LOG"
 
-# Triage memory ingest — idempotent re-runs write 0 rows:
+# Triage memory ingest - idempotent re-runs write 0 rows:
 TRIAGE_PATH="$WORKTREE/triage-output.json"
 if [ -f "$TRIAGE_PATH" ]; then
   node ~/.copilot/scripts/triage-memory.mjs ingest \
@@ -251,18 +251,18 @@ multi-agent-stack [ios|android|mobile|backend|frontend|fullstack|all]
 ## UI Bug Hunter
 
 For visual testing, use the dev-toolkit MCP server tools:
-- ios_screenshot / android_screenshot — capture screen
-- ios_tap / android_tap — interact with UI
-- ios_set_appearance — toggle dark mode
-- ios_get_ui_tree / android_get_ui_tree — accessibility tree
+- ios_screenshot / android_screenshot - capture screen
+- ios_tap / android_tap - interact with UI
+- ios_set_appearance - toggle dark mode
+- ios_get_ui_tree / android_get_ui_tree - accessibility tree
 
 Requires: @mmerterden/dev-toolkit-mcp MCP server running
 
-## Post-Development Integration Build (Multi-Repo) — required
+## Post-Development Integration Build (Multi-Repo) - required
 
 When a task touches multiple repositories that have a producer→consumer dependency
 (e.g. shared codegen library + consuming UI library), the pipeline MUST build the
-**host project** that integrates them after all changes are complete — before commit/PR.
+**host project** that integrates them after all changes are complete - before commit/PR.
 
 ### When this applies
 
@@ -270,12 +270,12 @@ When a task touches multiple repositories that have a producer→consumer depend
 - Repo B is consumed as a submodule or SPM/Gradle dependency by a host project (Repo C)
 - Changes in Repo A or B can silently break Repo C if key structures diverge (e.g. nested enum vs flat access pattern)
 
-### Required steps (Phase 6 · Step 0 — before pre-commit checkout)
+### Required steps (Phase 6 · Step 0 - before pre-commit checkout)
 
-1. **Identify the host project** — check `prefs.global.multiRepoIntegrationHosts` for a matching `repoSet` combo. If no match, ASK the user once (record the answer to skip re-asking); autopilot refuses to prompt, skips visibly.
-2. **Update submodules** — refresh each listed submodule path inside `hostPath` to pick up this task's feature branch / merged commits.
-3. **Resolve package dependencies** — flush stale SPM/Gradle/CocoaPods cache.
-4. **Build the host scheme/module** — capture error lines from stderr.
+1. **Identify the host project** - check `prefs.global.multiRepoIntegrationHosts` for a matching `repoSet` combo. If no match, ASK the user once (record the answer to skip re-asking); autopilot refuses to prompt, skips visibly.
+2. **Update submodules** - refresh each listed submodule path inside `hostPath` to pick up this task's feature branch / merged commits.
+3. **Resolve package dependencies** - flush stale SPM/Gradle/CocoaPods cache.
+4. **Build the host scheme/module** - capture error lines from stderr.
 5. **Evaluate**:
    - Zero new errors → sub-step `completed`, proceed to commit/PR.
    - New errors from our changes → sub-step `failed`, STOP. Offer: return to Phase 3 for auto-fix / pause for manual fix / override with warning.
@@ -286,12 +286,12 @@ When a task touches multiple repositories that have a producer→consumer depend
 Codegen mismatches only surface when the full dependency chain builds together. Building repos in
 isolation gives false confidence. Skipping this step has caused post-merge build failures that required
 additional fix PRs and wasted review cycles. The pipeline **learns** each combo's host project on first
-encounter and auto-applies on subsequent runs — no repeated configuration.
+encounter and auto-applies on subsequent runs - no repeated configuration.
 
 ### Tracker integration
 
 ```bash
-# Phase 6 entry — if multi-repo, register the integration-build sub-step:
+# Phase 6 entry - if multi-repo, register the integration-build sub-step:
 if [ "$(jq '.projects | length' "$STATE_FILE")" -ge 2 ]; then
   bash ~/.copilot/scripts/phase-tracker.sh sub 6 0 "Integration build" in_progress
   # ... run the build per refs/multi-repo-integration-build.md ...
@@ -305,7 +305,7 @@ Full contract: `~/.copilot/skills/multi-agent/refs/multi-repo-integration-build.
 ## Permissions Expectation
 
 Copilot CLI reads `~/.copilot/permissions-config.json` for its allowlist. The pipeline
-regularly uses these command groups — ensure they are present in `tools.allow` to avoid
+regularly uses these command groups - ensure they are present in `tools.allow` to avoid
 prompt fatigue during long pipeline runs:
 
 - Shell basics: `cd`, `ls`, `cat`, `grep`, `find`, `mkdir`, `rm`, `mv`, `cp`
@@ -316,4 +316,4 @@ prompt fatigue during long pipeline runs:
 - Pipeline scripts: `bash` (invokes phase-tracker.sh, phase-banner.sh, etc.)
 
 Destructive commands (`rm -rf /`, `git push --force` to main, `chmod 777`) remain in `deny`
-or `ask` by design — do not broaden these.
+or `ask` by design - do not broaden these.

package/install.js

@@ -6,7 +6,7 @@
  * v8.0.0 split the monolithic 1246-LOC installer into focused modules under
  * `install/`. This file remains as the entry point npm exposes via the
  * `multi-agent-pipeline` bin and the `./install` package export, so existing
- * `node install.js …` and `npx multi-agent-pipeline install …` invocations
+ * `node install.js ...` and `npx multi-agent-pipeline install ...` invocations
  * continue to work without API changes.
  *
  * @module multi-agent-pipeline/install

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "12.5.0",
+  "version": "12.7.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code and Copilot CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -14,16 +14,17 @@
   },
   "scripts": {
     "start": "node index.js",
-    "test": "node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/validate-schemas.mjs",
+    "test": "node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-mcp-refs.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/validate-schemas.mjs && node pipeline/scripts/validate-prefs.mjs && node pipeline/scripts/scorecard.mjs",
     "test:unit": "node --test test/*.test.mjs",
     "test:smoke": "node pipeline/scripts/run-smokes.mjs",
     "lint:skills": "node pipeline/scripts/lint-skills.mjs",
-    "test:quick": "node --test test/*.test.mjs && node pipeline/scripts/lint-skills.mjs",
-    "test:coverage": "c8 --check-coverage --reporter=text --reporter=lcov node --test test/*.test.mjs && c8 report",
+    "test:quick": "node --test test/*.test.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-mcp-refs.mjs",
+    "test:coverage": "c8 --clean --reporter=none node --test test/*.test.mjs && c8 --clean=false --check-coverage --reporter=text --reporter=lcov node pipeline/scripts/run-smokes.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "format": "prettier --write \"**/*.{js,mjs,json,md,yml}\" --ignore-path .gitignore",
-    "format:check": "prettier --check \"**/*.{js,mjs,json,md,yml}\" --ignore-path .gitignore"
+    "format": "prettier --write \"**/*.{js,mjs,json,yml}\" --ignore-path .gitignore",
+    "format:check": "prettier --check \"**/*.{js,mjs,json,yml}\" --ignore-path .gitignore",
+    "scorecard": "node pipeline/scripts/scorecard.mjs"
   },
   "keywords": [
     "multi-agent",
@@ -51,14 +52,14 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/mmerterden/multi-agent-pipeline.git"
+    "url": "git+https://github.com/mmerterden/multi-agent-pipeline.git"
   },
   "homepage": "https://github.com/mmerterden/multi-agent-pipeline#readme",
   "bugs": {
     "url": "https://github.com/mmerterden/multi-agent-pipeline/issues"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.11.0"
   },
   "files": [
     "index.js",
@@ -72,6 +73,7 @@
     "LICENSE",
     "!pipeline/scripts/smoke-figma-config-schema.sh",
     "!pipeline/scripts/smoke-personal-data.sh",
+    "!pipeline/scripts/validate-prefs.mjs",
     "!pipeline/scripts/smoke-install-leak-gate.sh",
     "!docs/internal/**"
   ],
@@ -79,9 +81,11 @@
     "@eslint/js": "^10.0.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "c8": "^11.0.0",
-    "eslint": "^10.2.0",
+    "c8": "^12.0.0",
+    "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.8.2"
+    "eslint-plugin-n": "^18.2.2",
+    "prettier": "^3.9.6",
+    "publint": "0.3.22"
   }
 }

package/pipeline/agents/security-auditor.md

@@ -85,7 +85,7 @@ Example: new `MANAGE_EXTERNAL_STORAGE` permission → `(google-play-compliance /
 
 The two SKILL.md files contain tabular rule catalogs:
 
-- **apple-archive-compliance**  -  17 rules (privacy-manifest, required-reason-api, info-plist, code-signing, embedded-sdk, entitlement, asset-validation, binary-size, team-id-consistency, provisioning-profile, swift-abi, extension-signing, ipv6-compliance, debug-tool-leak, production-hygiene, duplicate-resource, dead-reference) with ITMS codes + App Store Review Guideline refs.
+- **apple-archive-compliance**  -  18 rules (privacy-manifest, required-reason-api, info-plist, code-signing, embedded-sdk, entitlement, asset-validation, binary-size, team-id-consistency, provisioning-profile, swift-abi, extension-signing, ipv6-compliance, debug-tool-leak, production-hygiene, duplicate-resource, dead-reference, sdk-floor) with ITMS codes + App Store Review Guideline refs.
 - **google-play-compliance**  -  21 rules across Technical / Security / Privacy / Hygiene categories with Play policy refs.
 
 Cite rule + ref in your Output Format's `Category:` line so the code-reviewer and triage layers inherit the reference text unchanged.

package/pipeline/commands/archive-guard.md

@@ -1,14 +1,14 @@
 ---
-description: Scan an .xcarchive for Apple App Store Review compliance (17-rule deep audit)
+description: Scan an .xcarchive for Apple App Store Review compliance (18-rule deep audit)
 allowed-tools: Bash, Read, Glob
 ---
 
-Run the `ios_app_store_audit` MCP tool (shipped in `@mmerterden/dev-toolkit-mcp` ≥ v2.4)
-on an iOS archive. Backed by the same 17-rule catalog as `/multi-agent:test "store-ready"`
+Run the `ios_app_store_audit` MCP tool (shipped in `@mmerterden/dev-toolkit-mcp` ≥ v2.9.0)
+on an iOS archive. Backed by the same 18-rule catalog as `/multi-agent:test "store-ready"`
  -  this command is the lighter, post-hoc form (no platform-detect, no UI sweep).
 
 > **v8.4.0 migration note:** The standalone `~/ArchiveGuard/.build/release/archive-guard`
-> binary has been retired. The 17 rules live in
+> binary has been retired. The 18 rules live in
 > `dev-toolkit-mcp/tools/ios-app-store-audit/rules/` as a pure-Node port. Output JSON
 > shape is unchanged.
 
@@ -21,7 +21,7 @@ on an iOS archive. Backed by the same 17-rule catalog as `/multi-agent:test "sto
 2. Ask user which archive to scan (or use the argument if provided: $ARGUMENTS).
 3. Run the scan  -  preferred mode is the native MCP tool call:
    ```
-   mcp__dev_toolkit__ios_app_store_audit({
+   mcp__dev-toolkit__ios_app_store_audit({
      archive_path: "<archive_path>",
      rules: "all"          // "all" | "core" | "deep" | csv of ruleIDs
    })

package/pipeline/commands/multi-agent/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Task orchestrator  -  full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Fable triage (CLI-aware: 2-model on Claude Code, 3-model on Copilot CLI), commit, log"
+description: "Task orchestrator  -  full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Fable triage (CLI-aware: 2-model on Claude Code, 3-model on Copilot CLI), commit, log. Use when given a Jira ID, a GitHub issue or a free-text task and the whole pipeline should run."
 description-tr: "Görev orkestratörü - Jira ID + branch veya GitHub Issue URL ile tam pipeline: analiz, plan, TDD geliştirme, paralel review + Fable triyajı (CLI'ya göre: Claude Code'da 2, Copilot CLI'da 3 model), commit, log"
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, TaskList, TaskGet, AskUserQuestion, WebFetch, WebSearch, NotebookEdit, Skill
 ---
@@ -83,6 +83,7 @@ Lib scripts (`~/.claude/lib/`):
 | `create-jira ["desc"] [figma-url] [swagger-url]` | Create a standards-compliant Jira issue: asks the type (**Task** / **Bug** / **Story**), mines the project's recent same-type issues for conventions (summary format, labels, priority, test-scenario style), detects the active sprint, drafts from a standard template with auto-sizing sections (Design Reference / API Contract / Screenshots appear only when their source is given), asks about unknown fields, then full draft preview + explicit approval before create. No worktree, no commits. |
 | `test` or `test [args]` | UI Bug Hunter  -  screenshot + tap + analyze on booted simulator via MCP (read `$HOME/.claude/commands/sim-test.md`). `/multi-agent:test` also resolves here via the `commands/multi-agent/test/SKILL.md` delegate. |
 | `manual-test [#id]` | Phase 5 standalone Manual Test  -  checks out the task branch, prints Xcode / SourceTree hints, waits for user verdict (`ok` / `fix: ...`). |
+| `design-check [scope]` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module → mock-support feasibility gate (halts if unsupported) → **scenario inventory** (every launch arg / scenario case / scenario code / fixture / deep link becomes a countable target with file+line evidence) → scope resolve (empty = module, screen, `screen@variant`, target id, Figma URLs, `--resume`) → worktree Debug build + mock launch → drive EACH target by its own driver, capturing tap-reachable sub-states with it → per-variant pixel + px-spacing + typography + color compare → report (side-by-side + annotated overlay + stacked findings + fix prompt) exported to `~/DesignChecks/` as HTML + PDF (+ Confluence if enabled). **Coverage gate**: a target is audited or skipped with a concrete reason, else the run is reported INCOMPLETE with the missing ids. No commits, no CI. |
 | `stack [ios\|android\|backend\|mobile\|all]` | Swap skills for next conversation. No arg = show current stack. |
 | `language [en\|tr]` | Show or set the assistant `outputLanguage` (explanations and chat replies). `promptLanguage` is locked to `en` and is not toggleable. No arg = show current `outputLanguage`. With `en` or `tr` = set and persist `outputLanguage`. External payloads (commits, PR bodies, Jira) stay English. |
 | `setup` | Keychain token + Git Identity onboarding |
@@ -134,6 +135,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | Audit tools (Phase 5/6) | `$HOME/.claude/multi-agent-refs/audit-guide.md` |
 | `test` | `$HOME/.claude/commands/sim-test.md` (colon-form `/multi-agent:test` uses the delegate at `commands/multi-agent/test/SKILL.md`) |
 | `manual-test` | `$HOME/.claude/commands/multi-agent/manual-test/SKILL.md` |
+| `design-check` | `$HOME/.claude/commands/multi-agent/design-check/SKILL.md` |
 
 **Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `clear-logs`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
 

package/pipeline/commands/multi-agent/analysis/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Standalone feature-spec analysis. Platform-agnostic concept layer with repo-driven convention extraction (Phase 1c) and per-platform Pass B render. 23 main sections + 3 footer in Full mode; 7 sections in Lite mode (auto for small features). Collects Figma / Swagger / Confluence / Jira / Standards (Confluence + Wiki + local file) / Firebase / repo inputs. Stops after emit - does not chain into /multi-agent:dev."
+description: "Standalone feature-spec analysis. Platform-agnostic concept layer with repo-driven convention extraction (Phase 1c) and per-platform Pass B render. 23 main sections + 3 footer in Full mode; 7 sections in Lite mode (auto for small features). Collects Figma / Swagger / Confluence / Jira / Standards (Confluence + Wiki + local file) / Firebase / repo inputs. Stops after emit - does not chain into /multi-agent:dev. Use when a feature needs a written specification before any code, from Figma, Swagger, Confluence, Jira or repo inputs."
 description-tr: "Bağımsız özellik-spesifikasyonu analizi. Repo'dan konvansiyon çıkarımıyla (Faz 1c) platform-bağımsız kavram katmanı ve platform başına Pass B render. Full modda 23 ana + 3 dipnot bölümü; Lite modda 7 bölüm (küçük işlerde otomatik). Figma / Swagger / Confluence / Jira / Standartlar (Confluence + Wiki + yerel dosya) / Firebase / repo girdilerini toplar. Çıktıyı üretince durur - /multi-agent:dev'e zincirlenmez."
 argument-hint: "[\"<analysis-name>\"] [--lite | --full] [--no-cache] [--preview-conventions]"
 ---

package/pipeline/commands/multi-agent/analysis-resolve/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Resolve the Section 20 Risks and Open Questions of an analysis v3 document one row at a time. Proposes up to 3 source-labeled answer candidates per row (from evidence / from repo / AI reasoned), merges the chosen answer into the target body section, and updates the doc in place with a Section 23 changelog bump. Companion to /multi-agent:analysis - same Locked decisions apply (citation discipline, humanizer punctuation, no MCP, no auto-commit). Optional sibling propagation for per-platform file sets."
+description: "Resolve the Section 20 Risks and Open Questions of an analysis v3 document one row at a time. Proposes up to 3 source-labeled answer candidates per row (from evidence / from repo / AI reasoned), merges the chosen answer into the target body section, and updates the doc in place with a Section 23 changelog bump. Companion to /multi-agent:analysis - same Locked decisions apply (citation discipline, humanizer punctuation, no MCP, no auto-commit). Optional sibling propagation for per-platform file sets. Use when an analysis document's open questions and risks need answering row by row before development starts."
 description-tr: "Analiz v3 dokümanının Bölüm 20 Riskler ve Açık Sorular satırlarını tek tek çözer. Satır başına en fazla 3 kaynak-etiketli cevap adayı önerir (kanıttan / repodan / AI çıkarımı), seçilen cevabı ilgili gövde bölümüne işler ve dokümanı Bölüm 23 changelog artışıyla yerinde günceller. /multi-agent:analysis'in eşlikçisi - aynı Kilitli kararlar geçerli (alıntı disiplini, humanizer noktalama, MCP yok, otomatik commit yok). Platform bazlı dosya setleri için isteğe bağlı kardeş yayılımı."
 argument-hint: "[path/to/analysis/<feature>-<platform>.md] [--autonomous]"
 ---

package/pipeline/commands/multi-agent/autopilot/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Launch any task in autopilot mode: skips every confirmation, runs end-to-end autonomously."
+description: "Launch any task in autopilot mode: skips every confirmation, runs end-to-end autonomously. Use when a task should run end to end with no confirmation prompts."
 description-tr: "Herhangi bir görevi autopilot modunda başlatır: tüm onayları atlar, uçtan uca otonom çalışır."
 argument-hint: '"task"  -  issue URL, Jira ID, free-text, or #id (for resume)'
 ---

package/pipeline/commands/multi-agent/build-optimize/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Thin wrapper that dispatches to xcode-build-orchestrator on iOS projects. Benchmarks current Xcode build, runs compilation / project / SPM analyzers, produces a recommend-first optimization plan, and re-benchmarks after the developer approves changes."
+description: "Thin wrapper that dispatches to xcode-build-orchestrator on iOS projects. Benchmarks current Xcode build, runs compilation / project / SPM analyzers, produces a recommend-first optimization plan, and re-benchmarks after the developer approves changes. Use when an iOS build is slow and needs measuring before anything is changed."
 description-tr: "iOS projelerinde xcode-build-orchestrator'a delege eden ince sarmalayıcı. Mevcut Xcode build'ini ölçer, derleme / proje / SPM analizlerini koşar, önce-öneri yaklaşımlı bir optimizasyon planı üretir ve geliştirici onayından sonra yeniden ölçer."
 argument-hint: "(none - operates on current repo)"
 ---

package/pipeline/commands/multi-agent/create-jira/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with auto-sizing sections, full preview + explicit approval before create."
+description: "Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with auto-sizing sections, full preview + explicit approval before create. Use when a Jira Task, Bug or Story has to be written to the project's own conventions."
 description-tr: "Standartlara uygun Jira issue oluşturur (Task / Bug / Story): türü sorar, proje konvansiyonlarını çıkarır, otomatik boyutlanan bölümlerle standart şablondan taslak hazırlar, oluşturmadan önce tam önizleme + açık onay alır."
 argument-hint: "[\"<free-text description>\"] [figma-url] [swagger-url]  -  all optional, asked interactively when missing"
 ---