@mmerterden/multi-agent-pipeline 12.6.0 → 12.8.0

package/pipeline/lib/issue-fetcher.sh

@@ -34,7 +34,7 @@
 #   ACCOUNT_DEFAULT_REPO      fallback GitHub repo  (optional)
 #   PROMPT_LANG               tr|en  -  controls maturity.summary language (default: tr)
 
-set -eu
+set -euo pipefail
 
 INPUT="${1:-}"
 [ -z "$INPUT" ] && { echo '{"error":"input required"}'; exit 1; }

package/pipeline/lib/multi-repo-pipeline.sh

@@ -28,7 +28,7 @@
 # `bridge` writes agent-state.json v2.1.0 with projects[] populated  -  Phase 0
 # consumes this and skips its own picker steps.
 
-set -eu
+set -euo pipefail
 
 CMD="${1:-}"
 STATE="${2:-}"

package/pipeline/lib/repo-cache.sh

@@ -25,7 +25,7 @@
 #                LOCAL_SCAN_ROOTS env can override the default root list.
 #                LOCAL_SCAN_MAXDEPTH env (default 4) bounds traversal cost.
 
-set -eu
+set -euo pipefail
 
 PROVIDER="${1:-}"
 SCOPE="${2:-}"

package/pipeline/lib/submodule-detector.sh

@@ -24,7 +24,7 @@
 #   ]
 #
 
-set -eu
+set -euo pipefail
 
 MODE="local"
 TARGET="${1:-}"

package/pipeline/multi-agent-refs/_account-picker.md

@@ -14,7 +14,7 @@ First step of every `multi-agent` flow **that touches a remote provider**.
 > repos, account-picker is bypassed and the state file's `accountId` is left
 > `null` with `tokens={}`. Phases 6/7 read these as "local-only" signals.
 
-> **Language**: Per `$HOME/.claude/multi-agent-refs/rules.md` Language Application matrix  -  `AskUserQuestion.label` and `header` stay English (UI button + chip contract); `question` and `description` follow `outputLanguage`. Commit/PR/Jira payloads: subject + branch names + code identifiers stay English; body text follows `outputLanguage`.
+> **Language**: see `picker-contract.md` + `rules.md` Language Application matrix.
 
 ## Steps
 

package/pipeline/multi-agent-refs/_dev-context.md

@@ -6,7 +6,7 @@ description: "Internal  -  dev context (extra repos) picker for multi-agent."
 
 Selects extra repos the pipeline may touch beyond the primary repo(s)  -  typically submodules (e.g. SDKs vendored inside an app repo) or sibling libraries. Each candidate is enriched with a `canPush` flag so the picker can pre-select repos that the active account is allowed to edit, and surface read-only ones as advisory context the pipeline will not modify.
 
-> **Language**: Per `$HOME/.claude/multi-agent-refs/rules.md` Language Application matrix  -  `AskUserQuestion.label` and `header` stay English (UI button + chip contract); `question` and `description` follow `outputLanguage`. Commit/PR/Jira/Wiki payloads: subject + branch names + code identifiers stay English; body text follows `outputLanguage`.
+> **Language**: see `picker-contract.md` + `rules.md` Language Application matrix.
 
 ## Steps
 

package/pipeline/multi-agent-refs/_repo-picker.md

@@ -6,7 +6,7 @@ description: "Internal  -  multi-select repo picker for multi-agent."
 
 Used by `picker-issue`, `picker-jira`, `gh-num`, and `freetext` flows.
 
-> **Language**: Per `$HOME/.claude/multi-agent-refs/rules.md` Language Application matrix  -  `AskUserQuestion.label` and `header` stay English (UI button + chip contract); `question` and `description` follow `outputLanguage`. Commit/PR/Jira/Wiki payloads: subject + branch names + code identifiers stay English; body text follows `outputLanguage`.
+> **Language**: see `picker-contract.md` + `rules.md` Language Application matrix.
 
 ## Steps
 

package/pipeline/multi-agent-refs/component-dispatch.md

@@ -84,7 +84,7 @@ Phase 4 reviewer-skipping is **not** Phase 3's concern  -  Phase 4 decides based
 
 ## Cross-CLI behaviour (intentional divergence)
 
-Component dispatch is **no longer byte-identical across CLIs** and that is by design (see `cross-cli-contract.md` §1.1):
+Component dispatch is **no longer byte-identical across CLIs** and that is by design (see `cross-cli-contract.md` section 1.1):
 
 - **Claude Code**: dispatches to the enabled `ai-<platform>-engineering-toolkit` marketplace plugin via the Skill tool (this doc).
 - **Copilot CLI**: has no plugin loader; it continues to use its standalone `~/.copilot/skills/figma-*` skill copies (frozen fallback). Copilot's resolution + progress lines follow those local skills.

package/pipeline/multi-agent-refs/component-generation.md

@@ -0,0 +1,121 @@
+# Component Generation Guide (generic)
+
+> Lifted out of `core/multi-agent/SKILL.md`, where it was loaded on every
+> run of every mode. It applies only to a task that generates a UI
+> component from a design, so it now loads when that path is taken.
+> Component dispatch itself is in `component-dispatch.md`.
+
+When the task involves creating a SwiftUI component (any project, not just figma), follow this architecture:
+
+### Component Architecture: Configuration / View / Modifiers
+
+Every component produces up to 5 files:
+
+| File | When | Content |
+|------|------|---------|
+| `{Name}Configuration.swift` | Complex (>3 props) | Pure value type, all declarative properties |
+| `{Name}View.swift` | Always | SwiftUI view, renders Configuration |
+| `{Name}+Modifiers.swift` | Complex | Fluent modifier API chain |
+| `{Name}Preview.swift` | Always | All meaningful variant previews |
+| `{Name}Tests.swift` | Always | ViewInspector + Unit tests |
+
+### Configuration Purity Rule
+
+Configuration structs hold ONLY declarative, value-type properties:
+
+```swift
+// ✅ CORRECT  -  pure value type
+struct ButtonConfiguration {
+    var title: String = ""
+    var style: ButtonStyle = .primary
+    var isEnabled: Bool = true
+    var icon: Image? = nil
+}
+
+// ❌ WRONG  -  these do NOT belong in Configuration
+// Closures → View property
+// @Binding → View property
+// @State → View property
+// AnyView / @ViewBuilder → View generic parameter
+```
+
+### View Implementation
+
+```swift
+struct ButtonView: View {
+    let configuration: ButtonConfiguration
+    private var action: (() -> Void)?  // closure lives in View, not Config
+
+    var body: some View {
+        Button(action: { action?() }) {
+            HStack(spacing: .Spacing.spacing8) {
+                if let icon = configuration.icon { icon }
+                Text(configuration.title)
+                    .typographyStyle(.body1)
+            }
+        }
+        .disabled(!configuration.isEnabled)
+    }
+}
+```
+
+### Modifier Pattern
+
+```swift
+extension ButtonView {
+    func title(_ value: String) -> ButtonView {
+        var config = configuration
+        config.title = value
+        return ButtonView(configuration: config)
+    }
+    func style(_ value: ButtonStyle) -> ButtonView {
+        var config = configuration
+        config.style = value
+        return ButtonView(configuration: config)
+    }
+    func onTap(_ action: @escaping () -> Void) -> ButtonView {
+        var view = self
+        view.action = action
+        return view
+    }
+}
+```
+
+### Simple vs Complex Decision
+
+| Criteria | Simple | Complex |
+|----------|--------|---------|
+| Properties | ≤3 | >3 |
+| Configuration file | No  -  props in View directly | Yes  -  separate struct |
+| +Modifiers file | No | Yes |
+| View file | All-in-one | Renders Configuration |
+
+### 3-Layer Test Strategy
+
+| Layer | Tool | What It Validates |
+|-------|------|-------------------|
+| Structural | ViewInspector | Hierarchy, subview existence, applied modifiers |
+| Visual | Snapshot Tests | Pixel-correct render: light/dark, RTL/LTR |
+| Behavioral | Unit Tests | State changes, closures, configuration mutations |
+
+### Component Checklist (Before Commit)
+
+1. No magic numbers  -  all values are design tokens or named constants
+2. Configuration purity  -  no side-effects or view logic in Config
+3. Modifier correctness  -  fluent API valid, paired modifiers live in the View
+4. Accessibility  -  accessibility label/trait on every interactive element
+5. Preview  -  all meaningful variants in the preview
+6. Test  -  structural + unit tests written
+7. Dark mode  -  renders correctly in both color schemes
+8. Dynamic Type  -  text scales at large sizes without breaking the layout
+
+### When a Figma URL Is Provided
+
+If the user provides a Figma URL:
+1. Fetch the design data with Figma MCP tools (get_design_context, get_screenshot)
+2. Map the design's colors, spacing, and typography onto the project's token system
+3. Apply the Configuration/View/Modifiers pattern above
+4. Use the screenshot as a reference, do not copy it  -  adapt to the project's existing components
+
+---
+

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -50,7 +50,7 @@ Both skills are wired to 4 consumers: `/multi-agent:test "store-ready"` (primary
 
 ### 1.3 Figma-skill routing from multi-agent (superseded)
 
-Superseded by §1.1: Claude Code resolves component dispatch to the marketplace plugin (dual-name `create-component`/`create-ui-component`; full contract in `$HOME/.claude/multi-agent-refs/component-dispatch.md`); Copilot CLI uses its local `~/.copilot/skills/figma-*` copies. No shared filesystem-path routing table or figma-skill frontmatter/inventory parity remains under enforcement.
+Superseded by section 1.1: Claude Code resolves component dispatch to the marketplace plugin (dual-name `create-component`/`create-ui-component`; full contract in `$HOME/.claude/multi-agent-refs/component-dispatch.md`); Copilot CLI uses its local `~/.copilot/skills/figma-*` copies. No shared filesystem-path routing table or figma-skill frontmatter/inventory parity remains under enforcement.
 
 ---
 

package/pipeline/multi-agent-refs/features/model-fallback.md

@@ -9,7 +9,7 @@ without ever editing persona files at runtime.
 
 > **Fable 5 available again (2026-07).** `claude-fable-5` is the top tier once
 > more. Architect (`ios/android/backend-architect`), Reviewer-1 (`code-reviewer`),
-> and triage personas declare `preferredModel: fable` — the deepest-reasoning
+> and triage personas declare `preferredModel: fable` - the deepest-reasoning
 > roles. **If Fable 5 is unavailable, the first fallback is opus (`claude-opus-4-8`).**
 > Security and other `preferredModel: opus` personas keep opus as their top tier.
 > The `premiumTierUntil` date gate stays in the contract as a generic mechanism
@@ -98,6 +98,6 @@ per-phase `model` field already carries the override).
 - No edits to `pipeline/agents/*.md` at runtime; frontmatter is install-time
   configuration only.
 - Copilot CLI reviewer set is out of scope: Copilot CLI pins its own three
-  reviewer models (GPT-5.4 + Opus + Sonnet — Fable 5 is not offered there) and
+  reviewer models (GPT-5.4 + Opus + Sonnet - Fable 5 is not offered there) and
   does not use this persona ladder. Only Claude Code dispatches Reviewer-1 on
   Fable.

package/pipeline/multi-agent-refs/phases/operations.md

@@ -67,6 +67,34 @@ Run phases sequentially. Log every step to `agent-log.md`.
 If any phase fails, mark task as `paused` and stop  -  user can `resume` later.
 Update `agent-state.json` at EVERY phase transition.
 
+### Writing `agent-state.json` (required mechanism)
+
+Every state update goes through `write-state.mjs`. Never write the file with a
+plain read-modify-write (`jq ... > tmp && mv`, an editor tool, `cat >`):
+
+```bash
+# Merge a patch into the current state (the normal case).
+echo '{"currentPhase":4,"phases":{"4":{"status":"running"}}}' \
+  | node $HOME/.claude/scripts/write-state.mjs "$STATE_FILE"
+
+# Full replacement, only when rewriting the document wholesale.
+printf '%s' "$NEW_STATE" | node $HOME/.claude/scripts/write-state.mjs --replace "$STATE_FILE"
+```
+
+Why the indirection is required: multi-repo mode and concurrent worktrees share
+one `agent-state.json` per task id, so two writers using read-then-write lose one
+of the two updates  -  the second write is computed from a snapshot taken before
+the first landed. `write-state.mjs` does tmpfile + rename (atomic on POSIX) under
+an advisory `.lock`, reclaims a lock whose holder PID is dead, and releases the
+lock on every error path.
+
+Exit codes the caller must handle: `0` written, `1` invalid JSON on stdin, `2`
+lock timeout (another writer held it past the acquire window  -  retry once, then
+halt per the halt-visibility rule), `3` I/O error.
+
+Reads need no wrapper; the rename makes any read see either the old or the new
+document, never a truncated one.
+
 **Halt visibility (required, autopilot included).** A halt is never silent. Whenever a phase halts on a hard error (validator failed twice, no subagent returned, dispatch error past fallback, lock irrecoverable), in addition to the `agent-log.md` line: (a) write `state.status = "paused"` and `state.haltReason = "<phase>:<cause>"`; (b) record the cause on the tracker via `phase-tracker.sh meta <phase> halt "<cause>"` and `phase-tracker.sh update <phase> failed`; (c) emit one `>&2` alert line `HALT phase <N>: <cause>  -  resume with /multi-agent:resume #<id>`. Autopilot suppresses *confirmations*, not *halts*  -  the user must always be able to see why an unattended run stopped without reading the log.
 
 ### Pipeline Best Practices

package/pipeline/multi-agent-refs/phases/phase-0-init.md

@@ -487,6 +487,7 @@ done
 
 State file in multi-repo mode:
 - Single shared `agent-state.json` lives at `$HOME/.claude/logs/multi-agent/{first-project}/{task-id}/agent-state.json` (anchored on the first repo for back-compat with `multi-agent log`/`status` commands)
+- **One shared file + per-repo writers is exactly the race `write-state.mjs` exists for.** Every update to it (here and in every later phase) goes through `node $HOME/.claude/scripts/write-state.mjs` per the required mechanism in `operations.md` "Writing `agent-state.json`". A read-modify-write from two repos in the same loop drops one repo's `projects[]` entry.
 - `state.projects[]` holds per-repo `{name, root, worktreePath, branch, baseBranch, identity, platform, baseFetchStatus, commit, pr, pushAttempts, buildStatus}`  -  see `agent-state.schema.json`
 - Scalar fields (`project`, `projectRoot`, `worktreePath`, `branch`, `baseBranch`, `identity`) mirror `projects[0]` so legacy phases that read scalars keep working
 - Atomicity: if any repo's worktree creation fails (collision aborted, fetch aborted, disk full), roll back already-created worktrees: `git -C $proj worktree remove --force $WT_PATH; git -C $proj branch -D $BRANCH`. Never leave a partial multi-repo state.

package/pipeline/multi-agent-refs/phases/phase-2-planning.md

@@ -13,7 +13,7 @@ Phase 2 Planning consumes the analysis document. MCP forbidden.
    - Abort with `ERR: analysis doc missing. Run /multi-agent:analysis "<feature>" first.`
 
 2. **Parse YAML front-matter**: `feature`, `platform`, `language`, `mode`, `evidence_digest`, `template_version`. Persist into `state.analysis.frontMatter`.
-   - **Soft-skip (v9.1.0+, Locked 30)**: when `template_version == v2` AND (`prefs.global.legacyV2AnalysisAllowed == true` OR env `MULTI_AGENT_LEGACY_V2_ANALYSIS=allow`), emit `WARN: legacy v2 analysis doc detected; v3 expected. Continuing in degraded mode.` Step 3 section coverage check skips v3-specific sections (10 Localization, 11 Analytics, 12 Deeplink/Push, 13.6 SwiftUI Preview, 21 References). Phase 4 reviewer flags missing v3 sections rather than blocking. Escape hatch removed in v9.2.0; users must regenerate v3 docs by then.
+   - **`template_version` < `v3` aborts**: `ERR: analysis doc is template v<n>; v3 required. Re-run /multi-agent:analysis to regenerate.` No degraded mode.
 
 3. **Section coverage check**: verify these sections are non-empty (template v3 required sections per Locked 2):
    - Section 1 Summary, Section 2 Goals + Non-Goals, Section 4 User Stories, Section 9 API Contracts, Section 13 Architecture Plan, Section 14 Files to Add, Section 20 Risks, Section 21 References

package/pipeline/multi-agent-refs/phases/phase-3-dev.md

@@ -16,8 +16,7 @@ Pre-flight steps (run in order, abort on failure):
 2. **Parse YAML front-matter** (the doc has a `template_version: v3` header):
    - `feature`, `platform`, `language`, `mode (full | lite)`, `evidence_digest`
    - Persist into `state.analysis.frontMatter`
-   - **Abort condition (v9.0.x strict)**: `template_version` < `v3` -> exit with `ERR: analysis doc is template v<n>; v9 requires v3. Re-run analysis to regenerate.`
-   - **Soft-skip (v9.1.0+, Locked 30)**: when `prefs.global.legacyV2AnalysisAllowed == true` OR env `MULTI_AGENT_LEGACY_V2_ANALYSIS=allow` is set AND `template_version == v2`, emit `WARN: legacy v2 analysis doc detected; v3 expected. Continuing with reduced binding strength.` and persist `state.dev.legacyAnalysisMode = true`. Step 4 (Code Connect lookup) and Step 6 (conventions handoff) still run, but Step 5 (standards binding) and Pass B footnote enforcement degrade to warning level (Phase 4 reviewer flags missing citations rather than blocking). Escape hatch removed in v9.2.0.
+   - **Abort condition**: `template_version` < `v3` -> exit with `ERR: analysis doc is template v<n>; v3 required. Re-run /multi-agent:analysis to regenerate.` No degraded mode.
 
 3. **Evidence digest match (cache validation)**: if `state.run.lastAnalysisDigest` is present AND matches `frontMatter.evidence_digest`, mark as fresh; otherwise WARN that analysis is stale (continue but flag).
 

package/pipeline/multi-agent-refs/phases/phase-4-review.md

@@ -1,6 +1,6 @@
 ### Phase 4: Review (deterministic gates + parallel + triage)
 
-> **TLDR**  -  Three-stage review. Stage 1: deterministic gates (build + lint + test + secret scan) that MUST pass. Stage 2: AI models in parallel  -  reviewer set is **CLI-aware**: Claude Code dispatches 2 reviewers (Fable + Sonnet); Copilot CLI dispatches 3 reviewers (GPT-5.4 + Opus + Sonnet — Fable 5 is not offered on Copilot CLI). Stage 3: Fable triage (Opus on Copilot CLI)  -  evaluates raw findings, filters false-positives/out-of-scope, keeps only actionable items. Only triage-accepted blocking items loop back to Phase 3.
+> **TLDR**  -  Three-stage review. Stage 1: deterministic gates (build + lint + test + secret scan) that MUST pass. Stage 2: AI models in parallel  -  reviewer set is **CLI-aware**: Claude Code dispatches 2 reviewers (Fable + Sonnet); Copilot CLI dispatches 3 reviewers (GPT-5.4 + Opus + Sonnet - Fable 5 is not offered on Copilot CLI). Stage 3: Fable triage (Opus on Copilot CLI)  -  evaluates raw findings, filters false-positives/out-of-scope, keeps only actionable items. Only triage-accepted blocking items loop back to Phase 3.
 
 <!-- progress-contract: applied -->
 Progress emission per `$HOME/.claude/multi-agent-refs/progress-contract.md`  -  lines for each gate, each reviewer dispatch + finish, triage start, triage verdict, fix dispatch.
@@ -112,11 +112,16 @@ Cost ledger: `phase-4.repo_map_emitted bytes=N budget=B cache_hit=true|false`  -
 
 Before dispatching reviewers, run the deterministic diff risk scorer and inject the top-N files into each reviewer's prompt as a priority hint. **Advisory only  -  never gates the pipeline.** Heuristic, zero LLM, runs in well under a second.
 
+Score the diff **once, in full** (no `--top`): Steps 1.76/1.77 need every scored file (a shrinking test file ranked 20th; whether ANY file is high-stakes). The top-N hint is derived from that report, not a second git walk.
+
 ```bash
-RISK_JSON=$(node pipeline/scripts/diff-risk-score.mjs \
+RISK_FULL=$(node pipeline/scripts/diff-risk-score.mjs \
   --base "$BASE_BRANCH" --head HEAD \
-  --task-id "$TASK_ID" --top 5 2>/dev/null)
-echo "$RISK_JSON" | node pipeline/scripts/validate-diff-risk.mjs - >/dev/null 2>&1 || RISK_JSON=""
+  --task-id "$TASK_ID" 2>/dev/null)
+echo "$RISK_FULL" | node pipeline/scripts/validate-diff-risk.mjs - >/dev/null 2>&1 || RISK_FULL=""
+
+# Priority hint for the reviewer prompts: top 5 of the full report.
+RISK_JSON=$([ -n "$RISK_FULL" ] && jq -c '.files |= (sort_by(-.score) | .[:5])' <<< "$RISK_FULL" || echo "")
 ```
 
 **Signals & weights** (see `pipeline/schemas/diff-risk.schema.json`):
@@ -151,6 +156,35 @@ pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk \
 
 **Opt-out**: `prefs.global.diffRiskAdvisory = false` skips this step entirely (no script invocation, no priority block injection). Default `true` because the cost is bounded and the signal-to-noise has been measured against the golden-task fixture set.
 
+#### Step 1.76  -  Test-integrity gate (produces BLOCKING findings)
+
+Step 1.75 uses `test_lines_removed` as an advisory hint only  -  too weak for what it detects: a suite made green by deleting tests instead of fixing code. This turns the signal into blocking findings triage must adjudicate. Pure function of the full report, no git, no LLM.
+
+```bash
+TEST_INTEGRITY_JSON=$(printf '%s' "$RISK_FULL" | node pipeline/scripts/test-integrity-gate.mjs 2>/dev/null || echo "")
+TI_COUNT=$(jq -r '.count // 0' <<< "${TEST_INTEGRITY_JSON:-{\}}" 2>/dev/null || echo 0)
+[ "$TI_COUNT" -gt 0 ] && pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.test_integrity findings="$TI_COUNT"
+```
+
+`findings[]` are reviewer-shaped (`test_integrity`, `blocking`), so they merge into the reviewer findings at Step 3.0 and need no triage-prompt or `validate-triage.mjs` change. Triage keeps each blocking unless the removal is justified per the immutable-test rule (spec changed AND commit body names the test) → `deferred[]`.
+
+The gate never blocks the phase; it *emits* blocking findings. Empty or unreadable input yields zero findings and the phase continues. Feed it the FULL report  -  `--top` hides a shrinking test file below the cut. **No opt-out**: a run that can switch off its own anti-reward-hacking control cannot be trusted to report a pass.
+
+#### Step 1.77  -  Reviewer scope (cost gate)
+
+On a trivial diff every reviewer agrees and the extra models plus triage are paid for nothing. Reviewer count comes from the same report, no LLM.
+
+```bash
+SCOPE_JSON=$(printf '%s' "$RISK_FULL" | node pipeline/scripts/review-scope.mjs 2>/dev/null \
+  || echo '{"scope":"full","reason":"no risk report - failing safe"}')
+REVIEW_SCOPE=$(jq -r '.scope // "full"' <<< "$SCOPE_JSON")
+pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.scope scope="$REVIEW_SCOPE"
+```
+
+`single` (Reviewer 1 only) requires **all** of: churn <= 20 lines, `totals.max_score` < 3.0, and no `security_path` / `migration` / `public_api` / `no_test_change` / `test_lines_removed` on any file. Anything else → `full`.
+
+Fails safe in one direction only: empty report, parse failure or validator rejection all resolve to `full`, because skipping a reviewer trades coverage for cost. `consensus.reviewerCount` records what actually ran, so a single-reviewer run never reads as cross-model agreement. Opt-out: `prefs.global.reviewScopeGate = false` forces `full`.
+
 #### Step 1.8  -  Figma visual-fidelity context (when task carries a Figma reference)
 
 When `state.evidence.figma[]` is non-empty, the reviewer subagents MUST receive the captured screenshot URLs / paths and the canonical-component name (from `state.evidence.figma[i].screenshotUrl` and `state.evidence.figma[i].codeConnectSnippets[0].componentName` when present) so they can compare visual fidelity. Pass them inline in each reviewer prompt under a `## Figma evidence` block, one row per frame.
@@ -182,6 +216,8 @@ Phase 4 sends the same diff to every reviewer and then to triage, so the diff is
 
 Launch Agent instances **in parallel** using the shared `code-reviewer` subagent definition (`~/.claude/agents/code-reviewer.md`). The reviewer set is determined by the host CLI  -  GPT-5.4 is only available on Copilot CLI, so Claude Code skips that reviewer and runs a 2-model parallel review; Copilot CLI runs all three.
 
+**Scope from Step 1.77.** `$REVIEW_SCOPE == "single"` → dispatch **Reviewer 1 only**, and skip Step 2.5 + 3.6 (both no-ops with one reviewer). `"full"` (default + fail-safe) → the whole set below. Either way record the count in `consensus.reviewerCount`.
+
 | Reviewer   | subagent_type     | Model               | Focus                             | Skills Referenced                             | Where it runs        |
 | ---------- | ----------------- | ------------------- | --------------------------------- | --------------------------------------------- | -------------------- |
 | Reviewer 1 | `code-reviewer`   | `claude-fable-5` (Claude Code) / `claude-opus-4-8` (Copilot CLI) | Deep security + architecture      | `api-security-best-practices`, `architecture` | Both CLIs            |
@@ -259,9 +295,18 @@ Exit 0 = valid. Exit 2 = contradiction (approved=true with blocking findings)  -
 
 Opt-in empirical layer: when `prefs.global.verifyByTest.enabled` is `true`, accepted blocking findings additionally go through Step 3.7 (verify-by-test), which tries to reproduce each one with a minimal failing test before the Phase 3 rework loop fires. Full wiring: `$HOME/.claude/multi-agent-refs/features/verify-by-test.md`.
 
+##### 3.0 Merge the deterministic findings in
+
+Append the Step 1.76 test-integrity findings to the reviewer findings before counting, so they are adjudicated like any reviewer finding rather than resolved by triage never seeing them:
+
+```bash
+MERGED=$(jq -s '.[0] + (.[1].findings // [])' \
+  <(printf '%s' "$REVIEWER_FINDINGS_JSON") <(printf '%s' "${TEST_INTEGRITY_JSON:-{\}}"))
+```
+
 ##### 3.1 Short-circuit: no findings
 
-If merged findings `length === 0`, **skip triage**: write empty result `{"accepted": [], "deferred": [], "rejected": [], "approved": true}`, log, proceed to Phase 5.
+If **merged** findings `length === 0`, **skip triage**: write empty result `{"accepted": [], "deferred": [], "rejected": [], "approved": true}`, log, proceed to Phase 5. Note this is the merged count from 3.0: a run with zero reviewer findings but a non-empty test-integrity set must NOT short-circuit.
 
 ##### 3.2 Launch triage agent
 

package/pipeline/preferences-template.json

@@ -45,12 +45,7 @@
       "autoDiff": false,
       "manualNote": false
     },
-    "wikiScope": [
-      "main",
-      "ios",
-      "screenshots",
-      "index"
-    ],
+    "wikiScope": ["main", "ios", "screenshots", "index"],
     "autopilotReportTimeoutSeconds": 1800,
     "promptLanguage": "en",
     "outputLanguage": "en",
@@ -162,17 +157,16 @@
     }
   },
   "_derivedSkillSourcesTemplate": {
-    "_comment": "Optional. Populate global.derivedSkillSources[] to let /multi-agent:refactor check whether skills you derived from an upstream marketplace plugin have been updated. Kept in your LOCAL prefs only (never synced), so it may reference private sources. Copy an entry like the one below.",
+    "_comment": "Optional. Populate global.derivedSkillSources[] to let /multi-agent:refactor check whether skills you derived from an upstream marketplace plugin have been updated. Kept in your LOCAL prefs only (never synced), so it may reference private sources. Copy an entry like the one below. Set upstreamLocalClone when you have a working copy: the installed plugin cache is only as fresh as your last marketplace update, and a stale cache makes the drift check answer 'up to date' when it is four releases behind.",
     "_example": {
       "label": "Component toolkit skills",
       "localPath": "plugins/<my-plugin>/skills/workflow",
       "upstreamMarketplace": "<installed-marketplace-name>",
       "upstreamPlugin": "<upstream-plugin-name>",
-      "upstreamSkills": [
-        "<skill-a>",
-        "<skill-b>"
-      ],
+      "upstreamSkills": ["<skill-a>", "<skill-b>"],
       "derivedFromVersion": "0.0.0",
+      "upstreamVersionSource": "marketplace.json",
+      "upstreamLocalClone": "$HOME/<upstream-repo-working-copy>",
       "upstreamRepoUrl": "https://github.com/<org>/<repo>"
     }
   },

package/pipeline/schemas/agent-state.schema.json

@@ -97,8 +97,16 @@
             "type": "object",
             "required": ["tool", "phase"],
             "properties": {
-              "tool": { "type": "string", "description": "MCP tool name, e.g. mcp__claude_ai_Figma__get_design_context." },
-              "phase": { "type": "integer", "minimum": 0, "maximum": 7, "description": "Pipeline phase the call ran in. Only 0 (init) and 1 (analysis) are permitted." },
+              "tool": {
+                "type": "string",
+                "description": "MCP tool name, e.g. mcp__claude_ai_Figma__get_design_context."
+              },
+              "phase": {
+                "type": "integer",
+                "minimum": 0,
+                "maximum": 7,
+                "description": "Pipeline phase the call ran in. Only 0 (init) and 1 (analysis) are permitted."
+              },
               "timestamp": { "type": "string", "description": "ISO-8601 time of the call." }
             }
           }
@@ -154,7 +162,10 @@
               "items": { "type": "object", "additionalProperties": true },
               "description": "{ id, kind, label, screen, driver, evidence } per state driver (launch-arg / scenario-case / code-scenario / fixture / deep-link)."
             },
-            "groups": { "type": "array", "items": { "type": "object", "additionalProperties": true } },
+            "groups": {
+              "type": "array",
+              "items": { "type": "object", "additionalProperties": true }
+            },
             "byKind": { "type": "object", "additionalProperties": true },
             "truncated": { "type": "boolean" }
           }
@@ -164,9 +175,15 @@
           "additionalProperties": true,
           "description": "Resolved run scope: the inventory targets this run must audit. The coverage gate applies to this set, not to the whole inventory  -  a scoped run is not penalised for out-of-scope targets.",
           "properties": {
-            "argument": { "type": ["string", "null"], "description": "Raw $ARGUMENTS as given (empty = whole module, '--resume' = remainder of the last run)." },
+            "argument": {
+              "type": ["string", "null"],
+              "description": "Raw $ARGUMENTS as given (empty = whole module, '--resume' = remainder of the last run)."
+            },
             "targetIds": { "type": "array", "items": { "type": "string" } },
-            "resumedFrom": { "type": ["string", "null"], "description": "Report dir of the run this scope resumes, when --resume was used." }
+            "resumedFrom": {
+              "type": ["string", "null"],
+              "description": "Report dir of the run this scope resumes, when --resume was used."
+            }
           }
         },
         "figmaUrl": { "type": ["string", "null"] },
@@ -208,7 +225,10 @@
             "unaccountedIds": { "type": "array", "items": { "type": "string" } }
           }
         },
-        "reportDir": { "type": ["string", "null"], "description": "Output dir under ~/DesignChecks." }
+        "reportDir": {
+          "type": ["string", "null"],
+          "description": "Output dir under ~/DesignChecks."
+        }
       }
     },
     "identity": {
@@ -218,7 +238,10 @@
       "properties": {
         "name": { "type": "string" },
         "email": { "type": "string", "format": "email" },
-        "username": { "type": "string", "description": "SCM username (GitHub/Bitbucket). Used to filter out PR author from reviewer list." }
+        "username": {
+          "type": "string",
+          "description": "SCM username (GitHub/Bitbucket). Used to filter out PR author from reviewer list."
+        }
       }
     },
     "phases": {
@@ -229,7 +252,10 @@
           "type": "object",
           "additionalProperties": false,
           "properties": {
-            "status": { "type": "string", "enum": ["pending", "in_progress", "done", "skipped", "failed"] },
+            "status": {
+              "type": "string",
+              "enum": ["pending", "in_progress", "done", "skipped", "failed"]
+            },
             "startedAt": { "type": "string", "format": "date-time" },
             "finishedAt": { "type": "string", "format": "date-time" },
             "model": { "type": "string" },
@@ -312,7 +338,11 @@
       "properties": {
         "number": { "type": "integer", "minimum": 1 },
         "url": { "type": "string", "format": "uri" },
-        "version": { "type": "integer", "minimum": 0, "description": "Bitbucket PR version  -  must increment by 1 per PUT." },
+        "version": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Bitbucket PR version  -  must increment by 1 per PUT."
+        },
         "draft": { "type": "boolean" },
         "reviewers": {
           "type": "array",

package/pipeline/schemas/analysis-output.schema.json

@@ -18,8 +18,14 @@
           "enum": ["ios", "android", "backend", "frontend", "mobile", "unknown"],
           "description": "Dominant stack inferred from project markers (.xcodeproj, build.gradle, package.json, etc.)."
         },
-        "language": { "type": "string", "description": "E.g. 'Swift 6', 'Kotlin 2.1', 'Python 3.13', 'TypeScript 5'." },
-        "framework": { "type": "string", "description": "E.g. 'SwiftUI', 'Jetpack Compose', 'FastAPI', 'Next.js 16'." }
+        "language": {
+          "type": "string",
+          "description": "E.g. 'Swift 6', 'Kotlin 2.1', 'Python 3.13', 'TypeScript 5'."
+        },
+        "framework": {
+          "type": "string",
+          "description": "E.g. 'SwiftUI', 'Jetpack Compose', 'FastAPI', 'Next.js 16'."
+        }
       }
     },
     "touchedAreas": {
@@ -30,8 +36,16 @@
         "additionalProperties": false,
         "required": ["path", "why"],
         "properties": {
-          "path": { "type": "string", "minLength": 1, "description": "File or directory relative to repo root." },
-          "why": { "type": "string", "minLength": 4, "description": "Why the task likely affects this area." }
+          "path": {
+            "type": "string",
+            "minLength": 1,
+            "description": "File or directory relative to repo root."
+          },
+          "why": {
+            "type": "string",
+            "minLength": 4,
+            "description": "Why the task likely affects this area."
+          }
         }
       },
       "description": "Files / modules the task is most likely to modify. Phase 2 uses this to scope tasks."