@mmerterden/multi-agent-pipeline 13.2.0 → 13.3.0

package/pipeline/skills/shared/core/multi-agent-ios-coding-standard/SKILL.md

@@ -6,17 +6,17 @@ user-invocable: true
 argument-hint: "[module name or path]"
 ---
 
-# multi-agent ios-coding-standard — Module audit → plan → dev handoff
+# multi-agent ios-coding-standard  -  Module audit → plan → dev handoff
 
-**Input**: $ARGUMENTS — optionally a module name or path. When absent, Phase 1 discovers and asks.
+**Input**: $ARGUMENTS  -  optionally a module name or path. When absent, Phase 1 discovers and asks.
 
 This routine is the **procedure**. The rules live in the `ios-coding-standard` skill, whose registry is
 `references/rules.yml` and whose teaching doc is `references/STANDARD.md`. Load that
 skill first; it is installed on every host and carried by the iOS stack plugin, so
-there is one registry rather than a copy per CLI. Never restate a rule here — cite its ID. A rule that is not in the
+there is one registry rather than a copy per CLI. Never restate a rule here  -  cite its ID. A rule that is not in the
 registry is not a rule; if the audit needs one, propose it as `status: proposed` and say so.
 
-Read-only + planning. This routine never edits source — the dev pipeline does.
+Read-only + planning. This routine never edits source  -  the dev pipeline does.
 
 **Goal.** A developer new to the repo can open any file in the module and understand it without a
 guided tour, and nothing sensitive leaks on the way. Rank every finding by "does fixing this
@@ -27,26 +27,26 @@ dev task) stay English.
 
 ---
 
-## Phase 1 — Discover and pick the module
+## Phase 1  -  Discover and pick the module
 
 1. Repo root via `git rev-parse --show-toplevel`.
-2. **Discover module roots** — any directory with a `Package.swift`, a `Sources/` subtree or an
+2. **Discover module roots**  -  any directory with a `Package.swift`, a `Sources/` subtree or an
    `.xcodeproj`. Sweep the container dirs that exist (`Domains/`, `Packages/`, `Modules/`,
    `Features/`, `Core/`, `Common/`, top-level module dirs) one level deep, then two if empty.
 3. Record per module: name · path · Swift files · lines · governance docs present · SPM targets.
-   Keep this **module registry** for the whole run — `MOD-*` greps every import against it.
+   Keep this **module registry** for the whole run  -  `MOD-*` greps every import against it.
    Classify each module's role, because the role decides which dependency edges are legal:
    **feature** · **core/common** · **seam** (cross-module contracts/bridges/navigation) ·
    **composition root** (legitimately knows every module).
 4. If `$ARGUMENTS` resolves to a module, skip the prompt. Otherwise `AskUserQuestion`
    (single-select, `outputLanguage`), documented modules first, each option showing file/line
    counts and `docs: yes/no`. If the list exceeds the question limit, group the smallest into an
-   "other" option and ask again — never truncate silently.
+   "other" option and ask again  -  never truncate silently.
 5. Scope = the whole module's sources across all its targets, unless the user narrows it.
 
-## Phase 2 — Resolve what applies to THIS module
+## Phase 2  -  Resolve what applies to THIS module
 
-### 2a. The registry is the standard — in-module prose docs are NOT consulted
+### 2a. The registry is the standard  -  in-module prose docs are NOT consulted
 
 The skill's `references/rules.yml` (+ a project `modules/<Module>.yml` overlay) is the single source of truth. **Do not read, cite, or
 derive rules from a module's own `*-CLAUDE.md`, `docs/` set or any other in-repo prose.** They are
@@ -65,7 +65,7 @@ the specs the generator reads, and the module registry from Phase 1.
    be `blocking`.
    *Why prohibitions need to be written down:* inference reads dominant patterns, and a rule
    obeyed everywhere has no counter-example to infer from. A ban at 100% compliance is invisible
-   to a scan — it survives only if the overlay states it.
+   to a scan  -  it survives only if the overlay states it.
 2. **Repo-level rules** (root `CLAUDE.md`, contributing docs) apply to every module.
 3. **The module's own dominant pattern is its de-facto convention.** Count variants per dimension;
    the minority instances are the finding. Internal consistency beats conformity to a sibling.
@@ -75,14 +75,14 @@ Findings from step 3 are tagged `inferred` and capped at **suggestion**. Only re
 overlay-backed rules may be `blocking`.
 
 **When the overlay is missing**, generate a draft from code evidence, print it for confirmation,
-and mark every slot it could not derive — a frozen UI target, a name lock, a carve-out and an
+and mark every slot it could not derive  -  a frozen UI target, a name lock, a carve-out and an
 operational constraint all look like ordinary code from the outside. Do not guess them; list them
 as Open Questions.
 
 ### 2c. Vocabulary
 
 Bind each slot to a real symbol by grepping the module, then the reference module. **An unbound
-slot disables its rules** — never invent a name, never import a sibling's.
+slot disables its rules**  -  never invent a name, never import a sibling's.
 
 `HandlerName` · `EventParam` · `CoordinatorType` · `ResultType` / `ErrorType` / `ErrorFactory` ·
 `DIResolver` / `DIConfigurator` · `RequestModelSuffix` / `ResponseModelSuffix` / `TransportSuffix` ·
@@ -95,14 +95,14 @@ slot disables its rules** — never invent a name, never import a sibling's.
 
 Print the resolved table before scanning so a wrong binding is caught early.
 
-### 2d. Sensitive-data inventory — required before any SEC rule runs
+### 2d. Sensitive-data inventory  -  required before any SEC rule runs
 
 The `SEC-*` rules are written against the **data classes** in `references/rules.yml →
 sensitive_data_classes`, never against one module's field names. Resolve the module's concrete
 instances of each class: grep entities, request/response models, storage calls and analytics
 events for the values the module actually handles, and map each to its class.
 
-Produce the inventory as a table — **class · concrete symbols · where it enters · required
+Produce the inventory as a table  -  **class · concrete symbols · where it enters · required
 lifetime (transient / survives-restart / survives-reinstall) · where it is actually stored ·
 where it is logged · where it leaves (network, analytics, pasteboard, another module)**.
 
@@ -118,13 +118,13 @@ whose required lifetime nobody can state, is an Open Question, not a silent pass
 
 This table is a deliverable in its own right, independent of whether any violation is found.
 
-## Phase 3 — Scan
+## Phase 3  -  Scan
 
 Apply the rules in `references/rules.yml` that survived Phase 2 binding, plus the module's own `validation`
 gate. Tag every finding: **rule ID · severity · source (`registry` / `doc` / `inferred`) ·
 onboarding impact (high/medium/low)**.
 
-### Coverage gate — on disk, not in memory
+### Coverage gate  -  on disk, not in memory
 
 Before scanning, write `.<module>-audit-coverage.tsv` to the scratch dir: one row per target
 (every screen under `ScreenRoot`, every shared component, every entity, every file in every
@@ -132,25 +132,25 @@ target) with columns `path · status · rules-applied`. Mark rows as you go.
 
 - Each target is **audited** or **explicitly skipped with a reason** (generated, fixture,
   vendored). No third state.
-- **The run is incomplete while any row is unmarked** — and the file, not a claim, is the proof.
+- **The run is incomplete while any row is unmarked**  -  and the file, not a claim, is the proof.
   Chunk the module if it is too large for one pass; the checklist survives a context reset.
 - No sampling. A partial audit reported as complete certifies the unscanned screens as clean.
 
 ### Grep hygiene
 
 Registry `mechanism` patterns are line-based and match doc comments. Filter
-`^[[:space:]]*//` — BSD grep does not understand `\s`, so a `\s*//` filter silently lets `/// …`
-through — then open each surviving hit and confirm it is real code. Report pre-filter and
+`^[[:space:]]*//`  -  BSD grep does not understand `\s`, so a `\s*//` filter silently lets `/// ...`
+through  -  then open each surviving hit and confirm it is real code. Report pre-filter and
 post-verification counts separately; a table padded with comment matches destroys trust.
 
 ### Judgement rules need evidence, not assertion
 
 For any rule marked `enforcement: judgement`, a finding must carry the measurement its `check`
-names — a reference count, a call-site count, a consumer count, a file list. **No count, no
+names  -  a reference count, a call-site count, a consumer count, a file list. **No count, no
 finding.** This is what keeps a subjective rule from becoming an opinion.
 
 Every judgement rule has a worked ✗/✓ pair in `EXAMPLES.md`, keyed by ID. Cite it in the finding's
-proposed fix rather than re-describing the shape — the developer applying the fix should be
+proposed fix rather than re-describing the shape  -  the developer applying the fix should be
 reading the same picture the audit used.
 
 ### Module-specific overrides
@@ -159,79 +159,79 @@ The module's own docs win over the registry, including where they contradict a s
 Never apply one module's dialect to another. List every override honoured, so the reader sees why
 a registry rule was not raised.
 
-## Phase 4 — Produce the plan
+## Phase 4  -  Produce the plan
 
 No findings → report compliant and stop. Otherwise write
 `<ModulePath>/ios-coding-standard-plan-<module>.md` (or the repo's scratch/docs dir if the module
 tree must stay clean), containing, in order:
 
-1. **Coverage ledger** — total targets · audited · skipped with reasons. Not 100% accounted for
+1. **Coverage ledger**  -  total targets · audited · skipped with reasons. Not 100% accounted for
    means the plan is not deliverable.
-2. **Summary** — counts by severity and source, resolved vocabulary, branch to create.
-3. **Sensitive-data inventory** (Phase 2d) — first, because it is the highest-risk content.
-4. **Screen × role matrix** `[STRUCT-02]` — screens as rows, manifest roles as columns, cells
+2. **Summary**  -  counts by severity and source, resolved vocabulary, branch to create.
+3. **Sensitive-data inventory** (Phase 2d)  -  first, because it is the highest-risk content.
+4. **Screen × role matrix** `[STRUCT-02]`  -  screens as rows, manifest roles as columns, cells
    `✓ / missing / misplaced`. The structural map a newcomer reads first.
-5. **Type placement table** `[STRUCT-05]` — type · location · consumer count · correct tier ·
+5. **Type placement table** `[STRUCT-05]`  -  type · location · consumer count · correct tier ·
    move required. Paired with the nested-type list `[STRUCT-01]`: owner · nested type · kind ·
    reference count · verdict.
-6. **Visibility report** `[VIS-01, VIS-02]` — over-exposed declarations per file, non-final
+6. **Visibility report** `[VIS-01, VIS-02]`  -  over-exposed declarations per file, non-final
    classes with no subclass.
-7. **Boundary report** `[MOD-*]` — import graph (allowed vs forbidden, with coupling depth) ·
+7. **Boundary report** `[MOD-*]`  -  import graph (allowed vs forbidden, with coupling depth) ·
    manifest graph (declared vs legal for the role, plus dead edges) · **removability delta**
-   ("removing X touches N files: …") · inbound test (tests compile with no sibling present).
-8. **Testability seam report** `[TEST-*]` — types reaching for the environment, logic requiring a
+   ("removing X touches N files: ...") · inbound test (tests compile with no sibling present).
+8. **Testability seam report** `[TEST-*]`  -  types reaching for the environment, logic requiring a
    view to execute, doubles whose signatures have drifted.
-9. **Change-cost probe** `[FLEX-*]` — pick two plausible upcoming changes (a new variant of an
+9. **Change-cost probe** `[FLEX-*]`  -  pick two plausible upcoming changes (a new variant of an
    existing screen; a new field on a shared entity) and state what each costs in files today.
-10. **Findings table** — rule ID · `file:line` · current state · proposed fix · severity · source ·
+10. **Findings table**  -  rule ID · `file:line` · current state · proposed fix · severity · source ·
     onboarding impact.
-11. **Per-file work** — grouped per file, blocking → important → suggestion; within a severity,
+11. **Per-file work**  -  grouped per file, blocking → important → suggestion; within a severity,
     highest onboarding impact first.
-12. **Behaviour-preservation guard** — splitting files, adding MARKs, extracting extensions and
+12. **Behaviour-preservation guard**  -  splitting files, adding MARKs, extracting extensions and
     moving types must not change behaviour. Anything requiring a behaviour change (a missing
     analytics event, a wrong result type, a timezone fix, a storage migration) goes in a
     **separate group**, reviewed and tested on its own, never inside a mechanical split commit.
-13. **Tooling delegation & the ratchet** — the section that decides whether any of this survives.
+13. **Tooling delegation & the ratchet**  -  the section that decides whether any of this survives.
     - Classify each applied rule by its registry `enforcement`. For every `lint` / `format` /
       `scan` rule, state the concrete mechanism and whether that toolchain exists in the repo
       (`LintToolchain`). **When it does not exist, saying so is a finding**, ranked above most
       individual violations it would have caught.
     - Recommend **baseline-and-ratchet, never big-bang**: grandfather existing violations, surface
-      only new ones, drain the backlog behind a green build. Order the plan the same way — stop
+      only new ones, drain the backlog behind a green build. Order the plan the same way  -  stop
       the bleeding, then clean up.
     - Custom lint rule identifiers **are** the registry IDs (`sec_01_no_plaintext_persistence`,
       `mod_01_no_sibling_import`) so a violation points straight at the rule entry.
-    - **Linting is local-only by decision** — the skill's `references/lint-local.sh` with `references/swiftlint.draft.yml`, config
+    - **Linting is local-only by decision**  -  the skill's `references/lint-local.sh` with `references/swiftlint.draft.yml`, config
       and baseline kept outside the repository; no committed config, no build phase, no CI job.
       State this honestly in the plan rather than describing a gate that does not exist: a
       pre-PR habit catches less than a wall, so the residual risk is real and belongs in the
-      report. Adopting it project-wide remains an open decision — record it as one so it stays
+      report. Adopting it project-wide remains an open decision  -  record it as one so it stays
       visible instead of quietly lapsing.
     - Never imply the audit substitutes for the linter, or the linter for a gate. The audit finds
       the debt once; the linter keeps a developer honest; only a gate stops it returning.
-14. **Numeric exit criteria** — target and today's measured value side by side: lint violations
+14. **Numeric exit criteria**  -  target and today's measured value side by side: lint violations
     per 1k lines (<1) · public-surface ratio, public declarations ÷ externally consumed symbols
     (≈1) · forbidden cross-module imports (0) · removability delta · files over threshold and
     files >120 lines with no sectioning (0) · screens missing a manifest role (0) · escape-hatch
     count `[CONC-03]` (flat or falling) · exception-marker count (flat or falling) · dead code (0)
     · screens with logic and no mirrored tests (0) · unclassified sensitive symbols (0).
-15. **Exception ledger** — every `// standard:exception(<ID>)` in the module: rule · reason ·
+15. **Exception ledger**  -  every `// standard:exception(<ID>)` in the module: rule · reason ·
     expiry · expired yes/no.
-16. **Open Questions** — Phase 2b dimensions with no majority, and unclassifiable symbols.
-17. **Suggested commit slicing** — one commit per file-group / concern.
-18. **Scope guard** — only this module is touched; definition of done is the module's own
+16. **Open Questions**  -  Phase 2b dimensions with no majority, and unclassifiable symbols.
+17. **Suggested commit slicing**  -  one commit per file-group / concern.
+18. **Scope guard**  -  only this module is touched; definition of done is the module's own
     verification path.
 
 Then write a **separate one-page onboarding summary** beside the plan, aimed at a developer
 joining next week rather than at whoever does the remediation: the ten always/never lines
 specialised to this module, the screen file manifest, the placement ladder, the sensitive-data
-classes in play, and the verification command. Nobody learns a codebase from a 40-finding audit —
+classes in play, and the verification command. Nobody learns a codebase from a 40-finding audit -
 this page is the actual deliverable, and the audit is how you earn the right to write it
-accurately. Derive it from `references/STANDARD.md § 0`, do not re-invent it.
+accurately. Derive it from `references/STANDARD.md section 0`, do not re-invent it.
 
 Show a concise version of the plan to the user too.
 
-## Phase 5 — Hand off
+## Phase 5  -  Hand off
 
 `AskUserQuestion` (single-select, `outputLanguage`):
 
@@ -246,10 +246,10 @@ verifies, and commits only when asked. This routine ends at the handoff.
 
 ## Notes
 
-- **Verification reality is per-module — establish it, do not assume it.** Some targets cannot be
+- **Verification reality is per-module  -  establish it, do not assume it.** Some targets cannot be
   compiled from the CLI (asset symbol generation, UIKit-dependent packages, a dependency failing
   earlier in the graph); there, verification is Xcode and a manifest dump validates the manifest
-  only. Never trust a piped build's exit code — a pipe reports the tail's status. Record the
+  only. Never trust a piped build's exit code  -  a pipe reports the tail's status. Record the
   module's actual verification command in the plan.
 - One module per run. Several modules means several runs and several plans, never one
   cross-module churn commit.

package/pipeline/skills/shared/external/ios-coding-standard/references/STANDARD.md

@@ -2,8 +2,8 @@
 
 The one document to read before your first PR. Rule IDs in brackets point at `rules.yml`, which
 carries severity, tooling and rationale for each; `EXAMPLES.md` carries a worked ✗/✓ pair for
-every rule a tool cannot decide — look one up by ID when a review cites it. Your module's own docs
-win where they differ — this is the floor, not the ceiling.
+every rule a tool cannot decide  -  look one up by ID when a review cites it. Your module's own docs
+win where they differ  -  this is the floor, not the ceiling.
 
 Five principles, in the order they break things: **security · testability · readability ·
 flexibility · consistency.**
@@ -13,14 +13,14 @@ flexibility · consistency.**
 ## 0. The ten lines
 
 1. Sensitive data goes in the Keychain, never in `UserDefaults`, and never into a log. `[SEC-01, SEC-03]`
-2. Never reach for the environment — inject time, storage, randomness, session. `[TEST-01]`
+2. Never reach for the environment  -  inject time, storage, randomness, session. `[TEST-01]`
 3. One type per file; the file is named after it. `[STRUCT-01]`
 4. A screen is a known set of files, always the same set. `[STRUCT-02]`
 5. Where a type lives is decided by how many things use it. `[STRUCT-05]`
 6. A feature module never imports another feature module. `[MOD-01]`
 7. Everything is `private` and `final` until something forces otherwise. `[VIS-01, VIS-02]`
-8. One request in, one result out — `async`, no completion handlers, no `throws`. `[SVC-01]`
-9. Split concerns with `// MARK:` — business rules, service calls and UI never share a section. `[READ-01]`
+8. One request in, one result out  -  `async`, no completion handlers, no `throws`. `[SVC-01]`
+9. Split concerns with `// MARK:`  -  business rules, service calls and UI never share a section. `[READ-01]`
 10. Variants are configuration, not `if` trees. `[FLEX-02]`
 
 ---
@@ -32,13 +32,13 @@ Work out which **data class** a value belongs to before you decide where it goes
 document, booking reference, membership identity, payment instrument, personal contact,
 biometric/health, precise location. The class decides the storage, not convenience.
 
-### Storage `[SEC-01]` — ask "does it persist?" before "where does it go?"
+### Storage `[SEC-01]`  -  ask "does it persist?" before "where does it go?"
 
 Keychain answers *where a persisted secret lives*. It does not answer *this value is sensitive*.
 Most sensitive values in a flow are used and dropped, and those must not be persisted at all.
 
 ```swift
-// ✗ over-persistence — a value the flow throws away in 30 seconds now outlives logout
+// ✗ over-persistence  -  a value the flow throws away in 30 seconds now outlives logout
 //   and nobody owns deleting it
 try credentialStore.save(oneTimeCode, for: .verificationCode)
 UserDefaults.standard.set(passportNumber, forKey: "apisPassport")
@@ -50,7 +50,7 @@ UserDefaults.standard.set(passportNumber, forKey: "apisPassport")
 }
 ```
 ```swift
-// ✓ persisted, because it must survive an app restart — Keychain, explicit accessibility,
+// ✓ persisted, because it must survive an app restart  -  Keychain, explicit accessibility,
 //   no iCloud sync
 try credentialStore.save(
     membershipToken,
@@ -61,15 +61,15 @@ try credentialStore.save(
 
 **The ladder, in order:**
 
-1. **Does it need to outlive this flow?** Assume no. In-flow data — a form field, a scanned
-   document number, a one-time code, a draft — stays in memory and dies with the flow.
+1. **Does it need to outlive this flow?** Assume no. In-flow data  -  a form field, a scanned
+   document number, a one-time code, a draft  -  stays in memory and dies with the flow.
 2. **If yes: survive what?** Backgrounding → still just model state. App restart → Keychain.
    Reinstall → a product decision someone signs off, never a storage default.
 3. **Which class is it?** `payment-instrument`, `biometric-or-health` and `precise-location`
-   stay transient no matter what step 2 said — the answer to "it must survive" there is a
+   stay transient no matter what step 2 said  -  the answer to "it must survive" there is a
    server-side or system token, not local storage.
 
-**Why both directions are findings:** `UserDefaults` is a plist in the app container — it lands in
+**Why both directions are findings:** `UserDefaults` is a plist in the app container  -  it lands in
 unencrypted backups and outlives the session, so under-protection is obvious. Over-persistence is
 the subtler one: an unnecessary Keychain item survives the flow, survives logout unless someone
 remembers to delete it, and creates a cleanup obligation with no owner. "Put it in the Keychain to
@@ -95,11 +95,11 @@ private means a forgotten annotation fails safe; defaulting to public means it f
 
 ### The rest, briefly
 
-- No secret in source — anything committed is already leaked. `[SEC-02]`
+- No secret in source  -  anything committed is already leaked. `[SEC-02]`
 - HTTPS only; an ATS exception carries a written reason and an expiry date. `[SEC-04]`
 - Sensitive data has a lifetime: cleared on logout, hidden from the app-switcher snapshot,
   not cached to disk by default. `[SEC-05]`
-- Analytics events, user properties and crash breadcrumbs are redacted — check the parameter
+- Analytics events, user properties and crash breadcrumbs are redacted  -  check the parameter
   list of every event you add. `[SEC-06]`
 - Permissions are least-privilege with honest purpose strings; the privacy manifest matches what
   you actually collect. `[SEC-07, SEC-08]`
@@ -115,7 +115,7 @@ Testability is a property of the production code. You cannot add it later by wri
 ### Inject the environment `[TEST-01]`
 
 ```swift
-// ✗ untestable by construction — the assertion depends on today's date
+// ✗ untestable by construction  -  the assertion depends on today's date
 struct BoardingEligibility {
     func canCheckIn(flight: Flight) -> Bool {
         Date() > flight.departure.addingTimeInterval(-24 * 3600)
@@ -132,7 +132,7 @@ struct BoardingEligibility {
     }
 }
 ```
-**Why:** the rule is not "avoid `Date()`" — it is that anything the outside world decides
+**Why:** the rule is not "avoid `Date()`"  -  it is that anything the outside world decides
 (time, randomness, identifiers, locale, storage, session, feature flags) must be something the
 test can decide instead. A type that reaches for it has no seam, and no test discipline recovers.
 
@@ -157,7 +157,7 @@ func submitGate(for passengers: [Passenger], isLoggedIn: Bool) -> SubmitGate {
 needs a session, a network stub and a view model instance to answer "what happens when a document
 is missing".
 
-Also: name test doubles for what they do — stub, spy, fake, mock — one kind per file, and keep
+Also: name test doubles for what they do  -  stub, spy, fake, mock  -  one kind per file, and keep
 the signature identical to the real type, because a drifted double is the first thing the next
 person copies. `[TEST-04, SVC-02]`
 
@@ -176,7 +176,7 @@ Error handling`. Scene order: `State → Init → Body →` one `@ViewBuilder` p
 Two or more call sites → its own file with its own configuration. Exactly one call site and bound
 to the screen's state → a `private @ViewBuilder` in a MARK'd extension. Pushing a state-coupled
 fragment into its own file to shrink the screen trades one long file for a file plus a binding
-tangle — that reads worse, and it is a finding in the same way the opposite is.
+tangle  -  that reads worse, and it is a finding in the same way the opposite is.
 
 ### A pure transform is a shared helper `[READ-04d]`
 
@@ -193,7 +193,7 @@ enum OrderBFFFormatters {
     static func initials(from name: String?) -> String? { ... }
 }
 ```
-**Why:** these have no screen state, so nothing ties them to a screen — and left where they were
+**Why:** these have no screen state, so nothing ties them to a screen  -  and left where they were
 typed they get written a second time somewhere else, with a slightly different edge case.
 
 ### A view fragment that renders a thing is a component file `[READ-04b]`
@@ -210,7 +210,7 @@ private var legSwitcher: some View {
 }
 ```
 ```swift
-// ✓ SeatMapLegSwitcher.swift — data in, callbacks out, previewable on its own
+// ✓ SeatMapLegSwitcher.swift  -  data in, callbacks out, previewable on its own
 struct SeatMapLegSwitcher: View {
     let segments: [SeatMapSegment]
     let activeSegmentIndex: Int
@@ -222,20 +222,20 @@ struct SeatMapLegSwitcher: View {
     SeatMapLegSwitcher(segments: [.gidis, .donus], activeSegmentIndex: 0, onSelect: { _ in })
 }
 
-// ✓ the scene keeps the composition — which component shows, in what order
+// ✓ the scene keeps the composition  -  which component shows, in what order
 @ViewBuilder
 var content: some View {
     if viewModel.loadError { errorRetryView } else { SeatMapLegSwitcher(...) }
 }
 ```
 **Why:** the canvas is the fastest way to check a visual piece, and it only works when the piece
-takes data. A fragment bound to a view model needs the DI container no preview configures — so
+takes data. A fragment bound to a view model needs the DI container no preview configures  -  so
 it never gets looked at until the whole flow is run on a device.
 
 ### One type per file; nest only owned details `[STRUCT-01]`
 
 ```swift
-// ✗ a response model nested inside another — invisible to a filename search,
+// ✗ a response model nested inside another  -  invisible to a filename search,
 //   and moving it later renames every reference
 struct OrderResponseModel {
     struct PassengerModel { ... }
@@ -246,12 +246,12 @@ struct OrderResponseModel {
 struct OrderResponseModel { let items: [OrderItemModel] }   // OrderResponseModel.swift
 struct PassengerModel { ... }                                      // PassengerModel.swift
 
-// ✓ still fine — an owned detail with exactly one owner
+// ✓ still fine  -  an owned detail with exactly one owner
 @Observable final class SeatMapViewModel {
     enum ViewState { case loading, loaded, failed }
 }
 
-// ✓ also fine — a pure constants namespace; the nesting IS the grouping
+// ✓ also fine  -  a pure constants namespace; the nesting IS the grouping
 enum AppConstant {
     enum Phone { static let defaultDialCode = "+90" }
     enum DeepLink { static let scheme = "myapp" }
@@ -259,13 +259,13 @@ enum AppConstant {
 ```
 **Why:** entities and transport models get looked up by name, move between placement tiers as
 consumers change, and are referenced from mappers and tests. A `ViewState` or a `static let`
-literal does none of that — flattening `AppConstant.Phone` to `AppConstantPhone` loses the
+literal does none of that  -  flattening `AppConstant.Phone` to `AppConstantPhone` loses the
 grouping and buys no discoverability.
 
 ### A method that wraps one service is named after it `[SVC-07]`
 
 ```swift
-// ✗ transport verbs invented by the client — the name says what the code does
+// ✗ transport verbs invented by the client  -  the name says what the code does
 //   (which the signature already says), not which service will fire
 func fetchOpenStatus(_ request: CheckOpenStatusRequestModel) async -> Result
 func loadPassengers(...) async -> Result
@@ -317,7 +317,7 @@ var variant: SummaryVariant {
 **Why:** the mapper is the one type with no screen context. A rule buried in it is invisible
 from the view model that owns the behaviour, untestable without hand-building a DTO, and quietly
 duplicated the next time another screen needs the same decision. `?? ""` on an optional wire
-field is not a decision — it is the lowering itself.
+field is not a decision  -  it is the lowering itself.
 
 ### Signatures read as the contract `[SVC-01]`
 
@@ -339,7 +339,7 @@ result family means one error channel instead of `throws` plus a result plus an
 ### Visibility is documentation `[VIS-01, VIS-02, VIS-04]`
 
 Everything `private` and `final` until something forces otherwise. `public` only on what another
-module actually imports — and every surviving `public`, plus every cross-module contract, carries
+module actually imports  -  and every surviving `public`, plus every cross-module contract, carries
 a doc comment. That is the one place the "no unnecessary comments" rule inverts: an
 implementation detail explains itself through naming, a contract between two teams cannot.
 
@@ -350,7 +350,7 @@ implementation detail explains itself through naming, a contract between two tea
 ### A screen is a known file manifest `[STRUCT-02, STRUCT-03]`
 
 `Scene · ViewModel · LocalizedText · CoordinatorEvent · AnalyticsTracking · UseCase · Repository
-(+protocol +mock) · Mapper + models` — each present when its responsibility exists, absent when it
+(+protocol +mock) · Mapper + models`  -  each present when its responsibility exists, absent when it
 does not. An empty `LocalizedText` on a screen with no copy is noise, not compliance. Every screen
 sits at the same depth with the same internal grouping, because people navigate by muscle memory.
 
@@ -360,7 +360,7 @@ sits at the same depth with the same internal grouping, because people navigate
 |---|---|
 | 2+ modules | cross-module shared tier |
 | 2+ screens | the module's shared entities |
-| one screen | that screen's own folder — **not** the shared tier |
+| one screen | that screen's own folder  -  **not** the shared tier |
 | one type | its own file beside that type |
 
 Both directions are findings. A single-consumer type parked in the shared tier inflates the shared
@@ -369,7 +369,7 @@ surface and makes the next reader think it is load-bearing.
 ### Modules do not know each other `[MOD-01, MOD-05, MOD-06]`
 
 A feature module never imports a sibling feature. Cross-feature needs go through the seam layer
-(contracts / bridges / adapters). DI resolves a protocol declared in core or the seam — resolving
+(contracts / bridges / adapters). DI resolves a protocol declared in core or the seam  -  resolving
 another feature's concrete type is a compile-time dependency in a runtime disguise. Only the
 composition root knows the module list.
 
@@ -390,7 +390,7 @@ Text(title)
     .padding(style.padding)
 ```
 **Why:** adding a third variant costs a case instead of a branch, and the component stays open for
-extension — the next design change does not edit its body.
+extension  -  the next design change does not edit its body.
 
 ---
 
@@ -403,7 +403,7 @@ cases, so these rules are about the model being *legible*.
   runs from its declaration, without tracing callers. `[CONC-01]`
 - State `Sendable` where it is load-bearing, consistently. `[CONC-02]`
 - `@preconcurrency`, `nonisolated(unsafe)` and `@unchecked Sendable` are migration tools. Each
-  needs a reason and a removal condition — they are counted, and a rising count means the module
+  needs a reason and a removal condition  -  they are counted, and a rising count means the module
   is quietly returning to pre-Swift-6 guarantees while the build stays green. `[CONC-03]`
 - One model: no `DispatchQueue`, semaphore or completion handler layered onto `async`. `[CONC-04]`
 - Every task has an owner and a cancellation story. An unowned task outlives its screen and writes
@@ -416,19 +416,19 @@ cases, so these rules are about the model being *legible*.
 Identifier from the shared source on every interactive element `[A11Y-01]` · localized VoiceOver
 label, plus a hint when the action is not obvious from the label `[A11Y-02]` · 44×44 minimum tap
 target, and grouped content exposes one meaningful element rather than five fragments `[A11Y-03]`
-· Dynamic Type survives the largest accessibility sizes — no fixed-height container around
+· Dynamic Type survives the largest accessibility sizes  -  no fixed-height container around
 scalable text `[A11Y-04]` · RTL mirrors, so `leading`/`trailing`, never `left`/`right` `[A11Y-05]`.
 
 ---
 
-## 7. Performance — the four that are also readability
+## 7. Performance  -  the four that are also readability
 
 No expensive computation in a view body `[PERF-01]` · lazy containers with stable identity, never
 index-as-id `[PERF-02]` · no blocking work at init or on the main actor `[PERF-03]` · no formatter,
 calendar or regex constructed per render `[PERF-04]`.
 
 **Explicitly out of scope of this standard:** Instruments-driven optimisation, launch-time budgets,
-memory profiling. Those belong to a performance workflow — measure before optimising, and do not
+memory profiling. Those belong to a performance workflow  -  measure before optimising, and do not
 let a style document push you into speculative tuning.
 
 ---

package/pipeline/skills/shared/external/ios-coding-standard/references/lint-local.sh

@@ -44,7 +44,7 @@ if ! command -v swiftlint >/dev/null 2>&1; then
   cat >&2 <<'EOF'
 swiftlint is not installed.
 
-Install it for your user only — this does not touch the project:
+Install it for your user only  -  this does not touch the project:
 
     brew install swiftlint
 
@@ -82,7 +82,7 @@ fi
 : "${SENSITIVE:=token|password|passcode|secret|credential|passport|nationalId|identityNumber|pnr|reservationCode|ticketNumber|membershipNumber|cardNumber|cvv|dateOfBirth}"
 : "${TRANSIENT:=oneTimeCode|otp|verificationCode|draft}"
 
-# SIBLINGS: every other module that lives beside this one — the MOD-01 import guard.
+# SIBLINGS: every other module that lives beside this one  -  the MOD-01 import guard.
 if [ -z "${SIBLINGS:-}" ]; then
   PARENT="$(dirname "$MODULE_ABS")"
   SIBLINGS="$(find "$PARENT" -mindepth 1 -maxdepth 1 -type d ! -name "$MODULE_NAME" -exec basename {} \; \
@@ -106,7 +106,7 @@ text = open(src).read()
 for key in ("SENSITIVE", "TRANSIENT", "SIBLINGS"):
     # Wrapped in a non-capturing group: these values are alternations, and "|" binds looser than
     # concatenation. Substituting them bare turns "prefix\bA|B|C" into "(prefix\bA) or (B) or (C)",
-    # which matches every line containing any bare term — the whole pattern silently collapses.
+    # which matches every line containing any bare term  -  the whole pattern silently collapses.
     text = text.replace("((%s))" % key, "(?:%s)" % os.environ[key])
 text = text.replace("((LOGIC))", os.environ["LOGIC"])
 open(dst, "w").write(text)
@@ -118,7 +118,7 @@ echo "module    : $MODULE_ABS"
 echo "config    : $RESOLVED"
 echo "workdir   : $MODULE_WORK   (outside the repo)"
 echo "siblings  : $SIBLINGS"
-[ -f "$INVENTORY" ] && echo "inventory : $INVENTORY" || echo "inventory : (none — using the generic fallback pattern)"
+[ -f "$INVENTORY" ] && echo "inventory : $INVENTORY" || echo "inventory : (none  -  using the generic fallback pattern)"
 echo
 
 cd "$MODULE_ABS"
@@ -143,7 +143,7 @@ ARGS=(lint --config "$RESOLVED" --reporter "$REPORTER" --quiet)
 [ -n "$STRICT" ] && ARGS+=("$STRICT")
 
 set +e
-# stdout is the report, stderr is progress + config diagnostics — never merge them, or a
+# stdout is the report, stderr is progress + config diagnostics  -  never merge them, or a
 # machine-readable reporter comes back with progress lines spliced into it.
 swiftlint "${ARGS[@]}" "${LINT_PATHS[@]}" 2>"$MODULE_WORK/last-run.err" | tee "$MODULE_WORK/last-run.txt"
 STATUS=${PIPESTATUS[0]}