@mmerterden/multi-agent-pipeline 13.5.0 → 14.0.0

package/pipeline/skills/shared/core/apple-archive-compliance/references/rules.yml

@@ -0,0 +1,167 @@
+version: 1.0.0
+updated: 2026-07-29
+owner: iOS platform
+description: >
+  App Store review + ITMS upload rules, as a machine-readable registry. IDs are the
+  source-of-truth IDs the underlying scanner uses and are stable across versions  -  a
+  finding cites the ID so the author can look the rule up and disagree with it.
+
+# What these rules may be applied to. Every rule here is measured against a BUILT
+# archive, not against source, so path scoping names the release-relevant inputs a
+# diff can touch. A consumer resolves this before selecting rules and records what
+# it dropped: applying an archive rule to a source-only diff produces a finding
+# nobody can act on.
+scope:
+  languages: [swift, objective-c]
+  paths:
+    - "**/Info.plist"
+    - "**/PrivacyInfo.xcprivacy"
+    - "**/*.entitlements"
+    - "**/*App.swift"
+    - "**/AppDelegate*.swift"
+    - "**/SceneDelegate*.swift"
+    - "**/project.pbxproj"
+    - "**/*.xcarchive/**"
+  notCovered:
+    android: Play policy is a separate registry  -  see google-play-compliance
+    source-quality: readability, naming and architecture live in ios-coding-standard
+
+severity_levels: [blocking, important, suggestion]
+enforcement_kinds:
+  scan: a tool measures it against the built artefact
+  judgement: requires a person or an audit run
+
+# No rule here carries a regex mechanism. These are measured by the archive scanner
+# against a built artefact, so a consumer either runs that scanner and maps its
+# output onto these IDs, or reports the rule as unverified. Pattern-matching source
+# text for them produces confident wrong answers: a purpose string can be present
+# in the plist and absent from the archive.
+
+rules:
+  - id: privacy-manifest
+    title: >
+      `PrivacyInfo.xcprivacy` exists + well-formed + declares all required `NSPrivacyCollectedDataTypes`
+    severity: blocking
+    enforcement: scan
+    policy_ref: Guideline 5.1.1
+    rationale: app-store-compliance
+  - id: required-reason-api
+    title: >
+      Binary-scanned API usage (UserDefaults, stat, Disk, URL schemes, etc.) cross-referenced with privacy manifest reasons
+    severity: blocking
+    enforcement: scan
+    policy_ref: 5.1.1 + ITMS-91065
+    rationale: app-store-compliance
+  - id: info-plist
+    title: >
+      Purpose strings (`NS*UsageDescription`) for every declared permission, ATS configured, CFBundleDisplayName ≤ 30 chars
+    severity: blocking
+    severity_varies: error/warning
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: code-signing
+    title: >
+      Debug entitlements absent in release, correct APS environment (`aps-environment=production`), signature present
+    severity: blocking
+    enforcement: scan
+    policy_ref: ITMS-90035 / 90034 / 90046 / 90717
+    rationale: app-store-compliance
+  - id: embedded-sdk
+    title: >
+      Third-party SDKs on [Apple's 86 SDK list](https://developer.apple.com/support/third-party-SDK-requirements/) signed + have PrivacyInfo
+    severity: blocking
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: entitlement
+    title: >
+      Entitlement ↔ Info.plist mappings (background modes, associated domains, app groups) consistent
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: asset-validation
+    title: >
+      App icon set present + all required sizes, launch storyboard configured
+    severity: blocking
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: binary-size
+    title: >
+      `.app` bundle size + estimated post-thinning download size (warns if > 200MB)
+    severity: suggestion
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: team-id-consistency
+    title: >
+      App + extensions + widgets share same Team ID
+    severity: blocking
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: provisioning-profile
+    title: >
+      Profile expiry date in future, distribution type = App Store, profile classification sane
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: swift-abi
+    title: >
+      No unnecessary embedded Swift runtime on iOS 12.2+ targets
+    severity: important
+    enforcement: scan
+    policy_ref: ITMS-90426
+    rationale: app-store-compliance
+  - id: extension-signing
+    title: >
+      Extension bundle IDs follow `<app-bundle-id>.<ext-name>`, signed, App Groups match host
+    severity: blocking
+    enforcement: scan
+    policy_ref: ITMS-90283
+    rationale: app-store-compliance
+  - id: ipv6-compliance
+    title: >
+      No hardcoded IPv4 literals in binary, no legacy `gethostbyname` / `inet_addr` usage
+    severity: important
+    enforcement: scan
+    policy_ref: Guideline 2.5.5
+    rationale: app-store-compliance
+  - id: debug-tool-leak
+    title: >
+      40+ debug tools (Netfox, FLEX, CocoaDebug, Wormholy, HeliosTrace, DoraemonKit, Lookin, Reveal, etc.) + generic `_debug_` / `_profiler_` symbol scan
+    severity: blocking
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: production-hygiene
+    title: >
+      `print()` / `NSLog()` / `debugPrint()` symbol presence + mock/test JSON files shipped in bundle
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: duplicate-resource
+    title: >
+      Same asset under multiple paths (bloats bundle)
+    severity: suggestion
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: dead-reference
+    title: >
+      Files referenced in Xcode proj but absent from archive
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: app-store-compliance
+  - id: sdk-floor
+    title: >
+      `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28)
+    severity: blocking
+    enforcement: scan
+    policy_ref: ITMS-90725
+    rationale: app-store-compliance

package/pipeline/skills/shared/core/google-play-compliance/SKILL.md

@@ -4,6 +4,7 @@ language: en
 description: "Google Play Store publication compliance  -  bundletool + aapt2 + apksigner orchestration + 21-rule policy catalog with Play Console error codes + humanizer templates. Consumed by: /multi-agent:test 'store-ready' (primary dispatch), Phase 4 Security Auditor (catalog cross-ref on AndroidManifest / build.gradle / proguard / signing diffs), /multi-agent:review (PR citation), /multi-agent:channels (PR body auto-augmentation). Wiring enforced by smoke-compliance-skills.sh. Use when an .aab or .apk needs a Play policy check before upload, or a Play rejection has to be diagnosed."
 user-invocable: true
 argument-hint: '[bundle-path] [--threshold=error|warning|info] [--format=markdown|json] [--lang=en|tr]   -  no-arg: picks most recent .aab from app/build/outputs/bundle/release/'
+standards-registry: references/rules.yml
 ---
 
 # google-play-compliance  -  Google Play Store Publication Compliance Skill

package/pipeline/skills/shared/core/google-play-compliance/references/rules.yml

@@ -0,0 +1,184 @@
+version: 1.0.0
+updated: 2026-07-29
+owner: Android platform
+description: >
+  Google Play policy + platform requirements, as a machine-readable registry. IDs
+  are the source-of-truth IDs the underlying scanner uses and are stable across
+  versions  -  a finding cites the ID so the author can look it up and disagree.
+
+# What these rules may be applied to. Every rule here is measured against a BUILT
+# bundle or APK, not against source, so path scoping names the release-relevant
+# inputs a diff can touch. A consumer resolves this before selecting rules and
+# records what it dropped rather than applying a bundle rule to a source-only diff.
+scope:
+  languages: [kotlin, java]
+  paths:
+    - "**/AndroidManifest.xml"
+    - "**/build.gradle"
+    - "**/build.gradle.kts"
+    - "**/proguard-rules.pro"
+    - "**/network_security_config.xml"
+    - "**/gradle.properties"
+  notCovered:
+    ios: App Store policy is a separate registry  -  see apple-archive-compliance
+    source-quality: Kotlin naming, Compose and MVVM live in the android stack skills
+
+severity_levels: [blocking, important, suggestion]
+enforcement_kinds:
+  scan: a tool measures it against the built artefact
+  judgement: requires a person or an audit run
+
+# No rule here carries a regex mechanism. These are measured by the bundle scanner
+# against a built artefact, so a consumer either runs that scanner and maps its
+# output onto these IDs, or reports the rule as unverified. Grepping source for
+# them produces confident wrong answers: minifyEnabled can read true in one build
+# type and false in the one that ships.
+
+rules:
+  - id: target-api-level
+    title: >
+      `android:targetSdkVersion` ≥ 34 for new apps (Aug 2024+), ≥ 34 for updates (Nov 2024+). Lower → rejected.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  Target API
+    rationale: play-store-compliance
+  - id: native-64bit
+    title: >
+      Every native `.so` has an `arm64-v8a` counterpart. `armeabi-v7a`-only rejected since Aug 2019.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  64-bit
+    rationale: play-store-compliance
+  - id: app-bundle-format
+    title: >
+      New apps must ship `.aab`. `.apk` uploads rejected on new apps since Aug 2021.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  AAB
+    rationale: play-store-compliance
+  - id: base-module-size
+    title: >
+      Base APK from bundle ≤ 150 MB (bundletool `--mode=universal` size). Beyond → rejected.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Platform limit
+    rationale: play-store-compliance
+  - id: package-visibility
+    title: >
+      If `targetSdkVersion ≥ 30` and code queries other packages, `<queries>` must be declared in manifest.
+    severity: important
+    enforcement: scan
+    policy_ref: Android 11+
+    rationale: play-store-compliance
+  - id: foreground-service-types
+    title: >
+      Every `<service android:foregroundServiceType="..."/>` type must match runtime usage. Missing = policy violation.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Android 14
+    rationale: play-store-compliance
+  - id: app-signing
+    title: >
+      Signed with at least v2 scheme (apksigner verify --min-sdk-version). Enrollment in Play App Signing recommended.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Play App Signing
+    rationale: play-store-compliance
+  - id: cleartext-traffic
+    title: >
+      `android:usesCleartextTraffic="false"` OR Network Security Config explicitly lists cleartext domains.
+    severity: important
+    enforcement: scan
+    policy_ref: Policy  -  Security
+    rationale: play-store-compliance
+  - id: exported-components
+    title: >
+      Every `<activity>` / `<service>` / `<receiver>` with `<intent-filter>` must explicitly declare `android:exported="true"`. Missing → build fail on API 31+.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Android 12+
+    rationale: play-store-compliance
+  - id: proguard-mapping
+    title: >
+      Release build has `mapping.txt` (upload to Play Console for deobfuscation). `minifyEnabled = false` on release = warning.
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: play-store-compliance
+  - id: dangerous-permissions
+    title: >
+      Every dangerous permission (`MANAGE_EXTERNAL_STORAGE`, `SYSTEM_ALERT_WINDOW`, `REQUEST_INSTALL_PACKAGES`, `PACKAGE_USAGE_STATS`, `QUERY_ALL_PACKAGES`) has justification in Play Console.
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  Permissions
+    rationale: play-store-compliance
+  - id: advertising-id
+    title: >
+      If AdMob / advertising ID used (manifest `com.google.android.gms.permission.AD_ID`), must be declared in Data Safety form. Targeting API 33+ requires `AD_ID` permission.
+    severity: important
+    enforcement: scan
+    policy_ref: Policy  -  Ad ID
+    rationale: play-store-compliance
+  - id: background-location
+    title: >
+      `ACCESS_BACKGROUND_LOCATION` declared → Play Console background location justification required (policy revoke risk).
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  Location
+    rationale: play-store-compliance
+  - id: data-safety-consistency
+    title: >
+      Manifest-declared permissions match Data Safety form (drift audit  -  manual; this rule flags permissions likely to trigger form updates).
+    severity: important
+    enforcement: scan
+    policy_ref: Policy  -  Data safety
+    rationale: play-store-compliance
+  - id: sensitive-permission-special-access
+    title: >
+      `READ_SMS`, `RECEIVE_SMS`, `READ_CALL_LOG`, `WRITE_CALL_LOG`, `READ_CONTACTS`, `PROCESS_OUTGOING_CALLS` require special access from Play Console (Default handler use case).
+    severity: blocking
+    enforcement: scan
+    policy_ref: Policy  -  Sensitive
+    rationale: play-store-compliance
+  - id: debug-tool-leak
+    title: >
+      Release APK contains `com.squareup.leakcanary`, `com.facebook.stetho`, `com.github.chuckerteam.chucker`, `com.jakewharton.pidcat`, `com.github.anrwatchdog` (and variants) in DEX/META-INF.
+    severity: blocking
+    enforcement: scan
+    policy_ref: none
+    rationale: play-store-compliance
+  - id: log-statements
+    title: >
+      Release APK has `Log.d` / `Log.v` / `Timber.d` call sites in bytecode. Should be stripped via ProGuard rules or build-type conditional.
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: play-store-compliance
+  - id: mock-endpoints
+    title: >
+      Release APK manifest / resources contain dev/staging URL literals or test API key patterns (`dev.`, `staging.`, `test-api-key`, `Bearer test_`).
+    severity: important
+    enforcement: scan
+    policy_ref: none
+    rationale: play-store-compliance
+  - id: minify-enabled
+    title: >
+      Release build-type has `minifyEnabled = true` and `shrinkResources = true`. Both off = warning (size + deobfuscation impact).
+    severity: important
+    enforcement: scan
+    policy_ref: Build config
+    rationale: play-store-compliance
+  - id: version-code-progression
+    title: >
+      `versionCode` in this bundle > last published versionCode on Play (requires Play Console API lookup or user-provided last version).
+    severity: important
+    enforcement: scan
+    policy_ref: Platform req
+    rationale: play-store-compliance
+  - id: app-links-verification
+    title: >
+      `<intent-filter android:autoVerify="true">` domains have reachable `/.well-known/assetlinks.json`.
+    severity: suggestion
+    enforcement: scan
+    policy_ref: Digital Asset Links
+    rationale: play-store-compliance

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -206,7 +206,7 @@ This works across sessions because:
 
 ## Agent dispatch  -  per-persona model routing
 
-Every agent persona under `pipeline/agents/*.md` declares a `preferredModel` frontmatter field. The orchestrator MUST honor it on every dispatch, on both Claude Code and Copilot CLI  -  cross-CLI parity is enforced by `smoke-cross-cli-behavior.sh`.
+Every agent persona under `$HOME/.claude/agents/*.md` declares a `preferredModel` frontmatter field. The orchestrator MUST honor it on every dispatch, on both Claude Code and Copilot CLI  -  cross-CLI parity is enforced by `smoke-cross-cli-behavior.sh`.
 
 | Persona | `preferredModel` | Rationale (condensed) |
 |---|---|---|
@@ -252,7 +252,7 @@ task_text="$(jq -r '.summary' analysis.json)"
 touched=$(jq -r '.touchedAreas | map(.path) | join(",")' analysis.json)
 stack=$(jq -r '.stack.primary' analysis.json)
 
-matched_skills=$(node pipeline/scripts/match-skills.mjs \
+matched_skills=$(node "$HOME/.claude/scripts/match-skills.mjs" \
   "$task_text" \
   --touched-files "$touched" \
   --stack "$stack" \
@@ -264,7 +264,7 @@ matched_skills=$(node pipeline/scripts/match-skills.mjs \
 # per subagent dispatch on small tasks.
 ```
 
-**Fallback:** if `.skills-index.json` is missing (e.g. fresh checkout before `build-skills-index.mjs` runs), the orchestrator falls back to eager-load exactly as pre-v7.0  -  dynamic loading never blocks the happy path.
+**Fallback:** every install ships `.skills-index.json` beside the skills. If it is absent anyway (a checkout before `build-skills-index.mjs` runs), the orchestrator eager-loads as pre-v7.0  -  dynamic loading never blocks the happy path.
 
 **--index-only installs:** `node install.js --index-only` writes only the index, not the 206 SKILL.md payloads. Intended for:
 - CI pipelines that fetch skill bodies on demand
@@ -328,7 +328,7 @@ Full contract: `refs/tracker-contract.md` section "TaskCreate ordering (strict)"
 >
 > The condensed walkthrough below covers Step 1 (parse) + Step 2 (worktree), but DOES NOT replace the full contract. Read `refs/phases/phase-0-init.md` before every Phase 0 run and execute ALL 8 steps:
 >
-> 1. **Bootstrap tracker**  -  `pipeline/scripts/phase-tracker.sh init <task-id>` + 8 phase tiles (Step −1)
+> 1. **Bootstrap tracker**  -  `$HOME/.claude/scripts/phase-tracker.sh init <task-id>` + 8 phase tiles (Step −1)
 > 2. **Load prefs**  -  read `prefs.global` + `prefs.projects[{name}]`; halt with `/multi-agent:setup` prompt if no keychain mapping (Step 0)
 > 3. **Parse input**  -  classify + fetch Jira/GitHub issue + extract Figma URL if present (Step 1)
 > 4. **Select project(s)  -  single OR multi-repo**  -  present numbered list of repos from `$HOME`. Picker accepts space-separated numbers (`1 3 4`) for multi-select. Component/refactor tasks often span repos (e.g. component repo + consumer app). Surface saved `global.recentGroups` at the top of the list. **Never auto-pick a single repo when the task could touch more than one**  -  ask the user to confirm single vs multi. (Step 2)
@@ -445,7 +445,7 @@ Full contract: `refs/tracker-contract.md` section "TaskCreate ordering (strict)"
    - **5b  -  Approval loop**: render plan → user: `onayla`/`iptal`/free-text. A free-text edit request → the planning model (Fable) revises the plan → show it again. No iteration cap; user controls exit via `onayla` or `iptal`.
    - Persist `clarificationRounds`, `clarificationQuestions`, `clarificationAnswers`, `planIterations`, `planApprovedAt`, `planEditRequests` to `state.phases["2"]`.
 
-### Phase 3: Dev (claude-sonnet-4-6)
+### Phase 3: Dev (claude-sonnet-5)
 For each todo (respecting dependency order):
 1. Update todo status: `in_progress`
 2. **TDD cycle**:
@@ -458,11 +458,11 @@ For each todo (respecting dependency order):
 6. Log: `⚡ Phase 3: {todo-id}  -  Test ✅ Build ✅`
 
 ### Phase 4: Review (parallel + triage)
-0. **Diff Risk Scoring (advisory, v8.3+)**  -  before reviewer dispatch run `node pipeline/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
+0. **Diff Risk Scoring (advisory, v8.3+)**  -  before reviewer dispatch run `node $HOME/.claude/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
 1. Launch **code-reviewer** agents in parallel. Reviewer set depends on which CLI is hosting the pipeline:
-   - **Claude Code** (2 reviewers): `claude-fable-5` (deep security + architecture) + `claude-sonnet-4-6` (quality + correctness)
-   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-4-8` + `claude-sonnet-4-6` (Fable 5 is not offered on Copilot CLI)
-   - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-4-8` on Copilot CLI)
+   - **Claude Code** (2 reviewers): `claude-fable-5` (deep security + architecture) + `claude-sonnet-5` (quality + correctness)
+   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-5` + `claude-sonnet-5` (Fable 5 is not offered on Copilot CLI)
+   - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-5` on Copilot CLI)
 2. Collect findings, classify:
    - 🔴 **Blocking** → must fix → back to Phase 3 (max 3 iterations)
    - 🟡 **Important** → fix and re-review
@@ -472,7 +472,7 @@ For each todo (respecting dependency order):
 ### Phase 5: Test
 Lets the user physically test the code before opening a PR. The prompt MUST make it explicit that saying yes **removes the worktree and checks the branch out locally**  -  otherwise the user is hit with an implicit side effect.
 
-0. **Test Gap Report (advisory, v8.3+)**  -  before the local-checkout prompt run `node pipeline/scripts/test-gap-scan.mjs --base "$BASE_BRANCH" --stack <ios|android|python|node>` to surface public symbols added in this branch that have no paired test. Heuristic, deterministic, sub-second, never gates by default. iOS `*View.swift` / Android `@Composable` symbols default to `important` severity; other public API additions to `suggestion`. Optional gating via `prefs.testGap.blockingThreshold` (loops back to Phase 4 rework when the important+blocking count exceeds the threshold). Disabled when `prefs.testGap.enabled = false`.
+0. **Test Gap Report (advisory, v8.3+)**  -  before the local-checkout prompt run `node $HOME/.claude/scripts/test-gap-scan.mjs --base "$BASE_BRANCH" --stack <ios|android|python|node>` to surface public symbols added in this branch that have no paired test. Heuristic, deterministic, sub-second, never gates by default. iOS `*View.swift` / Android `@Composable` symbols default to `important` severity; other public API additions to `suggestion`. Optional gating via `prefs.testGap.blockingThreshold` (loops back to Phase 4 rework when the important+blocking count exceeds the threshold). Disabled when `prefs.testGap.enabled = false`.
 1. **Ask** with a native `AskUserQuestion` picker (never a typed y/N prompt). The options MUST make the local-checkout side effect explicit  -  testing removes the worktree and checks the branch out into the main repo:
    - `question`: "Check out locally to test now?" (rendered in `outputLanguage`)
    - `header`: "Test" (English, <=12 chars)

package/pipeline/skills/shared/core/multi-agent-analysis/SKILL.md

@@ -43,10 +43,10 @@ When the rendered Section 20 (Risks and Open Questions) has open rows, the repor
 
 ## Detailed implementation
 
-Full steps: `pipeline/commands/multi-agent/analysis/SKILL.md`.
-Template master copy: `pipeline/multi-agent-refs/analysis-template.md`.
-Schema: `pipeline/schemas/analysis-spec.schema.json`.
-Convention extractor: `pipeline/lib/extract-conventions.sh` (output contract: `pipeline/schemas/conventions-output.schema.json`).
+Full steps: `$HOME/.claude/commands/multi-agent/analysis/SKILL.md`.
+Template master copy: `$HOME/.claude/multi-agent-refs/analysis-template.md`.
+Schema: `$HOME/.claude/schemas/analysis-spec.schema.json`.
+Convention extractor: `$HOME/.claude/lib/extract-conventions.sh` (output contract: `$HOME/.claude/schemas/conventions-output.schema.json`).
 
 ## Notes
 

package/pipeline/skills/shared/core/multi-agent-analysis-resolve/SKILL.md

@@ -36,9 +36,9 @@ Companion to `multi-agent-analysis`. Walks the open rows of Section 20 (Risks an
 
 ## Detailed implementation
 
-Full steps: `pipeline/commands/multi-agent/analysis-resolve/SKILL.md`.
-Section 20 / changelog contracts: `pipeline/multi-agent-refs/analysis-template.md`.
-Convention defaults: `pipeline/multi-agent-refs/conventions-defaults.md`.
+Full steps: `$HOME/.claude/commands/multi-agent/analysis-resolve/SKILL.md`.
+Section 20 / changelog contracts: `$HOME/.claude/multi-agent-refs/analysis-template.md`.
+Convention defaults: `$HOME/.claude/multi-agent-refs/conventions-defaults.md`.
 
 ## Notes
 

package/pipeline/skills/shared/core/multi-agent-build-optimize/SKILL.md

@@ -38,8 +38,8 @@ Thin wrapper around the vendored `xcode-build-orchestrator` skill so iOS users d
 
 ## Detailed implementation
 
-Full steps: `pipeline/commands/multi-agent/build-optimize/SKILL.md`.
-Upstream attribution: `pipeline/skills/shared/external/NOTICE-xcode-build-skills.md`.
+Full steps: `$HOME/.claude/commands/multi-agent/build-optimize/SKILL.md`.
+Upstream attribution: `$HOME/.claude/skills/NOTICE-xcode-build-skills.md`.
 
 ## Notes
 

package/pipeline/skills/shared/core/multi-agent-create-jira/SKILL.md

@@ -37,7 +37,7 @@ A `C` section fires on: Design Reference → Figma URL; Screenshots → pasted i
    - `GET /rest/api/2/issue/createmeta?projectKeys={KEY}&issuetypeNames={TYPE}&expand=projects.issuetypes.fields` (404/empty → paged DC endpoint fallback). Required custom fields → step 7 questions with allowedValues options. Detect Sprint/Epic/Team fields generically via `schema.custom` ids.
    - `GET /rest/agile/1.0/board?projectKeyOrId={KEY}` → (ask when multiple) → `GET /rest/agile/1.0/board/{id}/sprint?state=active`. No board/Agile 404 → sprint option silently omitted.
 6. **External context** (only for provided sources, each failure-isolated, never blocks create):
-   - **Figma** (`FIGMA_URL` set)  -  3-tier chain (MCP → REST figma_pat → user screenshot); standalone command, MCP allowed here.
+   - **Figma** (`FIGMA_URL` set)  -  3-tier chain (MCP → REST `figma` PAT → user screenshot); standalone command, MCP allowed here.
    - **Swagger** (`SWAGGER_URL` set or contract pasted)  -  fetch the spec, extract ONLY the referenced endpoints (paths/operationIds/tags named in `FREE_TEXT`, else the pointed-at group): method + path + one-line summary + key request/response fields. Never crawl the whole spec. Fetch failure → link-only or omit.
    - **Screenshots**  -  staged for the step 8 attachment opt-in, referenced inline with `!file|thumbnail!`.
 7. **Draft + clarifying questions**  -  compose summary (`{minedPrefix} {title}`, 255 trunc) + description from the type's **standard template** in Jira wiki markup (`h3.`), auto-sizing conditional sections, humanizer pass, in `outputLanguage`; body to a file for `jq -n --rawfile` (UTF-8 verbatim, `--data-binary @file`, no re-encode). Ask ONLY genuinely unknown fields: component, epic (when usage rate is high), priority (when norm ambiguous), labels, assignee, sprint vs backlog, required customs, and any always-present section still empty (Bug Steps/Environment, or a Task/Story with no derivable Scope/AC). Never invent content the user did not supply.

package/pipeline/skills/shared/core/multi-agent-dev/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent-dev
 language: en
-description: "Fast development mode: Init → Dev (Opus) → Test → Commit → Report. Analysis, planning, and review phases are skipped. Use when the work is already scoped and only development, test and commit are needed."
+description: "Fast development mode: Init → Dev (Opus) → Review → Test → Commit → Report. Analysis and planning are skipped, review is not. Use when the work is already scoped but the result still has to be checked."
 user-invocable: true
 argument-hint: '"task" [autopilot]  -  issue URL, Jira ID, or free-text + optional autopilot'
 ---
@@ -22,12 +22,13 @@ A 5-phase fast pipeline: Init → Dev → Test → Commit → Report. Developmen
 ```
 Phase 0: Init       → Project detection, worktree, branch, identity (full picker)
 Phase 3: Dev        → Direct development with Opus (TDD optional)
+Phase 4: Review     → Deterministic gates + parallel review + triage
 Phase 5: Test       → User Test (interactive simulator)
 Phase 6: Commit     → Commit + push + PR
 Phase 7: Report     → Channels (Jira / Confluence / PR / Wiki)
 ```
 
-`--dev` skips Phase 1 (Analysis), Phase 2 (Planning + Approval Gate), and Phase 4 (Review). The Phase 3 Dev model is **Opus**. The Phase 0 picker, Phase 5 test, Phase 6 commit, and Phase 7 channels are identical to the full pipeline.
+`--dev` skips Phase 1 (Analysis) and Phase 2 (Planning + Approval Gate). The Phase 3 Dev model is **Opus**. The Phase 0 picker, Phase 4 review, Phase 5 test, Phase 6 commit, and Phase 7 channels are identical to the full pipeline. Review is not a fast-mode casualty: skipping analysis means less context going in, not less scrutiny coming out.
 
 > `--dev` contract: no plan discussion, development starts directly. If you want to discuss the plan, use normal mode.
 
@@ -53,15 +54,15 @@ Phase 7: Report     → Channels (Jira / Confluence / PR / Wiki)
 
 | Feature | Full (`/multi-agent`) | Dev (`/multi-agent:dev`) |
 |---------|---------------------|------------------------|
-| Phases | 8 (0-7) | 5 (0, 3, 5, 6, 7)  -  1, 2, 4 skipped |
+| Phases | 8 (0-7) | 6 (0, 3, 4, 5, 6, 7)  -  1, 2 skipped |
 | Phase 3 Dev model | Sonnet | **Opus** |
 | Phase 1 Analysis (explore agents) | ✅ | ❌ |
 | Phase 2 Planning + Approval Gate | ✅ | ❌ |
-| Phase 4 Review (parallel + triage) | ✅ | ❌ |
+| Phase 4 Review (parallel + triage) | ✅ | ✅ (same) |
 | Phase 0 picker (account, repos, branch, ...) | ✅ | ✅ (same) |
 | Phase 5 User Test | ✅ | ✅ (same) |
 | Phase 7 channels (Jira / Confluence / PR / Wiki) | ✅ | ✅ (same) |
-| Duration | ~10-15 min | ~5-7 min |
+| Duration | ~10-15 min | ~7-10 min |
 
 ## Analysis doc supplied to a fast mode (warn before starting)
 

package/pipeline/skills/shared/core/multi-agent-dev-autopilot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent-dev-autopilot
 language: en
-description: "Fastest mode: Dev (Opus) plus Autopilot. Init → Dev → Commit → Report with zero confirmations. Use when a change is well understood and should go from start to commit with no questions asked."
+description: "Fastest mode: Dev (Opus) plus Autopilot. Init → Dev → Review → Commit → Report with zero confirmations. Review still runs and auto-fixes blocking findings. Use when a change is well understood and should go from start to commit with no questions asked."
 user-invocable: true
 argument-hint: '"task"  -  issue URL, Jira ID, or free-text'
 ---
@@ -22,11 +22,12 @@ Dev mode + Autopilot combined: a 4-phase pipeline with no confirmations, end-to-
 ```
 Phase 0: Init       → Project detection, worktree, branch, identity
 Phase 3: Dev        → Direct development with Opus
+Phase 4: Review     → Gates + parallel review + triage, auto-fix
 Phase 6: Commit     → Automatic commit + push + PR (no approval)
 Phase 7: Report     → Short terminal summary
 ```
 
-**Skipped phases**: Analysis (1), Planning (2), Review (4), User Test (5)
+**Skipped phases**: Analysis (1), Planning (2), User Test (5)
 **Skipped confirmations**: Plan Approval Gate (clarification + approval loop), test prompt, commit prompt, PR prompt
 
 > If you want to discuss the plan, do not use this mode  -  normal mode runs the clarification + approval loop. The Dev+Autopilot contract is: "ask no questions".
@@ -35,7 +36,7 @@ Phase 7: Report     → Short terminal summary
 
 1. **Parse the input**  -  Normal multi-agent formats (Issue URL, Jira ID, free-text)
 2. **Phase 0: Init**  -  `"mode": "dev", "autopilot": true` in `agent-state.json`
-3. **Phase 3: Dev**  -  Write code + build directly with `claude-opus-4-8`
+3. **Phase 3: Dev**  -  Write code + build directly with `claude-opus-5`
 4. **Phase 6: Commit**  -  Create automatic commit + push + PR
 5. **Phase 7: Report**  -  Terminal summary
 
@@ -48,9 +49,9 @@ Phase 7: Report     → Short terminal summary
 
 | | Full | Dev | Autopilot | **Dev+Autopilot** |
 |--|------|-----|-----------|-------------------|
-| Phases | 9 | 4 | 9 | **4** |
+| Phases | 8 | 6 | 8 | **5** |
 | Model | Sonnet | Opus | Sonnet | **Opus** |
 | Plan Approval Gate | ✅ (clarification + approval) | ❌ | ❌ | **❌** |
 | Confirmation (test/commit/PR) | Yes | Yes | No | **No** |
-| Review | Parallel+triage (CLI-aware) | None | Parallel+triage (CLI-aware) | **None** |
-| Estimated duration | ~12 min | ~5 min | ~10 min | **~3 min** |
+| Review | Parallel+triage (CLI-aware) | Parallel+triage (CLI-aware) | Parallel+triage (CLI-aware) | **Parallel+triage, auto-fix** |
+| Estimated duration | ~12 min | ~7 min | ~10 min | **~5 min** |

package/pipeline/skills/shared/core/multi-agent-dev-local/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent-dev-local
 language: en
-description: "Fast mode + local  -  Init → Dev(Opus) → Commit → Report, no worktree. Use when a change should be developed on the current branch without creating a worktree."
+description: "Fast mode + local  -  Init → Dev(Opus) → Review → Commit → Report, no worktree. Use when a change should be developed and reviewed on the current branch without creating a worktree."
 user-invocable: true
 ---
 
@@ -13,7 +13,8 @@ Dedicated form of the `--dev` + `--local` combination. A 4-phase fast pipeline w
 
 ```
 Phase 0: Init       → Project detection, branch check, state (NO worktree)
-Phase 3: Dev        → Direct development with Opus (Analysis + Planning + Review skipped)
+Phase 3: Dev        → Direct development with Opus (Analysis + Planning skipped)
+Phase 4: Review     → Deterministic gates + parallel review + triage
 Phase 6: Commit     → Pre-commit checkout prompt, commit + push + PR
 Phase 7: Report     → Jira/Wiki + log + knowledge/memory
 ```
@@ -22,7 +23,7 @@ Phase 7: Report     → Jira/Wiki + log + knowledge/memory
 
 - Quick bug fix or small feature  -  review overhead is unnecessary
 - You're working on the current branch and don't want to switch worktrees
-- Routine change you trust that needs no review
+- Quick bug fix or small feature  -  analysis and planning buy nothing here
 
 ## Delegation
 

package/pipeline/skills/shared/core/multi-agent-dev-local-autopilot/SKILL.md

@@ -14,13 +14,14 @@ The triple `--dev` + `--local` + `autopilot`  -  the fastest form available. Zer
 ```
 Phase 0: Init       → Project detection, branch check, state (NO worktree, NO approval)
 Phase 3: Dev        → Direct development with Opus (automatic)
+Phase 4: Review     → Gates + parallel review + triage, auto-fix
 Phase 6: Commit     → Automatic commit + push + PR (NO local checkout prompt)
 Phase 7: Report     → Jira/Wiki + log + knowledge/memory
 ```
 
 ## When to use it
 
-- Routine change you trust that needs no review
+- Routine change you trust  -  you want it reviewed, not discussed
 - A CI / batch environment running the pipeline automatically  -  no user interaction
 - Prototype / spike  -  you care about speed
 

package/pipeline/skills/shared/core/multi-agent-help/SKILL.md

@@ -76,7 +76,7 @@ Pipeline (after Phase 0):
 Modes:
 
   (normal)             Full 8 phases, parallel review + Fable triage
-  --dev                Fast: Init -> Dev(Opus) -> Commit -> Report (no plan gate)
+  --dev                Fast: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report
   --local              No worktree  -  works directly on local branch
   autopilot            Skip all confirmations (EXCEPT Phase 7 channels menu)
   --dev autopilot      Fastest path
@@ -225,7 +225,7 @@ Pipeline (Phase 0'dan sonra):
 Modlar:
 
   (normal)             Tam 8 faz, paralel review + Fable triage
-  --dev                Hızlı: Init -> Dev(Opus) -> Commit -> Report (plan gate yok)
+  --dev                Hızlı: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report
   --local              Worktree yok  -  doğrudan local branch'te çalışır
   autopilot            Tüm onayları atla (İSTİSNA: Phase 7 channels menüsü)
   --dev autopilot      En hızlı yol

package/pipeline/skills/shared/core/multi-agent-ios-coding-standard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent-ios-coding-standard
 language: en
-description: "Audit an iOS module against the shared coding-standard registry (95 stable-ID rules), produce a remediation plan, then hand off to dev/dev-local. Use for a standards pass on a module, or when a review needs rule IDs rather than opinions."
+description: "Audit an iOS module against the shared coding-standard registry (99 stable-ID rules), produce a remediation plan, then hand off to dev/dev-local. Use for a standards pass on a module, or when a review needs rule IDs rather than opinions."
 user-invocable: true
 argument-hint: "[module name or path]"
 ---