@mmerterden/multi-agent-pipeline 13.5.0 → 14.0.0

package/pipeline/skills/shared/core/multi-agent-local-autopilot/SKILL.md

@@ -20,10 +20,10 @@ Runs the full 8-phase pipeline **without creating a worktree** + **skipping all
 | `multi-agent-autopilot "task"` | Full 8 phases | ✅ | ❌ |
 | `multi-agent-local "task"` | Full 8 phases | ❌ | ✅ |
 | **`multi-agent-local-autopilot "task"`** | **Full 8 phases** | **❌** | **❌** |
-| `multi-agent-dev "task"` | Init → Dev → Commit → Report | ✅ | ✅ |
-| `multi-agent-dev-autopilot "task"` | Init → Dev → Commit → Report | ✅ | ❌ |
-| `multi-agent-dev-local "task"` | Init → Dev → Commit → Report | ❌ | ✅ |
-| `multi-agent-dev-local-autopilot "task"` | Init → Dev → Commit → Report | ❌ | ❌ (fastest) |
+| `multi-agent-dev "task"` | Init → Dev → Review → Test → Commit → Report | ✅ | ✅ |
+| `multi-agent-dev-autopilot "task"` | Init → Dev → Review → Commit → Report | ✅ | ❌ |
+| `multi-agent-dev-local "task"` | Init → Dev → Review → Commit → Report | ❌ | ✅ |
+| `multi-agent-dev-local-autopilot "task"` | Init → Dev → Review → Commit → Report | ❌ | ❌ (fastest) |
 
 ## What changes
 

package/pipeline/skills/shared/core/multi-agent-review/SKILL.md

@@ -35,19 +35,19 @@ Skip Phase 0-3 and review a diff only. Input shapes: a PR (`#N`, `repo#N`, GitHu
 
    **Claude Code (2 in parallel):**
    - Agent 1: `claude-fable-5` → security + architecture
-   - Agent 2: `claude-sonnet-4-6` → general quality
+   - Agent 2: `claude-sonnet-5` → general quality
 
    **Copilot CLI (3 in parallel):**
-   - Agent 1: `claude-opus-4-8` → security + architecture (Fable 5 is not offered on Copilot CLI)
+   - Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
    - Agent 2: `gpt-5.4` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-4-6` → general quality
+   - Agent 3: `claude-sonnet-5` → general quality
 
 4. **Store-compliance cross-reference**  -  if iOS/Android release-relevant files changed, the matching catalog is loaded:
 
    | Platform | Trigger files | Catalog to load |
    |---|---|---|
-   | iOS | `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/*App.swift`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/project.pbxproj` | `pipeline/skills/shared/core/apple-archive-compliance/SKILL.md`  -  18 rules + ITMS refs |
-   | Android | `**/AndroidManifest.xml`, `**/build.gradle(.kts)`, `**/proguard-rules.pro`, `**/network_security_config.xml` | `pipeline/skills/shared/core/google-play-compliance/SKILL.md`  -  21 rules + Play policy refs |
+   | iOS | `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/*App.swift`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/project.pbxproj` | `$HOME/.claude/skills/apple-archive-compliance/SKILL.md`  -  18 rules + ITMS refs |
+   | Android | `**/AndroidManifest.xml`, `**/build.gradle(.kts)`, `**/proguard-rules.pro`, `**/network_security_config.xml` | `$HOME/.claude/skills/google-play-compliance/SKILL.md`  -  21 rules + Play policy refs |
 
    It appends the catalog's `ruleID` + the Apple ITMS / Play policy ref to each finding:
    - iOS example: `(apple-archive-compliance / info-plist  -  Guideline 5.1.1)`

package/pipeline/skills/shared/core/multi-agent-scan/SKILL.md

@@ -42,7 +42,7 @@ multi-agent-scan --root ~/.copilot/skills
 
 1. Run the script:
    ```bash
-   bash "$REPO_ROOT/pipeline/scripts/scan-skills.sh" $ARGUMENTS
+   bash "$HOME/.claude/scripts/scan-skills.sh" $ARGUMENTS
    ```
 
 2. Interpret the output:

package/pipeline/skills/shared/core/multi-agent-search/SKILL.md

@@ -42,7 +42,7 @@ JSON: `{ query, matched_tasks, tasks: [{ task_id, project, branch, date, matches
 
 1. Script:
    ```bash
-   bash "$REPO_ROOT/pipeline/scripts/search-logs.sh" "$ARGUMENTS"
+   bash "$HOME/.claude/scripts/search-logs.sh" "$ARGUMENTS"
    ```
 
 2. Exit code:

package/pipeline/skills/shared/core/{multi-agent-finish → multi-agent-ship}/SKILL.md

@@ -1,13 +1,13 @@
 ---
-name: multi-agent-finish
+name: multi-agent-ship
 language: en
 description: "Continue already-done LOCAL work through the pipeline tail: Review → Build+Test → Commit/PR → Report (technical analysis + Jira test-scenario comment). No dev phase. Use when local work is already done and only review, build, commit and reporting remain."
 user-invocable: true
 ---
 
-# multi-agent finish  -  Ship Local Work Through the Pipeline Tail
+# multi-agent ship  -  Take Existing Branch Work Through the Pipeline Tail
 
-You already wrote (and maybe hand-tested) the change on the current branch  -  or ran `dev-local` / `local`, which skip Review + Test. `finish` picks up from there and runs the **pipeline tail** over that existing local work in one command, without re-developing.
+You already wrote (and maybe hand-tested) the change on the current branch, or committed it outside the pipeline entirely. `ship` picks up from there and runs the **pipeline tail** over that existing work in one command, without re-developing. (As of v14.0.0 the `--dev` family reviews its own output, so this is for work with no pipeline run behind it.)
 
 ## Pipeline
 
@@ -34,14 +34,14 @@ Phases 1-3 (Analysis / Planning / Dev) are skipped by design  -  the branch's lo
 ## Input
 
 ```bash
-multi-agent finish                 # current branch vs base; Jira id from branch name
-multi-agent finish PROJ-12345    # explicit Jira id for the Phase 7 comment
-multi-agent finish --base develop   # override base branch for the diff
-multi-agent finish autopilot        # no gate prompts: auto-fix, auto-PR, auto-comment
+multi-agent ship                   # current branch vs base; Jira id from branch name
+multi-agent ship PROJ-12345      # explicit Jira id for the Phase 7 comment
+multi-agent ship --base develop     # override base branch for the diff
+multi-agent ship autopilot          # no gate prompts: auto-fix, auto-PR, auto-comment
 ```
 
 ## Notes
 
 - Build+Test is the automated success gate (not the interactive device user-test  -  that is `multi-agent:manual-test`). If the repo has no tests, it reports "no tests present"  -  never fabricates results.
 - Commit/PR follows house rules: conventional message, `Ref: #N` (never Closes/Fixes), NO AI/bot attribution. PR opened only if one does not already exist.
-- Full phase contract lives in the Claude Code command `commands/multi-agent/finish/SKILL.md`; this skill is the Copilot-CLI counterpart.
+- Full phase contract lives in the Claude Code command `commands/multi-agent/ship/SKILL.md`; this skill is the Copilot-CLI counterpart.

package/pipeline/skills/shared/external/ios-coding-standard/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: ios-coding-standard
-description: "The iOS coding-standard rule registry: 95 stable-ID rules across readability, security, service layer, concurrency, testing, module boundaries, naming and visibility, each with a severity and enforcement kind. Use when writing or reviewing Swift and you need the project rule rather than an opinion, or on a persistence or logging question."
+description: "The iOS coding-standard rule registry: 99 stable-ID rules across readability, security, service layer, business rules, concurrency, testing, module boundaries, naming and visibility, each with a severity and enforcement kind. Use when writing or reviewing Swift and you need the project rule rather than an opinion, or on a persistence, logging or business-rule-placement question."
 user-invocable: true
+standards-registry: references/rules.yml
 ---
 
 # iOS coding standard
@@ -12,10 +13,20 @@ is not.
 
 | File | What it is | When to read it |
 |---|---|---|
-| `references/rules.yml` | 95 rules with stable IDs, severity, enforcement kind and a `check` describing what counts as a violation | before asserting that something is or is not a violation |
+| `references/rules.yml` | 99 rules with stable IDs, severity, enforcement kind and a `check` describing what counts as a violation | before asserting that something is or is not a violation |
 | `references/STANDARD.md` | the same rules taught with before/after Swift, for a human | when you need the reasoning or an example, not just the rule |
 | `references/swiftlint.draft.yml` | the mechanically-enforceable subset as a SwiftLint config | when wiring lint into a project |
 | `references/lint-local.sh` | runs that config over one module, with a baseline mode | when grandfathering existing violations so only new ones surface |
+| `modules/<Module>.yml` | per-module overlay: vocabulary bindings, dialect choices, zero-instance prohibitions, carve-outs, known findings. **Project-local, never shipped**  -  see `modules/_TEMPLATE.yml` | before auditing a module, and before raising any slot-bound rule |
+| `references/EXAMPLES.md` | optional, project-local: a worked ✗/✓ pair per judgement rule, keyed by ID, drawn from real code in YOUR repo | when citing a judgement rule, so the fix and the audit read the same picture |
+
+**Two files are deliberately absent from the shipped skill.** `modules/<Module>.yml` and
+`references/EXAMPLES.md` quote a specific codebase: module paths, symbol names, real call-site
+counts, before/after snippets. That is exactly what makes them useful and exactly why they cannot
+travel  -  a shipped overlay would bind slots to another project's dialect, and a shipped example
+would teach its naming. Write them in your own installation; `modules/_TEMPLATE.yml` carries the
+shape and the slot list. An absent overlay is not a neutral default: an unbound slot DISABLES its
+rules, and the audit reports that rather than guessing a dialect.
 
 ## How to use it
 
@@ -33,7 +44,7 @@ is not.
    `// standard:exception(<RULE-ID>) <reason> <expiry:YYYY-MM-DD>`. An unmarked
    deviation is a finding; a marked one is a decision.
 
-## Two decisions the registry answers, and code usually gets wrong
+## Three decisions the registry answers, and code usually gets wrong
 
 **Persistence.** Read `references/rules.yml → persistence_decision` before reaching for
 storage. The ladder starts at "does this value need to outlive the current flow?"
@@ -48,10 +59,20 @@ clamp or threshold, choosing a screen state, and policy defaults are **not** - e
 belongs to the view model, or to a named domain rule when several screens share it.
 Carry the wire value with its unit in the name and convert where it is read.
 
+**Where a business rule lives.** Read `references/rules.yml → RULE-01` before writing one. Three
+homes, cheapest rung first: the **view model** when one screen asks it  -  stop there, a namespace with
+one consumer is over-hoisting; a **computed property on the entity** when several screens ask it of
+data the entity already carries; a **named rule namespace** when several screens ask it but the
+answer is screen policy rather than entity state. `SVC-08` bans every other layer. The part usually
+skipped is the citation: a rule names the requirement it enforces and its test repeats that token, so
+one grep reaches requirement, code and test  -  and that citation is what makes a `judgement` rule
+checkable instead of an opinion.
+
 ## Rule families
 
 `READ` readability and section structure · `SEC` secrets, logging, storage ·
-`SVC` service layer and mapping · `TEST` testability seams · `MOD` module
+`SVC` service layer and mapping · `RULE` business-rule surface and traceability ·
+`TEST` testability seams · `MOD` module
 boundaries and imports · `NAME` naming · `FLEX` flexibility and extension points ·
 `CONC` concurrency · `VIS` visibility and access level · `UI` view construction ·
 `PERF` performance · `DEPR` deprecation and retirement.
@@ -61,9 +82,27 @@ boundaries and imports · `NAME` naming · `FLEX` flexibility and extension poin
 The registry is project-configurable, not project-specific: rule bodies describe
 shapes (a mapper doing arithmetic, a logger interpolating a token) rather than named
 modules. A project adds its own vocabulary through a `modules/<Module>.yml` overlay
-beside `references/rules.yml` - the module's terms, its allowed dependencies, its validation
+in the `modules/` directory - the module's terms, its allowed dependencies, its validation
 rules - which the audit binds on top of the shared registry. Nothing in the shared
 registry names a module, so it applies unchanged to any SwiftUI codebase.
+Copy `modules/_TEMPLATE.yml` to `modules/<YourModule>.yml` and bind the slots from evidence in your
+own code  -  each binding wants a count, not a preference, because the count is what tells a dialect
+choice apart from a defect.
+
+**Language scope is declared, not assumed.** The registry carries a top-level `scope:` block naming
+the languages and paths its rules apply to. This exists because the rule bodies below were written
+against Swift with SwiftUI view construction: applied unread to an Objective-C or UIKit file they
+would manufacture findings, which buries the real ones and teaches the reader to distrust the run.
+A consumer that cannot honour `scope` must load the registry as reference only and say so.
+
+**Some rules govern a choice, not a defect.** Where two shapes are each internally coherent and the
+only real cost is mixing them, the rule binds to a slot in `rules.yml → module_overlay_slots` -
+service-method naming, the navigation-exit spelling, the component directory's name. An **unbound
+slot disables its rules**, and the audit says so rather than defaulting to one dialect silently.
+This matters because the alternative is reporting a hundred findings against a module that made the
+other defensible choice, which is a migration proposal wearing a standards pass. A slot is only
+legitimate when both values are genuinely defensible: `UI-04` is the counter-example - a module with
+no copy surface has not chosen differently, it is missing the surface, so that rule is never slotted.
 
 `references/swiftlint.draft.yml` carries one placeholder worth changing per project: the remote
 image-host allowlist is set to `example.com`. Point it at your own CDN, or the rule

package/pipeline/skills/shared/external/ios-coding-standard/modules/_TEMPLATE.yml

@@ -0,0 +1,82 @@
+########################################################################
+# Module overlay template.
+#
+# Copy to `modules/<YourModule>.yml` and fill in from EVIDENCE IN YOUR OWN CODE.
+# A real overlay is never shipped with this skill: it quotes module paths, symbol
+# names and call-site counts, so it describes one codebase and would bind another
+# codebase's slots to the wrong dialect.
+#
+# The rule that makes this safe: an UNBOUND slot DISABLES its rules. Leaving a
+# slot empty costs you those checks and the audit says so. Guessing a value costs
+# you a hundred findings against a module that made the other defensible choice,
+# which is a migration proposal wearing a standards pass. Empty beats guessed.
+#
+# Every `*_evidence` field wants a COUNT, not a preference. The count is the only
+# thing that distinguishes "this module chose a dialect" from "this module has a
+# defect". No count, no binding.
+########################################################################
+
+module: <YourModule>
+path: <Path/To/Module>
+role: feature          # feature | common | app
+registry_version: 1.1.0
+updated: <YYYY-MM-DD>
+
+description: >
+  Per-module overlay for the shared registry. Carries what code cannot state: the vocabulary
+  bindings a rule needs to generate its check, the module's dialect choices, prohibitions that
+  currently have zero instances, deliberate carve-outs, and the real verification command.
+
+# --- Dialect slots -----------------------------------------------------
+# Bind only what you can evidence. See `rules.yml -> module_overlay_slots`
+# for what each slot governs and which values are defensible.
+dialect:
+  # Governs SVC-07. Values: send-path | domain-verb
+  ServiceNamingScheme:
+  ServiceNamingScheme_evidence: >
+    Count both spellings before binding, e.g. "N `func send<Path>` against M `func fetch<X>`".
+    The minority spelling is then the finding this rule should report. If the counts are close,
+    the module has not chosen  -  leave the slot unbound and raise the split as the finding.
+
+  # Governs NAME-01. Values: coordinator-event | output-closure
+  NavExitShape:
+  NavExitShape_evidence: >
+    Count typed event enums against output closures, and name the handler symbol the coordinator
+    applies.
+
+  # Governs READ-04b. Any consistent directory name; two names in one module is the violation.
+  ComponentsDir:
+
+# --- Vocabulary --------------------------------------------------------
+# Symbol and path slots the judgement rules need in order to generate a check.
+# An unfilled slot disables the rules that read it.
+vocabulary:
+  ScreenRoot: <Sources/<Module>/Screens>
+  ScreenRoleSuffixes: []      # e.g. [Scene, ViewModel, UseCase, Repository, Mapper]
+  HandlerName: "<Screen><Suffix>"
+
+# --- Sensitive data inventory -----------------------------------------
+# Drives SEC-01 in both directions: a sensitive value over-persisted, AND a
+# transient value persisted at all. Classify every one the module handles;
+# see `rules.yml -> sensitive_data_classes` for the classes and their at-rest
+# and loggable rules. An unclassified symbol cannot be checked.
+sensitive_data: []
+
+# --- Zero-instance prohibitions ---------------------------------------
+# Shapes this module has never contained and intends never to. Recording the
+# zero is what makes the first instance a regression instead of a debate.
+prohibitions: []
+
+# --- Carve-outs --------------------------------------------------------
+# Deliberate deviations, each with a rule ID and a reason. A carve-out here is
+# a decision; the same deviation unmarked in code is a finding. In-code form:
+#   // standard:exception(<RULE-ID>) <reason> <expiry:YYYY-MM-DD>
+carve_outs: []
+
+# --- Verification ------------------------------------------------------
+# The command that actually proves this module builds and its tests pass.
+# The audit runs this rather than assuming a scheme name.
+validation:
+  command:
+  notes: >
+    Name the real scheme/target. A wrong command that exits 0 is worse than no command.

package/pipeline/skills/shared/external/ios-coding-standard/references/STANDARD.md

@@ -14,14 +14,17 @@ flexibility · consistency.**
 
 1. Sensitive data goes in the Keychain, never in `UserDefaults`, and never into a log. `[SEC-01, SEC-03]`
 2. Never reach for the environment  -  inject time, storage, randomness, session. `[TEST-01]`
-3. One type per file; the file is named after it. `[STRUCT-01]`
+3. One type per file, named after it; split its concerns with `// MARK:`  -  business rules, service
+   calls and UI never share a section. `[STRUCT-01, READ-01]`
 4. A screen is a known set of files, always the same set. `[STRUCT-02]`
 5. Where a type lives is decided by how many things use it. `[STRUCT-05]`
 6. A feature module never imports another feature module. `[MOD-01]`
 7. Everything is `private` and `final` until something forces otherwise. `[VIS-01, VIS-02]`
-8. One request in, one result out  -  `async`, no completion handlers, no `throws`. `[SVC-01]`
-9. Split concerns with `// MARK:`  -  business rules, service calls and UI never share a section. `[READ-01]`
-10. Variants are configuration, not `if` trees. `[FLEX-02]`
+8. One request in, one outcome out  -  `async`, no completion handlers, no `throws` beside a result,
+   and the outcome is one closed enum the caller must handle exhaustively. `[SVC-01, SVC-09]`
+9. A business rule has a name and a home a test can reach without a view. `[RULE-01, SVC-08]`
+10. Variants are configuration, not `if` trees  -  and a screen's load state is one enum carrying its
+    payload, not four flags that permit impossible combinations. `[FLEX-02, NAME-06]`
 
 ---
 
@@ -101,6 +104,16 @@ private means a forgotten annotation fails safe; defaulting to public means it f
   not cached to disk by default. `[SEC-05]`
 - Analytics events, user properties and crash breadcrumbs are redacted  -  check the parameter
   list of every event you add. `[SEC-06]`
+
+  Redaction at the call site is a habit, not a mechanism: it works today and fails on the event
+  somebody adds next month. Three properties make it real. **One named helper** does the reduction,
+  so there is a single implementation to review and one thing to grep. **The typed event declares
+  only the reduced form**  -  a parameter that *can* hold the raw value eventually does. **And the
+  reduction has a test:** deterministic for the same input, different for different inputs, and the
+  output does not contain the input. Three cheap assertions that turn a claim into a property; an
+  untested reduction helper is a finding even when the code is correct. Truncation needs one extra
+  check hashing does not  -  that what remains cannot identify the subject alone, and cannot be joined
+  against another field in the same payload to do so.
 - Permissions are least-privilege with honest purpose strings; the privacy manifest matches what
   you actually collect. `[SEC-07, SEC-08]`
 - Debug menus, mock launch arguments and redirect shortcuts are **compiled out** of release, not
@@ -157,9 +170,56 @@ func submitGate(for passengers: [Passenger], isLoggedIn: Bool) -> SubmitGate {
 needs a session, a network stub and a view model instance to answer "what happens when a document
 is missing".
 
-Also: name test doubles for what they do  -  stub, spy, fake, mock  -  one kind per file, and keep
-the signature identical to the real type, because a drifted double is the first thing the next
-person copies. `[TEST-04, SVC-02]`
+Also: name test doubles for what they do  -  stub, spy, fake, mock, **builder**  -  one kind per file,
+and keep the signature identical to the real type, because a drifted double is the first thing the
+next person copies. A builder is the one most often missing: a base value plus chainable
+single-field overrides, so each test states only what it varies instead of restating a fifteen-field
+initialiser. `[TEST-04, SVC-02]`
+
+### Give the rule a name and a home `[RULE-01]`
+
+Three homes, and the ladder picks. **One screen asks it** → the view model; stop there, a namespace
+with one consumer is over-hoisting. **Several screens ask it of data the entity already carries** →
+a computed property on the entity, under `// MARK: - Derived`. **Several screens ask it but the
+answer is screen policy rather than entity state** → a named rule namespace.
+
+```swift
+// ✗ a private computed property on the scene; the next screen needing this re-derives it
+private var showsStrikethrough: Bool { viewModel.segment.historyInfo?.crossed == true }
+```
+```swift
+// ✓ a caseless enum of pure statics in the domain layer, each citing what it enforces
+enum ReservationRules {
+    /// BR-21: the overline strikes ONLY when `historyInfo.crossed` is true. When it is false the
+    /// history fields may still be populated (voluntary itinerary metadata)  -  do not strike then.
+    static func shouldRenderStrikethrough(_ segment: Segment) -> Bool {
+        segment.historyInfo?.crossed == true
+    }
+}
+```
+```swift
+// ✓ and the test repeats the citation token, so one grep reaches spec, code and test
+@Test("BR_21: no strikethrough when the segment is not crossed")
+func test_BR_21_noStrikethrough_whenNotCrossed() { ... }
+```
+**Why:** the citation is not decoration, it is the rule's own measurement. A namespace whose
+functions cite nothing cannot be checked against anything, and a cited requirement with no test of
+the same token is an untested requirement. What the namespace must NOT become is a Utils bucket: a
+value transform is `READ-04d`, a shape lowering is `SVC-08`, a form rule is `STRUCT-06`.
+
+### A null object may ship; a test double may not `[TEST-08]`
+
+A type that satisfies a protocol by doing nothing  -  no event sent, `nil` returned, empty list  -  is
+the honest default for a dependency a caller has legitimately not wired: a defaulted initialiser
+parameter, a canvas preview, an optional slot nobody configured yet. Name it consistently and let it
+live in production sources.
+
+A type that carries **canned payloads** does not. It ships sample data to users, grows the store
+binary, and can be resolved by accident because nothing but its name says it is not real. It belongs
+in the test target. Distinguish by payload, never by name: a `Mock` that returns nothing is a null
+object misnamed, and a `Noop` returning three sample records is a double in the wrong target. If a
+canned payload really is needed at runtime  -  a demo build, an offline mode  -  that is a debug
+affordance and `SEC-09` asks what removes it from the store build.
 
 ---
 
@@ -289,6 +349,14 @@ func fetchAreaCodeList() async -> Result     // standard:exception(SVC-07) scree
 tells you which service fires without opening the repository. It also survives the rename the
 other way round: when the backend renames an endpoint, the compiler shows you every screen.
 
+**This one is a module decision, not a universal.** The alternative  -  naming the method after what
+the domain asks for  -  reads better at the call site and survives an endpoint rename, at the cost of
+that grep. Both are defensible, so the rule binds to the `ServiceNamingScheme` overlay slot: it is
+active only where a module declared `send-path`, and what it then enforces is consistency with the
+module's own declared scheme, never conformity to a sibling's choice. Check the module's overlay
+before raising this. Same for the navigation-exit spelling `[NAME-01]` and the component directory's
+name `[READ-04b]`  -  see `rules.yml → module_overlay_slots`.
+
 ### A mapper moves values; it never decides `[SVC-08]`
 
 ```swift
@@ -319,6 +387,13 @@ from the view model that owns the behaviour, untestable without hand-building a
 duplicated the next time another screen needs the same decision. `?? ""` on an optional wire
 field is not a decision  -  it is the lowering itself.
 
+**Moving a rule out of a mapper is two edits, not one.** The reason these survive review is that
+deleting the decision also deletes the data it was computed from: the mapper stored `isFailure` and
+dropped `info.status`, so no later layer can re-derive it. First make the entity carry the raw
+inputs, then express the decision  -  and put it in one of the three homes `[RULE-01]` names, never as
+a stored field the mapper fills, because a stored field is indistinguishable from a wire value at
+every call site that reads it.
+
 ### Signatures read as the contract `[SVC-01]`
 
 ```swift
@@ -336,6 +411,75 @@ public func savePassengers(
 result family means one error channel instead of `throws` plus a result plus an optional. Past
 ~2 parameters at a service boundary, the parameters want to be a model.
 
+### The outcome is a closed enum `[SVC-09, SVC-05]`
+
+```swift
+// ✗ two outcome channels, so no switch over the result is ever exhaustive
+func checkAccess(identifier: String) async throws -> AccessResponse
+```
+```swift
+// ✓ one type enumerating every outcome the caller must handle
+enum AccessOutcome: Equatable, Sendable {
+    case dashboard(pnr: String?)                 // a success case may name a DESTINATION
+    case ticketEntrance(pnr: String?)
+    case serviceError(referenceCode: String?, message: String?)
+    case offline
+    case timeout
+}
+
+// ✓ and the transport error is projected in the data layer, never above it
+} catch let error as ServiceError {
+    return error.projected(offline: .offline, timeout: .timeout) {
+        .serviceError(referenceCode: $0, message: $1)
+    }
+}
+```
+**Why:** the compiler answers "is any outcome unhandled?", which no `catch` can, and a success case
+naming a destination is what this buys over a bare `Result<Payload, Error>`  -  the wire's redirect
+string is resolved into a case in the repository, so no raw string reaches the view model.
+
+**Where the line falls between this and `SVC-05`.** How a call can FAIL is a module fact: one shared
+failure vocabulary, one factory that projects the transport error onto it. What a screen does NEXT is
+a screen fact: its own outcome enum, with its own destinations. A screen enum is correct when its
+failure cases name the shared kinds; it is the violation when it respells them. Re-declaring the same
+offline / timeout / server triple in a dozen screen enums means a new failure kind is a dozen edits
+and the classifications drift apart  -  which is the `SVC-05` finding, not an argument against this
+shape.
+
+### The load state is one enum with its payload attached `[NAME-06]`
+
+```swift
+// ✗ four properties; `isLoading` with data present and an error set is a state nothing rejects
+var isLoading = false
+var reservation: Reservation?
+var errorMessage: String?
+var isOffline = false
+```
+```swift
+// ✓ the payload hangs off the case, and the enum answers questions so the view never destructures
+struct LoadedContent: Hashable {
+    let reservation: Reservation
+    /// `nil` when the passenger request failed but the reservation loaded  -  the screen still
+    /// renders its flights, the passenger area is simply not drawn.
+    let passengerArea: PassengerArea?
+}
+
+enum ScreenState: Hashable {
+    case idle, loading
+    case loaded(LoadedContent)
+    case error(ScreenError)
+
+    var isLoading: Bool { if case .loading = self { return true }; return false }
+}
+```
+Two more things to copy. **State the case you deliberately did not model, in the file:** "there is no
+`empty` case  -  a successful response always represents a populated record; an empty payload arrives
+as a not-found error." Without that line the next reader cannot tell a considered omission from an
+oversight and adds the case defensively. And **a secondary source that may fail is an optional slot
+inside the payload, not a second state**  -  say what `nil` means at the property. Promoting a
+non-critical failure to a screen-level error discards the data that did arrive; silently defaulting
+it to an empty value makes "absent" and "empty" indistinguishable.
+
 ### Visibility is documentation `[VIS-01, VIS-02, VIS-04]`
 
 Everything `private` and `final` until something forces otherwise. `public` only on what another
@@ -349,11 +493,26 @@ implementation detail explains itself through naming, a contract between two tea
 
 ### A screen is a known file manifest `[STRUCT-02, STRUCT-03]`
 
-`Scene · ViewModel · LocalizedText · CoordinatorEvent · AnalyticsTracking · UseCase · Repository
-(+protocol +mock) · Mapper + models`  -  each present when its responsibility exists, absent when it
-does not. An empty `LocalizedText` on a screen with no copy is noise, not compliance. Every screen
+`Scene · ViewModel · LoadState · CopySurface · NavigationExit · AnalyticsTracking · UseCase ·
+Repository (+protocol) · Mapper + models`  -  each present when its responsibility exists, absent when
+it does not. An empty copy surface on a screen with no copy is noise, not compliance. Every screen
 sits at the same depth with the same internal grouping, because people navigate by muscle memory.
 
+Two of those names are the module's to spell. The navigation-exit type is a `CoordinatorEvent` enum
+with a handler alias in some modules and an `Output` enum with a closure in others  -  both enumerate
+every exit in one place, which is the property that matters `[NAME-01]`. The test double is not on
+the list at all: it lives in the test target `[TEST-08]`.
+
+**Where the protocol/implementation split earns its keep `[STRUCT-08]`.** An implementation with a
+body  -  a repository doing request construction, mapping, cache reads, error projection  -  goes in its
+own file beside its protocol, so a reader opening the contract does not scroll past it. A use case
+that is a pure pass-through, forwarding one call to one collaborator, may keep protocol, live type
+and null object in one file: there is nothing to scroll past, and splitting forty of those produces
+eighty files whose names differ by a suffix. Decide by whether there is anything a reader must skip,
+never by the layer's name  -  and answer the same way across the module, because the cost of this rule
+is a reader guessing which file a type is in. (A pass-through use case also invites `SVC-01`'s
+question: what does it add over calling the repository? Separate finding.)
+
 ### Placement is a consumer count `[STRUCT-05]`
 
 | Consumers | Home |

package/pipeline/skills/shared/external/ios-coding-standard/references/lint-local.sh

@@ -16,7 +16,19 @@
 set -euo pipefail
 
 SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_ROOT="${IOS_STANDARD_WORK_ROOT:-$HOME/.claude/local/ios-coding-standard}"
+# Scratch root. `~/.claude` is one host's tree: defaulting there made a Copilot- or
+# Codex-only machine create a stray .claude directory just to hold lint output. Prefer
+# whichever host tree already exists, and fall back to a neutral location.
+if [ -n "${IOS_STANDARD_WORK_ROOT:-}" ]; then
+  WORK_ROOT="$IOS_STANDARD_WORK_ROOT"
+else
+  WORK_ROOT=""
+  for _host_dir in "$HOME/.claude" "$HOME/.copilot" "$HOME/.codex"; do
+    [ -d "$_host_dir" ] && { WORK_ROOT="$_host_dir/local/ios-coding-standard"; break; }
+  done
+  unset _host_dir
+  [ -n "$WORK_ROOT" ] || WORK_ROOT="${TMPDIR:-/tmp}/ios-coding-standard"
+fi
 DRAFT_CONFIG="$SKILL_DIR/swiftlint.draft.yml"
 
 MODULE_PATH="${1:-}"