@mmerterden/multi-agent-pipeline 13.5.0 → 14.0.0

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -75,7 +75,7 @@ Pipeline (after Phase 0)  -  shown as visual cards in terminal:
 Modes:
 
   (normal)             Full 8 phases, Sonnet dev, Plan Approval Gate active, parallel review + Fable triage
-  --dev                Fast: Init -> Dev(Opus) -> Commit -> Report (no plan gate)
+  --dev                Fast: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report
   --local              No worktree  -  works directly on local branch
   autopilot            Skip all confirmations INCLUDING plan gate, auto commit/PR
                        (EXCEPT Phase 7 channels menu  -  always pauses)
@@ -91,7 +91,7 @@ Dedicated commands (same as flags above):
   /multi-agent:local-autopilot "task"           = multi-agent "task" --local autopilot
   /multi-agent:dev-local "task"                 = multi-agent "task" --dev --local
   /multi-agent:dev-local-autopilot "task"       = multi-agent "task" --dev --local autopilot
-  /multi-agent:finish [jira-id] [autopilot]     Continue already-done LOCAL work: Review → Build+Test → PR → Jira analysis + test scenarios (no dev)
+  /multi-agent:ship [jira-id] [autopilot]     Continue already-done LOCAL work: Review → Build+Test → PR → Jira analysis + test scenarios (no dev)
 
 ------------------------------------------------------------
 
@@ -318,7 +318,7 @@ Pipeline (Phase 0'dan sonra)  -  terminalde görsel kart olarak görünür:
 Modlar:
 
   (normal)             Tam 8 faz, Sonnet dev, Plan Onay Kapısı aktif, paralel review + Fable triage
-  --dev                Hızlı: Init -> Dev(Opus) -> Commit -> Report (plan gate yok)
+  --dev                Hızlı: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report
   --local              Worktree yok  -  doğrudan local branch'te çalışır
   autopilot            Plan gate dahil tüm onayları atla, otomatik commit/PR
                        (İSTİSNA: Phase 7 channels menüsü  -  her zaman durur)
@@ -334,7 +334,7 @@ Dedicated komutlar (yukarıdaki flag'lerin eşdeğeri):
   /multi-agent:local-autopilot "task"           = multi-agent "task" --local autopilot
   /multi-agent:dev-local "task"                 = multi-agent "task" --dev --local
   /multi-agent:dev-local-autopilot "task"       = multi-agent "task" --dev --local autopilot
-  /multi-agent:finish [jira-id] [autopilot]     Lokalde biten işi sürdür: Review → Build+Test → PR → Jira teknik analiz + test senaryoları (dev yok)
+  /multi-agent:ship [jira-id] [autopilot]     Lokalde biten işi sürdür: Review → Build+Test → PR → Jira teknik analiz + test senaryoları (dev yok)
 
 ------------------------------------------------------------
 

package/pipeline/commands/multi-agent/ios-coding-standard/SKILL.md

@@ -1,6 +1,6 @@
 ---
-description: "Audit an iOS module against the shared coding-standard registry (95 stable-ID rules), produce a remediation plan, then hand off to dev/dev-local. Use for a standards pass on a module, or when a review needs rule IDs rather than opinions."
-description-tr: "Bir iOS modulunu paylasilan kodlama-standardi registry'sine (95 sabit-ID kural) gore denetler, duzeltme plani cikarir, sonra dev/dev-local'e devreder. Bir modulde standart gecisi icin, ya da bir review'un gorus yerine kural ID'si istedigi durumda kullan."
+description: "Audit an iOS module against the shared coding-standard registry (99 stable-ID rules), produce a remediation plan, then hand off to dev/dev-local. Use for a standards pass on a module, or when a review needs rule IDs rather than opinions."
+description-tr: "Bir iOS modulunu paylasilan kodlama-standardi registry'sine (99 sabit-ID kural) gore denetler, duzeltme plani cikarir, sonra dev/dev-local'e devreder. Bir modulde standart gecisi icin, ya da bir review'un gorus yerine kural ID'si istedigi durumda kullan."
 argument-hint: "[module name or path]"
 allowed-tools: Skill, Bash, Read, Edit, Write, AskUserQuestion
 ---

package/pipeline/commands/multi-agent/local-autopilot/SKILL.md

@@ -21,10 +21,10 @@ Run the full pipeline **without a worktree** and **with every confirmation skipp
 | `/multi-agent:autopilot "task"` | 7 phases (no User Test) | ✅ | ❌ (autopilot) |
 | `/multi-agent:local "task"` | 7 phases (no User Test) | ❌ | ✅ (interactive) |
 | **`/multi-agent:local-autopilot "task"`** | **7 phases (no User Test)** | **❌** | **❌ (autopilot)** |
-| `/multi-agent:dev "task"` | Init → Dev → Commit → Report | ✅ | ✅ |
-| `/multi-agent:dev-autopilot "task"` | Init → Dev → Commit → Report | ✅ | ❌ |
-| `/multi-agent:dev-local "task"` | Init → Dev → Commit → Report | ❌ | ✅ |
-| `/multi-agent:dev-local-autopilot "task"` | Init → Dev → Commit → Report | ❌ | ❌ (fastest) |
+| `/multi-agent:dev "task"` | Init → Dev → Review → Test → Commit → Report | ✅ | ✅ |
+| `/multi-agent:dev-autopilot "task"` | Init → Dev → Review → Commit → Report | ✅ | ❌ |
+| `/multi-agent:dev-local "task"` | Init → Dev → Review → Commit → Report | ❌ | ✅ |
+| `/multi-agent:dev-local-autopilot "task"` | Init → Dev → Review → Commit → Report | ❌ | ❌ (fastest) |
 
 ## What changes
 

package/pipeline/commands/multi-agent/resume/SKILL.md

@@ -10,7 +10,7 @@ argument-hint: "[#id]  -  optional: task ID (e.g. #2). If omitted, the most rece
 
 Resume a paused or failed task from the last successful phase.
 
-> **Not the same as `/multi-agent:finish`.** `resume` continues a **tracked pipeline task** (needs its `agent-state.json`/worktree) from where it stopped. `/multi-agent:finish` takes **ad-hoc local work** on the current branch (no prior task required) and runs the pipeline tail - Review → Build+Test → PR → Jira report - over it.
+> **Not the same as `/multi-agent:ship`.** `resume` continues a **tracked pipeline task** (needs its `agent-state.json`/worktree) from where it stopped. `/multi-agent:ship` takes **ad-hoc local work** on the current branch (no prior task required) and runs the pipeline tail - Review → Build+Test → PR → Jira report - over it.
 
 ## Steps
 

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -177,12 +177,12 @@ Scope note: a guide governs only files under its own directory  -  a guide found
 
 **Claude Code (2 in parallel):**
 - Agent 1: `claude-fable-5` → security + architecture
-- Agent 2: `claude-sonnet-4-6` → general quality
+- Agent 2: `claude-sonnet-5` → general quality
 
 **Copilot CLI (3 in parallel):**
-- Agent 1: `claude-opus-4-8` → security + architecture (Fable 5 is not offered on Copilot CLI)
+- Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
 - Agent 2: `gpt-5.4` → edge cases, alternate perspective
-- Agent 3: `claude-sonnet-4-6` → general quality
+- Agent 3: `claude-sonnet-5` → general quality
 
 Each reviewer receives the diff, the module review guides from Step 2b (when any were found), plus the standard reviewer system prompt (see `$HOME/.claude/multi-agent-refs/phases/phase-4-review.md` for the prompt contract). Output: structured `findings[]` per reviewer.
 
@@ -192,8 +192,8 @@ When release-relevant iOS/Android files change, load the matching catalog:
 
 | Platform | Trigger files | Catalog |
 |---|---|---|
-| iOS | `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/*App.swift`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/project.pbxproj` | `pipeline/skills/shared/core/apple-archive-compliance/SKILL.md`  -  18 rules + ITMS refs |
-| Android | `**/AndroidManifest.xml`, `**/build.gradle(.kts)`, `**/proguard-rules.pro`, `**/network_security_config.xml` | `pipeline/skills/shared/core/google-play-compliance/SKILL.md`  -  21 rules + Play policy refs |
+| iOS | `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/*App.swift`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/project.pbxproj` | `$HOME/.claude/skills/apple-archive-compliance/SKILL.md`  -  18 rules + ITMS refs |
+| Android | `**/AndroidManifest.xml`, `**/build.gradle(.kts)`, `**/proguard-rules.pro`, `**/network_security_config.xml` | `$HOME/.claude/skills/google-play-compliance/SKILL.md`  -  21 rules + Play policy refs |
 
 Each finding gets the `ruleID` from the catalog plus the platform policy ref:
 - iOS: `(apple-archive-compliance / info-plist  -  Guideline 5.1.1)`

package/pipeline/commands/multi-agent/scan/SKILL.md

@@ -45,7 +45,7 @@ A single command that scans `pipeline/skills/` (or optionally `~/.claude/skills/
 
 1. **Run the script:**
    ```bash
-   bash "$REPO_ROOT/pipeline/scripts/scan-skills.sh" $ARGUMENTS
+   bash "$HOME/.claude/scripts/scan-skills.sh" $ARGUMENTS
    ```
 
 2. **Interpret the output:**

package/pipeline/commands/multi-agent/search/SKILL.md

@@ -79,7 +79,7 @@ JSON mode  -  for embedded automation:
 
 1. **Run the script:**
    ```bash
-   bash "$REPO_ROOT/pipeline/scripts/search-logs.sh" "$ARGUMENTS"
+   bash "$HOME/.claude/scripts/search-logs.sh" "$ARGUMENTS"
    ```
 
 2. **Exit code:**

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -103,10 +103,8 @@ These are the RECOMMENDED key names. When creating NEW keys, use these. But exis
 | `bitbucket_user` | `${USER}_Bitbucket_Username` | `bitbucket` + (`user` or `name`) |
 | `github` | `${USER}_Github_Access_Token` | `github` or `gh` (exclude `ssh`) |
 | `confluence` | `${USER}_Confluence_Access_Token` | `confluence` |
-| `figma_pat` | `${USER}_Figma_Access_Token` | `figma` + (`token` or `pat` or `access`) + NOT `mcp` |
+| `figma` | `${USER}_Figma_Access_Token` | `figma` + (`token` or `pat` or `access`) + NOT `mcp` |
 | `figma_mcp` | `${USER}_Figma_Mcp_Access_Token` | `figma` + `mcp` |
-
-> Multi-agent setup onboards **both** Figma tokens because the pipeline's 3-tier Figma access chain (see `pipeline/rules/figma-pipeline.md`) uses them in priority order: Tier 1 = MCP (`figma_mcp`), Tier 2 = REST PAT (`figma_pat`), Tier 3 = user screenshot fallback. Missing either token forces a downshift; missing both leaves Tier 3 as the only path.
 | `fortify` | `${USER}_Fortify_Access_Token` | `fortify` |
 | `graylog` | `${USER}_Graylog_Access_Token` | `graylog` |
 | `firebase` | `${USER}_Firebase_Access_Json` | `firebase` (any variant: `sa`, `service`, `account`, `access`, `json`) |
@@ -116,6 +114,8 @@ These are the RECOMMENDED key names. When creating NEW keys, use these. But exis
 | `appstore_connect_apple_id` | `${USER}_AppStoreConnect_Apple_Id` | (`appstore` or `asc`) + (`apple` or `account` or `user`) |
 | `appstore_connect_password_item` | `${USER}_AppStoreConnect_Password_Item` | (`appstore` or `asc` or `altool`) + (`password` or `app_specific`) |
 
+> Multi-agent setup onboards **both** Figma tokens because the pipeline's 3-tier Figma access chain (see `$HOME/.claude/rules/figma-pipeline.md`) uses them in priority order: Tier 1 = MCP (`figma_mcp`), Tier 2 = REST PAT (`figma`), Tier 3 = user screenshot fallback. Missing either token forces a downshift; missing both leaves Tier 3 as the only path. The Tier 2 logical key is `figma`, not `figma_pat`: `figma_pat` is the pre-v13.6 name that `migrate-prefs.mjs` consolidates away, and writing a new mapping under it means the next migration deletes it.
+
 > The four App Store Connect entries are **iOS-only and optional**: skip them all and the pipeline still works, it just reports Gate 2 of `/multi-agent:testflight-validation` as `SKIPPED` (never as a pass). They mirror the Figma 3-tier shape  -  Tier 1 = API key (`appstore_connect_key_id` + `appstore_connect_issuer_id`), Tier 2 = Apple ID + app-specific password (`appstore_connect_apple_id` + `appstore_connect_password_item`), Tier 3 = nothing configured. **Offer Tier 2 first when the user says they cannot create an API key**: creating one needs an Admin or App Manager role in App Store Connect, while an app-specific password is generated by the account holder at `appleid.apple.com` with no team permission at all. Two of these hold identifiers rather than secrets (key id, issuer id) and one holds a keychain ITEM NAME, not a password  -  they still go through the mapping layer so every credential is read the same way. Onboarding mechanics in Step 3b.
 
 **1c. Resolution logic (per service):**
@@ -193,7 +193,7 @@ Save the resolved mapping to preferences:
       "bitbucket_user": "${USER}_Bitbucket_Username",
       "github": "${USER}_Github",
       "confluence": null,
-      "figma_pat": "${USER}_Figma_Access_Token",
+      "figma": "${USER}_Figma_Access_Token",
       "figma_mcp": "${USER}_Figma_Mcp_Access_Token",
       "fortify": null,
       "graylog": null,
@@ -761,7 +761,7 @@ Clipboard helpers (`pbpaste`, `pbcopy`) are macOS-specific  -  for Copilot CLI o
 | `pbpaste` | `xclip -selection clipboard -o` (X11) or `wl-paste` (Wayland) | Install with `apt install xclip` or `apt install wl-clipboard` |
 | `pbcopy < /dev/null` | `xclip -selection clipboard < /dev/null` or `wl-copy --clear` | Same intent: clear clipboard after token paste |
 
-If you need to bypass the helper (debugging, raw inspection), the underlying platform commands are documented at the top of `pipeline/lib/credential-store.sh`. Otherwise stay on the helper  -  it keeps secrets off argv (stdin sentinel `-`) and writes both `-l` and `-s` attributes on macOS.
+If you need to bypass the helper (debugging, raw inspection), the underlying platform commands are documented at the top of `$HOME/.claude/lib/credential-store.sh`. Otherwise stay on the helper  -  it keeps secrets off argv (stdin sentinel `-`) and writes both `-l` and `-s` attributes on macOS.
 
 If no backend is available, setup falls back to a plain-text prompt + a warning that the token is **not persisted**  -  pipeline phases will re-ask each session.
 
@@ -776,7 +776,7 @@ Standard key names (used when creating NEW tokens). Discovery may find existing
 | `bitbucket_user` | `${USER}_Bitbucket_Username` | Plain text | Bitbucket profile username |
 | `github` | `${USER}_Github_Access_Token` | PAT | GitHub Settings -> Tokens (scopes: repo, read:org, project) |
 | `confluence` | `${USER}_Confluence_Access_Token` | PAT | Confluence -> Profile -> Personal Access Tokens (VPN required) |
-| `figma_pat` | `${USER}_Figma_Access_Token` | PAT (Tier 2, REST API) | Figma Developer Settings (max 90 days). Token Save Flow prompt copy: "Figma Personal Access Token (for Tier 2)". |
+| `figma` | `${USER}_Figma_Access_Token` | PAT (Tier 2, REST API) | Figma Developer Settings (max 90 days). Token Save Flow prompt copy: "Figma Personal Access Token (for Tier 2)". |
 | `figma_mcp` | `${USER}_Figma_Mcp_Access_Token` | OAuth (Tier 1, MCP) | Automatic via Claude Code Figma MCP remote auth. Token Save Flow prompt copy: "Figma MCP token (for Tier 1)". |
 | `fortify` | `${USER}_Fortify_Access_Token` | API Token | Fortify SSC -> Token Management (VPN required) |
 | `graylog` | `${USER}_Graylog_Access_Token` | PAT (API Basic `<token>:token`) | Graylog -> System -> Users and Teams -> Edit Tokens (VPN required). Auth is HTTP Basic with the token as username and literal `token` as password. |

package/pipeline/commands/multi-agent/{finish → ship}/SKILL.md

@@ -4,11 +4,11 @@ description-tr: "Halihazırda bitmiş LOKAL işi pipeline kuyruğundan geçirir:
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, TaskList, TaskGet, AskUserQuestion, WebFetch, WebSearch, Skill
 ---
 
-# multi-agent finish  -  Ship Local Work Through the Pipeline Tail
+# multi-agent ship  -  Take Existing Branch Work Through the Pipeline Tail
 
 > **Language (read FIRST)**: Before any status output, read `prefs.global.outputLanguage` and render every conversational line in it. `AskUserQuestion` and external payloads stay English. Full contract: `$HOME/.claude/multi-agent-refs/rules.md` "Language Application".
 
-You already did the work locally  -  wrote code on the current branch and maybe tested it by hand (or ran `/multi-agent:local` / `/multi-agent:dev-local`, which skip Review + Test). `/multi-agent:finish` picks up from there and runs the **pipeline tail** over that existing local work in one command: parallel review, a build + test success gate, commit/push + PR, then the technical analysis and a **Jira comment with test scenarios**. It does NOT re-develop  -  Analysis / Planning / Dev (phases 1-3) are intentionally skipped; the diff already on the branch IS the input.
+You already did the work locally  -  wrote code on the current branch and maybe tested it by hand, or committed it outside the pipeline entirely. (As of v14.0.0 the `--dev` family reviews its own output, so this command is for work that had no pipeline run behind it, not a patch for a mode that skipped review.) `/multi-agent:ship` picks up from there and runs the **pipeline tail** over that existing local work in one command: parallel review, a build + test success gate, commit/push + PR, then the technical analysis and a **Jira comment with test scenarios**. It does NOT re-develop  -  Analysis / Planning / Dev (phases 1-3) are intentionally skipped; the diff already on the branch IS the input.
 
 ## When to use it
 
@@ -24,10 +24,10 @@ You already did the work locally  -  wrote code on the current branch and maybe
 ## Input
 
 ```bash
-/multi-agent:finish                       # current branch vs its base; resolve Jira id from branch name
-/multi-agent:finish PROJ-12345          # bind to an explicit Jira id for the Phase 7 comment
-/multi-agent:finish --base develop         # override the base branch for the diff
-/multi-agent:finish autopilot              # no gate prompts: auto-fix blocking findings, auto-PR, auto-comment
+/multi-agent:ship                       # current branch vs its base; resolve Jira id from branch name
+/multi-agent:ship PROJ-12345          # bind to an explicit Jira id for the Phase 7 comment
+/multi-agent:ship --base develop         # override the base branch for the diff
+/multi-agent:ship autopilot              # no gate prompts: auto-fix blocking findings, auto-PR, auto-comment
 ```
 
 ## Pipeline
@@ -40,7 +40,7 @@ Phase 6: Commit        → commit remaining local changes + push + open PR if no
 Phase 7: Report        → technical analysis + Jira comment with test scenarios (channels: Jira / PR / Confluence / Wiki)
 ```
 
-Phases 1-3 (Analysis / Planning / Dev) are skipped by design  -  `finish` treats the current branch's local changes as the Phase 3 output.
+Phases 1-3 (Analysis / Planning / Dev) are skipped by design  -  `ship` treats the current branch's local changes as the Phase 3 output.
 
 ## Phase 0  -  Context resolution (finish-specific)
 
@@ -54,10 +54,10 @@ Phases 1-3 (Analysis / Planning / Dev) are skipped by design  -  `finish` treats
 
 - **Phase 4 Review** - run per `$HOME/.claude/multi-agent-refs/phases/phase-4-review.md` against the resolved diff: deterministic gates (Step 1.x), stack-specific parallel reviewers (Fable + Sonnet on Claude Code; GPT + Opus + Sonnet on Copilot CLI), Fable triage → `triage.accepted`. Blocking/important accepted findings:
   - interactive: present them and ask (`AskUserQuestion`) whether to fix now (loop back through a minimal Phase-3-style TDD fix) or proceed;
-  - `autopilot` (or `prefs.global.finish.autoFix == true`): auto-fix accepted blocking/important findings, then re-review the fix, before advancing.
+  - `autopilot` (or `prefs.global.ship.autoFix == true`): auto-fix accepted blocking/important findings, then re-review the fix, before advancing.
 - **Phase 5 Build+Test** - the **automated success gate** (this is what "build+test success" means here; the interactive device user-test is `/multi-agent:manual-test`). Stack-aware: build via `figma-config.build` (iOS scheme / Android gradle / detected backend/frontend build) and run the existing test suite if present (`swift test` / `xcodebuild test` / `./gradlew test` / `pytest` / `npm test` / `vitest`). Require success to advance; on failure, surface logs and (interactive) stop or (autopilot) attempt a bounded fix loop. **If the repo has no tests, report "no tests present" - never fabricate test results.**
-- **Phase 6 Commit/PR** - per `$HOME/.claude/multi-agent-refs/phases/phase-6-commit.md`: stage + commit any remaining local changes with a conventional message (`{type}(scope): desc [{JIRA_KEY}-{id}]`), push, and open a PR **only if one does not already exist** for the branch. PR body per `$HOME/.claude/rules/pipeline-output-formatting.md` and `$HOME/.claude/rules/git-conventions.md` - `Ref: #N` / `Related: #N`, never `Closes/Fixes/Resolves`; NO AI/bot attribution anywhere.
-- **Phase 7 Report** - per `$HOME/.claude/multi-agent-refs/phases/phase-7-report.md` + `channels.md`: produce the **technical analysis** and **test scenarios**, then post to the configured channels. Default content for `finish`: a Jira **comment** carrying the technical analysis + the test scenarios (and, when the PR was opened, the PR description). Every body runs through the humanizer; bot/tool/AI signatures are FORBIDDEN in comments.
+- **Phase 6 Commit/PR** - per `$HOME/.claude/multi-agent-refs/phases/phase-6-commit.md`: stage + commit any remaining local changes with a conventional message (`{type}(scope): desc [{JIRA_KEY}-{id}]`), push, and open a PR **only if one does not already exist** for the branch. PR body per `$HOME/.claude/multi-agent-refs/rules.md "External System Outputs"` and `$HOME/.claude/rules/git-conventions.md` - `Ref: #N` / `Related: #N`, never `Closes/Fixes/Resolves`; NO AI/bot attribution anywhere.
+- **Phase 7 Report** - per `$HOME/.claude/multi-agent-refs/phases/phase-7-report.md` + `channels.md`: produce the **technical analysis** and **test scenarios**, then post to the configured channels. Default content for `ship`: a Jira **comment** carrying the technical analysis + the test scenarios (and, when the PR was opened, the PR description). Every body runs through the humanizer; bot/tool/AI signatures are FORBIDDEN in comments.
 
 ## Modes
 
@@ -66,7 +66,7 @@ Phases 1-3 (Analysis / Planning / Dev) are skipped by design  -  `finish` treats
 
 ## Required: Phase Tracker Contract
 
-**The phase tracker is required.** Full spec: [`$HOME/.claude/multi-agent-refs/tracker-contract.md`]($HOME/.claude/multi-agent-refs/tracker-contract.md). `finish` registers its active phase set  -  `0:Init 4:Review 5:Build+Test 6:Commit 7:Report`  -  but NEVER resets a tracker that an earlier run already built (load-or-continue; contract section "Continuation runs"):
+**The phase tracker is required.** Full spec: [`$HOME/.claude/multi-agent-refs/tracker-contract.md`]($HOME/.claude/multi-agent-refs/tracker-contract.md). `ship` registers its active phase set  -  `0:Init 4:Review 5:Build+Test 6:Commit 7:Report`  -  but NEVER resets a tracker that an earlier run already built (load-or-continue; contract section "Continuation runs"):
 
 ```bash
 # Phase 0, first shell call (every CLI). init ONLY when no prior state exists -
@@ -104,5 +104,5 @@ No TaskList widget. After every state change call `bash $HOME/.claude/scripts/ph
 ```bash
 /multi-agent:dev-local "PROJ-12345"     # develop locally (Init→Dev→Commit→Report, no review/test)
 # ... you inspect / hand-test the change ...
-/multi-agent:finish                        # now: review + build/test + PR + Jira analysis & test scenarios
+/multi-agent:ship                        # now: review + build/test + PR + Jira analysis & test scenarios
 ```

package/pipeline/commands/multi-agent/testflight-validation/SKILL.md

@@ -205,7 +205,7 @@ Rules for the report:
 - No AI or assistant attribution anywhere, per
   `$HOME/.claude/rules/git-conventions.md`.
 - Real newlines, no HTML entities, per
-  `$HOME/.claude/rules/pipeline-output-formatting.md`.
+  `$HOME/.claude/multi-agent-refs/rules.md "External System Outputs"`.
 
 ## Step 8  -  offer the next action, do not take it
 

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -89,8 +89,11 @@ Update the pipeline in one command. Existing preferences are preserved; only ski
    ```bash
    echo ""
    echo "Verification:"
-   cd "$PIPE_DIR" && bash pipeline/scripts/smoke-schema-validation.sh 2>&1 | tail -1
-   bash pipeline/scripts/smoke-cross-cli-behavior.sh 2>&1 | tail -1
+   # Repo-relative on purpose: these are maintainer smokes, excluded from installs.
+   # Both lines name $PIPE_DIR rather than relying on the cd from the line above,
+   # so neither can be read - or copied - as an installed-tree invocation.
+   bash "$PIPE_DIR/pipeline/scripts/smoke-schema-validation.sh" 2>&1 | tail -1
+   bash "$PIPE_DIR/pipeline/scripts/smoke-cross-cli-behavior.sh" 2>&1 | tail -1
    ```
 
 ## Output

package/pipeline/commands/sim-test.md

@@ -133,7 +133,7 @@ Step A  -  run the standard visual + accessibility sweep (light + dark + large t
 
 Step B  -  dispatch compliance skill:
   iOS:
-    Load pipeline/skills/shared/core/apple-archive-compliance/SKILL.md
+    Load $HOME/.claude/skills/apple-archive-compliance/SKILL.md
     Prereq: @mmerterden/dev-toolkit-mcp ≥ v2.9.0 (provides ios_app_store_audit MCP tool)
              -  installable via npm; standalone ArchiveGuard binary deprecated in v8.4.0
     Artifact: pick newest .xcarchive under ~/Library/Developer/Xcode/Archives/**
@@ -142,7 +142,7 @@ Step B  -  dispatch compliance skill:
               OR (Node fallback): node -e "import('@mmerterden/dev-toolkit-mcp/tools/ios-app-store-audit/index.js').then(m => m.runAudit({ archivePath: '<path>', rules: 'all' }).then(r => console.log(JSON.stringify(r))))"
               Humanize via --lang en (promptLanguage is locked to "en"; pass --lang=tr explicitly to opt into Turkish)
   Android:
-    Load pipeline/skills/shared/core/google-play-compliance/SKILL.md
+    Load $HOME/.claude/skills/google-play-compliance/SKILL.md
     Prereq: bundletool, aapt2, apksigner in PATH (Android SDK build-tools)
     Artifact: newest .aab under **/build/outputs/bundle/**/*.aab
               OR explicit path argument

package/pipeline/lib/credential-store-resolver.sh

@@ -31,6 +31,22 @@
 #      always succeeds by design, so the caller stays alive to report a useful error.
 
 resolve_credential_store() {
+  # An explicit override wins. The usage note below has always documented
+  # `CRED_STORE` as an override, but this function used to assign over it
+  # unconditionally, so setting it did nothing whenever any host tree happened to
+  # carry a credential-store.sh - which is every normal machine. Honour it, and
+  # require it to be executable so a typo surfaces here rather than as a confusing
+  # failure three layers down.
+  if [ -n "${CRED_STORE:-}" ]; then
+    if [ -x "$CRED_STORE" ]; then
+      export CRED_STORE
+      return 0
+    fi
+    echo "credential helper: CRED_STORE is set to '$CRED_STORE', which is not executable." >&2
+    echo "Unset it to fall back to the installed helpers, or point it at a real file." >&2
+    return 1
+  fi
+
   # All three supported hosts. Codex was missing here, so a Codex-only install could
   # not resolve the credential helper at all - every fetcher on that host reported
   # "credential helper not found" while the file sat in ~/.codex/lib.

package/pipeline/lib/credential-store.sh

@@ -94,10 +94,18 @@ require_cmd() {
 # entries whose name already equals the logical key).
 PREFS_FILE="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
 
+# Reader order is python3 then node, and both are here on purpose. python3 is present
+# on macOS and every mainstream Linux; node is guaranteed wherever this pipeline is
+# installed at all, because the installer IS a node program. Windows commonly has node
+# and no python3, and with a python3-only reader the mapping was skipped there in
+# silence: the lookup fell back to the LOGICAL key, searched Credential Manager for a
+# target that does not exist, and reported the token as missing while it sat under its
+# mapped name. A missing interpreter must not look like a missing token.
 resolve_key() {
   local logical="$1" mapped=""
-  if [ -f "$PREFS_FILE" ] && command -v python3 >/dev/null 2>&1; then
-    mapped=$(python3 -c '
+  if [ -f "$PREFS_FILE" ]; then
+    if command -v python3 >/dev/null 2>&1; then
+      mapped=$(python3 -c '
 import json, sys
 try:
     with open(sys.argv[1], encoding="utf-8") as fh:
@@ -108,6 +116,19 @@ name = prefs.get("global", {}).get("keychainMapping", {}).get(sys.argv[2])
 if isinstance(name, str) and name.strip():
     sys.stdout.write(name.strip())
 ' "$PREFS_FILE" "$logical" 2>/dev/null || true)
+    fi
+    if [ -z "$mapped" ] && command -v node >/dev/null 2>&1; then
+      mapped=$(node -e '
+try {
+  const prefs = JSON.parse(require("fs").readFileSync(process.argv[1], "utf-8"));
+  const name = ((prefs.global || {}).keychainMapping || {})[process.argv[2]];
+  if (typeof name === "string" && name.trim()) process.stdout.write(name.trim());
+} catch { /* no mapping readable - caller falls back to the logical key */ }
+' "$PREFS_FILE" "$logical" 2>/dev/null || true)
+    fi
+    if [ -z "$mapped" ] && ! command -v python3 >/dev/null 2>&1 && ! command -v node >/dev/null 2>&1; then
+      echo "WARN: neither python3 nor node found; keychainMapping ignored, looking up '$logical' verbatim." >&2
+    fi
   fi
   printf '%s' "${mapped:-$logical}"
 }
@@ -239,8 +260,23 @@ do_delete() {
 do_list() {
   case "$PLATFORM" in
     macos)
+      # Read `svce` - the SERVICE attribute, which is what `set` writes with -s and
+      # `get` looks up with -s. This used to read `0x00000007`, which is the LABEL:
+      # it happens to match for items written by keychain.py (which stamps both -l and
+      # -s), but it is the wrong key in principle and diverges on any item whose label
+      # was set independently, listing a name `get` cannot resolve.
+      #
+      # `dump-keychain` prints the first few attributes under numeric tags and the rest
+      # under named ones, and `svce` is in the named group - so the tag to match is
+      # `"svce"`, not `0x00000008`.
+      #
+      # Without `-d` this reads attributes only and does not prompt for access; only
+      # the data-dumping form does.
+      #
+      # A trailing `\000` appears when security prints the value in its hex+C-string
+      # form; it is not part of the service name.
       security dump-keychain 2>/dev/null \
-        | awk -F'"' '/0x00000007 <blob>=/{print $2}' \
+        | awk -F'"' '/"svce"<blob>=/ && NF >= 5 { v = $4; sub(/\\000$/, "", v); if (v != "") print v }' \
         | sort -u
       ;;
     linux)
@@ -287,7 +323,14 @@ do_doctor() {
       fi
       ;;
     *)
-      echo "Backend:         (no platform support  -  falling back to env vars)"
+      # This used to advertise an env-var fallback. There isn't one here: `get` on an
+      # unrecognised platform exits 2. Individual callers have their own env escape
+      # hatches (figma-token.sh honours $FIGMA_PAT, for instance), but this helper
+      # does not, and claiming otherwise sent people looking for a mechanism that
+      # does not exist.
+      echo "Backend:         none  -  unrecognised platform, \`get\` exits 2"
+      echo "Workaround:      set the credential in the caller's own env var where one"
+      echo "                 exists (e.g. FIGMA_PAT), or run on macOS / Linux / Windows"
       ;;
   esac
 }

package/pipeline/lib/fetch-figma-annotations.sh

@@ -16,9 +16,10 @@
 #                              [--lang-prefixes TR,EN] [--batch 4]
 #   fetch-figma-annotations.sh --url <figma-url> [--lang-prefixes TR,EN]
 #
-# Token source: credential-store.sh get <logical-key>, where <logical-key> is
-# read from prefs.global.keychainMapping.figma_pat. Falls back to the FIGMA_PAT
-# environment variable. No literal keychain service name is embedded here.
+# Token source: figma-token.sh, which resolves the canonical `figma` logical key
+# through credential-store.sh (falling back to the legacy `figma_pat` key, then
+# to the FIGMA_PAT environment variable). No literal keychain service name is
+# embedded here.
 #
 # Label parsing (config-driven via --lang-prefixes, ordered):
 #   prefixed  : lines like "TR: ...", "EN: ..." win regardless of order
@@ -37,7 +38,6 @@
 
 set -uo pipefail
 
-PREFS="$HOME/.claude/multi-agent-preferences.json"
 # Locate the resolver with an existence check, not a `.`-chain: sourcing a missing file
 # aborts the shell under `set -e`, `||` included, so a chain skips both its later
 # candidates and its trailing `|| true`. A missing store is tolerated here - CRED_STORE
@@ -57,6 +57,26 @@ for _cred_resolver in \
 done
 unset _cred_resolver
 CRED_STORE="${CRED_STORE:-}"
+
+# Tier 2 token lookup lives in one file so it cannot drift per fetcher. Same
+# existence-check discipline as the resolver loop above, and the same tolerance:
+# without it, resolution still works through the FIGMA_PAT env fallback below.
+for _figma_token_lib in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/figma-token.sh" \
+  "$HOME/.claude/lib/figma-token.sh" \
+  "$HOME/.copilot/lib/figma-token.sh" \
+  "$HOME/.codex/lib/figma-token.sh"; do
+  [ -f "$_figma_token_lib" ] || continue
+  # shellcheck source=/dev/null
+  . "$_figma_token_lib" 2>/dev/null || true
+  if command -v resolve_figma_token >/dev/null 2>&1; then break; fi
+done
+unset _figma_token_lib
+if ! command -v resolve_figma_token >/dev/null 2>&1; then
+  resolve_figma_token() { [ -n "${FIGMA_PAT:-}" ] && printf '%s' "$FIGMA_PAT"; }
+  figma_token_remediation() { printf 'figma-token.sh not found - reinstall the pipeline, or export FIGMA_PAT.'; }
+fi
+
 FIGMA_API="https://api.figma.com/v1"
 HTTP_TIMEOUT=60
 
@@ -92,32 +112,10 @@ fi
 [ -z "$FILE_KEY" ] && die 1 "missing --file-key (or a --url to parse it from)"
 [ -z "$NODE_IDS" ] && die 1 "missing --node-id (or a --url to parse it from)"
 
-# Resolve the Figma PAT (keychain via prefs mapping, then FIGMA_PAT env).
-resolve_token() {
-  local token_key=""
-  if [ -f "$PREFS" ] && command -v python3 >/dev/null 2>&1; then
-    token_key=$(python3 -c "
-import json
-try:
-    p = json.load(open('$PREFS'))
-    print(p.get('global', {}).get('keychainMapping', {}).get('figma_pat') or '')
-except Exception:
-    print('')
-" 2>/dev/null || true)
-  fi
-  if [ -n "$token_key" ] && [ -n "$CRED_STORE" ] && [ -x "$CRED_STORE" ]; then
-    local tok
-    tok=$("$CRED_STORE" get "$token_key" 2>/dev/null || true)
-    if [ -n "$tok" ]; then printf '%s' "$tok"; return 0; fi
-  fi
-  if [ -n "${FIGMA_PAT:-}" ]; then printf '%s' "$FIGMA_PAT"; return 0; fi
-  return 1
-}
-
-FIGMA_TOKEN=$(resolve_token || true)
+FIGMA_TOKEN=$(resolve_figma_token || true)
 if [ -z "$FIGMA_TOKEN" ]; then
   printf '{"ok":false,"reason":"missing-token","source":"figma-rest","fileKey":"%s"}\n' "$FILE_KEY"
-  die 2 "no Figma PAT (map prefs.global.keychainMapping.figma_pat or set FIGMA_PAT)"
+  die 2 "$(figma_token_remediation)"
 fi
 
 TMPDIR_A=$(mktemp -d "${TMPDIR:-/tmp}/figma-annot.XXXXXX")

package/pipeline/lib/figma-screenshot.sh

@@ -23,10 +23,10 @@
 #   Tier 2 (Figma REST + PAT)     -> primary path here
 #   Tier 3 (user screenshot)      -> not handled; exit 3 with guidance
 #
-# Token source: credential-store.sh get <logical-key>, where <logical-key>
-# is read from prefs.global.keychainMapping.figma_pat. Falls back to the
-# FIGMA_PAT environment variable. No literal keychain service name is
-# embedded in this script.
+# Token source: figma-token.sh, which resolves the canonical `figma` logical
+# key through credential-store.sh (falling back to the legacy `figma_pat` key,
+# then to the FIGMA_PAT environment variable). No literal keychain service name
+# is embedded in this script.
 #
 # Exit codes:
 #   0  success
@@ -41,7 +41,6 @@ set -euo pipefail
 
 # --- Globals ----------------------------------------------------------------
 
-PREFS="$HOME/.claude/multi-agent-preferences.json"
 # Locate the resolver with an existence check, not a `.`-chain: sourcing a missing file
 # aborts the shell under `set -e`, `||` included, so a chain skips both its later
 # candidates and its trailing `|| true`. A missing store is tolerated here - CRED_STORE
@@ -61,6 +60,26 @@ for _cred_resolver in \
 done
 unset _cred_resolver
 CRED_STORE="${CRED_STORE:-}"
+
+# Tier 2 token lookup lives in one file so it cannot drift per fetcher. Same
+# existence-check discipline as the resolver loop above, and the same tolerance:
+# without it, resolution still works through the FIGMA_PAT env fallback.
+for _figma_token_lib in \
+  "$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)/figma-token.sh" \
+  "$HOME/.claude/lib/figma-token.sh" \
+  "$HOME/.copilot/lib/figma-token.sh" \
+  "$HOME/.codex/lib/figma-token.sh"; do
+  [ -f "$_figma_token_lib" ] || continue
+  # shellcheck source=/dev/null
+  . "$_figma_token_lib" 2>/dev/null || true
+  if command -v resolve_figma_token >/dev/null 2>&1; then break; fi
+done
+unset _figma_token_lib
+if ! command -v resolve_figma_token >/dev/null 2>&1; then
+  resolve_figma_token() { [ -n "${FIGMA_PAT:-}" ] && printf '%s' "$FIGMA_PAT"; }
+  figma_token_remediation() { printf 'figma-token.sh not found - reinstall the pipeline, or export FIGMA_PAT.'; }
+fi
+
 FIGMA_API="https://api.figma.com/v1"
 PARALLEL_DL=4
 HTTP_TIMEOUT=60
@@ -105,8 +124,8 @@ Options:
   --help           Show this help text and exit.
 
 Token resolution:
-  Read via credential-store.sh using
-  prefs.global.keychainMapping.figma_pat. Falls back to FIGMA_PAT env.
+  Read via credential-store.sh using prefs.global.keychainMapping.figma
+  (legacy figma_pat still honoured). Falls back to FIGMA_PAT env.
 
 Output:
   PNG files plus manifest.json in the output directory.
@@ -151,35 +170,6 @@ print(f"{file_key}\t{node}")
 PY
 }
 
-resolve_token() {
-  # 1) Try the keychain via credential-store.sh, keyed by prefs mapping.
-  local token_key=""
-  if [ -f "$PREFS" ] && command -v python3 >/dev/null 2>&1; then
-    token_key=$(python3 -c "
-import json, sys
-try:
-    p = json.load(open('$PREFS'))
-    print(p.get('global', {}).get('keychainMapping', {}).get('figma_pat') or '')
-except Exception:
-    print('')
-" 2>/dev/null || true)
-  fi
-  if [ -n "$token_key" ] && [ -x "$CRED_STORE" ]; then
-    local tok
-    tok=$("$CRED_STORE" get "$token_key" 2>/dev/null || true)
-    if [ -n "$tok" ]; then
-      printf '%s' "$tok"
-      return 0
-    fi
-  fi
-  # 2) Env fallback so CI / one-shot use still works.
-  if [ -n "${FIGMA_PAT:-}" ]; then
-    printf '%s' "$FIGMA_PAT"
-    return 0
-  fi
-  return 1
-}
-
 # curl_figma <output> <url>
 # Honours retries: 429 retries once after a 5s pause; 5xx uses exponential
 # backoff (1s, 2s, 4s). Writes the body to <output>, returns the HTTP code on
@@ -409,11 +399,10 @@ require_cmd python3
 # Tier 1 (Figma MCP) is not reachable from a bash script. Stay on Tier 2 (REST).
 log "INFO: Tier 1 (Figma MCP) not available from shell; using Tier 2 (REST)."
 
-FIGMA_TOKEN=$(resolve_token || true)
+FIGMA_TOKEN=$(resolve_figma_token || true)
 if [ -z "${FIGMA_TOKEN:-}" ]; then
   log "Tier 3 (user-provided screenshot required): no PAT resolved."
-  log "Hint: store the token via credential-store.sh, mapped through"
-  log "      prefs.global.keychainMapping.figma_pat, or export FIGMA_PAT."
+  log "Hint: $(figma_token_remediation)"
   exit 3
 fi