@mmerterden/multi-agent-pipeline 13.5.1 → 14.0.0

package/pipeline/multi-agent-refs/phases/phase-4-review.md

@@ -16,14 +16,14 @@ xcodebuild ... 2>&1 | tee "$WORKTREE/.build.log"
 # Gate 3: Tests pass (xcodebuild test/gradle test/pytest/npm test)  -  tee output to a log
 <test-command> 2>&1 | tee "$WORKTREE/.test.log"
 # Gate 4: Secrets  -  run the scanner against the staged diff
-bash pipeline/scripts/pre-commit-check.sh
+bash $HOME/.claude/scripts/pre-commit-check.sh
 ```
 
 **Default-FAIL evidence gate (required before recording any pass):** a green exit code is not enough  -  the captured log must actually show success. Before marking build/test passed, run the evidence gate against the tee'd log; it fails CLOSED when the log is missing, empty, or shows failure markers:
 
 ```bash
-node pipeline/scripts/evidence-gate.mjs --claim build --status passed --evidence "$WORKTREE/.build.log" || BUILD_PASS=false
-node pipeline/scripts/evidence-gate.mjs --claim test  --status passed --evidence "$WORKTREE/.test.log"  || TEST_PASS=false
+node $HOME/.claude/scripts/evidence-gate.mjs --claim build --status passed --evidence "$WORKTREE/.build.log" || BUILD_PASS=false
+node $HOME/.claude/scripts/evidence-gate.mjs --claim test  --status passed --evidence "$WORKTREE/.test.log"  || TEST_PASS=false
 ```
 
 This prevents a false "it built" claim with no log behind it. On exit 1, treat the gate as failed (do NOT proceed to AI review) and surface the gate's `reason`.
@@ -81,13 +81,7 @@ If changes include UI files (iOS: `*View.swift`, `*Screen.swift`, `*Cell.swift`;
 - Missing safe area / keyboard avoidance → **important**
 - Hardcoded colors instead of system/semantic colors → **suggestion**
 
-**iOS  -  SwiftUI interaction & accessibility conventions** (skills: `figma-navigation`, `figma-overlays`, `figma-bottom-sheets`, plus the enriched `figma-to-swiftui` accessibility rules). Gated to changed SwiftUI files; each is native-SwiftUI-first unless the project's `figma-config` `ui.*` declares a custom system, in which case check against that system instead:
-- A reusable component that **routes itself** (hardcoded `NavigationLink(destination: ConcreteScreen())`, calls a router) instead of emitting a typed `Output` → **important** (breaks reuse).
-- A reusable component that **presents its own app-level overlay** (toast/alert/modal) instead of emitting an intent for the caller → **important** (double-fires when composed).
-- `AnyView` routed through an overlay center / data-modal path (rich content should be a local `.sheet/.modal { }`) → **important**.
-- Loading HUD not **ref-counted** / missing `end` on an error path / no min-show (flash) → **important**.
-- A pinned bottom CTA built as a presented sheet instead of `.safeAreaInset(edge:.bottom)`, or detents that aren't ascending / use magic-number heights → **suggestion**.
-- **Accessibility over-annotation** (redundant `.isButton` on `Button` / `.isStaticText` on `Text`, `.accessibilityLabel` duplicating visible text, a per-enum-variant a11y key for non-interactive visual state, hints on self-explanatory actions) → **suggestion**; **missing** decorative-image hiding or interactive-state `.accessibilityValue` → **important**.
+**iOS  -  SwiftUI interaction & accessibility conventions.** Gated to changed SwiftUI files. These are rule-registry territory as of v14.0.0, not a list transcribed here: Step 1.78 resolves them from whichever registry declares SwiftUI scope, so the criteria and their severities live in one place instead of drifting between this doc and the skill. Reviewers receive the resolved rule IDs. Native-SwiftUI-first unless the project's `figma-config` `ui.*` declares a custom system, in which case check against that system. Reference skills, when no registry covers the change: `figma-navigation`, `figma-overlays`, `figma-bottom-sheets`, `figma-to-swiftui`.
 
 **Android  -  Material Design compliance** (skills: `compose-components`, `android-architecture`):
 - Non-Material3 component when M3 equivalent exists → **suggestion**
@@ -102,7 +96,7 @@ Device-level audit runs in Phase 5 (`audit-guide.md`).
 
 #### Step 1.6  -  Repo Map Injection (advisory, opt-in)
 
-**Gated by `prefs.global.repoMap.enabled`** (default: `false`). Same pattern as Phase 1 Step 2.5  -  runs `pipeline/scripts/repo-map.mjs` and injects the result as `${REPO_MAP}` into each reviewer's prompt context. Reviewers treat it the same way the priority files block is treated: advisory hint, not gospel.
+**Gated by `prefs.global.repoMap.enabled`** (default: `false`). Same pattern as Phase 1 Step 2.5  -  runs `$HOME/.claude/scripts/repo-map.mjs` and injects the result as `${REPO_MAP}` into each reviewer's prompt context. Reviewers treat it the same way the priority files block is treated: advisory hint, not gospel.
 
 Phase 4 reuses the cached map from Phase 1 when both phases run in the same task (avoid recomputing the same scan twice). The orchestrator caches under `state.repoMap.<sha>` keyed by `git rev-parse HEAD`; cache miss → regenerate. When `enabled=false`, both phases skip the script entirely and no `${REPO_MAP}` placeholder appears in prompts (no empty-string artefact).
 
@@ -115,16 +109,16 @@ Before dispatching reviewers, run the deterministic diff risk scorer and inject
 Score the diff **once, in full** (no `--top`): Steps 1.76/1.77 need every scored file (a shrinking test file ranked 20th; whether ANY file is high-stakes). The top-N hint is derived from that report, not a second git walk.
 
 ```bash
-RISK_FULL=$(node pipeline/scripts/diff-risk-score.mjs \
+RISK_FULL=$(node $HOME/.claude/scripts/diff-risk-score.mjs \
   --base "$BASE_BRANCH" --head HEAD \
   --task-id "$TASK_ID" 2>/dev/null)
-echo "$RISK_FULL" | node pipeline/scripts/validate-diff-risk.mjs - >/dev/null 2>&1 || RISK_FULL=""
+echo "$RISK_FULL" | node $HOME/.claude/scripts/validate-diff-risk.mjs - >/dev/null 2>&1 || RISK_FULL=""
 
 # Priority hint for the reviewer prompts: top 5 of the full report.
 RISK_JSON=$([ -n "$RISK_FULL" ] && jq -c '.files |= (sort_by(-.score) | .[:5])' <<< "$RISK_FULL" || echo "")
 ```
 
-**Signals & weights** (see `pipeline/schemas/diff-risk.schema.json`):
+**Signals & weights** (see `$HOME/.claude/schemas/diff-risk.schema.json`):
 
 | Signal | Weight | Triggers when |
 |---|---|---|
@@ -142,13 +136,13 @@ RISK_JSON=$([ -n "$RISK_FULL" ] && jq -c '.files |= (sort_by(-.score) | .[:5])'
 **Gate behavior**: this step is **never blocking**. If risk scoring fails (git error, parse error, validator rejection), continue with no priority hint  -  reviewers receive the full diff in their default order. Failures are logged via metrics:
 
 ```bash
-[ -z "$RISK_JSON" ] && pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk_skipped reason=$REASON
+[ -z "$RISK_JSON" ] && $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk_skipped reason=$REASON
 ```
 
 On success, emit a single summary metric:
 
 ```bash
-pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk \
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk \
   top_files=$(jq '.files | length' <<< "$RISK_JSON") \
   max_score=$(jq '.totals.max_score' <<< "$RISK_JSON") \
   loc_added=$(jq '.totals.loc_added' <<< "$RISK_JSON")
@@ -161,9 +155,9 @@ pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.diff_risk \
 Step 1.75 uses `test_lines_removed` as an advisory hint only  -  too weak for what it detects: a suite made green by deleting tests instead of fixing code. This turns the signal into blocking findings triage must adjudicate. Pure function of the full report, no git, no LLM.
 
 ```bash
-TEST_INTEGRITY_JSON=$(printf '%s' "$RISK_FULL" | node pipeline/scripts/test-integrity-gate.mjs 2>/dev/null || echo "")
+TEST_INTEGRITY_JSON=$(printf '%s' "$RISK_FULL" | node $HOME/.claude/scripts/test-integrity-gate.mjs 2>/dev/null || echo "")
 TI_COUNT=$(jq -r '.count // 0' <<< "${TEST_INTEGRITY_JSON:-{\}}" 2>/dev/null || echo 0)
-[ "$TI_COUNT" -gt 0 ] && pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.test_integrity findings="$TI_COUNT"
+[ "$TI_COUNT" -gt 0 ] && $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.test_integrity findings="$TI_COUNT"
 ```
 
 `findings[]` are reviewer-shaped (`test_integrity`, `blocking`), so they merge into the reviewer findings at Step 3.0 and need no triage-prompt or `validate-triage.mjs` change. Triage keeps each blocking unless the removal is justified per the immutable-test rule (spec changed AND commit body names the test) → `deferred[]`.
@@ -175,18 +169,51 @@ The gate never blocks the phase; it *emits* blocking findings. Empty or unreadab
 On a trivial diff every reviewer agrees and the extra models plus triage are paid for nothing. Reviewer count comes from the same report, no LLM.
 
 ```bash
-SCOPE_JSON=$(printf '%s' "$RISK_FULL" | node pipeline/scripts/review-scope.mjs 2>/dev/null \
+SCOPE_JSON=$(printf '%s' "$RISK_FULL" | node $HOME/.claude/scripts/review-scope.mjs 2>/dev/null \
   || echo '{"scope":"full","reason":"no risk report - failing safe"}')
 REVIEW_SCOPE=$(jq -r '.scope // "full"' <<< "$SCOPE_JSON")
-pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.scope scope="$REVIEW_SCOPE"
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.scope scope="$REVIEW_SCOPE"
 ```
 
 `single` (Reviewer 1 only) requires **all** of: churn <= 20 lines, `totals.max_score` < 3.0, and no `security_path` / `migration` / `public_api` / `no_test_change` / `test_lines_removed` on any file. Anything else → `full`.
 
 Fails safe in one direction only: empty report, parse failure or validator rejection all resolve to `full`, because skipping a reviewer trades coverage for cost. `consensus.reviewerCount` records what actually ran, so a single-reviewer run never reads as cross-model agreement. Opt-out: `prefs.global.reviewScopeGate = false` forces `full`.
 
+#### Step 1.78  -  Criteria resolution (skill conformance, required)
+
+Resolves WHAT the changed code was supposed to honour, before any reviewer sees it. Zero LLM. Full contract: [`$HOME/.claude/multi-agent-refs/features/skill-conformance.md`]($HOME/.claude/multi-agent-refs/features/skill-conformance.md).
+
+```bash
+node $HOME/.claude/scripts/skill-conformance.mjs \
+  --diff "$WORKTREE/.review-diff.txt" --state "$WORKTREE/agent-state.json" \
+  --repo "$WORKTREE" --out "$WORKTREE/.pipeline/criteria-manifest.json"
+CRIT_RC=$?
+CRITERIA=$(cat "$WORKTREE/.pipeline/criteria-manifest.json" 2>/dev/null || echo '{}')
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.criteria \
+  rules="$(jq -r '.selectedRuleCount // 0' <<< "$CRITERIA")" \
+  ledger="$(jq -r '.ledger.source // "derived"' <<< "$CRITERIA")"
+[ "$CRIT_RC" != "0" ] && HALT "criteria could not be resolved (rc=$CRIT_RC)  -  see resolutionFailure / unparseableRegistries"
+```
+
+Output conforms to `$HOME/.claude/schemas/criteria-manifest.schema.json`. The four parts that matter downstream:
+
+- **`selectedRules[]` is the denominator.** Rule IDs from every registry whose declared `scope` matches the diff, persisted BEFORE the reviewers run so the set cannot be renegotiated after one has seen the diff. That is what makes "applied completely" answerable rather than "looks fine": a reviewer finding nothing must still return a verdict per ID. Discovery is declared via `standards-registry:` frontmatter, so no stack-specific skill is named here.
+- **`coverage.declaredGaps[]` + `droppedReasons`.** An uncovered language, and every out-of-scope rule, is reported with a reason. "No rule applied", "every rule passed" and "the rule set was narrowed" must never render the same.
+- **`ledger`.** `state.telemetry.skillCalls[]` corroborates only; `ledger.source` defaults to `derived` and coverage is never computed from self-report. A declared skill the resolver cannot bind is flagged.
+- **`findings[]`.** Reviewer-shaped, merging at Step 3.0 alongside test-integrity: expired / unexplained / unknown-ID exception markers, plus any registry whose delegated linter is not wired here (those rules are unverified, so reporting no violations reports that nothing was measured).
+
+**Any non-zero exit halts** (1 = setup error incl. a bad `--skills-root`; 2 = no root resolved, unparseable registry, or a declared path escaping its skill dir): continuing would drop a rule set from the denominator, and since the reviewer validator skips the checklist when zero rules were selected, the run would report clean over criteria never loaded. A coverage gap halts only under `prefs.global.skillConformance.blockOnCoverageGap`. No opt-out for the stage or the exception-expiry check, on the same grounds as Step 1.76.
+
 #### Step 1.8  -  Figma visual-fidelity context (when task carries a Figma reference)
 
+**Dev-mode inputs.** Phases 1 and 2 never run in the `--dev` family, so three inputs this phase was written around are absent. Substitute them and RECORD the substitution  -  a step that could not run and a step that passed must not read the same, or the completeness claim cannot be checked:
+
+| Absent input | Substitute |
+|---|---|
+| `detectedStack` (Phase 1 Step 2) | the language census in `criteria-manifest.json` → `languages`, from the diff's file extensions |
+| Phase 1 analysis summary + Phase 2 plan (triage scope, cache prefix) | the task description plus the inline task list Phase 3 generated for itself |
+| `state.evidence.figma[]` (this step), Step 2.8 visual conformance | nothing. Record each as `not-applicable (no Phase 1 evidence)` in `consensus.visualConformance`; never silently omit |
+
 When `state.evidence.figma[]` is non-empty, the reviewer subagents MUST receive the captured screenshot URLs / paths and the canonical-component name (from `state.evidence.figma[i].screenshotUrl` and `state.evidence.figma[i].codeConnectSnippets[0].componentName` when present) so they can compare visual fidelity. Pass them inline in each reviewer prompt under a `## Figma evidence` block, one row per frame.
 
 Visual-fidelity mismatches against the captured screenshot are BLOCKING findings, not nits:
@@ -208,7 +235,7 @@ When `state.figmaAccess.tier === 3` (user-attached screenshot, no Code Connect s
 
 Phase 4 sends the same diff to every reviewer and then to triage, so the diff is the dominant token cost. Two measures keep it bounded:
 
-**Shared cache prefix.** Build the reviewer and triage prompts so the large invariant context  -  the full diff, the Phase 1 analysis summary, the Phase 2 plan  -  is a byte-identical leading block across all dispatches in this iteration. Only the per-reviewer focus + skill line varies, and it goes AFTER the shared block. When the host supports prompt caching, the 2nd/3rd reviewer and the triage call then read that prefix at the discounted cache-read rate instead of re-billing it as fresh input. Forward the host-reported cache-read count as `tokens_cached` per the Token telemetry contract so the saving lands in the cost ledger.
+**Shared cache prefix.** Build the reviewer and triage prompts so the large invariant context  -  the full diff, the `${CRITERIA}` block from Step 1.78, the Phase 1 analysis summary, the Phase 2 plan  -  is a byte-identical leading block across all dispatches in this iteration. Only the per-reviewer focus + skill line varies, and it goes AFTER the shared block. `${CRITERIA}` goes in the prefix, identical for every reviewer: subsetting it per reviewer would invalidate the prefix for the whole panel and re-bill the largest block in the phase. Per-reviewer emphasis stays a one-line pointer in the suffix. When the host supports prompt caching, the 2nd/3rd reviewer and the triage call then read that prefix at the discounted cache-read rate instead of re-billing it as fresh input. Forward the host-reported cache-read count as `tokens_cached` per the Token telemetry contract so the saving lands in the cost ledger.
 
 **Single-repo diff cap.** If the diff exceeds the Phase 4 token allowance (`token-budget.json`), truncate the largest files and append a footer `[truncated  -  full diff in file://$WORKTREE/.review-diff.txt]`, writing the full diff to that path. Reviewers and triage receive the same capped view + the marker so they can flag "review the full diff manually." Log `review.diff_truncated bytes_dropped=<N>`. (Multi-repo already caps the combined diff at 80% of budget; this is the single-repo equivalent.)
 
@@ -220,32 +247,27 @@ Launch Agent instances **in parallel** using the shared `code-reviewer` subagent
 
 | Reviewer   | subagent_type   | Claude Code | Copilot CLI | Codex CLI | Focus | Skills Referenced |
 | ---------- | --------------- | --- | --- | --- | --- | --- |
-| Reviewer 1 | `code-reviewer` | `claude-fable-5` | `claude-opus-4-8` | `gpt-5.6` @ `xhigh` | Deep security + architecture | `api-security-best-practices`, `architecture` |
+| Reviewer 1 | `code-reviewer` | `claude-fable-5` | `claude-opus-5` | `gpt-5.6` @ `xhigh` | Deep security + architecture | `api-security-best-practices`, `architecture` |
 | Reviewer 2 | `code-reviewer` | (not dispatched) | `gpt-5.4` | `gpt-5.4` @ `high` | Edge cases, different perspective | cross-model diversity |
-| Reviewer 3 | `code-reviewer` | `claude-sonnet-4-6` | `claude-sonnet-4-6` | `gpt-5.6` @ `medium` | Quality + correctness + naming | `clean-code`, stack-specific skill |
-| Triage     | triage persona  | `claude-fable-5` | `claude-opus-4-8` | `gpt-5.6` @ `max` | Filter false positives + out-of-scope | - |
+| Reviewer 3 | `code-reviewer` | `claude-sonnet-5` | `claude-sonnet-5` | `gpt-5.6` @ `medium` | Quality + correctness + naming | `clean-code`, stack-specific skill |
+| Triage     | triage persona  | `claude-fable-5` | `claude-opus-5` | `gpt-5.6` @ `max` | Filter false positives + out-of-scope | - |
 
 Reviewer count per host: **Claude Code 2, Copilot CLI 3, Codex CLI 3**.
 
 #### Codex CLI  -  two constraints that fail silently
 
-Both were measured against Codex 0.145, not inferred. Getting either wrong produces
-a review that looks like it ran.
+Both were measured against Codex 0.145, not inferred, and both produce a review that
+looks like it ran. The full statement lives in the managed block at `~/.codex/AGENTS.md`
+(always loaded on that host, so it is not restated here):
 
-1. **Every `spawn_agent` that sets `model` or `reasoning_effort` MUST pass
-   `fork_turns: "none"`** (or a positive integer). Codex states that a full-history
-   fork "inherits the parent model and reasoning effort and does not accept
-   overrides"  -  so omitting `fork_turns` silently collapses the whole panel onto
-   the orchestrator's model, with three reviewers reporting from one perspective
-   and no error anywhere.
-2. **Three concurrent children is the ceiling.** Codex advertises 4 concurrency
-   slots *including the orchestrator*, so a 3-reviewer panel saturates it and a 4th
-   child queues instead of running in parallel. The reviewer count on Codex is
-   capability-derived, not a preference.
+1. **`fork_turns: "none"` on every `spawn_agent` that sets `model` or
+   `reasoning_effort`** - a full-history fork discards the override and collapses the
+   panel onto one model, silently.
+2. **Three concurrent children is the ceiling** - 4 slots including the orchestrator,
+   so the reviewer count on Codex is capability-derived, not a preference.
 
-Codex also refuses to spawn sub-agents at all unless instructions ask for it
-explicitly; the pipeline's `~/.codex/AGENTS.md` managed block carries that
-authorization. Without it Phase 4 degrades to a single in-thread review.
+Sub-agent delegation itself is authorized by that same managed block; without it Phase 4
+degrades to a single in-thread review.
 
 **Single-vendor caveat.** Every Codex reviewer is an OpenAI model, so the
 cross-vendor disagreement that Claude Code and Copilot CLI get for free is absent.
@@ -257,7 +279,7 @@ in the triage note when all three agree on a borderline finding.
 
 Each reviewer inherits the `code-reviewer` agent's focus areas (Security, Architecture, Quality, Performance) and output contract. The orchestrator overrides only the model and the stack-specific skill per-reviewer  -  no prompt duplication.
 
-**Model override wiring:** `code-reviewer.md` declares `preferredModel: fable`, so Reviewer 1 uses the persona default (Fable 5). Reviewer 2 (Copilot-only, `gpt-5.4`) and Reviewer 3 (`claude-sonnet-4-6`) set `PHASE_MODEL_OVERRIDE=<model>` before dispatch  -  the orchestrator exports `CLAUDE_CODE_SUBAGENT_MODEL` on Claude Code, or passes `--model` on Copilot CLI. Full precedence rule: `skills/shared/core/multi-agent/SKILL.md#agent-dispatch--per-persona-model-routing-v610`. Fable dispatches are subject to the fallback contract (`$HOME/.claude/multi-agent-refs/features/model-fallback.md`): dispatch-error retry walks `fable -> opus -> sonnet` and budget-ceiling downgrade.
+**Model override wiring:** `code-reviewer.md` declares `preferredModel: fable`, so Reviewer 1 uses the persona default (Fable 5). Reviewer 2 (Copilot-only, `gpt-5.4`) and Reviewer 3 (`claude-sonnet-5`) set `PHASE_MODEL_OVERRIDE=<model>` before dispatch  -  the orchestrator exports `CLAUDE_CODE_SUBAGENT_MODEL` on Claude Code, or passes `--model` on Copilot CLI. Full precedence rule: `skills/shared/core/multi-agent/SKILL.md#agent-dispatch--per-persona-model-routing-v610`. Fable dispatches are subject to the fallback contract (`$HOME/.claude/multi-agent-refs/features/model-fallback.md`): dispatch-error retry walks `fable -> opus -> sonnet` and budget-ceiling downgrade.
 
 **Stack-specific skills loaded per reviewer** (from Phase 1 `detectedStack`). On Claude Code, Reviewer 2 (GPT-5.4) is not dispatched  -  its skill column is ignored. On Copilot CLI all three columns are used.
 
@@ -298,33 +320,38 @@ reading a diff cannot see spacing; something has to compare against the design.
 Skip only when the diff has no UI change. Record the outcome in
 `consensus.visualConformance` so Phase 7 reports whether it ran.
 
-**iOS/Swift  -  interaction & convention checks (conditional).** When the diff touches SwiftUI UI files (`*View.swift`, `*Screen.swift`, `*Configuration.swift`, `*+Modifiers.swift`), the iOS reviewers additionally apply the component/interaction conventions documented in the analysis doc (Section 14 Code Connect mapping) and, where the repo has the marketplace component toolkit enabled (`ai-ios-engineering-toolkit`), that plugin's navigation / overlay / bottom-sheet conventions (interaction: emit-intent vs self-route/self-present; native-SwiftUI-first vs the project's `ui.*` custom system) plus the component accessibility rules (minimalism). These back the Step 1.5 iOS convention checks. Generic across SwiftUI projects  -  not tied to any one app. Omit when the diff has no SwiftUI UI changes (keeps the reviewer prompt lean).
+**iOS/Swift  -  interaction & convention checks (conditional).** Step 1.78 resolves these. Where no registry covers the change, reviewers fall back to the analysis doc (Section 14 Code Connect mapping) and, when `ai-ios-engineering-toolkit` is enabled, that plugin's navigation / overlay / bottom-sheet + accessibility conventions.
 
-**Module review guides (conditional, all stacks).** A module in the repo may carry its own CLAUDE guide  -  a convention/checklist file living somewhere in the module's directory tree that the host CLI never auto-loads. When a changed file's module has such a guide, the review must consult it. Discovery is deterministic, from the diff's changed paths: for each changed file, walk its directory chain up to the repo root and collect `CLAUDE.md`, `*-CLAUDE.md`, and `AGENTS.md` files (root-level ones excluded  -  the host CLI already loads those). Dedupe, cap at 5 (log any dropped). Inject into every reviewer prompt with the directive: read each guide before reviewing and apply its rules/checklist to the changed files under its directory  -  a guide governs only its own subtree, and guide violations are findings triaged by severity like any other. No guides found → no-op, prompt stays lean. Same contract as `/multi-agent:review` Step 2b.
+**Module review guides (conditional, all stacks).** Step 1.78 resolves them into `criteria-manifest.json` → `moduleGuides`. Inject with the directive: read each guide, apply its rules to the changed files under its directory  -  a guide governs only its own subtree, and its violations are findings triaged like any other. Same contract as `/multi-agent:review` Step 2b.
 
 **Dispatch timeout (required, mirrors triage 3.3).** Reviewers run in parallel and triage waits on all of them, so one stalled reviewer hangs the phase. Bound each reviewer dispatch by `REVIEWER_TIMEOUT_SECONDS` (default 180). If a reviewer has not returned by the budget: log `review.reviewer_timeout reviewer=<name>`, treat that reviewer as absent, and proceed to triage with the reviewers that did return. The merged-findings count and `consensus.reviewerCount` reflect only the reviewers that returned. If **zero** reviewers return, retry Reviewer 1 once; on a second total failure HALT with `ERR: no reviewer returned within ${REVIEWER_TIMEOUT_SECONDS}s; resume with /multi-agent:resume #N.`. The Step 2.5 rebuttal round uses the same per-dispatch timeout. Never block indefinitely on a slow or dead reviewer dispatch.
 
 #### Output contract  -  reviewer step
 
-Step 2 produces N reviewer-output objects (one per dispatched reviewer), each conforming to `pipeline/schemas/reviewer-output.schema.json`. They are persisted to `state.reviewIterations[<iteration>].reviewers[]` and consumed by Step 3 (Fable triage)  -  never by Phase 6 directly. The triage step (below) is the producer of the only review artifact Phase 6 reads, conforming to `pipeline/schemas/triage-output.schema.json`.
+Step 2 produces N reviewer-output objects (one per dispatched reviewer), each conforming to `$HOME/.claude/schemas/reviewer-output.schema.json`. They are persisted to `state.reviewIterations[<iteration>].reviewers[]` and consumed by Step 3 (Fable triage)  -  never by Phase 6 directly. The triage step (below) is the producer of the only review artifact Phase 6 reads, conforming to `$HOME/.claude/schemas/triage-output.schema.json`.
 
-**Subagent return format**  -  each reviewer returns JSON conforming to `pipeline/schemas/reviewer-output.schema.json`:
+**Subagent return format**  -  each reviewer returns JSON conforming to `$HOME/.claude/schemas/reviewer-output.schema.json`:
 
 ```json
-{"findings":[{"severity":"blocking|important|suggestion","file":"...","line":N,"issue":"...","fix":"..."}],"approved":true|false}
+{"findings":[{"severity":"blocking|important|suggestion","file":"...","line":N,"issue":"...","fix":"...","ruleId":"SEC-01","criteriaSource":"ios-coding-standard"}],
+ "conformance":[{"ruleId":"SEC-01","verdict":"conformant|violated|not-applicable","file":"...","line":N,"reason":"..."}],
+ "approved":true|false}
 ```
 
+`ruleId` + `criteriaSource` appear on a finding that cites a rule from `${CRITERIA}`. `conformance` is required whenever Step 1.78 selected at least one rule, with exactly one row per selected ID and none outside the set.
+
 **Required: validator gate (deterministic)  -  run immediately after each reviewer returns, before merging findings.** Persist each reviewer's output and validate the file  -  the validator's exit code decides, not the LLM turn:
 
 ```bash
 REVIEWER_FILE="$WORKTREE/.pipeline/reviewer-$N.json"
 printf '%s' "$REVIEWER_JSON" > "$REVIEWER_FILE"
-node $HOME/.claude/scripts/validate-reviewer.mjs "$REVIEWER_FILE"
+node $HOME/.claude/scripts/validate-reviewer.mjs "$REVIEWER_FILE" \
+  --criteria "$WORKTREE/.pipeline/criteria-manifest.json"
 ```
 
 Progress line: `    → checking validator validate-reviewer ({reviewer})`
 
-Exit 0 = valid. Exit 2 = contradiction (approved=true with blocking findings)  -  flip `approved` to `false`, continue. Exit 1 = malformed; gate protocol (fails CLOSED, same handling as the evidence gate): emit the validator stderr + `errors[]` verbatim, attempt ONE self-correction rework (re-invoke that reviewer with the errors quoted, overwrite the file), re-run the validator. If it fails again -> HALT the phase (no merge, no triage). Recovery hint: `ERR: reviewer output failed validate-reviewer.mjs twice. Inspect $REVIEWER_FILE against pipeline/schemas/reviewer-output.schema.json, then resume with /multi-agent:resume #N.`
+Exit 0 = valid. Exit 2 = contradiction (approved=true with blocking findings)  -  flip `approved` to `false`, continue. With `--criteria`, exit 1 also covers the conformance checklist: a selected rule ID with no verdict, a verdict for an ID that was never selected, a `conformant` row with no file evidence, or a `violated` row with no matching finding. Those are the four ways a review can look complete without being complete, and the validator is what makes the checklist more than decoration  -  it is hand-written and does not apply `additionalProperties`, so an unchecked array would otherwise pass. Exit 1 = malformed; gate protocol (fails CLOSED, same handling as the evidence gate): emit the validator stderr + `errors[]` verbatim, attempt ONE self-correction rework (re-invoke that reviewer with the errors quoted, overwrite the file), re-run the validator. If it fails again -> HALT the phase (no merge, no triage). Recovery hint: `ERR: reviewer output failed validate-reviewer.mjs twice. Inspect $REVIEWER_FILE against $HOME/.claude/schemas/reviewer-output.schema.json, then resume with /multi-agent:resume #N.`
 
 #### Step 2.5  -  Disagreement-round loop (opt-in)
 
@@ -379,7 +406,7 @@ PRIOR_ART="["
 for finding in $(jq -c '.findings[]' <<< "$MERGED_FINDINGS"); do
   issue=$(jq -r '.issue' <<< "$finding")
   file=$(jq -r '.file' <<< "$finding")
-  hits=$(node pipeline/scripts/triage-memory.mjs query \
+  hits=$(node $HOME/.claude/scripts/triage-memory.mjs query \
     --issue "$issue" --file-glob "$(dirname "$file")/*" --top 3 2>/dev/null \
     | jq -c '.hits // []')
   PRIOR_ART="$PRIOR_ART$hits,"
@@ -394,7 +421,7 @@ The triage prompt MUST include a hedge: *"prior-art entries are context, not com
 **Rejected-preference brief (on by default via `prefs.global.learningsLedger.injectIntoTriage`).** Inject the durable rejected-preference list so triage does not re-accept a suggestion the team already rejected on this repo:
 
 ```bash
-node pipeline/scripts/learnings-ledger.mjs brief --max 20 2>/dev/null
+node $HOME/.claude/scripts/learnings-ledger.mjs brief --max 20 2>/dev/null
 ```
 
 Exit 2 (empty ledger) skips silently. The `## Rejected review preferences` section names patterns the team chose not to act on; triage should lean toward `rejected` for a finding that restates one  -  but the same hedge applies (context, not command; a genuinely new instance can still be accepted).
@@ -410,11 +437,16 @@ For each finding, decide:
 - DEFERRED: real issue but out of current task scope → log for later, do not block
 - REJECTED: false positive, duplicate, style-only nitpick, or already correct
 
+A finding carrying a `ruleId` cites a written rule from a registry the project
+adopted, so it is not a matter of taste: it can be DEFERRED or REJECTED as out of
+scope for THIS task, but "I would have written it differently" is not available as
+a reason. Preserve `ruleId` and `criteriaSource` on every finding you keep.
+
 #### Output contract  -  triage step
 
-Step 3 produces a single triage-output object conforming to `pipeline/schemas/triage-output.schema.json` and persists it to `state.reviewIterations[<iteration>].triage`. This is the **only** Phase 4 artifact Phase 6 reads. Phase 6 commits MUST cite only `accepted` findings that were resolved; `deferred` items get linked in the PR description as follow-up work; `rejected` items never appear in any user-facing output.
+Step 3 produces a single triage-output object conforming to `$HOME/.claude/schemas/triage-output.schema.json` and persists it to `state.reviewIterations[<iteration>].triage`. This is the **only** Phase 4 artifact Phase 6 reads. Phase 6 commits MUST cite only `accepted` findings that were resolved; `deferred` items get linked in the PR description as follow-up work; `rejected` items never appear in any user-facing output.
 
-Return ONLY valid JSON conforming to pipeline/schemas/triage-output.schema.json:
+Return ONLY valid JSON conforming to $HOME/.claude/schemas/triage-output.schema.json:
 {
   "accepted":  [{ "severity": "blocking|important|suggestion", "file": "...", "line": N, "issue": "...", "fix": "...", "reviewer": "fable|opus|sonnet|gpt" }],
   "deferred":  [{ "finding": {...}, "reason": "..." }],
@@ -440,7 +472,7 @@ Progress line: `    → checking validator validate-triage`
 | Exit  | Meaning                      | Action                                            |
 | ----- | ---------------------------- | ------------------------------------------------- |
 | **0** | Valid and clean              | Act on triage output as-is                        |
-| **1** | Invalid structure            | Gate protocol (strict, fails CLOSED): (a) emit the validator's stderr and `errors[]` JSON into the log verbatim; (b) attempt ONE self-correction rework  -  re-prompt triage with the errors quoted, overwrite `$TRIAGE_FILE`; (c) re-run the validator. Second failure -> HALT the phase with the recovery hint: `ERR: triage output failed validate-triage.mjs twice. Inspect $TRIAGE_FILE against pipeline/schemas/triage-output.schema.json, fix or regenerate it, then resume with /multi-agent:resume #N.` |
+| **1** | Invalid structure            | Gate protocol (strict, fails CLOSED): (a) emit the validator's stderr and `errors[]` JSON into the log verbatim; (b) attempt ONE self-correction rework  -  re-prompt triage with the errors quoted, overwrite `$TRIAGE_FILE`; (c) re-run the validator. Second failure -> HALT the phase with the recovery hint: `ERR: triage output failed validate-triage.mjs twice. Inspect $TRIAGE_FILE against $HOME/.claude/schemas/triage-output.schema.json, fix or regenerate it, then resume with /multi-agent:resume #N.` |
 | **2** | Over-rejection guard tripped | Pause for human confirm (autopilot: log + accept) |
 | **3** | Contradiction auto-corrected | Proceed with `result.corrected`                   |
 
@@ -461,13 +493,13 @@ Failure fallback (timeout >120s, or agent crash before any JSON is produced): re
 Emit metrics per review pass for Phase 7 cost rollup:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=fable duration_ms=$R1_DURATION tokens_in=$R1_IN tokens_out=$R1_OUT   # model=opus on Copilot CLI
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=fable duration_ms=$R1_DURATION tokens_in=$R1_IN tokens_out=$R1_OUT   # model=opus on Copilot CLI
 # GPT-5.4 metric emitted only on Copilot CLI (skip on Claude Code):
 [ "${CLI_HOST:-claude}" = "copilot" ] && \
-  LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=gpt-5.4 duration_ms=$GPT_DURATION tokens_in=$GPT_IN tokens_out=$GPT_OUT
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=sonnet duration_ms=$SONNET_DURATION tokens_in=$SONNET_IN tokens_out=$SONNET_OUT
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.triage_call model=fable duration_ms=$TRIAGE_DURATION tokens_in=$TRIAGE_IN tokens_out=$TRIAGE_OUT
-pipeline/scripts/log-metric.sh "$TASK_ID" 4 review.completed raw_count=$RAW accepted=$ACC deferred=$DEF rejected=$REJ approved=$APPROVED duration_ms=$DURATION
+  LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=gpt-5.4 duration_ms=$GPT_DURATION tokens_in=$GPT_IN tokens_out=$GPT_OUT
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.reviewer_call model=sonnet duration_ms=$SONNET_DURATION tokens_in=$SONNET_IN tokens_out=$SONNET_OUT
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.triage_call model=fable duration_ms=$TRIAGE_DURATION tokens_in=$TRIAGE_IN tokens_out=$TRIAGE_OUT
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 4 review.completed raw_count=$RAW accepted=$ACC deferred=$DEF rejected=$REJ approved=$APPROVED duration_ms=$DURATION
 ```
 
 `LOG_METRIC_FORWARD_TO_TRACKER=1` mirrors `tokens_in`/`tokens_out`/`model` into `phase-tracker.sh` (see `$HOME/.claude/multi-agent-refs/progress-contract.md#token-telemetry-forwarding-v83`). On non-zero validator exit (1/2/3), also emit `triage.edge_case` with cause. Omit `tokens_in`/`tokens_out` if unavailable. Best-effort  -  never fails the pipeline.
@@ -515,7 +547,7 @@ Act **only on triage.accepted**:
 At the end of every fix/rework round (each Phase 3 re-entry that resolved accepted findings, including the final one), append ONE one-line root-cause lesson per resolved blocking/important finding to the existing learnings ledger (`learnings-ledger.mjs`  -  the store Phase 1 and triage already replay; never invent a parallel store):
 
 ```bash
-node pipeline/scripts/learnings-ledger.mjs add --kind fact \
+node $HOME/.claude/scripts/learnings-ledger.mjs add --kind fact \
   --statement "<one-line rule/what-to-do so this class of finding does not recur (<=140 chars)>" \
   --diagnosis "<the causal WHY the failure happened, one line>" \
   --scope "<file-or-area glob from the finding>" --task "$TASK_ID"

package/pipeline/multi-agent-refs/phases/phase-5-test.md

@@ -1,6 +1,6 @@
 ### Phase 5: Test
 
-> **TLDR**  -  Optional test gate. Offers to boot the simulator/emulator (UI Bug Hunter) or hand off to the user for manual QA. Skipped in `autopilot` and `--dev` modes. If issues found, loops back to Phase 3.
+> **TLDR**  -  Optional test gate. Offers to boot the simulator/emulator (UI Bug Hunter) or hand off to the user for manual QA. Needs an interactive prompt AND a worktree checkout, so it runs in `--dev` and the full pipeline but is dropped by every `autopilot` or `--local` variant. If issues found, loops back to Phase 3.
 
 <!-- progress-contract: applied -->
 Progress emission per `$HOME/.claude/multi-agent-refs/progress-contract.md`  -  lines for local-test prompt render, user-answer capture, repo checkout (if selected).
@@ -19,13 +19,13 @@ case "$STACK" in
   *)                     SCAN_STACK="" ;;
 esac
 if [ -n "$SCAN_STACK" ] && [ "${prefs_testGap_enabled:-true}" = "true" ]; then
-  GAP_JSON=$(node pipeline/scripts/test-gap-scan.mjs \
+  GAP_JSON=$(node $HOME/.claude/scripts/test-gap-scan.mjs \
     --base "$BASE_BRANCH" --head HEAD --stack "$SCAN_STACK" 2>/dev/null)
-  echo "$GAP_JSON" | node pipeline/scripts/validate-test-gap.mjs - >/dev/null 2>&1 || GAP_JSON=""
+  echo "$GAP_JSON" | node $HOME/.claude/scripts/validate-test-gap.mjs - >/dev/null 2>&1 || GAP_JSON=""
 fi
 ```
 
-**What the report contains** (per `pipeline/schemas/test-gap.schema.json`):
+**What the report contains** (per `$HOME/.claude/schemas/test-gap.schema.json`):
 
 | Field | Meaning |
 |---|---|
@@ -49,7 +49,7 @@ fi
 **Telemetry**:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=0 pipeline/scripts/log-metric.sh "$TASK_ID" 5 test_gap.scanned \
+LOG_METRIC_FORWARD_TO_TRACKER=0 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 5 test_gap.scanned \
   stack=$SCAN_STACK \
   sources=$(jq '.totals.sourcesScanned' <<< "$GAP_JSON") \
   gaps=$(jq '.totals.gapCount' <<< "$GAP_JSON")
@@ -100,7 +100,7 @@ Tier 1 / Tier 2 records print `screenshotUrl` from the captured evidence (Tier 2
    bash $HOME/.claude/scripts/phase-tracker.sh now 5 "awaiting local test (user)"
    bash $HOME/.claude/scripts/phase-tracker.sh render
    ```
-   The waiting state persists in `tracker-state.json` across the handoff; `/multi-agent:finish` and `/multi-agent:manual-test` CONTINUE this state file and never re-init it (`$HOME/.claude/multi-agent-refs/tracker-contract.md` "Continuation runs").
+   The waiting state persists in `tracker-state.json` across the handoff; `/multi-agent:ship` and `/multi-agent:manual-test` CONTINUE this state file and never re-init it (`$HOME/.claude/multi-agent-refs/tracker-contract.md` "Continuation runs").
 6. If fix needed:
    - Branch already has WIP commit (from step 2)  -  changes are safe
    - **Heal stale admin state first** (same contract as Phase 0  -  step 3's
@@ -152,7 +152,7 @@ Returns severity-tagged findings (Critical / High / Medium). Critical items bloc
 When the security-auditor or any other Phase 5 sub-agent runs, forward its token totals so Phase 7's Cost Breakdown captures Phase 5:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 5 audit.completed \
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 5 audit.completed \
   model=opus tokens_in=$IN tokens_out=$OUT duration_ms=$DUR
 ```
 

package/pipeline/multi-agent-refs/phases/phase-6-commit.md

@@ -15,9 +15,9 @@ Progress emission per `$HOME/.claude/multi-agent-refs/progress-contract.md`  -
 
 #### Input contract
 
-Phase 6 consumes the latest Phase 4 triage output object conforming to `pipeline/schemas/triage-output.schema.json` (`accepted`, `deferred`, `rejected` buckets) plus the working-tree mutations from Phase 3. The commit body cites only `accepted` findings that were resolved; `deferred` items must be linked in the PR description as follow-up work, never silently dropped. If the triage output reports any unresolved blocking accepted finding, Phase 6 refuses to commit  -  the pipeline returns to Phase 3 for rework.
+Phase 6 consumes the latest Phase 4 triage output object conforming to `$HOME/.claude/schemas/triage-output.schema.json` (`accepted`, `deferred`, `rejected` buckets) plus the working-tree mutations from Phase 3. The commit body cites only `accepted` findings that were resolved; `deferred` items must be linked in the PR description as follow-up work, never silently dropped. If the triage output reports any unresolved blocking accepted finding, Phase 6 refuses to commit  -  the pipeline returns to Phase 3 for rework.
 
-The "Build passes" checklist item below is evidence-gated, not self-asserted: Phase 6 trusts the `buildStatus.ok` that Phase 3 / Phase 4 recorded through `pipeline/scripts/evidence-gate.mjs` (a pass without a substantiating build/test log is treated as unverified and blocks the commit). The secret scanner (`pre-commit-check.sh`) runs on the staged diff as the final pre-commit gate.
+The "Build passes" checklist item below is evidence-gated, not self-asserted: Phase 6 trusts the `buildStatus.ok` that Phase 3 / Phase 4 recorded through `$HOME/.claude/scripts/evidence-gate.mjs` (a pass without a substantiating build/test log is treated as unverified and blocks the commit). The secret scanner (`pre-commit-check.sh`) runs on the staged diff as the final pre-commit gate.
 
 #### Step 0  -  Multi-Repo Integration Build
 
@@ -322,19 +322,19 @@ A task ending with one or more `pushStatus === "skipped"` repos does NOT bump `r
 
 ```bash
 for proj in $(jq -r '.projects[].name' "$STATE_FILE"); do
-  pipeline/scripts/log-metric.sh "$TASK_ID" 6 commit.created   repo=$proj sha=$SHA
-  pipeline/scripts/log-metric.sh "$TASK_ID" 6 push.attempted   repo=$proj attempts=$N status=$STATUS
-  pipeline/scripts/log-metric.sh "$TASK_ID" 6 pr.opened        repo=$proj url=$URL number=$N
+  $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 commit.created   repo=$proj sha=$SHA
+  $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 push.attempted   repo=$proj attempts=$N status=$STATUS
+  $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 pr.opened        repo=$proj url=$URL number=$N
 done
-pipeline/scripts/log-metric.sh "$TASK_ID" 6 multi_repo.completed repos=$REPOS skipped=$SKIPPED
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 multi_repo.completed repos=$REPOS skipped=$SKIPPED
 ```
 
 **Token forwarding:** the commit-message and PR-body generators run on a model. Forward those calls into the tracker so Phase 7's Cost Breakdown captures Phase 6:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 6 commit.message_generated \
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 commit.message_generated \
   model=<sonnet|opus> tokens_in=$IN tokens_out=$OUT duration_ms=$DUR
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 6 pr.body_generated \
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 6 pr.body_generated \
   model=<sonnet|opus> tokens_in=$IN tokens_out=$OUT duration_ms=$DUR
 ```
 

package/pipeline/multi-agent-refs/phases/phase-7-report.md

@@ -147,7 +147,7 @@ Write `agent-log.md` with ALL sections:
 
 ## Plan Todo Rollup (when `prefs.global.planTodos.enabled`)
 
-Rendered via `pipeline/lib/plan-todos.sh list "$TASK_ID"`. Inline the resulting markdown checklist verbatim  -  one line per todo with status marker ([x] / [~] / [/] / [!]), ID, task text, and notes when present. Status summary one-liner ("4/6 done, 1 skipped, 1 failed") goes at the top from `plan-todos.sh status`.
+Rendered via `$HOME/.claude/lib/plan-todos.sh list "$TASK_ID"`. Inline the resulting markdown checklist verbatim  -  one line per todo with status marker ([x] / [~] / [/] / [!]), ID, task text, and notes when present. Status summary one-liner ("4/6 done, 1 skipped, 1 failed") goes at the top from `plan-todos.sh status`.
 
 Skipped sections: when `planTodos.enabled` is false or no `plan.todos[]` was emitted, the Plan Todo block is omitted (no empty header). Phase 3 task-by-task progress still appears in the Timeline section either way.
 
@@ -187,9 +187,9 @@ Skipped sections: when `planTodos.enabled` is false or no `plan.todos[]` was emi
 **Telemetry emission** (mandatory): forward the phase's own LLM spend (humanizer + report compose calls) to the tracker, then emit the final event:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 7 report.compose \
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" 7 report.compose \
   model=$REPORT_MODEL tokens_in=$R_IN tokens_out=$R_OUT duration_ms=$R_DUR
-pipeline/scripts/log-metric.sh "$TASK_ID" 7 task.completed \
+$HOME/.claude/scripts/log-metric.sh "$TASK_ID" 7 task.completed \
   phases=$PHASE_COUNT review_cycles=$CYCLES lang=$PROMPT_LANG \
   channels_pr=$PR_STATUS channels_jira=$JIRA_STATUS \
   channels_confluence=$CONF_STATUS channels_wiki=$WIKI_STATUS \
@@ -203,7 +203,7 @@ pipeline/scripts/log-metric.sh "$TASK_ID" 7 task.completed \
 **Cost Breakdown emission (mandatory):** as part of agent-log compose, append the per-task cost block produced by `render-agent-log-cost.sh`. Best-effort  -  exit 2 (no tracker data) silently skipped:
 
 ```bash
-COST_BLOCK=$(bash pipeline/scripts/render-agent-log-cost.sh "$TASK_ID" 2>/dev/null) && \
+COST_BLOCK=$(bash $HOME/.claude/scripts/render-agent-log-cost.sh "$TASK_ID" 2>/dev/null) && \
   printf '\n%s\n' "$COST_BLOCK" >> "$AGENT_LOG"
 ```
 
@@ -214,7 +214,7 @@ This is independent of the channels-side `reportContent.costSummary` (which gate
 ```bash
 TRIAGE_PATH="$WORKTREE/triage-output.json"
 if [ -f "$TRIAGE_PATH" ]; then
-  node pipeline/scripts/triage-memory.mjs ingest \
+  node $HOME/.claude/scripts/triage-memory.mjs ingest \
     --triage "$TRIAGE_PATH" \
     --task-id "$TASK_ID" \
     --task-title "$TASK_TITLE" \
@@ -228,11 +228,11 @@ Best-effort. The corpus is JSONL at `~/.claude/memory/multi-agent/<repo-slug>/tr
 
 ```bash
 if [ -f "$TRIAGE_PATH" ]; then
-  node pipeline/scripts/learnings-ledger.mjs from-triage \
+  node $HOME/.claude/scripts/learnings-ledger.mjs from-triage \
     --triage "$TRIAGE_PATH" --task "$TASK_ID" >/dev/null 2>&1 || true
 fi
 # Optionally capture a durable architectural fact the analysis established:
-# node pipeline/scripts/learnings-ledger.mjs add --kind fact \
+# node $HOME/.claude/scripts/learnings-ledger.mjs add --kind fact \
 #   --statement "<one-line fact>" --scope "<path-glob>" --task "$TASK_ID" >/dev/null 2>&1 || true
 ```
 
@@ -286,7 +286,7 @@ for entry in $(jq -c '.[]' memory-synthesis.json); do
   body=$(jq -r '.body' <<< "$entry")
   slug=$(jq -r '.slug' <<< "$entry")
   type=$(jq -r '.type' <<< "$entry")
-  printf '%s\n' "$body" | bash pipeline/scripts/memory-save.sh "$PROJECT_ROOT" "$type" "$slug" -
+  printf '%s\n' "$body" | bash $HOME/.claude/scripts/memory-save.sh "$PROJECT_ROOT" "$type" "$slug" -
 done
 ```
 

package/pipeline/multi-agent-refs/phases.md

@@ -20,7 +20,7 @@
 
 ```
 Normal:    0-Init -> 1-Analysis -> 2-Planning -> 3-Dev -> 4-Review -> 5-Test -> 6-Commit -> 7-Report
---dev:     0-Init ------------------------------------------> 3-Dev -----------> 6-Commit -> 7-Report
+--dev:     0-Init ------------------------------------------> 3-Dev -> 4-Review -> 5-Test -> 6-Commit -> 7-Report
 --local:   Same as above but no worktree  -  works directly on local branch
 ```
 
@@ -42,9 +42,9 @@ Two channels run in parallel at every phase boundary. Both are required in their
 Phase 0 MUST initialize the tracker and register all 8 phases:
 
 ```bash
-pipeline/scripts/phase-tracker.sh init "$TASK_ID"
+$HOME/.claude/scripts/phase-tracker.sh init "$TASK_ID"
 for p in 0:Init 1:Analysis 2:Planning 3:Dev 4:Review 5:Test 6:Commit 7:Report; do
-  pipeline/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
+  $HOME/.claude/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
 done
 ```
 
@@ -55,20 +55,20 @@ This produces an initial card stack printed by both CLIs.
 As each phase enters/exits:
 
 ```bash
-pipeline/scripts/phase-tracker.sh update <N> in_progress    # phase starts
+$HOME/.claude/scripts/phase-tracker.sh update <N> in_progress    # phase starts
 # ...do the work...
-pipeline/scripts/phase-tracker.sh update <N> completed      # phase ends OK
+$HOME/.claude/scripts/phase-tracker.sh update <N> completed      # phase ends OK
 # or:
-pipeline/scripts/phase-tracker.sh update <N> failed         # phase failed
-pipeline/scripts/phase-tracker.sh update <N> skipped        # --dev mode etc.
+$HOME/.claude/scripts/phase-tracker.sh update <N> failed         # phase failed
+$HOME/.claude/scripts/phase-tracker.sh update <N> skipped        # --dev mode etc.
 ```
 
 For sub-phase progress (e.g. Phase 1's parallel Explore agents, Phase 4's reviewer dispatch + triage + validator gate, Phase 6's commit + push + PR sub-steps):
 
 ```bash
-pipeline/scripts/phase-tracker.sh sub <N> 1 "<sub name>" pending      # register
-pipeline/scripts/phase-tracker.sh sub <N> 1 "<sub name>" in_progress  # advance
-pipeline/scripts/phase-tracker.sh sub <N> 1 "<sub name>" completed    # done
+$HOME/.claude/scripts/phase-tracker.sh sub <N> 1 "<sub name>" pending      # register
+$HOME/.claude/scripts/phase-tracker.sh sub <N> 1 "<sub name>" in_progress  # advance
+$HOME/.claude/scripts/phase-tracker.sh sub <N> 1 "<sub name>" completed    # done
 ```
 
 State persists at `$HOME/.claude/logs/multi-agent/<task_id>/tracker-state.json`  -  atomic writes mean concurrent worktrees don't corrupt each other.
@@ -78,9 +78,9 @@ State persists at `$HOME/.claude/logs/multi-agent/<task_id>/tracker-state.json`
 Call alongside tracker update for extra emphasis:
 
 ```bash
-pipeline/scripts/phase-banner.sh start <N> "<name>" "<one-line detail>"
-pipeline/scripts/phase-banner.sh end   <N> done   "<name>" "<short result>"
-pipeline/scripts/phase-banner.sh sub   <N> 2     "<sub>" "<detail>"
+$HOME/.claude/scripts/phase-banner.sh start <N> "<name>" "<one-line detail>"
+$HOME/.claude/scripts/phase-banner.sh end   <N> done   "<name>" "<short result>"
+$HOME/.claude/scripts/phase-banner.sh sub   <N> 2     "<sub>" "<detail>"
 ```
 
 Banner status enum on `end`: `done` | `failed` | `skipped`. Anything else exits 64.

package/pipeline/multi-agent-refs/progress-contract.md

@@ -128,7 +128,7 @@ Overhead: ~40 bytes / line + one millisecond clock read. Negligible vs. any of t
 Every phase that dispatches a billable LLM agent MUST forward the call's token totals to the tracker so the agent-log Cost Breakdown stays complete. The single canonical call shape is:
 
 ```bash
-LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" <phase-id> <event> \
+LOG_METRIC_FORWARD_TO_TRACKER=1 $HOME/.claude/scripts/log-metric.sh "$TASK_ID" <phase-id> <event> \
   model=<fable|opus|sonnet|haiku|gpt-5.4|gpt-5.6|gpt-5.6-terra> \
   tokens_in=$IN tokens_out=$OUT duration_ms=$DUR
 ```
@@ -142,7 +142,7 @@ This contract is enforced by `smoke-agent-log-cost.sh` (forwarder unit test) and
 When `prefs.global.costBudget.enabled` is true, run the budget check once at the END of every phase, right after that phase's token totals have been forwarded to the tracker:
 
 ```bash
-pipeline/scripts/cost-budget-check.mjs --task-id "$TASK_ID" \
+$HOME/.claude/scripts/cost-budget-check.mjs --task-id "$TASK_ID" \
   --prefs "$HOME/.claude/multi-agent-preferences.json"
 ```