@mmerterden/multi-agent-pipeline 14.1.0 → 14.2.1

package/CHANGELOG.md

@@ -16,6 +16,182 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [14.2.1] - 2026-07-30
+
+### Changed
+
+- **`testflight-validation` merged into a new `/multi-agent:store-ready`, and the
+  Android side brought to parity.** The iOS archive audit existed twice with
+  identical arguments  -  `ios_app_store_audit({archive_path, rules: "all"})` in the
+  command's Gate 1 and again inside `sim-test.md`'s `store-ready` scenario. Two
+  copies of one call is how the second door grew with no Gate 2, no Gate 3 and no
+  Android equivalent. There is now one implementation.
+  Gates are symmetric per platform, because the failure modes are: a malformed
+  package, a package the store itself refuses, and a policy a human enforces.
+
+  | Gate | iOS | Android |
+  |---|---|---|
+  | 1 Static | `ios_app_store_audit`, 18 rules | `android_apk_audit` + `google-play-compliance`, 21 rules |
+  | 2 Authoritative | `altool --validate-app` | `SKIPPED` |
+  | 3 Policy | `app-store-review` vs source | `play-store-review` vs source |
+
+  Gate 2's asymmetry is reported as an asymmetry rather than smoothed over: Play's
+  authoritative check exists only server-side, through a Publishing API draft edit,
+  and the pipeline ships no client for it. An Android run therefore clears at most
+  2 of 3 and never prints `passed`. `bundletool validate` is Gate 1 and is not
+  promoted to fill the hole.
+  The running-app sweep became Step A rather than a separate errand  -  a build can
+  be structurally perfect and still ship an unreadable screen  -  and it degrades to
+  `SKIPPED (no booted device)` instead of halting the package validation.
+
+  Nothing was removed. `testflight-validation` is a thin iOS-pinned alias (removing
+  a command is a breaking change to the slash-command surface), and
+  `test "store-ready"` still resolves, now as a hand-off. `sim-test.md` keeps only
+  the pointer, so a dark-mode run no longer loads altool and credential-tier prose
+  it never needs.
+
+### Added
+
+- **Four fixed-scenario `test-*` commands.** `/multi-agent:test-dark-mode`,
+  `:test-accessibility`, `:test-dynamic-type` and `:test-screenshots [locale]` pin a
+  scenario the quoted-tag form made you remember and quote. Typing `test-` now
+  autocompletes the matrix list instead of returning a single entry whose tags live
+  only in the help text. The scenario-tag form is unchanged and not deprecated -
+  each command is an alias for it, delegating to the same `sim-test.md`, so there is
+  one implementation and no forked logic. Same pattern the mode aliases already use
+  (`:dev-autopilot` = `--dev autopilot`).
+  `screenshot <lang>` became `test-screenshots [locale]` rather than
+  `test-screenshot-tr`: the locale is a parameter, and freezing one language into a
+  command name buys one command per language. `store-ready` deliberately got no
+  alias - it takes an optional archive path, and its 18-rule audit is the same one
+  `/multi-agent:testflight-validation` runs as its first gate, so the alias would
+  have advertised a second door onto a duplicate.
+
+### Fixed
+
+- **Copilot's `purge` could not see a single worktree.** It discovered them with
+  `find {repo}/.worktrees/ -name "agent-state.json"`, and no worktree carries that
+  file: Phase 0 writes state to `$HOME/.claude/logs/multi-agent/{project}/{task-id}/`.
+  Verified on a repo with two live task worktrees  -  the marker scan returns zero
+  while `purge.sh`'s own directory enumeration finds both. So the skill reported
+  "nothing to purge" as success with real worktrees on disk. The Claude Code command
+  had already been fixed by delegating to `purge.sh`; the Copilot mirror never
+  received that fix, which is the second time a repaired Claude-side surface left its
+  Copilot counterpart behind in this release.
+  It now delegates to the script and explicitly forbids re-introducing a
+  marker-file scan.
+- **The stale log location survived in four more places** after `clear-logs` was
+  redirected. `shared/core/multi-agent` told Phase 0 to create `agent-log.md` and
+  `agent-state.json` inside `.worktrees/PROJ-{id}/`, told `:resume` to look for state
+  there, and printed that path as the report location; `phase-0-init` said "create log
+  dir" without naming one, 49 lines above the line that does. All four now name
+  `$HOME/.claude/logs/multi-agent/{project}/{task-id}/`, the path the tracker,
+  `prune-logs.sh` and `:resume` actually read.
+  `status` and `log` keep their worktree scan as a legacy fallback: it finds nothing
+  on a current tree, but it is harmless and would still serve an old one.
+
+- **`clear-logs` scanned a path nothing writes to, and help advertised it as a
+  slash command that does not exist.** It looked for
+  `.worktrees/PROJ-*/agent-log.md` and `agent-state.json`; Phase 0 has written both
+  to `$HOME/.claude/logs/multi-agent/{project}/{task-id}/` since the layout moved.
+  Against the current tree the scan matches zero files, so the op reported "logs
+  cleared, deleted 0" as success while every real log stayed on disk  -  worse than a
+  missing command, because it reads as done. There was also no `clear-logs` command
+  directory, so the `/multi-agent:clear-logs` entry in the Copilot help pointed at a
+  slash command that was never installed.
+  The name is kept as a redirect to `prune-logs` rather than deleted, so an existing
+  invocation lands somewhere correct. `prune-logs` and `garbage-collect` now appear
+  in the Copilot help, matching the Claude Code side. This is the `finish` → `ship`
+  class of drift the inventory gate's own comment describes, in the files that gate
+  does not parse.
+- **`sim-test.md` advertised two scenarios it never implemented.** `"biometric"` and
+  `"performance"` sat in the activation block with no implementation section, so
+  reaching either fell through to the general sweep and was reported as the scenario
+  asked for. Neither can be built symmetrically today: biometric has `ios_biometric`
+  and no Android counterpart, launch timing has `android_launch_time` and no iOS
+  counterpart, and the file auto-detects platform  -  so each would work on one
+  platform and silently do nothing on the other. Both rows are withdrawn with the
+  reason recorded in place, rather than shipped as half-features or left advertised.
+  Advertised scenarios and implemented sections now match one to one.
+- **`help` never documented two shipped commands.** `testflight-validation` and
+  `ios-coding-standard` existed in the tree, installed correctly, and appeared in no
+  block of `help/SKILL.md` in either language - `ios-coding-standard` was reachable
+  only because it also sat in `prefs.global.routines`, i.e. it read as a personal
+  routine rather than a first-party command. Both are now in the EN and TR Post-Hoc
+  sections. A command absent from help is a command nobody runs.
+- **Rule count drifted between the two language blocks.** The TR block advertised a
+  17-rule iOS store audit against the EN block's 18 and `ios_app_store_audit`'s
+  actual 18. The TR reader was being given a number no code produces.
+
+### Changed
+
+- **`DESC_CEILING` 78000 -> 81000**, with the paired pin in
+  `test/context-budget-gate.test.mjs` moved in the same commit, as that test
+  requires. Not a bump to silence a red gate: at 78000 the surface had **16 bytes**
+  of headroom, so any new command failed regardless of how tersely it was described,
+  while the gate's own average check sat at 320 against its 420 ceiling - the signal
+  that the tree grew rather than that descriptions are padded. The alternative was
+  shaving routing text off eight unrelated `shared/external` skills to fund four
+  commands, which trades a real capability for a cosmetic number. Both the gate and
+  the test now carry the ceiling's history inline so the next raise has to argue for
+  itself. Cost is honest: ~470 always-on tokens per run.
+
+## [14.1.1] - 2026-07-30
+
+Three defects that all shared one shape: a name written in one place and read in
+another, so the mechanism looked implemented, ran without error, and did nothing.
+
+- **Phase 0 wrote the base-ref field its own exit gate does not read.** `/multi-agent:dev`
+  recorded `"baseRefFreshness"` while `phase0-exit-gate.mjs` requires `baseFetchStatus`
+  with one of `fresh | cached-stale | local-branch | aborted`. The value vocabulary was
+  already correct - only the field name differed - so every dev-mode run failed its own
+  exit gate with `baseFetchStatus="<unset>"` even when all four Phase 0 pickers had
+  actually run. A gate that always fails is as useless as one that never fails. The
+  canonical name appeared in five places and the wrong one in exactly one: the dev
+  command's own doc. `smoke-phase-0-multi-repo.sh` now asserts that the name the exit
+  gate reads equals the name the phase doc documents, and that no shipped file names an
+  alternative, with a planted-line probe proving the detector can fire.
+- **Branch memory never populated.** Phase 0 Step 3 read
+  `prefs.global.recentBranches[{projectKey}]` while its own step 7 wrote the legacy
+  `prefs.projects[].branches`, which `prefs.schema.json` marks pre-v2.1.0. Both spots
+  also described a `{name, lastUsed}` entry the schema rejects (`branch` is required and
+  `additionalProperties` is false), so a literal implementation would have failed prefs
+  validation and the dedup - which keys on `branch` - would have accumulated a duplicate
+  every run. The "reused from last run" picker option could therefore never appear.
+  `migrate-prefs.mjs` carries stranded legacy entries into the canonical LRU, stamped
+  with the migration time because the legacy field never recorded a real one and an epoch
+  stamp would be pruned by the TTL on first read; `count: 0` marks them seeded rather
+  than observed.
+- **The sync skill hardcoded the author's git identity.** `git config user.name`,
+  `user.email` and `gh auth switch --user` carried literal values in the plugin-publish
+  block, while the same file's other two publish blocks used `{identity.name}` and
+  `{owner}`. Since the file ships to every installation, a downstream user's
+  plugins-repo commits would have been attributed to someone else and their `gh` account
+  switched under them - and it contradicted the pipeline's own rule that the git author
+  is always the user's identity.
+
+Leak-gate coverage, which is why the third defect had gone unnoticed:
+
+- `smoke-personal-data.sh` only ever scanned `pipeline/`, but the package also publishes
+  `install/`, `docs/`, `index.js`, `install.js`, `README.md` and `CHANGELOG.md`, and every
+  tracked file is public regardless of what npm ships. `CHANGELOG.md` was additionally in
+  the `--exclude` list. A second pass now scans every tracked file outside `pipeline/`,
+  driven by `git ls-files` so the covered set stays exactly "what is public" with no
+  second list to maintain. `LICENSE`, `package.json` and `CODE_OF_CONDUCT.md` are exempt,
+  because a package must name its author and a code of conduct must give a real contact.
+- Added patterns for the author's own name, personal email and `gh auth switch` account -
+  none were checked before, which is precisely how a literal identity survived in a
+  shipped command - plus the employer's abbreviation where it is used as a symbol or
+  workspace prefix, bounded so ordinary words that merely contain those letters
+  (`HEALTHY`, `RHYTHM`) do not match.
+- `--exclude-dir` for `.git`, `node_modules`, `.worktrees`, `.next` and `DerivedData`.
+  Without it, `--root` mode scanned `.git/logs`, so auditing any checkout was guaranteed
+  to "fail" on commit metadata no consumer receives, burying the real findings.
+- Five leaks removed from public files: a real corporate email in `CHANGELOG-archive.md`,
+  a corporate toolkit name in both changelogs, the author's website in `docs/adr/0008`
+  and `docs/internal/`, and corporate symbol/repo/task literals in `docs/internal/`.
+  These are gone from HEAD; git history still contains them.
+
 ## [14.1.0] - 2026-07-29
 
 Two things the pipeline was supposed to do and did not: use the skills a project's
@@ -2650,7 +2826,7 @@ Analysis open-question resolver + repo hygiene hardening.
   blockquotes), humanizer punctuation policy, no Figma access (Locked 30 - design-gap
   rows get only Defer + a re-run recommendation), no auto-commit. Command inventory
   33 -> 34; `/multi-agent:analysis` Phase 5 report now suggests the resolver when
-  Section 20 has open rows. Pattern ported from the ai-mobile-toolkit resolver skills.
+  Section 20 has open rows. Pattern ported from a private stack toolkit's resolver skills.
 - **Dead references removed.** `analysis.md` Reusable refs no longer points at a
   non-existent `fetch-wiki.sh` (the wiki fetch chain is inline: clone -> gh api ->
   WebFetch); `refs/features/external-context-injection.md` figma row routed to the real

package/README.md

@@ -62,11 +62,11 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 | Autopilot | `/multi-agent:autopilot "task"` | All 8 phases, no confirmations |
 | Dev | `/multi-agent:dev "task"` | Init → Dev → Review → Test → Commit → Report |
 | Local | `/multi-agent:local "task"` | Full pipeline, current branch (no worktree) |
-| Finish | `/multi-agent:ship` | Run the review→test→commit→report tail over local work |
+| Ship | `/multi-agent:ship` | Run the review→test→commit→report tail over local work |
 | Audit | `/multi-agent:design-check` | Mock-mode vs Figma conformance, local-only |
 | Audit | `/multi-agent:testflight-validation` | Pre-submission gates for a TestFlight build: static archive audit → Apple's `altool --validate-app` → Review-Guidelines check. Validates only, never uploads |
 
-Helpers: `setup`, `status`, `resume #N`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. 43 commands in all  -  full list: `/multi-agent:help`.
+Helpers: `setup`, `status`, `resume #N`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. 44 commands in all  -  full list: `/multi-agent:help`.
 
 ## Stacks
 
@@ -80,12 +80,12 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 43 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 44 commands.
 
 | Tool | Flag | What it installs |
 |---|---|---|
 | Claude Code | `--claude` (default) | slash commands + skills + agents + `PreToolUse` secret-scan hook |
-| Copilot CLI | `--copilot` | instructions + 43 sub-command skills + scripts |
+| Copilot CLI | `--copilot` | instructions + 44 sub-command skills + scripts |
 | Codex CLI | `--codex` | one router skill + 43 specs as refs + 8 agent TOML + `AGENTS.md` block + `codex mcp add` |
 
 Filter skills by stack with `--platform=ios\|android\|all`.

package/docs/adr/0008-installer-modularization-and-secret-leak-defense.md

@@ -10,7 +10,7 @@ Two pressures collided during the v7.x line:
 
 1. **Installer monolith.** `install.js` reached 1246 LOC by v7.9.1. It mixed flag parsing, three platform installers (Claude / Copilot / six third-party adapters), telemetry, a dev-only file exclusion list, and a 200-line static generator for `copilot-instructions.md`. Reasoning about install behaviour required holding the whole file in your head; reviewers asked for documentation we could not produce because every change touched untyped, intertwined sections.
 
-2. **Secret leaks at deploy time.** During the v7.9.1 production deploy of `mmerterden.dev`, a `vercel deploy --token=vcp_...` invocation failed. The Vercel CLI printed the failed argv verbatim in its retry hint. That leaked the deploy token into the conversation transcript and forced a token rotation. A second incident in the same release window - `git -c user.email=...` overriding the repo-local config - pushed seven commits with the wrong author identity, which Vercel's contributor gate then blocked. Both classes of failure share a root cause: privileged values flowed through argv when the codebase had no audited boundary between provider tools and the orchestration layer.
+2. **Secret leaks at deploy time.** During the v7.9.1 production deploy of the project website, a `vercel deploy --token=vcp_...` invocation failed. The Vercel CLI printed the failed argv verbatim in its retry hint. That leaked the deploy token into the conversation transcript and forced a token rotation. A second incident in the same release window - `git -c user.email=...` overriding the repo-local config - pushed seven commits with the wrong author identity, which Vercel's contributor gate then blocked. Both classes of failure share a root cause: privileged values flowed through argv when the codebase had no audited boundary between provider tools and the orchestration layer.
 
 We needed an architectural answer that prevented both classes of failure from recurring without expanding scope into "rewrite everything as TypeScript" - the project's zero-dependency philosophy (ADR-4) is a hard constraint.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "14.1.0",
+  "version": "14.2.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/deploy.md

@@ -43,7 +43,10 @@ Run through the iOS deployment checklist before App Store submission.
 ### 6. Archive & Upload
 
 - [ ] Archive with Release configuration
-- [ ] Run App Store compliance scan: `/archive-guard <archive>` (uses `ios_app_store_audit` MCP tool)
+- [ ] Run pre-submission validation: `/multi-agent:store-ready --archive=<archive>`  -  three gates
+      (static audit, Apple's own `altool --validate-app`, guideline review vs source).
+      `/archive-guard <archive>` is the quick single-gate form when only the static
+      audit is wanted.
 - [ ] Upload via Xcode Organizer or `xcrun altool`
 - [ ] Verify in App Store Connect
 

package/pipeline/commands/multi-agent/SKILL.md

@@ -72,7 +72,7 @@ Lib scripts (`~/.claude/lib/`):
 | `log [id]` | Show task log |
 | `resume [id]` | Resume paused task |
 | `kill [id]` | Delete worktree (logs preserved). Confirm first |
-| `clear-logs` | Clean global log directory. Keep counter |
+| `clear-logs` | **Superseded  -  redirect, do not run.** Say so and route to `prune-logs`. It targeted `.worktrees/PROJ-*/agent-log.md`, a path nothing has written to since logs moved to `$HOME/.claude/logs/multi-agent/{project}/{task-id}/`; running it would report deleting nothing as success. |
 | `purge` | Worktree + logs + counter  -  full reset (double confirm) |
 | `review [#N\|repo#N\|PR-url\|branch]` | Parallel review of a PR or branch diff; with no input (interactive) lists open GitHub + Bitbucket PRs to multi-select. Posts per-finding inline comments + approve/needs-work on PRs. No worktree. |
 | `review-jira [KEY\|url]` | Grade a Jira issue's readiness for the pipeline (scope / AC / repro / design / API / stack), then post the gaps as a Jira comment. Read-only on code. |
@@ -82,6 +82,8 @@ Lib scripts (`~/.claude/lib/`):
 | `channels [PR-url\|#N\|Jira-url\|Jira-id] [--channels pr,jira,confluence,wiki] [--content normal,test,auto-diff,note] [--message "..."]` | Post task report to multi-select channels (PR description, Jira comment, Confluence page, Wiki pages) with multi-select content sources. Humanizer pass per-channel. Bitbucket PR updates use reviewer-preserving PUT. Phase 7 delegates to this command; also invocable post-hoc for fixes made outside the pipeline. No worktree. |
 | `create-jira ["desc"] [figma-url] [swagger-url]` | Create a standards-compliant Jira issue: asks the type (**Task** / **Bug** / **Story**), mines the project's recent same-type issues for conventions (summary format, labels, priority, test-scenario style), detects the active sprint, drafts from a standard template with auto-sizing sections (Design Reference / API Contract / Screenshots appear only when their source is given), asks about unknown fields, then full draft preview + explicit approval before create. No worktree, no commits. |
 | `test` or `test [args]` | UI Bug Hunter  -  screenshot + tap + analyze on booted simulator via MCP (read `$HOME/.claude/commands/sim-test.md`). `/multi-agent:test` also resolves here via the `commands/multi-agent/test/SKILL.md` delegate. |
+| `test-dark-mode` · `test-accessibility` · `test-dynamic-type` · `test-screenshots [locale]` | Fixed-scenario aliases for the four parameterless / single-parameter `test` scenarios, so the tag autocompletes instead of having to be quoted. Each delegates to the same `sim-test.md` with its scenario pinned; behaviour is identical to the quoted form, which is not deprecated. |
+| `store-ready [repo] [--archive=\|--ipa=\|--aab=\|--apk=] [--skip-sweep]` | Pre-submission store readiness for a built **package**, iOS and Android, local-only. Three symmetric gates per platform  -  static package audit, the store's own validator, policy review vs repo source  -  plus the running-app sweep as Step A. A skipped gate is never folded into the pass count, and an Android run clears at most 2 of 3 because Play's authoritative check is server-side only. Validates only, never uploads. `testflight-validation` is the iOS-pinned alias; `test "store-ready"` hands off here. |
 | `manual-test [#id]` | Phase 5 standalone Manual Test  -  checks out the task branch, prints Xcode / SourceTree hints, waits for user verdict (`ok` / `fix: ...`). |
 | `design-check [scope]` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module → mock-support feasibility gate (halts if unsupported) → **scenario inventory** (every launch arg / scenario case / scenario code / fixture / deep link becomes a countable target with file+line evidence) → scope resolve (empty = module, screen, `screen@variant`, target id, Figma URLs, `--resume`) → worktree Debug build + mock launch → drive EACH target by its own driver, capturing tap-reachable sub-states with it → per-variant pixel + px-spacing + typography + color compare → report (side-by-side + annotated overlay + stacked findings + fix prompt) exported to `~/DesignChecks/` as HTML + PDF (+ Confluence if enabled). **Coverage gate**: a target is audited or skipped with a concrete reason, else the run is reported INCOMPLETE with the missing ids. No commits, no CI. |
 | `stack [ios\|android\|backend\|mobile\|all]` | Swap skills for next conversation. No arg = show current stack. |
@@ -113,7 +115,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | `help` | `$HOME/.claude/commands/multi-agent/help/SKILL.md` |
 | `channels` | `$HOME/.claude/commands/multi-agent/channels/SKILL.md` |
 | `sync` | `$HOME/.claude/commands/multi-agent/sync/SKILL.md` |
-| `clear-logs` | Handled inline  -  scan + delete agent-log.md/agent-state.json files |
+| `clear-logs` | Handled inline  -  redirect to `prune-logs`, see the routing note |
 | `review` | `$HOME/.claude/commands/multi-agent/review/SKILL.md` |
 | `review-jira` | `$HOME/.claude/commands/multi-agent/review-jira/SKILL.md` (loads `$HOME/.claude/multi-agent-refs/readiness-review.md`) |
 | `review-issue` | `$HOME/.claude/commands/multi-agent/review-issue/SKILL.md` (loads `$HOME/.claude/multi-agent-refs/readiness-review.md`) |
@@ -136,10 +138,11 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | Token lookup needed | `$HOME/.claude/multi-agent-refs/keychain.md` |
 | Audit tools (Phase 5/6) | `$HOME/.claude/multi-agent-refs/audit-guide.md` |
 | `test` | `$HOME/.claude/commands/sim-test.md` (colon-form `/multi-agent:test` uses the delegate at `commands/multi-agent/test/SKILL.md`) |
+| `test-dark-mode` · `test-accessibility` · `test-dynamic-type` · `test-screenshots` | `$HOME/.claude/commands/sim-test.md`, scenario pinned by the command name (delegates at `commands/multi-agent/test-*/SKILL.md`) |
 | `manual-test` | `$HOME/.claude/commands/multi-agent/manual-test/SKILL.md` |
 | `design-check` | `$HOME/.claude/commands/multi-agent/design-check/SKILL.md` |
 
-**Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `clear-logs`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
+**Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
 
 **How**: After routing, `Read` the relevant file and follow its instructions. Only load what the current action needs.
 

package/pipeline/commands/multi-agent/dev/SKILL.md

@@ -91,9 +91,13 @@ The agent CANNOT make these Phase 0 decisions automatically; it suggests, then w
          3. Cancel
        Confirm? [1/2/3]
      ```
-   - User picks `2` → log warning + record `"baseRefFreshness": "stale"` in
+   - User picks `2` → log warning + record `"baseFetchStatus": "cached-stale"` in
      `agent-state.json`, proceed from local ref. Phase 6 push needs network anyway,
      so re-prompt there if still unreachable.
+   - Option `1` (fetch succeeded) records `"fresh"`; a local-branch base records
+     `"local-branch"`; option `3` records `"aborted"`. The field name and this
+     four-value vocabulary are what `phase0-exit-gate.mjs` reads, so a run that writes
+     anything else cannot close Phase 0.
 
    Always show what was **observed** next to what was **classified**. The previous
    wording asserted `Detected: <host> unreachable (VPN/DNS)` for every failure mode,

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -119,6 +119,14 @@ Post-Hoc & Side-Channel:
   /multi-agent:search         Cross-task log search with smart ranking; --semantic queries triage corpus
   /multi-agent:scan           Skill security scan against tiered pattern catalog
   /multi-agent:refactor       Adapted best-practices + bug hunt + upstream-drift + dev-toolkit MCP research -> one plan, approval, dev + sync
+  /multi-agent:store-ready [repo] [--archive=|--ipa=|--aab=|--apk=] [--skip-sweep]  Pre-submission store readiness,
+                              iOS + Android, local-only. Three symmetric gates per platform: static package audit,
+                              the store's own validator, policy review vs repo source. Plus the running-app sweep.
+                              A skipped gate is never counted as a pass. Validates only, never uploads.
+  /multi-agent:testflight-validation [repo] [--ipa=|--archive=]  iOS-pinned alias of :store-ready, kept because it is
+                              the name you reach for when the target is TestFlight. Same three gates, one implementation.
+  /multi-agent:ios-coding-standard [module]  Audit an iOS module against the 99-rule coding-standard registry -> remediation
+                              plan + one-page onboarding summary -> hand off to dev / dev-local. Read-only, never edits source.
 
 Setup & Maintenance:
 
@@ -156,11 +164,22 @@ Interactive Launchers:
 UI Testing (standalone  -  not part of pipeline phases):
 
   /multi-agent:test                  Full simulator test (screenshot all screens)
-  /multi-agent:test "dark mode"      Dark mode bug test
-  /multi-agent:test "accessibility"  Accessibility audit (labels, tap targets, contrast)
-  /multi-agent:test "dynamic type"   Large text size test
-  /multi-agent:test "screenshot tr"  App Store screenshots in Turkish
-  /multi-agent:test "store-ready"    App Store guideline pre-flight check
+
+  Fixed-scenario commands  -  no quoting, and they autocomplete off `test-`:
+
+  /multi-agent:test-dark-mode        Dark mode bug test
+  /multi-agent:test-accessibility    Accessibility audit (labels, tap targets, contrast)
+  /multi-agent:test-dynamic-type     Large text size test
+  /multi-agent:test-screenshots [tr] App Store screenshot set in a locale (default tr)
+
+  The scenario-tag form still works and is not deprecated  -  each command above is
+  an alias for it.
+
+  /multi-agent:test "dark mode" | "accessibility" | "dynamic type" | "screenshot <lang>"
+
+  `store-ready` is NOT a UI test: it validates a built package, on iOS and Android,
+  through three gates per platform, and lives at /multi-agent:store-ready. The old
+  /multi-agent:test "store-ready" [path] tag still works and hands off there.
 
   Uses xcrun simctl / adb (native, no external app needed).
   Booted simulator/emulator required. Auto-detects bundle ID from project.
@@ -362,6 +381,14 @@ Post-Hoc & Side-Channel:
   /multi-agent:search         Task log'larında akıllı arama; --semantic triage corpus'unu sorgular
   /multi-agent:scan           Skill güvenlik taraması (tiered pattern catalog)
   /multi-agent:refactor       Uyarlanmış best-practice + bug avı + upstream-drift + dev-toolkit MCP araştırması -> tek plan, onay, dev + sync
+  /multi-agent:store-ready [repo] [--archive=|--ipa=|--aab=|--apk=] [--skip-sweep]  Yükleme öncesi store hazırlığı,
+                              iOS + Android, yalnızca lokal. Platform başına 3 simetrik kapı: statik paket denetimi,
+                              store'un kendi doğrulayıcısı, kaynağa karşı politika incelemesi. Artı çalışan-app sweep'i.
+                              Atlanan kapı asla pass sayılmaz. Sadece doğrular, asla yüklemez.
+  /multi-agent:testflight-validation [repo] [--ipa=|--archive=]  :store-ready'nin iOS'a sabitlenmiş alias'ı; hedef
+                              TestFlight olduğunda akla gelen isim olduğu için korunuyor. Aynı 3 kapı, tek implementasyon.
+  /multi-agent:ios-coding-standard [modül]  Bir iOS modülünü 99 kurallık kodlama-standardı registry'sine göre denetler -> düzeltme
+                              planı + tek sayfalık onboarding özeti -> dev / dev-local'e devreder. Read-only, kaynağı hiç düzenlemez.
 
 Setup & Maintenance:
 
@@ -399,11 +426,22 @@ Rutinler (kendi tekrar eden işlerin):
 UI Testing (standalone  -  pipeline fazlarından bağımsız):
 
   /multi-agent:test                  Tam simulator testi (tüm ekran screenshot'ları)
-  /multi-agent:test "dark mode"      Dark mode bug testi
-  /multi-agent:test "accessibility"  Erişilebilirlik denetimi (label/tap-target/kontrast)
-  /multi-agent:test "dynamic type"   Büyük metin boyutu testi
-  /multi-agent:test "screenshot tr"  App Store screenshot seti (Türkçe locale)
-  /multi-agent:test "store-ready"    App Store guideline pre-flight kontrolü
+
+  Sabit-senaryo komutları  -  tırnak gerekmez, `test-` ile autocomplete'e düşer:
+
+  /multi-agent:test-dark-mode        Dark mode bug testi
+  /multi-agent:test-accessibility    Erişilebilirlik denetimi (label/tap-target/kontrast)
+  /multi-agent:test-dynamic-type     Büyük metin boyutu testi
+  /multi-agent:test-screenshots [tr] Belirtilen dilde App Store screenshot seti (default tr)
+
+  Senaryo etiketli form çalışmaya devam eder, kaldırılmadı  -  yukarıdaki komutların
+  her biri onun alias'ı.
+
+  /multi-agent:test "dark mode" | "accessibility" | "dynamic type" | "screenshot <dil>"
+
+  `store-ready` bir UI testi DEĞİL: üretilmiş paketi platform başına üç kapıdan
+  geçirerek doğrular, iOS + Android, ve /multi-agent:store-ready altında. Eski
+  /multi-agent:test "store-ready" [path] etiketi çalışır ve oraya devreder.
 
   xcrun simctl / adb kullanır (harici app gerekmez).
   Booted simulator/emulator şart. Bundle ID proje'den otomatik algılanır.
@@ -458,7 +496,7 @@ Temel Özellikler:
   Multi-Repo       Repo başına worktree, repo başına identity, commit öncesi entegrasyon build'i
   Identity Routing Repo origin URL'sinden git kimliği seçimi (kurumsal vs kişisel)
   Issue Safety     Issue'lar asla auto-close edilmez (GitHub + Jira için 4 onay gerekir)
-  Store Compliance /multi-agent:test "store-ready"  -  iOS için 17 kurallık audit (ITMS / Privacy Manifest /
+  Store Compliance /multi-agent:test "store-ready"  -  iOS için 18 kurallık audit (ITMS / Privacy Manifest /
                    code signing / debug-tool leak / IPv6 / SDK list / vb.) + Android için 21 kurallık audit
   Bilingual        EN + TR  -  outputLanguage assistant açıklamasını değiştirir; promptLanguage en kilitli
 

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -116,7 +116,7 @@ These are the RECOMMENDED key names. When creating NEW keys, use these. But exis
 
 > Multi-agent setup onboards **both** Figma tokens because the pipeline's 3-tier Figma access chain (see `$HOME/.claude/rules/figma-pipeline.md`) uses them in priority order: Tier 1 = MCP (`figma_mcp`), Tier 2 = REST PAT (`figma`), Tier 3 = user screenshot fallback. Missing either token forces a downshift; missing both leaves Tier 3 as the only path. The Tier 2 logical key is `figma`, not `figma_pat`: `figma_pat` is the pre-v13.6 name that `migrate-prefs.mjs` consolidates away, and writing a new mapping under it means the next migration deletes it.
 
-> The four App Store Connect entries are **iOS-only and optional**: skip them all and the pipeline still works, it just reports Gate 2 of `/multi-agent:testflight-validation` as `SKIPPED` (never as a pass). They mirror the Figma 3-tier shape  -  Tier 1 = API key (`appstore_connect_key_id` + `appstore_connect_issuer_id`), Tier 2 = Apple ID + app-specific password (`appstore_connect_apple_id` + `appstore_connect_password_item`), Tier 3 = nothing configured. **Offer Tier 2 first when the user says they cannot create an API key**: creating one needs an Admin or App Manager role in App Store Connect, while an app-specific password is generated by the account holder at `appleid.apple.com` with no team permission at all. Two of these hold identifiers rather than secrets (key id, issuer id) and one holds a keychain ITEM NAME, not a password  -  they still go through the mapping layer so every credential is read the same way. Onboarding mechanics in Step 3b.
+> The four App Store Connect entries are **iOS-only and optional**: skip them all and the pipeline still works, it just reports Gate 2 of `/multi-agent:store-ready` as `SKIPPED` (never as a pass). They mirror the Figma 3-tier shape  -  Tier 1 = API key (`appstore_connect_key_id` + `appstore_connect_issuer_id`), Tier 2 = Apple ID + app-specific password (`appstore_connect_apple_id` + `appstore_connect_password_item`), Tier 3 = nothing configured. **Offer Tier 2 first when the user says they cannot create an API key**: creating one needs an Admin or App Manager role in App Store Connect, while an app-specific password is generated by the account holder at `appleid.apple.com` with no team permission at all. Two of these hold identifiers rather than secrets (key id, issuer id) and one holds a keychain ITEM NAME, not a password  -  they still go through the mapping layer so every credential is read the same way. Onboarding mechanics in Step 3b.
 
 **1c. Resolution logic (per service):**