@mmerterden/multi-agent-pipeline 14.1.0 → 14.2.1

package/pipeline/skills/shared/core/multi-agent-test-screenshots/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: multi-agent-test-screenshots
+language: en
+description: "App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the screenshot scenario. Use when generating store screenshots or checking a localised build renders."
+user-invocable: true
+argument-hint: "[locale]  -  empty = tr; e.g. tr | en | de | ar"
+---
+
+# multi-agent-test-screenshots  -  Locale screenshot set
+
+Fixed-scenario alias, **parameterised by locale**. The scenario is pinned; the language
+is not, because one skill per language would put a parameter in a name.
+
+## Locale resolution
+
+1. `$ARGUMENTS` names a locale (`tr`, `en`, `de`, `ar`, ...) → use it.
+2. `$ARGUMENTS` empty → `tr`.
+3. `$ARGUMENTS` is something other than a locale → do not guess a language and do not
+   silently fall back. Ask which locale, rendered in `outputLanguage`.
+
+## Dispatcher
+
+Read and follow:
+
+```
+$HOME/.copilot/multi-agent/sim-test.md
+```
+
+(Equivalent on Claude Code: `$HOME/.claude/commands/sim-test.md`.)
+
+Run it with **scenario = `screenshot <locale>`**, substituting the locale resolved
+above. That is the tag the target doc matches; passing a bare `screenshot` leaves the
+language unset.
+
+## Equivalent
+
+`multi-agent-test "screenshot tr"`  -  identical behaviour. Both forms are supported;
+neither is deprecated.
+
+## Requirements
+
+- **iOS**: Xcode + booted Simulator (`xcrun simctl list | grep Booted`)
+- **Android**: Android SDK + running emulator or USB device (`adb devices`)
+- **MCP**: `dev-toolkit` MCP server registered (tool names start with `mcp__dev-toolkit__*`)

package/pipeline/skills/shared/core/multi-agent-testflight-validation/SKILL.md

@@ -1,120 +1,48 @@
 ---
 name: multi-agent-testflight-validation
 language: en
-description: "Pre-submission validation for a TestFlight / App Store build (iOS, local-only). Three gates: static archive audit, Apple's own `altool --validate-app`, and a Review-Guidelines check. ITMS codes are mapped to the rule each implies. Validates only, never uploads. Use when a build is about to go to TestFlight, or a submission was rejected and you need why."
+description: "iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never uploads. Use when an iOS build is about to go to TestFlight, or a submission was rejected and you need why."
 user-invocable: true
 argument-hint: "[repo]  -  empty = pick from prefs; repo name or path; --ipa=<path>; --archive=<path>; --resume"
 ---
 
-# multi-agent-testflight-validation  -  pre-submission validation
+# multi-agent-testflight-validation  -  iOS alias for store-ready
 
-Catch, before you upload, what App Store Connect would send back after you do.
+This skill is an alias. The implementation it used to carry was merged into
+`multi-agent-store-ready`, which runs the same three gates on iOS and adds the
+Android side, so there is one flow to maintain instead of two that had already
+started to drift.
 
-**Local-only**: no commits, no push, no PR, no channels. **It never uploads**  -  only
-`--validate-app` is ever invoked, never `--upload-app`.
+The name is kept because it is the one people reach for when the target is
+TestFlight, and removing a surface is a breaking change.
 
-## Why three gates
+## Dispatcher
 
-Each sees something the others structurally cannot, so reporting one as "the check"
-is how a build passes locally and gets rejected anyway.
+Read and follow:
 
-| Gate | Runs | Needs | Sees | Blind to |
-|---|---|---|---|---|
-| **1. Static** | `ios_app_store_audit` (18 rules) | `.xcarchive` | privacy manifest, required-reason API, Info.plist, signing, entitlements, embedded SDK, IPv6, debug leak | anything account-dependent |
-| **2. Authoritative** | `ios_testflight_validate` → `altool --validate-app` | `.ipa` + credentials | unregistered bundle ID, profile/app-record mismatch, **version+build already used**, entitlement not provisioned | the Review Guidelines |
-| **3. Guideline** | `app-store-review` skill + repo evidence | repo checkout | ATT, privacy policy, account deletion, IAP, purpose-string wording | anything not in source |
-
-Most "we passed validation and still got rejected" cases are Gate 3 findings:
-Apple's validator does not read the Review Guidelines.
-
-## Flow
-
-**0. Input.** `(empty)` → ask · `my-ios-app`/path → that repo · `--ipa=<path>` →
-Mode B without Gate 1 · `--archive=<path>` → Mode B with all gates · `--resume`.
-State at `~/.claude/logs/multi-agent/<task_id>/agent-state.json`,
-`taskId = TFV-<repo>-<yyyymmddHHMM>`. Register phases with
-`bash ~/.copilot/scripts/phase-tracker.sh` and render with
-`phase-tracker.sh render` at every boundary.
-
-**1. Pickers.** Repo (iOS entries in `prefs.projects`; a single match auto-resolves,
-and the breadcrumb says so) → branch → mode. Print
-`Step <i>/<n>: <what this decides>` for each. On `git fetch` failure do **not**
-silently use a cached ref, and **classify the failure before naming a cause**:
-`could not read Password` / `Authentication failed` / `403` is a credential
-problem, not a network one, and a VPN cannot fix it; `Could not resolve host` /
-`Operation timed out` is the network. Show the stderr line verbatim next to your
-classification, then offer the remedy that matches it. Only the network case gets
-the continue-on-a-stale-ref option: for a credential failure, staleness is
-unrelated to what broke.
-
-**2. Pre-flight.** `xcrun --find altool` and `xcodebuild -version`; a missing
-prerequisite halts. Resolve credentials and name the active tier in the report:
-tier 1 ASC API key (key id + issuer id from the keychain via
-`prefs.global.keychainMapping`, `.p8` at
-`~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8`), tier 2 Apple ID +
-app-specific password by keychain reference, tier 3 none → **Gate 2 is `SKIPPED`
-and the verdict line says so**. Credentials come from `/multi-agent:setup`; never
-prompt for a secret value in chat. Tier 2 needs no elevated App Store Connect
-role, which matters when API-key creation is not permitted on the account.
-
-**3. Obtain the build.**
-- Mode B `.xcarchive` → Gate 1 runs; export with `ios_export_ipa` to reach Gate 2.
-- Mode B `.ipa` only → **Gate 1 `SKIPPED (needs .xcarchive)`**. The static audit
-  reads archive structure an `.ipa` does not carry. Do not present a two-gate run
-  as a full pass.
-- Mode A → worktree at `{projectRoot}/{worktreeBasePath}/{taskId}` (**never under
-  `$HOME`**) → `ios_xcodebuild({action: "archive", configuration: "Release",
-  destination: "generic/platform=iOS"})`  -  the simulator default would produce a
-  non-distributable archive  -  then `ios_export_ipa({method:
-  "app-store-connect", team_id, ...})`. Leave `allow_provisioning_updates` off
-  unless asked: it lets xcodebuild create or modify profiles in the developer
-  account, which a validation run has no business doing.
-
-**4. Gate 1.** `ios_app_store_audit({archive_path, rules: "all"})`. `error` blocks,
-`warning` advises. Keep each ITMS code  -  Gate 2 may return the same one, and that
-agreement tells the user it is real.
-
-**5. Gate 2.** `ios_testflight_validate({ipa_path, platform: "ios", <creds>})`.
-Render the verdict as returned: `PASS` / `FAIL` (each issue with ITMS code, mapped
-guideline, hint) / `SKIPPED` (with the reason, **never as a pass**). This is the
-only gate that catches an already-used build number  -  the most common wasted
-upload  -  so when it fails on that, name the next free build number.
-
-**6. Gate 3.** Load `app-store-review` and check, with an evidence path each:
-purpose strings (present, specific, matching actual use) · `PrivacyInfo.xcprivacy`
-(exists, declares required-reason APIs, matches linked SDKs) · ATT before any
-tracking · in-app account deletion when accounts are created · privacy policy
-reachable · IAP through StoreKit with no external purchase path · Sign in with
-Apple alongside third-party social login. Mark `pass` / `fail` /
-`not-applicable`, and `not-applicable` needs a reason  -  an unexamined area is not
-a pass.
+```
+$HOME/.copilot/multi-agent/commands/store-ready.md
+```
 
-**7. Report.** `~/TestFlightChecks/<repo>-<branch>-<timestamp>/report.md` plus a
-printed summary:
+(Equivalent on Claude Code: `$HOME/.claude/commands/multi-agent/store-ready/SKILL.md`.)
 
-```
-Verdict: <N> of 3 gates cleared[, <M> skipped]
-Build:   <path>  ·  <bundle id> <version> (<build>)
-Auth:    tier <1|2|none>  ·  <method>
+Run it with **platform pinned to `ios`** and skip its platform-detection step. Pass
+`$ARGUMENTS` through verbatim: `--ipa=`, `--archive=`, a repo name or path, and
+`--resume` all mean exactly what they mean there.
 
-Gate 1  static audit        PASS | FAIL (<n> blocking, <n> advisory) | SKIPPED (<reason>)
-Gate 2  Apple validation    PASS | FAIL (<n> issues) | SKIPPED (<reason>)
-Gate 3  guideline review    PASS | FAIL (<n> findings) | <n> not-applicable
+`--aab=` / `--apk=` are Android inputs and are not valid here. If one is supplied,
+do not silently switch platform  -  say the Android inputs belong to
+`multi-agent-store-ready`, and stop.
 
-Blocking  -  fix before uploading
-  [ITMS-90683] Info.plist: NSCameraUsageDescription missing
-      guideline 5.1.1 Data Collection and Storage
-      <hint>  ·  <file:line>
+## What you get
 
-Not run
-  Gate 1: needs an .xcarchive; only an .ipa was supplied
-```
+Unchanged from before the merge, on the iOS path:
 
-A skipped gate is never folded into the pass count. Every blocking finding carries
-a file path or an ITMS code. No AI or assistant attribution anywhere; real
-newlines, no HTML entities.
+| Gate | What runs | Needs |
+|---|---|---|
+| **1. Static** | `ios_app_store_audit` (18 rules, real ITMS codes) | an `.xcarchive` |
+| **2. Authoritative** | `ios_testflight_validate` → `altool --validate-app` | an `.ipa` + credentials |
+| **3. Policy** | `app-store-review` skill vs repo source | repo checkout |
 
-**8. Offer, do not act.** Print the exact `xcrun altool --upload-app` command for
-when the gates are clear (uploading stays an explicit human act), plus
-`--resume` after fixes and `/multi-agent:fix-bug` for code-level Gate 3 findings.
-Never upload, never bump the build number, never commit.
+A skipped gate is never folded into the pass count, and the run never uploads. The
+report lands in `~/StoreChecks/ios-<repo>-<branch>-<timestamp>/report.md`.

package/pipeline/skills/shared/external/firebase/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: firebase
-description: "You're a developer who has shipped dozens of Firebase projects. You've seen the \\"easy\\" path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges. Use when integrating or reviewing Firebase: auth, Firestore, functions, or its cost and scaling traps."
+description: "You're a developer who has shipped dozens of Firebase projects. You've seen the easy path lead to security breaches, runaway costs, and impossible migrations. You know Firebase is powerful, but you also know its sharp edges. Use when integrating or reviewing Firebase: auth, Firestore, functions, or its cost and scaling traps."
 risk: unknown
 source: "vibeship-spawner-skills (Apache 2.0)"
 date_added: "2026-02-27"

package/pipeline/skills/skills-index.md

@@ -3,7 +3,7 @@
 > Auto-generated by `pipeline/scripts/build-skills-index.mjs`  -  do not hand-edit.
 > Regenerate with `node pipeline/scripts/build-skills-index.mjs`.
 
-**196 skills** across 2 groups.
+**201 skills** across 2 groups.
 
 | Group | Name | Platform | Description |
 |-------|------|----------|-------------|
@@ -56,7 +56,7 @@
 | external | `energykit` |  -  | Query grid electricity forecasts and submit load events using EnergyKit to help users optimize home electricity usage. Use when building sma |
 | external | `eventkit-calendar` |  -  | Create, read, and manage calendar events and reminders using EventKit and EventKitUI. Use when adding events to the user's calendar, creatin |
 | external | `fastapi-pro` |  -  | Build high-performance async APIs with FastAPI, SQLAlchemy 2.0, and Pydantic V2. Master microservices, WebSockets, and modern Python async p |
-| external | `firebase` |  -  | You're a developer who has shipped dozens of Firebase projects. You've seen the \\"easy\\" path lead to security breaches, runaway costs, an |
+| external | `firebase` |  -  | You're a developer who has shipped dozens of Firebase projects. You've seen the easy path lead to security breaches, runaway costs, and impo |
 | external | `github-actions-templates` |  -  | Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications. Use when a GitHub Actions workflow has  |
 | core | `google-play-compliance` |  -  | Google Play Store publication compliance  -  bundletool + aapt2 + apksigner orchestration + 21-rule policy catalog with Play Console error c |
 | external | `gradle-kotlin-dsl` |  -  | Configure Android builds with Gradle Kotlin DSL, version catalogs (libs.versions.toml), convention plugins (build-logic module), common conf |
@@ -102,7 +102,6 @@
 | core | `multi-agent-dev-local` |  -  | Fast mode + local  -  Init → Dev(Opus) → Review → Commit → Report, no worktree. Use when a change should be developed and reviewed on the cu |
 | core | `multi-agent-dev-local-autopilot` |  -  | Fastest + local  -  Dev(Opus) + autopilot, no worktree, zero interaction. Use when a change should be developed on the current branch with n |
 | core | `multi-agent-diff-explain` |  -  | Map Phase 4 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
-| core | `multi-agent-ship` |  -  | Continue already-done LOCAL work through the pipeline tail: Review → Build+Test → Commit/PR → Report (technical analysis + Jira test-scenari |
 | core | `multi-agent-forget` |  -  | Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one an |
 | core | `multi-agent-garbage-collect` |  -  | Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before d |
 | core | `multi-agent-help` |  -  | Multi-agent pipeline usage guide  -  renders in EN or TR per prefs.global.outputLanguage (falls back to promptLanguage for backward compatib |
@@ -127,11 +126,17 @@
 | core | `multi-agent-scan` |  -  | Skill security scan: walks local skill directories against a tiered pattern catalog. Use when local skill directories need checking for unsa |
 | core | `multi-agent-search` |  -  | Log search across every agent-log.md with smart ranking and filters. Optional --semantic flag queries the per-repo triage corpus. Use when s |
 | core | `multi-agent-setup` |  -  | First-run setup wizard: keychain token discovery, Git Identity onboarding, and pipeline preparation. Use when the pipeline is being set up f |
+| core | `multi-agent-ship` |  -  | Continue already-done LOCAL work through the pipeline tail: Review → Build+Test → Commit/PR → Report (technical analysis + Jira test-scenari |
 | core | `multi-agent-stack` |  -  | Select the active stack for this repo by enabling the matching marketplace plugin(s) in .claude/settings.json (ios/android/mobile/backend/fr |
 | core | `multi-agent-status` |  -  | Show every multi-agent task's ID, phase, branch, and status. Use when asked what is running, or for an overview of every task. |
+| core | `multi-agent-store-ready` |  -  | Pre-submission store readiness for a built package, iOS and Android, local-only. Three symmetric gates per platform: a static package audit, |
 | core | `multi-agent-sync` |  -  | One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, website, and the dev-toolkit MCP server. Use whe |
 | core | `multi-agent-test` |  -  | UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb). Auto-detects platform. Screenshot + tap + analyze on the booted device. T |
-| core | `multi-agent-testflight-validation` |  -  | Pre-submission validation for a TestFlight / App Store build (iOS, local-only). Three gates: static archive audit, Apple's own `altool --val |
+| core | `multi-agent-test-accessibility` |  -  | Accessibility audit on a booted simulator / emulator: VoiceOver labels, sub-44pt tap targets, contrast, traits. Alias pinning the accessibil |
+| core | `multi-agent-test-dark-mode` |  -  | Dark mode UI test on a booted simulator / emulator: walk every screen light then dark, report contrast + colour bugs. Alias pinning the dark |
+| core | `multi-agent-test-dynamic-type` |  -  | Dynamic Type layout test on a booted simulator / emulator: re-walk every screen at XL through accessibility-extra-large, report truncation a |
+| core | `multi-agent-test-screenshots` |  -  | App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the  |
+| core | `multi-agent-testflight-validation` |  -  | iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never upl |
 | core | `multi-agent-uninstall` |  -  | Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline set |
 | core | `multi-agent-update` |  -  | Update the pipeline to the latest version: git pull, install, migrate. Use when the installed pipeline is behind and should be brought to th |
 | external | `musickit-audio` |  -  | Integrate Apple Music playback, catalog search, and Now Playing metadata using MusicKit and MediaPlayer. Use when adding music search, Apple |