@mmerterden/multi-agent-pipeline 15.12.1 → 15.12.2

package/CHANGELOG.md

@@ -16,6 +16,12 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.12.2] - 2026-08-22
+
+### Fixed
+- **`grep -P` is banned in shell, and the ban is enforced.** Unlike the other divergences the portability gate tracks, this one has no guarded form: BSD grep has no `-P` at all, so it exits 2 with "invalid option", and the `2>/dev/null` that nearly every check carries turns that error into an empty result, which reads as "found nothing". A check written that way passes on every input including the one it was meant to catch. Two gates in this repo did exactly that, were handed a file with the defect deliberately planted in it, and reported a clean tree. The scan covers every shell file under `scripts/` and `lib/`, not only the shipped ones, because the two that broke were smoke gates that never ship - and a gate that cannot fail is worse than no gate, since it is trusted. The check opens by proving its own detector fires on a planted invocation.
+- **Always-loaded context is back under budget with its designed headroom.** The fixed per-run load had reached 60000 of a 60000 ceiling, so the next edit to either tracked file would have broken the gate. The cause was the pattern the gate exists to catch: `core/multi-agent/SKILL.md` carried a full transcription of the Phase 0 contract, restating all eight steps that `refs/phases/phase-0-init.md` already defines, while its own text said the transcription "does not replace the contract, read the ref". Its citations into that ref had also drifted - `L221` now points at the token pre-check, not the branch picker it claimed. Every rule was verified present in the ref before cutting (per-repo branch picker, shared branch name with per-repo collision, per-repo identity, serial per-repo worktrees). What stays in the always-loaded file is the part that enforces rather than describes: the blocking exit gate and the credential-inventory rule. 2422 bytes reclaimed, load now 57576 of 60000. The ceiling was not raised.
+
 ## [15.12.1] - 2026-08-22
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.12.1",
+  "version": "15.12.2",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -320,22 +320,17 @@ Full contract: `refs/tracker-contract.md` section "TaskCreate ordering (strict)"
 
 ### Phase 0: Init
 
-> **Contract (strict)**  -  Phase 0 has **8 sequential interactive steps** defined in `refs/phases/phase-0-init.md`. Do **NOT** short-circuit. Even when input is a Jira ID + branch, Steps 1, 4, 5, 6 (load prefs, multi-repo offer, branch picker, branch name confirm) are REQUIRED UX checkpoints  -  skipping them breaks component-production flows where base branch is `iteration/develop`, not `develop`, and where multiple repos must be selected.
+> **Contract (strict)**  -  Phase 0 has **8 sequential interactive steps**, defined in
+> `refs/phases/phase-0-init.md`. Read it before every Phase 0 run and execute all of
+> them. Do **NOT** short-circuit: even when the input is a Jira ID plus a branch, the
+> prefs load, the multi-repo offer, the branch picker and the branch-name confirm are
+> required UX checkpoints. A run once took a Jira ID and implemented straight onto the
+> local checkout with neither the project nor the branch picker ever shown, and nothing
+> failed, so nothing caught it. The walkthrough below covers input parsing and worktree
+> creation only; it is not the contract.
 >
-> The condensed walkthrough below covers Step 1 (parse) + Step 2 (worktree), but DOES NOT replace the full contract. Read `refs/phases/phase-0-init.md` before every Phase 0 run and execute ALL 8 steps:
->
-> 1. **Bootstrap tracker**  -  `$HOME/.claude/scripts/phase-tracker.sh init <task-id>` + 8 phase tiles (Step −1)
-> 2. **Load prefs**  -  read `prefs.global` + `prefs.projects[{name}]`; halt with `/multi-agent:setup` prompt if no keychain mapping (Step 0)
-> 3. **Parse input**  -  classify + fetch Jira/GitHub issue + extract Figma URL if present (Step 1)
-> 4. **Select project(s)  -  single OR multi-repo**  -  present numbered list of repos from `$HOME`. Picker accepts space-separated numbers (`1 3 4`) for multi-select. Component/refactor tasks often span repos (e.g. component repo + consumer app). Surface saved `global.recentGroups` at the top of the list. **Never auto-pick a single repo when the task could touch more than one**  -  ask the user to confirm single vs multi. (Step 2)
-> 5. **Pick base branch PER REPO**  -  REQUIRED INTERACTIVE STEP. If one repo selected: run `git ls-remote --heads origin` on that repo, present sorted list (develop* / release/* / main/master first), suggest top of `global.recentBranches[{projectKey}]`. **If multiple repos selected: fire the branch picker separately for each repo** (phase-0-init.md L221: "In multi-repo mode, the prompt fires per-repo"). Users reported this being silently skipped for component work where the correct base is `iteration/develop`  -  either per-repo prompt missing, or one branch assumed for all repos. Skip only if the user's original input explicitly specified a branch. (Step 3)
-> 6. **Branch name confirm**  -  `feature/PROJ-{id}-{kebab}` or `bugfix/...`  -  user confirms or edits. In multi-repo mode the branch name is shared across all selected repos (collision check runs per-repo; any collision applies the suffix to all). (Step 4)
-> 7. **Git identity  -  per repo**  -  route via `prefs.global.platformIdentityRouting`; ask if ambiguous. Multi-repo mode resolves identity **per repo independently** (phase-0-init.md L283). (Step 6)
-> 8. **Instruction files + workspace creation  -  serially per repo**  -  detect `.instructions/figma/` etc. In multi-repo mode, worktree creation loops per repo serially (phase-0-init.md L308); any failure rolls back previously-created worktrees. Write `agent-state.json` with `state.projects[]` array (scalar `project`/`projectRoot`/`branch` mirror `projects[0]` for back-compat). (Steps 7-8)
->
-> **Exit gate (BLOCKING).** The contract above was prose only, and a run still took a
-> Jira ID and implemented straight onto the local checkout with no picker shown. Before
-> marking Phase 0 completed:
+> **Exit gate (BLOCKING).** Prose alone did not stop that run. Before marking Phase 0
+> completed:
 >
 > ```bash
 > node "$HOME/.copilot/scripts/phase0-exit-gate.mjs" "$TASK_ID" --input "$USER_INPUT"