@mmerterden/multi-agent-pipeline 15.5.0 → 15.6.1

package/CHANGELOG.md

@@ -16,6 +16,25 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [15.6.1] - 2026-08-19
+
+### Changed
+- **`/multi-agent:update` installs from npm, not from a git clone**: the registry is the single update channel - latest published release resolved with a direct registry read (never `npm view`'s cache), downloaded via `npm pack` with the registry pinned, installed with `install.js --all`, changes rendered from the packaged CHANGELOG, smokes run from the tarball. A pipeline repo clone is now purely a maintainer workspace (synced by `/multi-agent:sync`); consumers need no git access at all, so collaborator grants on the private repo can stay read-only or be dropped.
+
+### Fixed
+- **`node --test` runs stop pinging the live dashboard**: the tracker-entities suite calls `phase-tracker.sh init` outside run-smokes' `MULTI_AGENT_SMOKE` guard, so every test run left a phantom "probe" row on the timeline. The suite now sets the flag itself, and `usage-report.mjs` refuses to emit under it as the last line of defense for any caller.
+- **Usage report reads the tracker as it is actually written**: `tracker-state.json` stores `phases` as an array, but the reporter iterated it with `Object.entries`, so dashboard phase ids were array indexes - every phase after a skipped one was mislabeled (Commit id "6" reported as Faz 5). Failed-phase error tags carried the same wrong ids.
+- **Run duration and terminal timestamp resolve from the tracker**: nothing stamps `state.finishedAt`, so every run reported `du=null` and a terminal emit was stamped with the reporter's wall clock (wrong for backfills). Both now fall back to the tracker's phase span (earliest start to latest completion).
+- **Version and user fields stop reporting null**: the reporter reads the installer's `~/.claude/.pipeline-version` marker (installed trees have no adjacent `package.json`) and falls back to `identity.name` when `identity.username` is absent.
+
+## [15.6.0] - 2026-08-18
+
+### Fixed
+- **The heart goes platform-blind** (platform-dynamic audit, 15 findings): Phase 3's RED run, target resolution and build verification become `case "$STACK"` arms (gradle/pytest/npm beside xcodebuild, with the Gradle build-lock decision stated); Phase 4 Gate 1 matches its own stack-generic Gates 2-3; Phase 2 dispatches the platform's architect agent; Phase 5's device-check table gains the Android MCP tools; the figma-config schema stops claiming SwiftUI as universal; wiki scope gains a `platform` value.
+
+### Added
+- **Per-stack routing hatches**: `STACK_ONLY` lists in `_stack-routing.mjs` so a stack-only skill (ktlint, hilt-di, ...) routes with one list entry instead of a regex widening - and `--check-routing` now FAILS on unrouted skills. `lint-skills` accepts `platform: backend|frontend`.
+
 ## [15.5.0] - 2026-08-18
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.5.0",
+  "version": "15.6.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -1,43 +1,49 @@
 ---
-description: "Update the pipeline to the latest version: git pull, install, migrate. Use when the installed pipeline is behind and should be brought to the latest version."
-description-tr: "Pipeline'ı son sürüme günceller: git pull, install, migrate."
+description: "Update the pipeline to the latest published npm release: registry check, npm pack, install, migrate. Use when the installed pipeline is behind and should be brought to the latest version."
+description-tr: "Pipeline'ı npm'deki son yayına günceller: registry kontrolü, npm pack, install, migrate."
 allowed-tools: Bash, Read, Write, AskUserQuestion
 ---
 
 # multi-agent update
 
-Update the pipeline in one command. Existing preferences are preserved; only skill / script / schema files are refreshed.
+Update the pipeline in one command. The npm registry is the single update channel: the latest published release is downloaded and installed. Existing preferences are preserved; only skill / script / schema files are refreshed.
+
+A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/multi-agent:sync` - it is never consulted here. A fix that only exists on `main` reaches users when a release is published, not before.
 
 ## Steps
 
-1. **Find the pipeline repo**:
+1. **Resolve the package and both versions** (run steps 1-3 in ONE shell block so the variables survive):
    ```bash
-   PIPE_DIR=""
-   for candidate in "$HOME/multi-agent-pipeline" "$HOME/dev/multi-agent-pipeline" "$HOME/projects/multi-agent-pipeline"; do
-     [ -d "$candidate/.git" ] && PIPE_DIR="$candidate" && break
-   done
-   if [ -z "$PIPE_DIR" ]; then
-     echo "Pipeline repo not found. Clone it:"
-     echo "  git clone git@github.com:{owner}/multi-agent-pipeline.git"
+   PKG="@{npm-scope}/multi-agent-pipeline"
+   REG="https://registry.npmjs.org"
+   CUR=$(tr -d '[:space:]' < "$HOME/.claude/.pipeline-version" 2>/dev/null)
+   [ -n "$CUR" ] || CUR="unknown"
+   # Read the registry directly - `npm view` can answer from a stale local cache.
+   LATEST=$(curl -fsS "$REG/$(printf '%s' "$PKG" | sed 's|/|%2F|')/latest" \
+     | node -pe 'JSON.parse(require("fs").readFileSync(0,"utf8")).version' 2>/dev/null)
+   if [ -z "$LATEST" ]; then
+     echo "Registry unreachable ($REG) - check your network and retry."
      exit 1
    fi
+   echo "Current: v$CUR   Latest: v$LATEST"
    ```
 
-2. **Capture the current version**:
+2. **Stop early when already current** (still refresh the marketplace, step 4b):
    ```bash
-   OLD_VERSION=$(node -p "require('$PIPE_DIR/package.json').version" 2>/dev/null || echo "unknown")
-   echo "Current: v$OLD_VERSION"
+   [ "$CUR" = "$LATEST" ] && echo "✓ Already up to date: v$LATEST"
    ```
 
-3. **Pull latest**:
+3. **Download the release and install**:
    ```bash
-   cd "$PIPE_DIR" && git pull origin main
+   UPD_DIR="${TMPDIR:-/tmp}/multi-agent-update"
+   rm -rf "$UPD_DIR" && mkdir -p "$UPD_DIR"
+   # --registry pinned: an ambient .npmrc must not reroute the scope elsewhere.
+   npm pack "$PKG@$LATEST" --registry "$REG" --pack-destination "$UPD_DIR" --silent >/dev/null
+   tar -xzf "$UPD_DIR"/*.tgz -C "$UPD_DIR"
+   node "$UPD_DIR/package/install.js" --all
    ```
 
-4. **Install (copy the files)**:
-   ```bash
-   node "$PIPE_DIR/install.js" --all
-   ```
+   The installer refreshes every configured CLI target (Claude Code, Copilot CLI, Codex CLI) and writes the new version to `$HOME/.claude/.pipeline-version`.
 
 4b. **Update the stack-plugin marketplace** (pulls the latest plugin versions):
    ```bash
@@ -98,44 +104,41 @@ Update the pipeline in one command. Existing preferences are preserved; only ski
    fi
    ```
 
-6. **Show the new version**:
+6. **Show the new version and its changes** (from the packaged CHANGELOG - there is no git history on this channel):
    ```bash
-   NEW_VERSION=$(node -p "require('$PIPE_DIR/package.json').version" 2>/dev/null || echo "unknown")
+   NEW=$(tr -d '[:space:]' < "$HOME/.claude/.pipeline-version" 2>/dev/null)
    echo ""
-   if [ "$OLD_VERSION" = "$NEW_VERSION" ]; then
-     echo "✓ Already up to date: v$NEW_VERSION"
-   else
-     echo "✓ Updated: v$OLD_VERSION → v$NEW_VERSION"
-     echo ""
-     echo "Changes:"
-     cd "$PIPE_DIR" && git log --oneline "v$OLD_VERSION..v$NEW_VERSION" 2>/dev/null | head -15
-   fi
+   echo "✓ Updated: v$CUR → v$NEW"
+   echo ""
+   echo "Changes:"
+   awk -v new="## [$NEW]" -v cur="## [$CUR]" \
+     'index($0,new){on=1} on&&index($0,cur){exit} on' \
+     "$UPD_DIR/package/CHANGELOG.md" | head -40
    ```
 
-7. **Smoke test (optional)**:
+7. **Smoke test (optional)** - the release tarball ships exactly two smokes for this purpose:
    ```bash
    echo ""
    echo "Verification:"
-   # Repo-relative on purpose: these are maintainer smokes, excluded from installs.
-   # Both lines name $PIPE_DIR rather than relying on the cd from the line above,
-   # so neither can be read - or copied - as an installed-tree invocation.
-   bash "$PIPE_DIR/pipeline/scripts/smoke-schema-validation.sh" 2>&1 | tail -1
-   bash "$PIPE_DIR/pipeline/scripts/smoke-cross-cli-behavior.sh" 2>&1 | tail -1
+   bash "$UPD_DIR/package/pipeline/scripts/smoke-schema-validation.sh" 2>&1 | tail -1
+   bash "$UPD_DIR/package/pipeline/scripts/smoke-cross-cli-behavior.sh" 2>&1 | tail -1
+   rm -rf "$UPD_DIR"
    ```
 
 ## Output
 
 ```
-Current: v14.2.2
-  -> git pull origin main
+Current: v15.6.0   Latest: v15.6.1
+  -> npm pack @{npm-scope}/multi-agent-pipeline@15.6.1
   -> node install.js --all (51 commands, 228 scripts, 205 skills)
   -> migrate-prefs.mjs (0 changes  -  already v2.6.0)
 
-✓ Updated: v14.2.2 → v15.0.0
+✓ Updated: v15.6.0 → v15.6.1
 
 Changes:
-  e3f883e fix(dev): Phase 6 must show local test prompt
-  59617aa fix(setup): first-run guard
+  ## [15.6.1] - 2026-08-19
+  ### Fixed
+  - Usage report reads the tracker as it is actually written
   ...
 
 Verification:

package/pipeline/multi-agent-refs/component-dispatch.md

@@ -52,7 +52,7 @@ a single atom is `component`. When it cannot be decided, ask  -  do not default
 omits the wiring.
 
 **Pre-implementation validation is not optional on iOS.** Before the create skill
-runs, dispatch `ai-ios-toolkit:figma-validate` for the frame. It checks
+runs, dispatch `<toolkit>:figma-validate` (probed like every dual-name skill; a toolkit that ships none records the skip) for the frame. It checks
 registry presence, Code Connect strategy, **design token compliance**, dependency
 readiness, atomic scope and already-implemented status in about ten seconds. Those
 are precisely the checks whose absence produced guessed spacing and an unpublished

package/pipeline/multi-agent-refs/phases/phase-3-dev.md

@@ -122,16 +122,17 @@ For each task (respecting dependency order):
      - `describe` / `it` → Quick/Nimble
    - Test naming: `test{Scenario}_{Expected}` (e.g. `testKeychainReturnsNil_doesNotCrash`)
    - One test per behavior change  -  not one test per file
-   - Run test to confirm RED:
+   - Run test to confirm RED  -  the command is the platform's, one arm per stack:
      ```bash
-     acquire_build_lock "$TASK_ID"
-     xcodebuild test \
-       -scheme "{scheme}" \
-       -destination "platform=iOS Simulator,name={simulator}" \
-       -derivedDataPath "{worktreePath}/.DerivedData" \
-       -only-testing:"{testTarget}/{testClass}/{testMethod}" \
-       2>&1 | tail -5
-     release_build_lock
+     case "$STACK" in
+       ios)     acquire_build_lock "$TASK_ID"
+                xcodebuild test -scheme "{scheme}" -destination "platform=iOS Simulator,name={simulator}" \
+                  -derivedDataPath "{worktreePath}/.DerivedData" -only-testing:"{testTarget}/{testClass}/{testMethod}" 2>&1 | tail -5
+                release_build_lock ;;
+       android) ./gradlew test --tests "{testClass}.{testMethod}" 2>&1 | tail -5 ;;
+       backend) pytest "{test_file}::{test_name}" 2>&1 | tail -5 ;;
+       frontend) npm test -- --testPathPattern="{file}" 2>&1 | tail -5 ;;
+     esac
      ```
    - Must fail for the RIGHT reason (expected assertion, not compilation error)
 
@@ -154,49 +155,22 @@ For each task (respecting dependency order):
    - Only if duplication or naming is poor
    - Re-run tests after refactor → still GREEN
 
-   **Scheme + destination resolution** (auto-detect once per project, cache in `agent-state.json`):
+   **Target resolution** (auto-detect once per project, cache in `agent-state.json`; ios resolves scheme + simulator, android resolves module + variant, backend/frontend need none):
    ```bash
-   # List available schemes
-   xcodebuild -list -json -project "{projectPath}" 2>/dev/null \
-     || xcodebuild -list -json -workspace "{workspacePath}" 2>/dev/null
-   # Pick: prefer scheme matching project name, then first non-test scheme
-   
-   # Available simulators
-   xcrun simctl list devices available -j | jq '.devices | to_entries[] | select(.key | contains("iOS")) | .value[0].name'
+   case "$STACK" in
+     ios)     xcodebuild -list -json -project "{projectPath}" 2>/dev/null || xcodebuild -list -json -workspace "{workspacePath}" 2>/dev/null
+              # prefer the scheme matching the project name, then the first non-test scheme
+              xcrun simctl list devices available -j | jq '.devices | to_entries[] | select(.key | contains("iOS")) | .value[0].name' ;;
+     android) ./gradlew projects 2>/dev/null | grep -E "^\+--- Project" ; ./gradlew tasks --all 2>/dev/null | grep -m5 "assemble.*Debug" ;;
+   esac
    ```
 
-   **Non-Xcode projects:**
-   - Python: `pytest {test_file}::{test_name}` → `pytest`
-   - Node.js: `npm test -- --testPathPattern={file}` → `npm test`
-   - Android: `./gradlew test --tests "{testClass}.{testMethod}"` → `./gradlew test`
-
-4. **Build verification with queue lock** (see Build Queue section below):
-
-   **Preferred  -  MCP tool (token-efficient, dev-toolkit-mcp ≥ 2.3.0):**
-   ```
-   acquire_build_lock "$TASK_ID"
-   mcp__dev-toolkit__ios_xcodebuild({
-     project: "{projectPath}",        // or workspace
-     scheme: "{scheme}",
-     configuration: "Release",
-     destination: "generic/platform=iOS",
-     derived_data_path: "{worktreePath}/.DerivedData"
-   })
-   release_build_lock
-   ```
-   Returns one line: `Build: SUCCESS|FAILURE (E errors, W warnings) [xcresult-<id>]`. On failure, drill in only when needed via `mcp__dev-toolkit__ios_xcresult({id, mode: "errors"})`. Saves thousands of tokens per build cycle vs. raw xcodebuild output.
-
-   **Fallback  -  raw xcodebuild** (when MCP server is unavailable):
-   ```bash
-   acquire_build_lock "$TASK_ID"
-   xcodebuild build \
-     -scheme "{scheme}" \
-     -destination "generic/platform=iOS" \
-     -derivedDataPath "{worktreePath}/.DerivedData" \
-     2>&1 | tail -5
-   release_build_lock
-   ```
-5. If build fails → fix → rebuild (max 3 attempts, track `retryCount` in state). With MCP path: pass the captured xcresult ID to `ios_xcresult` mode `errors` first, then `warnings` only if needed  -  never dump full log into context.
+4. **Build verification** (per stack; ios/android under the build queue lock, see below):
+   - **ios, preferred (MCP, dev-toolkit ≥ 2.3.0)**: `acquire_build_lock` → `mcp__dev-toolkit__ios_xcodebuild({project|workspace, scheme, configuration: "Release", destination: "generic/platform=iOS", derived_data_path: "{worktreePath}/.DerivedData"})` → `release_build_lock`. Returns one line `Build: SUCCESS|FAILURE (E errors, W warnings) [xcresult-<id>]`; on failure drill in via `mcp__dev-toolkit__ios_xcresult({id, mode: "errors"})`, never dump the full log.
+   - **ios, fallback (raw)**: same lock pair around `xcodebuild build -scheme "{scheme}" -destination "generic/platform=iOS" -derivedDataPath "{worktreePath}/.DerivedData" 2>&1 | tail -5`.
+   - **android**: lock pair around `./gradlew assembleDebug 2>&1 | tail -5` (the Gradle daemon and `build/` outputs contend across parallel worktrees exactly as DerivedData does  -  the lock applies).
+   - **backend / frontend**: `python -m compileall .` / `npm run build --if-present 2>&1 | tail -5`; no lock.
+5. If build fails → fix → rebuild (max 3 attempts, track `retryCount` in state).
 6. **Intermediate commit** (after each completed task in the plan):
    ```bash
    git -C "{worktreePath}" add -A
@@ -247,7 +221,7 @@ release_build_lock() { rm -rf "$BUILD_LOCK"; }
 - Phase 4 Step 1 Gate 1 (build gate before review)
 - Phase 4 Step 1 Gate 3 (test gate before review)
 
-**Non-Xcode projects** (Python, Node.js): No lock needed  -  these can build/test in parallel without conflicts.
+**Android**: same lock discipline  -  the Gradle daemon and `build/` outputs contend across parallel worktrees. **Backend/frontend** (Python, Node.js): no lock needed  -  these build/test in parallel without conflicts.
 
 ---
 

package/pipeline/multi-agent-refs/phases/phase-4-review.md

@@ -10,8 +10,8 @@ Progress emission per `$HOME/.claude/multi-agent-refs/progress-contract.md`  -
 If any gate fails → fix first, don't waste AI tokens reviewing broken code.
 
 ```bash
-# Gate 1: Build (Xcode uses build queue lock  -  see Phase 3)  -  tee output to a log
-xcodebuild ... 2>&1 | tee "$WORKTREE/.build.log"
+# Gate 1: Build (xcodebuild/gradle assemble/tsc/py compile  -  stack-dependent; Xcode uses the build queue lock, see Phase 3)  -  tee output to a log
+<build-command> 2>&1 | tee "$WORKTREE/.build.log"
 # Gate 2: Lint (swiftlint/ktlint/ruff/eslint  -  stack-dependent)
 # Gate 3: Tests pass (xcodebuild test/gradle test/pytest/npm test)  -  tee output to a log
 <test-command> 2>&1 | tee "$WORKTREE/.test.log"

package/pipeline/multi-agent-refs/phases/phase-5-test.md

@@ -126,12 +126,12 @@ Before or during user testing, run device-level audits via Bash if user requests
 
 | Check               | When              | Command                                   |
 | ------------------- | ----------------- | ----------------------------------------- |
-| Accessibility audit | UI changes        | `mcp__dev-toolkit__ios_accessibility_audit` (or `swift ui-tree-dumper.swift`) |
-| Biometric test      | Auth flow changes | `mcp__dev-toolkit__ios_biometric` (or `xcrun simctl keychain biometric-match`) |
-| Launch time         | Android project   | `adb shell am start -W`                   |
-| Visual test         | Any UI changes    | `/multi-agent test` (sim-test)            |
-| Snapshot regression | Component / pixel-stable UI changes | `mcp__dev-toolkit__ios_visual_diff` (dev-toolkit-mcp ≥ 2.3.0) |
-| App Store screenshots | `taskType === screenshot` | `mcp__dev-toolkit__ios_status_bar({preset: "clean"})` before each capture |
+| Accessibility audit | UI changes        | `mcp__dev-toolkit__{ios,android}_accessibility_audit` |
+| Biometric test      | Auth flow changes | ios: `mcp__dev-toolkit__ios_biometric` (android: manual) |
+| Launch time         | Perf-sensitive changes | ios: app-launch instrument · android: `mcp__dev-toolkit__android_launch_time` |
+| Visual test         | Any UI changes    | `/multi-agent test` (sim-test, both platforms) |
+| Snapshot regression | Component / pixel-stable UI changes | ios: `mcp__dev-toolkit__ios_visual_diff` · android: `mcp__dev-toolkit__android_screenshot` + compare |
+| Store screenshots   | `taskType === screenshot` | ios: `ios_status_bar({preset: "clean"})` · android: `android_screenshot` |
 
 Results included in Phase 7 report. MCP tools preferred when available  -  concise structured output, lower token cost.
 

package/pipeline/multi-agent-refs/phases/phase-6-commit.md

@@ -129,13 +129,13 @@ gh pr create --base {baseBranch} --head {branch} $REVIEWERS \
   --body-file /tmp/pr-body-$TASK_ID.md
 ```
 
-**UI Component PR (when SwiftUI component detected):**
+**UI Component PR (when a UI component is detected (SwiftUI/Compose)):**
 
 Same `gh pr create` pattern with component-specific body sections:
 
 - Component Details: file table (Configuration, View, Modifiers, Tests)
 - Variants table, Design Tokens Used, Figma URL
-- Accessibility: labels, identifiers, 44pt tap target, Dynamic Type
+- Accessibility: labels, identifiers, platform-minimum tap target (44pt iOS / 48dp Android), Dynamic Type
 - Test Coverage: structural/behavioral/snapshot counts
 - Checklist: no magic numbers, configuration purity, modifier chain, accessibility, dark mode + RTL, build passes
 

package/pipeline/multi-agent-refs/rules.md

@@ -139,7 +139,7 @@ This is the single source of truth. When a contributor or model is unsure where
 
 ## Build Queue
 
-- All `xcodebuild` / `xcodebuild test` calls acquire `/tmp/claude-xcodebuild.lock` before running. Parallel Xcode builds corrupt DerivedData and simulator state.
+- `xcodebuild` and `./gradlew` build/test calls acquire `/tmp/claude-xcodebuild.lock` first: parallel runs corrupt DerivedData/simulators and contend on the Gradle daemon.
 - Each worktree uses its own `-derivedDataPath "{worktreePath}/.DerivedData"` to prevent cross-contamination.
 - Lock auto-releases; stale locks (>15min) get force-cleaned.
 - Non-Xcode builds (Gradle, npm, Python) don't need the lock  -  they handle their own concurrency.

package/pipeline/schemas/figma-project-config.schema.json

@@ -276,7 +276,7 @@
     "ui": {
       "type": "object",
       "additionalProperties": false,
-      "description": "UI interaction systems. Consumed by the figma-navigation / figma-overlays / figma-bottom-sheets convention skills and by Phase 4 review. When a section is absent or its mode is 'native', the pipeline uses stock SwiftUI (NavigationStack, .alert/.sheet(item:), .sheet+presentationDetents). Set mode 'custom' to route to a project-supplied system by the type names below.",
+      "description": "UI interaction systems. Consumed by the figma-navigation / figma-overlays / figma-bottom-sheets convention skills and by Phase 4 review. When a section is absent or its mode is 'native', the pipeline uses the platform's stock system (SwiftUI NavigationStack/.sheet on iOS, Compose Navigation/dialogs on Android). Set mode 'custom' to route to a project-supplied system by the type names below.",
       "properties": {
         "navigationSystem": {
           "type": "object",

package/pipeline/scripts/_stack-routing.mjs

@@ -27,7 +27,11 @@ export const COMMON_SKILLS = [
   "localization-reuse-map",
 ];
 
-// Apple/Xcode-only skills that match no stack pattern → iOS plugin only.
+// Stack-only escape hatches: skill names that match no stack pattern route to
+// exactly one plugin. Every stack gets one - a stack whose new skill matches
+// nothing must be addable HERE (one list entry), never by widening a regex or
+// releasing new pipeline logic. Apple's list came first; the peers are seeded
+// with the names that plausibly arrive next.
 export const APPLE_ONLY = [
   "avkit",
   "cryptokit",
@@ -42,6 +46,38 @@ export const APPLE_ONLY = [
   "xcode-project-analyzer",
 ];
 
+export const ANDROID_ONLY = [
+  "ktlint",
+  "detekt",
+  "espresso",
+  "hilt-di",
+  "proguard-r8",
+  "workmanager",
+  "jetpack-glance",
+  "coroutines",
+  "material3-theming",
+  "baseline-profiles",
+];
+
+export const BACKEND_ONLY = [
+  "grpc-services",
+  "message-queues",
+  "sql-migrations",
+];
+
+export const FRONTEND_ONLY = [
+  "storybook",
+  "web-vitals",
+  "service-workers",
+];
+
+export const STACK_ONLY = {
+  "ai-ios-toolkit": APPLE_ONLY,
+  "ai-android-toolkit": ANDROID_ONLY,
+  "ai-backend-toolkit": BACKEND_ONLY,
+  "ai-frontend-toolkit": FRONTEND_ONLY,
+};
+
 // stack → matching pattern (per-stack routing patterns (formerly in stack-swap.sh))
 //
 // A skill lands in every plugin whose pattern it matches, so a bare substring
@@ -70,7 +106,9 @@ export const STACK_PATTERNS = {
  */
 export function routeSkill(name) {
   if (COMMON_SKILLS.includes(name)) return [COMMON_PLUGIN];
-  if (APPLE_ONLY.includes(name)) return ["ai-ios-toolkit"];
+  for (const [plugin, list] of Object.entries(STACK_ONLY)) {
+    if (list.includes(name)) return [plugin];
+  }
   const hits = [];
   for (const [plugin, re] of Object.entries(STACK_PATTERNS)) {
     if (re.test(name)) hits.push(plugin);

package/pipeline/scripts/build-stack-plugins.mjs

@@ -56,6 +56,7 @@ import {
   COMMON_PLUGIN,
   COMMON_SKILLS,
   APPLE_ONLY,
+  STACK_ONLY,
   STACK_PATTERNS,
 } from "./_stack-routing.mjs";
 
@@ -119,9 +120,12 @@ for (const skill of allSkills) {
     desired[COMMON_PLUGIN].add(skill);
     continue;
   }
-  if (APPLE_ONLY.includes(skill)) {
-    desired["ai-ios-toolkit"].add(skill);
-    continue;
+  {
+    const only = Object.entries(STACK_ONLY).find(([, list]) => list.includes(skill));
+    if (only) {
+      desired[only[0]].add(skill);
+      continue;
+    }
   }
   let matched = false;
   for (const [plugin, re] of Object.entries(STACK_PATTERNS)) {
@@ -144,7 +148,7 @@ for (const skill of allSkills) {
 // source in this repo, so CI can gate it without a checkout of the plugins repo.
 const multiRouted = [];
 for (const skill of allSkills) {
-  if (COMMON_SKILLS.includes(skill) || APPLE_ONLY.includes(skill)) continue;
+  if (COMMON_SKILLS.includes(skill) || Object.values(STACK_ONLY).some((l) => l.includes(skill))) continue;
   const owners = Object.entries(STACK_PATTERNS)
     .filter(([, re]) => re.test(skill))
     .map(([p]) => p);
@@ -160,8 +164,14 @@ if (args.includes("--check-routing")) {
     console.error("fix: anchor the offending STACK_PATTERNS alternative to the exact skill name");
     process.exit(1);
   }
+  if (unrouted.length) {
+    console.error(`check-routing: ${unrouted.length} skill(s) route to NO plugin`);
+    for (const s of unrouted) console.error(`  FAIL ${s}`);
+    console.error("fix: add the name to its stack's STACK_ONLY list in _stack-routing.mjs");
+    process.exit(1);
+  }
   console.log(
-    `check-routing: clean (${allSkills.length} skills, ${unrouted.length} unrouted, 0 multi-routed)`,
+    `check-routing: clean (${allSkills.length} skills, 0 unrouted, 0 multi-routed)`,
   );
   process.exit(0);
 }

package/pipeline/scripts/usage-report.mjs

@@ -212,6 +212,12 @@ function resolveStatePath({ state, taskId }) {
 }
 
 function packageVersion() {
+  try {
+    const marker = readFileSync(join(homedir(), ".claude", ".pipeline-version"), "utf-8").trim();
+    if (marker) return marker;
+  } catch {
+    /* marker absent */
+  }
   const candidates = [
     join(__dirname, "..", "..", "package.json"),
     join(homedir(), ".claude", "multi-agent-pipeline", "package.json"),
@@ -260,10 +266,25 @@ function phaseDurationSec(p) {
 }
 
 function trackerSummary(state) {
+  const empty = {
+    tk: null,
+    cost: null,
+    phs: null,
+    failed: [],
+    models: [],
+    startedAt: null,
+    endedAt: null,
+  };
   const path = resolveTracker(state);
-  if (!path) return { tk: null, cost: null, phs: null, failed: [], models: [] };
+  if (!path) return empty;
   const tracker = readJson(path);
-  if (!tracker?.phases) return { tk: null, cost: null, phs: null, failed: [], models: [] };
+  const raw = tracker?.phases;
+  const list = Array.isArray(raw)
+    ? raw
+    : raw && typeof raw === "object"
+      ? Object.entries(raw).map(([id, p]) => ({ id, ...(p ?? {}) }))
+      : null;
+  if (!list || list.length === 0) return empty;
 
   let tin = 0;
   let tout = 0;
@@ -271,7 +292,10 @@ function trackerSummary(state) {
   const phs = [];
   const failed = [];
   const models = new Set();
-  for (const [id, p] of Object.entries(tracker.phases)) {
+  let startedAt = typeof tracker?.started_at === "string" && tracker.started_at ? tracker.started_at : null;
+  let endedAt = null;
+  for (const p of list) {
+    const id = p?.id != null && String(p.id) !== "" ? String(p.id) : "?";
     if (p?.status === "failed") failed.push(id);
     if (p?.model) models.add(String(p.model));
     const pin = Number(p?.tokens_in || 0);
@@ -280,6 +304,10 @@ function trackerSummary(state) {
     tin += pin;
     tout += pout;
     tcache += pcache;
+    const ps = p?.started_at || p?.startedAt || null;
+    const pf = p?.completed_at || p?.finished_at || p?.finishedAt || null;
+    if (ps && (!startedAt || ps < startedAt)) startedAt = ps;
+    if (pf && (!endedAt || pf > endedAt)) endedAt = pf;
     phs.push({
       p: Number.isNaN(Number(id)) ? id : Number(id),
       st: p?.status || null,
@@ -300,6 +328,8 @@ function trackerSummary(state) {
     phs: phs.length ? phs : null,
     failed,
     models: Array.from(models).slice(0, 10),
+    startedAt,
+    endedAt,
   };
 }
 
@@ -312,11 +342,18 @@ function deriveErrors(state, failedPhases) {
   return Array.from(errs).slice(0, 20);
 }
 
-function durationSec(state) {
+function durationSec(state, spend) {
   const s = state.startedAt ? Date.parse(state.startedAt) : NaN;
   const f = state.finishedAt ? Date.parse(state.finishedAt) : NaN;
-  if (Number.isNaN(s) || Number.isNaN(f) || f < s) return null;
-  return Math.round((f - s) / 1000);
+  if (!Number.isNaN(s) && !Number.isNaN(f) && f >= s) {
+    return Math.round((f - s) / 1000);
+  }
+  const ts = spend?.startedAt ? Date.parse(spend.startedAt) : NaN;
+  const tf = spend?.endedAt ? Date.parse(spend.endedAt) : NaN;
+  if (!Number.isNaN(ts) && !Number.isNaN(tf) && tf >= ts) {
+    return Math.round((tf - ts) / 1000);
+  }
+  return null;
 }
 
 function runId(state) {
@@ -324,8 +361,10 @@ function runId(state) {
   return base == null ? null : String(base);
 }
 
-function eventTimestamp(state) {
-  return state.finishedAt || state.updatedAt || new Date().toISOString();
+function eventTimestamp(state, spend) {
+  if (state.finishedAt) return state.finishedAt;
+  if (isTerminalStatus(state) && spend?.endedAt) return spend.endedAt;
+  return state.updatedAt || new Date().toISOString();
 }
 
 const TERMINAL_STATUSES = ["complete", "completed", "failed", "paused", "halted", "error"];
@@ -360,8 +399,8 @@ function buildEvent(state) {
   const ctx = deriveContext(state);
   return {
     id: runId(state),
-    t: eventTimestamp(state),
-    u: state.identity?.username || null,
+    t: eventTimestamp(state, spend),
+    u: state.identity?.username || state.identity?.name || null,
     c: commandOf(state),
     m: state.mode || null,
     ap: Boolean(state.autopilot),
@@ -376,7 +415,7 @@ function buildEvent(state) {
       ? state.reviewIterations.length
       : 0,
     pr: Boolean(state.pr && (state.pr.url || state.pr.number)),
-    du: durationSec(state),
+    du: durationSec(state, spend),
     tk: spend.tk,
     cost: spend.cost,
     phs: spend.phs,
@@ -416,6 +455,7 @@ async function post(endpoint, token, event) {
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
+  if (process.env.MULTI_AGENT_SMOKE && !args.dryRun) return;
   const prefs = resolvePrefs();
   const token = resolveToken();
   const endpoint = prefs.endpoint || ENDPOINT_DEFAULT;