@mmerterden/multi-agent-pipeline 16.0.0 → 16.0.1

package/CHANGELOG.md

@@ -16,6 +16,23 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [16.0.1] - 2026-08-23
+
+Found by reviewing v16.0.0 after it shipped. Four defects, three of them mine from that release.
+
+### Fixed
+
+- **`/multi-agent:update` could not download the release, and said the opposite.** Step 3 ran `npm pack --registry "$REG"` under a comment claiming "an ambient .npmrc must not reroute the scope elsewhere". `--registry` does **not** override a scope mapping: a user-level `@scope:registry=https://npm.pkg.github.com` line wins, npm fails with `notarget`, and `--silent` hid the reason. Measured on the maintainer's own machine - exit 1, no tarball. The scope is now pinned with `--@<scope>:registry`, the failure prints the diagnosis and the `npm config get` command that confirms it, and the tarball name comes from npm's own output instead of a glob that would have extracted a stale tgz left in the temp dir. This mattered more than usual because v16.0.0 published a `required` floor whose remedy is exactly this command.
+- **`analyst.evidence` and `analyst.signals` shipped declared-but-inert in v15.22.0.** Nothing read them. They passed `smoke-prefs-consumed.sh` because the words "evidence" and "signals" saturate the very file that should have consumed them. Phase 1d now names `prefs.global.analyst.evidence[]`, `.signals[]` and `.webSignals` where it dispatches, and states that a source absent from its array is off rather than unreachable.
+- **`priorArtEnrichment.topN` never reached the script it configures.** `triage-memory.mjs query` reads `memoryRecall.maxResults` (5) unless `--top` is passed, so a user setting `topN: 3` got 5 and no signal. Phase 4 passes `--top` now.
+
+### Changed
+
+- **`smoke-prefs-consumed.sh` was reporting green off its own prose.** The gate lists formerly-inert settings in its header to document them, and its own file sat in the search path, so `contextOffload.minLines`, `learningsLedger.maxBriefEntries`, `testGap.scanTree` and `.promoteSeverity` were all satisfied by the sentence describing them as broken. It excludes itself now, the way the portability and personal-data scanners already did.
+- **A second rule, for the blind spot that let two of the above ship.** A new setting must name its full path - `parent.leaf`, or the shell form `prefs_parent_leaf`, which is the stronger signal since it can only come from resolving that exact key. Bare-leaf matching survives for 32 grandfathered settings that are legitimately referenced by leaf name in prose. The list is a ratchet enforced mechanically, not by promise: an entry that has since been wired fails the gate until it is deleted.
+- Underscore is a word character to both `grep -w` and `\w`, so a bare-leaf search never sees `${prefs_testGap_scanTree:-false}`. Three genuinely wired settings looked dead the moment the gate stopped searching itself; recognising the shell form is what tells a real defect from that artefact.
+- The scan is one filesystem walk matched in memory instead of two recursive greps per setting across 944 files: 2 minutes back down to 1.5 seconds.
+
 ## [16.0.0] - 2026-08-23
 
 ### Removed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.0.0",
+  "version": "16.0.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -45,9 +45,23 @@ A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/mu
    ```bash
    UPD_DIR="${TMPDIR:-/tmp}/multi-agent-update"
    rm -rf "$UPD_DIR" && mkdir -p "$UPD_DIR"
-   # --registry pinned: an ambient .npmrc must not reroute the scope elsewhere.
-   npm pack "$PKG@$LATEST" --registry "$REG" --pack-destination "$UPD_DIR" --silent >/dev/null
-   tar -xzf "$UPD_DIR"/*.tgz -C "$UPD_DIR"
+   # `--registry` does NOT override a scope mapping. A user-level .npmrc line
+   # like `@scope:registry=https://npm.pkg.github.com` wins over it, so the
+   # download hits the wrong registry, fails with `notarget`, and `--silent`
+   # hides why. Pin the SCOPE, which is the setting that actually loses.
+   SCOPE=$(printf '%s' "$PKG" | sed -n 's|^@\([^/]*\)/.*|\1|p')
+   PACK_OUT=$(npm pack "$PKG@$LATEST" ${SCOPE:+"--@${SCOPE}:registry=$REG"} \
+     --registry "$REG" --pack-destination "$UPD_DIR" 2>&1) || {
+     echo "Download failed for $PKG@$LATEST:"; printf '%s\n' "$PACK_OUT"
+     echo "If this says 'notarget', an .npmrc scope mapping is routing @${SCOPE} elsewhere:"
+     echo "  npm config get @${SCOPE}:registry"
+     exit 1
+   }
+   # Never glob into tar: an older tarball left in $UPD_DIR would be extracted
+   # instead, and the run would install the version it was trying to leave.
+   TGZ="$UPD_DIR/$(printf '%s' "$PACK_OUT" | tail -1 | tr -d '[:space:]')"
+   [ -f "$TGZ" ] || { echo "npm pack reported no tarball; aborting."; exit 1; }
+   tar -xzf "$TGZ" -C "$UPD_DIR"
    node "$UPD_DIR/package/install.js" --all
    ```
 

package/pipeline/multi-agent-refs/analysis/evidence.md

@@ -191,10 +191,12 @@ Runs after Phase 1c, only when `ai-analyst-toolkit` is enabled. Not enabled is a
 
 Two tiers, and the difference decides where a fact is allowed to appear.
 
-| Tier | Sources | Bucket | May appear in |
-|---|---|---|---|
-| Evidence | `evidence-github`, `evidence-registry` | `state.analysisSpec.evidence.outside[]` | any section, cited `GitHub:<owner>/<repo>#<n>` or `Release:<pkg>@<ver>` (Locked 3) |
-| Signal | `signal-community` | `state.analysisSpec.evidence.signals[]` | Section 20 Risks only, as a "reported in the wild" row with its link and date |
+| Tier | Sources | Enabled by | Bucket | May appear in |
+|---|---|---|---|---|
+| Evidence | `evidence-github`, `evidence-registry` | `prefs.global.analyst.evidence[]` (default `["github","registry"]`) | `state.analysisSpec.evidence.outside[]` | any section, cited `GitHub:<owner>/<repo>#<n>` or `Release:<pkg>@<ver>` (Locked 3) |
+| Signal | `signal-community` | `prefs.global.analyst.signals[]` (default `["stackoverflow","hackernews"]`), plus `prefs.global.analyst.webSignals` for Reddit / X | `state.analysisSpec.evidence.signals[]` | Section 20 Risks only, as a "reported in the wild" row with its link and date |
+
+Read those three prefs before dispatching: a source absent from its array is not queried and is not reported as unreachable either, because the user turned it off rather than the network failing. `prefs.global.analyst.evidence[]` set to `[]` disables the whole evidence tier without disabling the plugin.
 
 What to ask for: whether a dependency the feature touches has an open upstream bug, what a pinned version actually changed, whether prior art exists for the pattern being introduced, and whether anyone outside this team has reported the same symptom.
 

package/pipeline/multi-agent-refs/phases/phase-4-review.md

@@ -413,7 +413,7 @@ Launch **1 Agent** (subagent_type: `general-purpose`, model: `fable` on Claude C
 - Raw findings from Reviewer 1 + Reviewer 2 (merged JSON)
 - Task scope (Phase 1 analysis summary + Phase 2 plan)
 - Full diff being reviewed
-- **Prior-art context (advisory)**  -  for each raw finding, look up similar past findings via `triage-memory.mjs query` and inject up to 5 matches as additional context. Disabled when `prefs.global.priorArtEnrichment.enabled = false`.
+- **Prior-art context (advisory)**  -  per raw finding, `triage-memory.mjs query --top <prefs.global.priorArtEnrichment.topN>` (default 3). Pass `--top`: without it the script falls back to `memoryRecall.maxResults`, a different concern, and `topN` silently does nothing. Off when `priorArtEnrichment.enabled = false`.
 
 ```bash
 PRIOR_ART="["