@mmerterden/multi-agent-pipeline 16.11.0 → 16.13.0

package/pipeline/scripts/test-gap-scan.mjs

@@ -42,6 +42,7 @@ import { readFileSync, existsSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join, dirname, extname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isExcludedBy } from "./_path-match.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -118,27 +119,7 @@ function loadDiff() {
 }
 
 function isExcluded(path) {
-  if (!Array.isArray(rules.excludePathGlobs)) return false;
-  for (const pat of rules.excludePathGlobs) {
-    if (pat.endsWith("/")) {
-      if (path.includes(pat) || path.startsWith(pat)) return true;
-    } else if (pat.includes("**")) {
-      // Tokenize ** before the single-* pass so the * rewrite cannot mangle
-      // the already-translated .* (which broke cross-directory matches).
-      const DOUBLE_STAR = "\u0000";
-      const re = new RegExp(
-        "^" +
-          pat
-            .replace(/\./g, "\\.")
-            .replace(/\*\*/g, DOUBLE_STAR)
-            .replace(/\*/g, "[^/]*")
-            .replace(new RegExp(DOUBLE_STAR, "g"), ".*") +
-          "$",
-      );
-      if (re.test(path)) return true;
-    } else if (path.endsWith(pat)) return true;
-  }
-  return false;
+  return isExcludedBy(path, rules.excludePathGlobs);
 }
 
 // git quotes a `diff --git` path (core.quotePath, on by default) whenever it

package/pipeline/scripts/uninstall.mjs

@@ -32,6 +32,7 @@
  *   - $HOME/.claude/multi-agent-preferences.json (pipeline settings)
  *   - $HOME/.claude/logs/multi-agent/ (task logs, state, metrics, audit trail)
  *   - $HOME/.claude/memory/multi-agent/ (per-repo learnings ledger + triage corpus)
+ *   - $HOME/.claude/knowledge/ (per-repo knowledge base + code graph)
  *
  * @module pipeline/scripts/runtime/uninstall
  */
@@ -726,6 +727,7 @@ export async function main() {
     console.log("    - ~/.claude/multi-agent-preferences.json (pipeline settings)");
     console.log("    - ~/.claude/logs/multi-agent/ (task logs, state, metrics, audit trail)");
     console.log("    - ~/.claude/memory/multi-agent/ (per-repo learnings ledger + triage corpus)");
+    console.log("    - ~/.claude/knowledge/ (per-repo knowledge base + code graph)");
     console.log("");
   }
   console.log("  PRESERVED (never touched):");
@@ -834,12 +836,19 @@ export async function main() {
   // architectural facts and past review findings written in prose about the
   // repos they were collected from. On a corporate checkout that is concrete
   // information about the codebase, and it survived even --all-data.
+  //
+  // The knowledge root is the same class of data and was missing for the same
+  // reason: architecture.md, patterns.md, gotchas.md and decisions.md are prose
+  // about a private codebase, and code-graph.json is every symbol name in it.
+  // Leaving that behind after "remove everything" is the worst version of this
+  // bug, because the graph is the most complete of the three.
   if (allData && HOME) {
     console.log("");
-    console.log("  [Full cleanup] Removing pipeline settings, logs + memory...");
+    console.log("  [Full cleanup] Removing pipeline settings, logs, memory + knowledge...");
     preservePrefsCredentialMapping(join(HOME, ".claude", "multi-agent-preferences.json"));
     rmIfExists(join(HOME, ".claude", "logs", "multi-agent"));
     rmIfExists(join(HOME, ".claude", "memory", "multi-agent"));
+    rmIfExists(join(HOME, ".claude", "knowledge"));
   }
 
   // Legacy adapter-file cleanup (adapters removed in v10.7.0). These blocks
@@ -917,7 +926,7 @@ export async function main() {
   if (!allData) {
     console.log("");
     console.log(
-      "  Kept your pipeline settings, logs + per-repo memory. To remove those too, re-run with --all-data.",
+      "  Kept your pipeline settings, logs, per-repo memory + knowledge base. To remove those too, re-run with --all-data.",
     );
   } else {
     console.log("");

package/pipeline/scripts/validate-analysis-doc.mjs

@@ -215,11 +215,15 @@ function main() {
     }
   }
 
-  // 2a. Corporate profile: every EKLENECEK owes an open question.
+  // 2a. Corporate profile: every EKLENECEK owes an open question, by id.
   //
   // A placeholder with nobody assigned to resolve it is how "to be filled in"
-  // reaches production. The pairing is what makes the backbone guarantee worth
-  // having: the section renders, AND the gap it admits to is tracked.
+  // reaches production. This used to pair a gap with Section 20 by matching the
+  // section NUMBER inside the risks block, which is ambiguous in both directions:
+  // "9" is a substring of "19" and "5.9" of "5.9.5", so the regex grew guards for
+  // cases it still could not separate. Stable ids remove the ambiguity the same
+  // way IG / UC / FG already do: the body writes EKLENECEK (AS-07) and Section 20
+  // defines AS-07, and each side is checked against the other.
   if (profile === "corporate") {
     const lines = text.split("\n");
     const risksStart = lines.findIndex((l) =>
@@ -232,29 +236,61 @@ function main() {
         risksBlock += `${lines[i]}\n`;
       }
     }
-    let currentSection = null;
-    const unpaired = new Set();
+    const AS_ID = /\bAS-(\d{2,3})\b/g;
+    const definedIds = new Set(
+      [...risksBlock.matchAll(AS_ID)].map((m) => `AS-${m[1]}`),
+    );
+    const referencedIds = new Set();
     for (let i = 0; i < lines.length; i++) {
-      const m = lines[i].match(/^#{2,4}\s+(\d+(?:\.\d+)*)\.?\s/);
-      if (m) currentSection = m[1];
-      if (!lines[i].includes("EKLENECEK")) continue;
       if (risksStart !== -1 && i > risksStart) continue;
-      if (!currentSection) continue;
-      // The number has to stand alone: substring matching would let section "2"
-      // be satisfied by a "2.3" in some other row, and "9" by a "19". The
-      // trailing guard rejects a following digit and a following ".<digit>",
-      // but NOT a sentence-ending period - "etkilediği bölüm 9." is a real
-      // pairing, and rejecting it would block a correct document.
-      const token = new RegExp(
-        `(^|[^\\d.])${currentSection.replace(/\./g, "\\.")}(?!\\d|\\.\\d)`,
-        "m",
-      );
-      if (!token.test(risksBlock)) unpaired.add(currentSection);
+      for (const m of lines[i].matchAll(AS_ID)) referencedIds.add(`AS-${m[1]}`);
+      if (!lines[i].includes("EKLENECEK")) continue;
+      // A gap that names no id cannot be traced to an owner, which is the whole
+      // point of admitting it.
+      if (!/\bAS-\d{2,3}\b/.test(lines[i])) {
+        errors.push(
+          `line ${i + 1}: EKLENECEK carries no AS-NN reference (Locked 33)`,
+        );
+      }
     }
-    for (const sec of unpaired) {
-      errors.push(
-        `section ${sec} carries EKLENECEK but no Risks and Open Questions row references it (Locked 33)`,
-      );
+    for (const id of referencedIds) {
+      if (!definedIds.has(id)) {
+        errors.push(
+          `${id} is referenced in the body but not defined in Risks and Open Questions (Locked 33)`,
+        );
+      }
+    }
+    for (const id of definedIds) {
+      if (!referencedIds.has(id)) {
+        // An open question with no body reference is allowed only when the row
+        // says so; otherwise it is a question about nothing the document raises.
+        const row = risksBlock
+          .split("\n")
+          .find((l) => l.includes(id)) || "";
+        if (!/(no body reference|govde referansi yok)/i.test(row)) {
+          errors.push(
+            `${id} is defined in Risks and Open Questions but never referenced in the body (Locked 33)`,
+          );
+        }
+      }
+    }
+
+    // 2b. JSON does not fit in a table cell (Locked 37).
+    //
+    // One document rendered `Request` as inline JSON with a field note glued to
+    // the end, and `Response` as a proper fenced block below the table: two
+    // formats for the same thing, one table apart. The payload belongs under the
+    // table; the cell says which of the three states it is in.
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!/^\|\s*\*\*(Request|Response)\*\*\s*\|/.test(line)) continue;
+      const cell = line.split("|")[2] || "";
+      if (/[{}]/.test(cell)) {
+        errors.push(
+          `line ${i + 1}: ${/Request/.test(line) ? "Request" : "Response"} cell holds JSON; ` +
+            "put the payload in a fenced block under the table (Locked 37)",
+        );
+      }
     }
 
     // The traceability matrix is the most expensive thing in the document to get
@@ -295,6 +331,32 @@ function main() {
     }
   }
 
+  // 2c. Diagram labels keep their diacritics.
+  //
+  // The punctuation gate skips fenced blocks, so a mermaid diagram is the one
+  // place a Turkish document can quietly go ASCII: one run shipped `Hayir` and
+  // `Basarili` in its flow chart while every other line was correct. A warning,
+  // not an error - node ids are legitimately ASCII, only labels are checked.
+  if (parsed.fm.language === "tr") {
+    const mmLines = text.split("\n");
+    let inMermaid = false;
+    for (let i = 0; i < mmLines.length; i++) {
+      const t = mmLines[i].trim();
+      if (/^```mermaid\s*$/.test(t)) { inMermaid = true; continue; }
+      if (inMermaid && t === "```") { inMermaid = false; continue; }
+      if (!inMermaid) continue;
+      const labels = [...mmLines[i].matchAll(/[[({|]([^\]})|]{3,})[\]})|]/g)].map((m) => m[1]);
+      for (const lbl of labels) {
+        if (/^[\x20-\x7E]+$/.test(lbl) && /\b(Hayir|Basarili|Basarisiz|Odeme|Iptal|Gecerli|Gecersiz|Secim|Dogrulama|Uyari|Baslangic|Bitis|Onay|Aciklama)\b/.test(lbl)) {
+          errors.push(
+            `WARN line ${i + 1}: diagram label "${lbl}" looks like Turkish flattened to ASCII (Locked 7)`,
+          );
+        }
+      }
+    }
+  }
+
+
   // 2b. Opt-in coverage sections must be present when the front-matter says so.
   const uiTests = String(parsed?.fm?.ui_tests || "false").toLowerCase() === "true";
   const a11yDepth = String(parsed?.fm?.a11y_depth || "basic").toLowerCase();

package/pipeline/scripts/validate-code-graph.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+// validate-code-graph.mjs  -  schema validator for graph-build.mjs output.
+//
+// Zero deps (ADR-0004). Reads JSON from path or STDIN, validates against
+// pipeline/schemas/code-graph.schema.json.
+//
+// Edge endpoints are checked against the node set, not just for type: a graph
+// whose edges point at ids no node declares still parses as valid JSON, but
+// every traversal built on it silently drops those hops.
+//
+// Exit codes:
+//   0  -  valid
+//   1  -  invalid
+//  64  -  usage error
+
+import { readFileSync } from "node:fs";
+
+const ALLOWED_STACK = new Set(["ios", "android", "node", "python"]);
+const ALLOWED_NODE_KIND = new Set(["file", "symbol", "module"]);
+const ALLOWED_EDGE_KIND = new Set(["defines", "imports", "references"]);
+const MAX_REPORTED_DANGLING = 5;
+
+function readInput() {
+  const arg = process.argv[2];
+  if (!arg) {
+    console.error("error: provide a path or '-' for STDIN");
+    process.exit(64);
+  }
+  if (arg === "-") {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      process.stdin.setEncoding("utf-8");
+      process.stdin.on("data", (c) => chunks.push(c));
+      process.stdin.on("end", () => resolve(chunks.join("")));
+      process.stdin.on("error", reject);
+    });
+  }
+  return Promise.resolve(readFileSync(arg, "utf-8"));
+}
+
+function validateStats(obj, errors) {
+  if (typeof obj.stats !== "object" || obj.stats === null || Array.isArray(obj.stats)) {
+    errors.push("stats must be an object");
+    return;
+  }
+  for (const key of ["files", "nodes", "edges"]) {
+    if (!Number.isInteger(obj.stats[key]) || obj.stats[key] < 0) {
+      errors.push(`stats.${key} must be a non-negative integer`);
+    }
+  }
+  if (Array.isArray(obj.nodes) && obj.stats.nodes !== obj.nodes.length) {
+    errors.push(
+      `stats.nodes (${obj.stats.nodes}) does not match nodes.length (${obj.nodes.length})`,
+    );
+  }
+  if (Array.isArray(obj.edges) && obj.stats.edges !== obj.edges.length) {
+    errors.push(
+      `stats.edges (${obj.stats.edges}) does not match edges.length (${obj.edges.length})`,
+    );
+  }
+}
+
+function validateNodes(obj, errors) {
+  if (!Array.isArray(obj.nodes)) {
+    errors.push("nodes must be an array");
+    return new Set();
+  }
+  const ids = new Set();
+  obj.nodes.forEach((n, i) => {
+    const p = `nodes[${i}]`;
+    if (typeof n !== "object" || n === null) {
+      errors.push(`${p} must be an object`);
+      return;
+    }
+    if (typeof n.id !== "string" || n.id.length === 0) errors.push(`${p}.id must be a string`);
+    else if (ids.has(n.id)) errors.push(`${p}.id is duplicated: ${n.id}`);
+    else ids.add(n.id);
+    if (!ALLOWED_NODE_KIND.has(n.kind))
+      errors.push(`${p}.kind must be one of ${[...ALLOWED_NODE_KIND].join(",")}`);
+    if (typeof n.name !== "string") errors.push(`${p}.name must be a string`);
+    if (!Number.isInteger(n.degree) || n.degree < 0)
+      errors.push(`${p}.degree must be a non-negative integer`);
+  });
+  return ids;
+}
+
+function validateEdges(obj, ids, errors) {
+  if (!Array.isArray(obj.edges)) {
+    errors.push("edges must be an array");
+    return;
+  }
+  const dangling = [];
+  obj.edges.forEach((e, i) => {
+    const p = `edges[${i}]`;
+    if (typeof e !== "object" || e === null) {
+      errors.push(`${p} must be an object`);
+      return;
+    }
+    if (typeof e.from !== "string") errors.push(`${p}.from must be a string`);
+    if (typeof e.to !== "string") errors.push(`${p}.to must be a string`);
+    if (!ALLOWED_EDGE_KIND.has(e.kind))
+      errors.push(`${p}.kind must be one of ${[...ALLOWED_EDGE_KIND].join(",")}`);
+    if (ids.size) {
+      if (typeof e.from === "string" && !ids.has(e.from)) dangling.push(`${p}.from -> ${e.from}`);
+      if (typeof e.to === "string" && !ids.has(e.to)) dangling.push(`${p}.to -> ${e.to}`);
+    }
+  });
+  if (dangling.length) {
+    errors.push(
+      `${dangling.length} edge endpoint(s) reference no node: ` +
+        dangling.slice(0, MAX_REPORTED_DANGLING).join("; ") +
+        (dangling.length > MAX_REPORTED_DANGLING ? "; ..." : ""),
+    );
+  }
+}
+
+function validateManifest(obj, errors) {
+  if (obj.manifest === undefined) return;
+  if (typeof obj.manifest !== "object" || obj.manifest === null || Array.isArray(obj.manifest)) {
+    errors.push("manifest must be an object");
+    return;
+  }
+  for (const [path, entry] of Object.entries(obj.manifest)) {
+    if (typeof entry !== "object" || entry === null) {
+      errors.push(`manifest["${path}"] must be an object`);
+      continue;
+    }
+    if (!Number.isInteger(entry.size) || entry.size < 0)
+      errors.push(`manifest["${path}"].size must be a non-negative integer`);
+    if (!Number.isInteger(entry.mtimeMs) || entry.mtimeMs < 0)
+      errors.push(`manifest["${path}"].mtimeMs must be a non-negative integer`);
+  }
+}
+
+export function validate(obj) {
+  const errors = [];
+  if (typeof obj !== "object" || obj === null || Array.isArray(obj))
+    return ["root must be an object"];
+
+  if (obj.schemaVersion !== "1.0.0") errors.push(`schemaVersion must be "1.0.0"`);
+  if (!ALLOWED_STACK.has(obj.stack))
+    errors.push(`stack must be one of ${[...ALLOWED_STACK].join(",")}`);
+  if (typeof obj.root !== "string" || obj.root.length === 0)
+    errors.push("root must be a non-empty string");
+  if (typeof obj.generatedAt !== "string" || Number.isNaN(Date.parse(obj.generatedAt)))
+    errors.push("generatedAt must be an ISO 8601 timestamp");
+  if (obj.baseCommit !== undefined && obj.baseCommit !== null && typeof obj.baseCommit !== "string")
+    errors.push("baseCommit must be a string or null");
+
+  validateStats(obj, errors);
+  const ids = validateNodes(obj, errors);
+  validateEdges(obj, ids, errors);
+  validateManifest(obj, errors);
+
+  return errors;
+}
+
+(async () => {
+  const raw = await readInput();
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch (e) {
+    console.log(JSON.stringify({ ok: false, errors: [`JSON parse error: ${e.message}`] }));
+    process.exit(1);
+  }
+  const errors = validate(obj);
+  if (errors.length === 0) {
+    console.log(JSON.stringify({ ok: true, errors: [] }));
+    process.exit(0);
+  }
+  console.log(JSON.stringify({ ok: false, errors }));
+  process.exit(1);
+})();

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 210,
+  "skillCount": 211,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -950,7 +950,7 @@
     },
     {
       "name": "multi-agent",
-      "description": "Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable + Sonnet on Claude Code, GPT + Opus + Sonnet on Copilot CLI) → commit → log. Every step is written to agent-log.md. Use when given a Jira ID, a GitHub issue or ",
+      "description": "Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable + Opus + Sonnet on Claude Code, GPT + Opus + Sonnet on Copilot CLI) → commit → log. Every step is written to agent-log.md. Use when given a Jira ID, a GitHub is",
       "platform": null,
       "group": "core",
       "plugin": null,
@@ -1135,6 +1135,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-garbage-collect/SKILL.md"
     },
+    {
+      "name": "multi-agent-graph",
+      "description": "Build and query this repo's code graph: a deterministic, LLM-free map of symbols, imports and references used to narrow Phase 1's Explore scope and to keep the knowledge base current. Read-only on code, costs no API tokens. Use when a task needs to know where something lives or what depends on it be",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-graph",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-graph/SKILL.md"
+    },
     {
       "name": "multi-agent-help",
       "description": "Multi-agent pipeline usage guide  -  renders in EN or TR per prefs.global.outputLanguage (falls back to promptLanguage for backward compatibility). Use when asked what the pipeline can do, which mode to pick, or what a command means.",
@@ -1313,7 +1324,7 @@
     },
     {
       "name": "multi-agent-review",
-      "description": "Run parallel review on a branch diff or a Pull Request: 2 models on Claude Code (Fable + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonnet). On PR input, posts per-finding inline comments + approve/needs-work. With no input (interactive), lists open GitHub + Bitbucket PRs to multi-select. Use wh",
+      "description": "Run parallel review on a branch diff or a Pull Request: 3 models on Claude Code (Fable + Opus + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonnet). On PR input, posts per-finding inline comments + approve/needs-work. With no input (interactive), lists open GitHub + Bitbucket PRs to multi-select.",
       "platform": null,
       "group": "core",
       "plugin": null,

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 210 skills (56 core + 154 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 211 skills (57 core + 154 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  56 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  57 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  154 iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  56
+- [Pipeline Orchestration](#pipeline-orchestration)  -  57
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  90
 - [Android / Kotlin](#android-kotlin)  -  13
 - [Web](#web)  -  10
@@ -44,6 +44,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-feedback`](./core/multi-agent-feedback/) | `core` | Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows t |
 | [`multi-agent-forget`](./core/multi-agent-forget/) | `core` | Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one an |
 | [`multi-agent-garbage-collect`](./core/multi-agent-garbage-collect/) | `core` | Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before d |
+| [`multi-agent-graph`](./core/multi-agent-graph/) | `core` | Build and query this repo's code graph: a deterministic, LLM-free map of symbols, imports and references used to narrow Phase 1's Explore sc |
 | [`multi-agent-help`](./core/multi-agent-help/) | `core` | Multi-agent pipeline usage guide  -  renders in EN or TR per prefs.global.outputLanguage (falls back to promptLanguage for backward compatib |
 | [`multi-agent-ios-coding-standard`](./core/multi-agent-ios-coding-standard/) | `core` | Audit an iOS module against the shared coding-standard registry (99 stable-ID rules), produce a remediation plan, then hand off to dev/dev-l |
 | [`multi-agent-issue`](./core/multi-agent-issue/) | `core` | List unassigned GitHub issues, pick one, auto-assign, and launch the multi-agent pipeline. Use when a GitHub issue should be picked up and s |
@@ -60,7 +61,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-refactor`](./core/multi-agent-refactor/) | `core` | Analyse the project: extract adapted best-practices, hunt real bugs + improvement areas, check upstream drift of derived skills, research th |
 | [`multi-agent-resume`](./core/multi-agent-resume/) | `core` | Resume a stopped or failed task from the phase where it left off. Use when a task stopped or failed and should carry on from where it left o |
 | [`multi-agent-resume-local`](./core/multi-agent-resume-local/) | `core` | Continue already-done LOCAL work through the pipeline tail: Review → Build+Test → Commit/PR → Report (technical analysis + Jira test-scenari |
-| [`multi-agent-review`](./core/multi-agent-review/) | `core` | Run parallel review on a branch diff or a Pull Request: 2 models on Claude Code (Fable + Sonnet), 3 models on Copilot CLI (GPT + Opus + Sonn |
+| [`multi-agent-review`](./core/multi-agent-review/) | `core` | Run parallel review on a branch diff or a Pull Request: 3 models on Claude Code (Fable + Opus + Sonnet), 3 models on Copilot CLI (GPT + Opus |
 | [`multi-agent-review-analysis`](./core/multi-agent-review-analysis/) | `core` | Review a written analysis document instead of a diff: resolve it from a path, a Confluence page or a Jira issue, run the deterministic gates |
 | [`multi-agent-review-issue`](./core/multi-agent-review-issue/) | `core` | Assess whether a GitHub issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / sta |
 | [`multi-agent-review-jira`](./core/multi-agent-review-jira/) | `core` | Assess whether a Jira issue is ready for multi-agent development: fetch it, grade scope / acceptance criteria / repro / design / API / stack |
@@ -258,6 +259,6 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`xcode-build-benchmark`](./external/xcode-build-benchmark/) | `external` | Benchmark Xcode clean and incremental builds with repeatable inputs, timing summaries, and timestamped `.build-benchmark/` artifacts. Use wh |
 | [`xcode-build-fixer`](./external/xcode-build-fixer/) | `external` | Apply approved Xcode build optimization changes following best practices, then re-benchmark to verify improvement. Use when a developer has  |
 | [`xcode-build-orchestrator`](./external/xcode-build-orchestrator/) | `external` | Orchestrate Xcode build optimization by benchmarking first, running the specialist analysis skills, prioritizing findings, requesting explic |
-| [`xcode-compilation-analyzer`](./external/xcode-compilation-analyzer/) | `external` | Analyze Swift and mixed-language compile hotspots using build timing summaries and Swift web diagnostics, then produce a recommend-firs |
+| [`xcode-compilation-analyzer`](./external/xcode-compilation-analyzer/) | `external` | Analyze Swift and mixed-language compile hotspots using build timing summaries and Swift frontend diagnostics, then produce a recommend-firs |
 | [`xcode-project-analyzer`](./external/xcode-project-analyzer/) | `external` | Audit Xcode project configuration, build settings, scheme behavior, and script phases to find build-time improvements with explicit approval |
 

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent
 language: en
-description: "Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable + Sonnet on Claude Code, GPT + Opus + Sonnet on Copilot CLI) → commit → log. Every step is written to agent-log.md. Use when given a Jira ID, a GitHub issue or a free-text task and the whole pipeline should run."
+description: "Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable + Opus + Sonnet on Claude Code, GPT + Opus + Sonnet on Copilot CLI) → commit → log. Every step is written to agent-log.md. Use when given a Jira ID, a GitHub issue or a free-text task and the whole pipeline should run."
 user-invocable: true
 argument-hint: '"PROJ-12345" "feature/PROJ-12345-flight-filter" | "https://github.com/.../issues/316" | status | log #1 | resume #1 | kill #1 | clear-logs | purge | review'
 ---
@@ -455,7 +455,7 @@ For each todo (respecting dependency order):
 ### Phase 4: Review (parallel + triage)
 0. **Diff Risk Scoring (advisory, v8.3+)**  -  before reviewer dispatch run `node $HOME/.claude/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
 1. Launch **code-reviewer** agents in parallel. Reviewer set depends on which CLI is hosting the pipeline:
-   - **Claude Code** (2 reviewers): `claude-fable-5` (deep security + architecture) + `claude-sonnet-5` (quality + correctness)
+   - **Claude Code** (3 reviewers): `claude-fable-5` (deep security + architecture) + `claude-sonnet-5` (quality + correctness)
    - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-5` + `claude-sonnet-5` (Fable 5 is not offered on Copilot CLI)
    - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-5` on Copilot CLI)
 2. Collect findings, classify:
@@ -656,7 +656,7 @@ Phase 3: Dev
        └─ TDD, token rules, code style  -  from global instructions
 
 Phase 4: Review (parallel + triage)
-  Claude Code  (2 parallel):
+  Claude Code  (3 parallel):
     ├─ code-reviewer (claude-opus)   → all 5 review skills
     └─ code-reviewer (claude-sonnet) → all 5 review skills
   Copilot CLI  (3 parallel):

package/pipeline/skills/shared/core/multi-agent-graph/SKILL.md

@@ -0,0 +1,106 @@
+---
+name: multi-agent-graph
+language: en
+description: "Build and query this repo's code graph: a deterministic, LLM-free map of symbols, imports and references used to narrow Phase 1's Explore scope and to keep the knowledge base current. Read-only on code, costs no API tokens. Use when a task needs to know where something lives or what depends on it before reading files."
+user-invocable: true
+argument-hint: "[build | refresh | ask \"<question>\" | affected \"<symbol>\" | report | status]"
+---
+# multi-agent-graph  -  code graph build and query
+
+**Input**: $ARGUMENTS
+
+A code graph is a map of what this repo declares and what refers to what, built by
+regex over comment-stripped source. It exists so Phase 1 can narrow its Explore
+fan-out and Phase 7 can refresh `~/.claude/knowledge/<project>/` without an LLM
+pass. It answers "where does this live" and "what depends on this". It does not
+answer "what calls this at runtime": call graphs and type resolution need a real
+parser, which would be an npm runtime dependency, and ADR-0004 forbids one.
+
+No worktree, no branch, no commit, no pipeline chaining.
+
+## Sub-commands
+
+| Input | Runs | Notes |
+|---|---|---|
+| `build` | `graph-build.mjs --root <repo> --stack <stack>` | Writes `~/.claude/knowledge/<project>/code-graph.json` |
+| `refresh` | same as `build` | A full rebuild takes seconds, so there is no separate incremental path |
+| `ask "<question>"` | `graph-query.mjs "<question>" --budget N` | Token-budgeted traversal; default budget 2000 |
+| `affected "<symbol>"` | `graph-affected.mjs "<symbol>" --depth N` | Reverse traversal: the blast radius of a change |
+| `report` | `graph-report.mjs` | Writes `GRAPH_REPORT.md` beside the graph |
+| `status` | `graph-report.mjs --status` | One line: stack, scale, build time and whether `baseCommit` still matches HEAD. Never read the graph file yourself - it is 22MB on a large repo |
+
+With no argument, run `status`, then offer `build` when no graph exists and
+`refresh` when `baseCommit` differs from the current HEAD.
+
+## Steps
+
+1. **Resolve the repo.** `PROJECT_ROOT` is the current repo root unless the user
+   named another. Derive the graph path once and pass it to every call below:
+
+   ```bash
+   GRAPH_PATH="$HOME/.claude/knowledge/$(basename "$PROJECT_ROOT")/code-graph.json"
+   ```
+
+   The query, affected and report scripts default that path from the CWD's
+   basename, which is not the same thing when the shell sits in a worktree or a
+   sub-package, so a defaulted path can point at a graph that was never built.
+
+2. **Resolve the stack.** Read `state.detectedStack` when a run is in flight;
+   otherwise detect from project markers the way Phase 1 Step 2 does. Only stacks
+   with a file in `$HOME/.claude/scripts/code-graph-rules/` can be built. A stack with
+   no rule file is reported as unsupported, never guessed at.
+
+3. **Run the sub-command.** Every script is read-only on the repo and writes only
+   under `~/.claude/knowledge/`:
+
+   ```bash
+   node $HOME/.claude/scripts/graph-build.mjs --root "$PROJECT_ROOT" --stack "$STACK" --out "$GRAPH_PATH"
+   node $HOME/.claude/scripts/graph-query.mjs "<question>" --graph "$GRAPH_PATH" --budget 2000
+   node $HOME/.claude/scripts/graph-affected.mjs "<symbol>" --graph "$GRAPH_PATH" --depth 2
+   node $HOME/.claude/scripts/graph-report.mjs --graph "$GRAPH_PATH"
+   node $HOME/.claude/scripts/graph-report.mjs --graph "$GRAPH_PATH" --status
+   ```
+
+4. **Validate after a build.** A graph that parses but whose edges point at
+   missing nodes yields silently truncated traversals, so the build is not
+   reported as successful until the validator agrees:
+
+   ```bash
+   node $HOME/.claude/scripts/validate-code-graph.mjs "$GRAPH_PATH"
+   ```
+
+   A non-zero exit fails CLOSED: report the validator's `errors[]` verbatim and
+   do not record the graph as usable.
+
+5. **Report.** One line for a build (`files / nodes / edges / elapsed`), the
+   traversal output as-is for `ask` and `affected`, the report path for `report`.
+
+## What the output is for
+
+`ask` returns ranked nodes plus their neighbourhood within a token budget. Feed
+it to an Explore agent as the starting file set rather than pasting it into a
+final answer: it is a search result, not an explanation.
+
+`affected` returns dependents, which is what `analysis.touchedAreas[]` wants.
+
+## Limits worth stating when reporting
+
+- References resolve only when a name maps to exactly one declaration. A type
+  declared in two files is ambiguous and is deliberately dropped, so `affected`
+  under-reports for duplicated names rather than fanning out to every candidate.
+- Only type-like symbols are reference targets. Functions appear in the graph
+  through their declaring file, not as targets, because a bare lowercase name
+  matched across files is almost never a call to that exact declaration.
+- Comments and string literals are stripped before extraction, so a name that
+  appears only in prose or in a string produces no edge.
+- A nested declaration is a node but never a reference target. A Kotlin sealed
+  case or a Python inner class named `Icon` or `Color` is declared exactly once,
+  so the ambiguity rule above does not catch it, and every file that merely
+  mentions the framework type of that name would otherwise gain an edge to it.
+- On stacks whose exported unit is a function (Node most of all) the symbol
+  layer is thin by design and the import graph between files carries the value.
+  Ask `affected "<file>.mjs"` there, not `affected "<functionName>"`.
+- `affected` at `--depth 1` returns direct symbol references only. An import
+  whose module name matches a declaring file's basename reaches the symbol
+  through that file, so its importers appear at depth 2. Keep the default
+  depth of 2 unless direct references are what you actually want.

package/pipeline/skills/shared/core/multi-agent-help/SKILL.md

@@ -63,7 +63,7 @@ Pipeline (after Phase 0):
   Phase 2: Planning  -> Task breakdown + architecture review + Plan Approval Gate
   Phase 3: Dev       -> TDD: test -> code -> build (Sonnet) + build queue
   Phase 4: Review    -> Deterministic gates + parallel AI review + Fable triage
-                        (Claude Code: Fable + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
+                        (Claude Code: Fable + Opus + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
   Phase 5: Test      -> Optional: switch to branch, test in Xcode
   Phase 6: Commit    -> Commit -> push -> PR + issue body update (never auto-closes)
   Phase 7: Report    -> Channels dispatcher (PR · Jira · Confluence · Wiki, multi-select)
@@ -240,7 +240,7 @@ Pipeline (Phase 0'dan sonra):
   Phase 2: Planning  -> Task kırılımı + mimari inceleme + Plan Onay Kapısı
   Phase 3: Dev       -> TDD: test -> kod -> build (Sonnet) + build queue
   Phase 4: Review    -> Deterministik kapılar + paralel AI review + Fable triage
-                        (Claude Code: Fable + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
+                        (Claude Code: Fable + Opus + Sonnet · Copilot CLI: GPT-5.4 + Opus + Sonnet)
   Phase 5: Test      -> Opsiyonel: branch'e geç, Xcode'da test
   Phase 6: Commit    -> Commit -> push -> PR + issue body güncelleme (hiç auto-close yok)
   Phase 7: Report    -> Channels dispatcher (PR · Jira · Confluence · Wiki, multi-select)