@mmerterden/multi-agent-pipeline 16.18.0 → 16.20.0

package/pipeline/commands/multi-agent/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: "Task orchestrator  -  full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Fable triage (CLI-aware: 2-model on Claude Code, 3-model on Copilot CLI), commit, log. Use when given a Jira ID, a GitHub issue or a free-text task and the whole pipeline should run."
+description: "Task orchestrator  -  full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Fable triage (3 reviewers per host: Fable + Opus + Sonnet on Claude Code, GPT-5.4 + Opus + Sonnet on Copilot CLI), commit, log. Use when given a Jira ID, a GitHub issue or a free-text task and the whole pipeline should run."
 description-tr: "Görev orkestratörü - Jira ID + branch veya GitHub Issue URL ile tam pipeline: analiz, plan, TDD geliştirme, paralel review + Fable triyajı (CLI'ya göre: Claude Code'da 3, Copilot CLI'da 3 model), commit, log"
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, TaskList, TaskGet, AskUserQuestion, WebFetch, WebSearch, NotebookEdit, Skill
 ---
@@ -48,7 +48,7 @@ Classification schema lives in `$HOME/.claude/multi-agent-refs/_input-parser.md`
 | 7 | `issue` | full picker | account → repo (multi) → issue → maturity → dev-context |
 | 8 | Free-text | `freetext` | account → repo (single) → dev-context (maturity skip) |
 
-**Rule**: Whatever the type, **account is always asked** (autopilot picks a default). After issue fetch, **maturity check is mandatory**  -  blockers halt the pipeline. Picker `label` + `header` render in English (`promptLanguage` is locked to `en`); the `question` and each option's `description` render in `outputLanguage`, per the canonical matrix in `multi-agent-refs/rules.md`.
+**Rule**: Whatever the type, **account is always asked** (autopilot picks a default). After issue fetch, **maturity check is mandatory**  -  blockers halt the pipeline. Picker `header` renders in English (the 12-char chip); the `question`, each option's `label` and each option's `description` render in `outputLanguage`, per the canonical matrix in `multi-agent-refs/rules.md`.
 
 Lib scripts (`~/.claude/lib/`):
 - `account-resolver.sh`  -  keychain account inventory
@@ -102,8 +102,8 @@ Lib scripts (`~/.claude/lib/`):
 This command uses lazy loading for token efficiency. Read the relevant sub-file based on the routed action:
 
 **File layout:**
-- `commands/multi-agent/*.md` → **invocable actions** (each gets its own `/multi-agent:<name>` slash command)
-- `$HOME/.claude/multi-agent-refs/**` → **internal references**, read by the main command, never invoked directly (surface as `/multi-agent:refs:...` in autocomplete  -  the prefix signals "not an action")
+- `commands/multi-agent/{cmd}/SKILL.md` → **invocable actions** (each gets its own `/multi-agent:<name>` slash command)
+- `$HOME/.claude/multi-agent-refs/**` → **internal references**, read by the main command, never invoked directly. They live outside `commands/` precisely so they never appear in slash-command autocomplete.
 
 | Route | File to Read |
 |-------|-------------|
@@ -262,7 +262,7 @@ When called with `review`:
 1. Detect current branch and project from cwd (or ask)
 2. Get diff: `git diff HEAD` (unstaged + staged)
 3. If no diff, get diff against base branch: `git diff origin/{baseBranch}...HEAD`
-4. Launch Phase 4 review (parallel + Fable triage  -  2-model on Claude Code, 3-model on Copilot CLI) on the diff
+4. Launch Phase 4 review (parallel + Fable triage  -  3 reviewers on every host: Fable + Opus + Sonnet on Claude Code, GPT-5.4 + Opus + Sonnet on Copilot CLI) on the diff
 5. No worktree, no state file  -  lightweight one-shot review
 6. Print findings to terminal
 

package/pipeline/commands/multi-agent/complaint-analysis/SKILL.md

@@ -127,7 +127,7 @@ Set `phase: "drafting"`.
 ### Phase 4 - Draft, humanize, buffer
 
 1. Render the report per `$HOME/.claude/multi-agent-refs/complaint-analysis-template.md` (8 fixed sections; single-language body in `outputLanguage`; verdict tokens English per Locked 9) to `/tmp/complaint-analysis-<run-slug>-<UTC-iso8601>/report.md`. Store `outputs.draftDir`.
-2. **Humanizer pass (MANDATORY: actually invoke the `ai-common-toolkit:humanizer` skill; the punctuation grep alone does NOT satisfy this)** with `language: <tr|en>`, `tone: technical-explanatory`, `stripFancyPunctuation: true`. Diacritics preserved (Locked 8).
+2. **Humanizer pass (required: actually invoke the `ai-common-toolkit:humanizer` skill; the punctuation grep alone does NOT satisfy this)** with `language: <tr|en>`, `tone: technical-explanatory`, `stripFancyPunctuation: true`. Diacritics preserved (Locked 8).
 3. Punctuation gate: `node $HOME/.claude/scripts/validate-complaint-doc.mjs <draft>` reports no banned-punctuation error. It checks the policy in Node, so the same result holds on macOS, Linux and Windows; `grep -P` is absent from BSD grep and would never run there.
 4. Show the draft path + size to the user. Set `phase: "awaiting_output_decision"`.
 

package/pipeline/commands/multi-agent/design-check/SKILL.md

@@ -133,7 +133,7 @@ for l in sys.stdin:
    Print the resolved set grouped by screen **with its relaunch cost**: `<n> targets · <relaunchCount> relaunches`. Read the cost from `plan`, not from the target count - one relaunch serves every in-app target on that screen, so a 50-target module is typically a dozen relaunches, not fifty. **Whole-module is the intended default**; only ask for confirmation when `relaunchCount` exceeds `config coverage.confirmAbove` (default 25), and phrase it as a cost estimate, not as an invitation to shrink the audit. Never propose a smaller scope as the easy path - a scoped run is for resuming or for a focused re-check, not for avoiding work.
 7. **`--resume`** - read the most recent `~/DesignChecks/{repo}__{module}/*/run-state.json`; the scope becomes that run's targets minus its `covered` and minus its `skipped` entries. Skips carry a reason and are honoured, so a resume covers the genuinely unaudited remainder. No previous run → tell the user and fall back to whole-module scope after confirmation.
 8. **Report dir** - create `~/DesignChecks/{repo}__{module}/{UTC-timestamp}/` (and `assets/` inside it) now, and persist it as `state.designCheck.reportDir`. Phase 3 writes captures, comparison images, and `run-state.json` into it, so it must exist before driving starts - not at export time. This is report output, not a worktree; $HOME is intended here.
-9. **Worktree** - build the Debug app in an isolated worktree so the user's tree is untouched. Follow `phase-0-init.md` Step 8 convention exactly: `{projectRoot}/{worktreeBasePath}/{taskId}` (default `.worktrees/DC-<shortId>`), **never under $HOME** (`feedback_worktree_path_convention`). Stale-lock heal (`git worktree prune`) + residue guard (`.worktrees/` in `.git/info/exclude`) first. Local mode is not offered - the audit always uses a worktree checkout of the current branch's HEAD (no fetch/push).
+9. **Worktree** - build the Debug app in an isolated worktree so the user's tree is untouched. Follow the `phase-0-init.md` Step 6 worktree location convention exactly: `{projectRoot}/.worktrees/{taskId}` with `taskId` = `DC-<shortId>`, **never under $HOME** (the `.worktrees` segment is fixed, not a preference). Stale-lock heal (`git worktree prune`) + residue guard (`.worktrees/` in `.git/info/exclude`) first. Local mode is not offered - the audit always uses a worktree checkout of the current branch's HEAD (no fetch/push).
 
 Persist `agent-state.json` with `taskId`, `mode: "design-check"`, `platform`, `projectRoot`, `worktreePath`, `module`, `designCheck`.
 

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -53,7 +53,7 @@ How It Works (Phase 0  -  Interactive Flow):
 Pipeline (after Phase 0)  -  shown as visual cards in terminal:
 
   Phase 0:   Init       -> The 8 steps above
-  Phase 1:   Analysis   -> Stack detection + codebase scan (Fable)
+  Phase 1:   Analysis   -> Stack detection + codebase scan (Sonnet)
   Phase 2:   Planning   -> Task breakdown + architecture review + Plan Approval Gate
                           (clarification max 2 rounds + approval loop  -  Full + interactive
                            only; a Short run has no plan, autopilot may not ask)
@@ -331,7 +331,7 @@ Nasıl Çalışır (Phase 0  -  İnteraktif Akış):
 Pipeline (Phase 0'dan sonra)  -  terminalde görsel kart olarak görünür:
 
   Phase 0:   Init       -> Yukarıdaki 8 adım
-  Phase 1:   Analysis   -> Stack tespiti + codebase taraması (Fable)
+  Phase 1:   Analysis   -> Stack tespiti + codebase taraması (Sonnet)
   Phase 2:   Planning   -> Task kırılımı + mimari inceleme + Plan Onay Kapısı
                           (clarification max 2 tur + onay döngüsü  -  sadece Tam +
                            etkileşimli; Kısa'da plan yok, autopilot soru soramaz)

package/pipeline/commands/multi-agent/local-autopilot/SKILL.md

@@ -67,7 +67,7 @@ Depth is a separate axis, asked at Phase 0 Step 7.5 rather than encoded in the c
 
 ## Delegation
 
-Orchestrator routing: the routing table in `$HOME/.claude/commands/multi-agent/SKILL.md` resolves `local-autopilot` as the union of the `dev-local` + `autopilot` mode mixins. Contract details: `$HOME/.claude/multi-agent-refs/phases/phase-0-init.md` Step 8 (local branch) + `$HOME/.claude/multi-agent-refs/phases/phase-2-planning.md` Step 5 (autopilot gate skip + safety classifier).
+Orchestrator routing: the routing table in `$HOME/.claude/commands/multi-agent/SKILL.md` resolves `local-autopilot` as the union of the `dev-local` + `autopilot` mode mixins. Contract details: `$HOME/.claude/multi-agent-refs/phases/phase-0-init.md` Step 6 (local branch) + `$HOME/.claude/multi-agent-refs/phases/phase-2-planning.md` Step 5 (autopilot gate skip + safety classifier).
 ## Required: outward-facing payload contracts
 
 Before writing anything outward-facing  -  PR body, Jira comment, Confluence page, closing report  -  load `$HOME/.claude/multi-agent-refs/payload-contracts.md`. It names the canonical section set for each payload, the markup dialect per surface (PR body is Markdown, Jira is wiki markup  -  mixing them is a defect), and the token/duration numbers the closing report must carry. Improvising a payload shape from memory is the most common failure of the short modes.

package/pipeline/commands/multi-agent/manual-test/SKILL.md

@@ -47,5 +47,9 @@ Lets you switch to the task branch for manual testing in Xcode before the PR is
 5. **Wait for the user's reply**
 
 6. **Branch on the answer**:
-   - **OK** → `phase-tracker.sh update 5 completed` + `phase-tracker.sh meta 5 Result "local test passed (user)"`, recreate the worktree, continue to Phase 6
+   - **OK** → first write `$WORKTREE/.pipeline/manual-test.json` (one entry per acceptance criterion from the analysis doc test plan, the plan tasks, or the user's own words):
+     ```json
+     {"criteria":[{"spec":"<quote>","source":"analysis 15.2 | plan task 3 | user","observed":"<what was seen>","verdict":"pass|fail|not-tested","reason":"<required when not-tested>","screenshot":"<path or null>"}],"verdict":"passed|failed"}
+     ```
+     then run `node $HOME/.claude/scripts/evidence-gate.mjs --claim manual --status passed --evidence "$WORKTREE/.pipeline/manual-test.json"`. Exit 1 means the "ok" is not accepted: name the criterion that is missing evidence and wait for the next reply. Exit 0 → `phase-tracker.sh update 5 completed` + `phase-tracker.sh meta 5 Result "local test passed (user)"`, recreate the worktree, continue to Phase 6. Full contract: `$HOME/.claude/multi-agent-refs/phases/phase-5-test.md` step 5.
    - **Fix needed** → `phase-tracker.sh now 5 "applying fix: <summary>"`, recreate the worktree, apply the fix

package/pipeline/commands/multi-agent/resume/SKILL.md

@@ -23,6 +23,7 @@ Resume a paused or failed task from the last successful phase.
    - `currentPhase`  -  last completed phase
    - `status`  -  `paused` | `failed` | `in_progress`
    - `haltReason`  -  if set, show it so the user knows why the run stopped; clear it on successful re-entry
+   - `circuitBreaker`  -  if `tripped`, show `trigger` + `detail`, then set `tripped: false` and keep `counters`; if the same trigger fires again at the next checkpoint the breaker re-trips (no silent bypass)
    - `autopilot`  -  preserve the mode
 
 3. **Load context**  -  rebuild working context from durable artifacts, never from conversation memory:

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -117,12 +117,12 @@ jq --arg sha "$HEAD_SHA" '.review.headCommitSha = $sha' "$AGENT_STATE" > "$tmp_s
 **pr mode  -  bitbucket-server:**
 
 ```bash
-# Resolve credentials via prefs.keychainMapping (never hardcode key names).
+# Resolve credentials via prefs.global.keychainMapping (never hardcode key names).
 . "$HOME/.claude/lib/credential-store-resolver.sh" \
   || . "$HOME/.copilot/lib/credential-store-resolver.sh"
 resolve_credential_store
-USER_KEY=$(jq -r '.keychainMapping.bitbucket_user' "$HOME/.claude/multi-agent-preferences.json")
-TOKEN_KEY=$(jq -r '.keychainMapping.bitbucket_token' "$HOME/.claude/multi-agent-preferences.json")
+USER_KEY=$(jq -r '.global.keychainMapping.bitbucket_user' "$HOME/.claude/multi-agent-preferences.json")
+TOKEN_KEY=$(jq -r '.global.keychainMapping.bitbucket_token' "$HOME/.claude/multi-agent-preferences.json")
 BB_USER=$("$CRED_STORE" get "$USER_KEY")
 BB_TOKEN=$("$CRED_STORE" get "$TOKEN_KEY")
 
@@ -175,15 +175,25 @@ Scope note: a guide governs only files under its own directory  -  a guide found
 
 ### 3. Launch parallel reviewers  -  host-CLI dependent
 
+Every host runs three reviewers; only the second slot differs, because GPT-5.4 exists on Copilot and Codex but not on Claude Code, where Opus fills it.
+
 **Claude Code (3 in parallel):**
 - Agent 1: `claude-fable-5` → security + architecture
-- Agent 2: `claude-sonnet-5` → general quality
+- Agent 2: `claude-opus-5` → edge cases, alternate perspective
+- Agent 3: `claude-sonnet-5` → general quality
 
 **Copilot CLI (3 in parallel):**
 - Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
 - Agent 2: `gpt-5.4` → edge cases, alternate perspective
 - Agent 3: `claude-sonnet-5` → general quality
 
+**Codex CLI (3 in parallel, single vendor):**
+- Agent 1: `gpt-5.6` @ `xhigh` → security + architecture
+- Agent 2: `gpt-5.4` @ `high` → edge cases, alternate perspective
+- Agent 3: `gpt-5.6` @ `medium` → general quality
+
+With the `fable` rung disabled by prefs the Claude Code panel is two reviewers (Opus + Sonnet); see `$HOME/.claude/multi-agent-refs/features/model-fallback.md`.
+
 Each reviewer receives the diff, the module review guides from Step 2b (when any were found), plus the standard reviewer system prompt (see `$HOME/.claude/multi-agent-refs/phases/phase-4-review.md` for the prompt contract). Output: structured `findings[]` per reviewer.
 
 ### 4. Store-compliance cross-reference
@@ -203,16 +213,18 @@ Catalog-only  -  does NOT invoke binaries. For a full scan, use `/multi-agent:te
 
 ### 4b. Platform parity cross-check (advisory, read-only)
 
-When `state.siblings[]` holds a checked-out repo whose `stack` is the other
-mobile platform and the diff touches a screen, a service, a request model or a
-localization file, compare the change against that repo on four axes: endpoints
-called, parameters sent, business rules around the call, localization keys used.
+When a counterpart repo resolves whose `stack` is the other mobile platform and
+the diff touches a screen, a service, a request model or a localization file,
+compare the change against that repo on four axes: endpoints called, parameters
+sent, business rules around the call, localization keys used.
 
-The counterpart is resolved automatically, in both directions (ios ↔ android):
-a remembered `prefs.projects[<slug>].counterpartRoots[]` first, then the primary
-checkout's sibling directories, then `state.siblings[]`. One match is used and
-remembered, so the next review of the same project asks nothing. `--with
-<path|owner/repo>` overrides all of it for a one-off and is remembered too.
+The counterpart is resolved automatically, in both directions (ios ↔ android),
+from four sources in this order, first hit wins: `--with <path|owner/repo>` (a
+one-off override, remembered like any other resolution), then a remembered
+`prefs.projects[<slug>].counterpartRoots[]`, then the primary checkout's sibling
+directories, then `state.siblings[]` from the Phase 0 dev-context picker. None of
+them is a precondition for the others. One match is used and remembered, so the
+next review of the same project asks nothing.
 
 Several candidates → interactive runs ask once; autopilot and non-interactive
 runs skip silently, because an unattended run must not block on a picker. No
@@ -237,12 +249,13 @@ Triage also marks each finding as `accepted` (real issue), `deferred` (real but
 | Model    | Verdict   | Blocking | Important | Suggestion |
 |----------|-----------|----------|-----------|------------|
 | Fable    | approved  | 0        | 1         | 3          |
+| Opus     | approved  | 0        | 2         | 2          |
 | Sonnet   | rejected  | 1        | 2         | 5          |
 
 Consensus: ⚠ DISAGREEMENT  -  see Fable triage
 ```
 
-This summary ALWAYS prints, regardless of input mode. The chat is the live conversation; on the PR side, the durable artifacts are inline comments + the review state (Step 7).
+One row per reviewer that ran: Fable + Opus + Sonnet on Claude Code, Opus + GPT-5.4 + Sonnet on Copilot CLI, the three GPT rows on Codex CLI. This summary ALWAYS prints, regardless of input mode. The chat is the live conversation; on the PR side, the durable artifacts are inline comments + the review state (Step 7).
 
 ### 7. Post to PR  -  only when input.kind === "pr"
 

package/pipeline/commands/multi-agent/review-analysis/SKILL.md

@@ -23,7 +23,7 @@ Read `$HOME/.claude/multi-agent-refs/analysis/review.md` and execute it:
 
 ## Why it cites Locked decisions
 
-The analysis flow already declares 35 Locked decisions and two deterministic validators. A reviewer that says "I would have written this differently" gives the author nothing to act on; one that says "Locked 34: the Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason. Findings that map to no rule are still allowed, but they are marked as judgement, not dressed up as a violation.
+The analysis flow already declares 36 Locked decisions and two deterministic validators. A reviewer that says "I would have written this differently" gives the author nothing to act on; one that says "Locked 34: the Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason. Findings that map to no rule are still allowed, but they are marked as judgement, not dressed up as a violation.
 
 ## What it never does
 

package/pipeline/commands/multi-agent/store-ready/SKILL.md

@@ -183,7 +183,7 @@ is a guess the user must be able to correct.
 
 ### Mode A  -  build from the branch
 
-1. Worktree at `{projectRoot}/{worktreeBasePath}/{taskId}` on the chosen branch.
+1. Worktree at `{projectRoot}/.worktrees/{taskId}` on the chosen branch (phase-0-init.md Step 6 convention; the `.worktrees` segment is fixed, not a preference).
    **Never under `$HOME`**, never a direct checkout of the main working tree.
 2. Resolve the scheme / module and workspace / project from prefs; ask if ambiguous.
 3. Build:
@@ -218,10 +218,22 @@ is a guess the user must be able to correct.
   Use the fallback only when the tool is genuinely absent, and say in the report
   which path ran  -  a rule set that silently differed between two invocations is
   worse than a missing gate.
+
+  Then, whichever path ran, count `<archive>/dSYMs/*.dSYM`. Zero is a blocking
+  finding: `[SYMBOLS] archive carries no dSYM; crash reports will not symbolicate`,
+  with the hint `DEBUG_INFORMATION_FORMAT = dwarf-with-dsym` for the Release
+  configuration. This check runs from the package alone and does not need the
+  MCP tool.
 - **Android**: `android_apk_audit` on the artifact, plus the
   `google-play-compliance` skill's 21 rules  -  `bundletool validate` and manifest
   dump, `aapt2 dump badging`, `apksigner verify`, ABI / native scan.
 
+  Then, when the module has `minifyEnabled true` and the bundle build produced no
+  `mapping.txt`, raise the same class of blocking finding:
+  `[SYMBOLS] minified bundle carries no mapping.txt; crash reports will not
+  deobfuscate`. This check reads the module config and the build output alone
+  and does not need the MCP tool.
+
 `error` findings are blocking; `warning` is advisory. Group by severity and keep
 each finding's ITMS / Play policy code  -  Gate 2 may return the same code on iOS,
 and seeing it in both places tells the user it is real rather than a heuristic.
@@ -259,6 +271,7 @@ that catches what a human reviewer rejects, so it reads source, not the binary.
 | Privacy policy | reachable in-app and in the metadata |
 | IAP | anything unlocking features goes through StoreKit, with no external purchase path |
 | Sign in with Apple | present when a third-party social login is offered |
+| Crash symbolication | a dSYM upload step exists: an Xcode run-script calling `upload-symbols`, or a Crashlytics / Sentry / Datadog upload in CI |
 
 **Android**  -  `ai-android-toolkit:play-store-review`:
 
@@ -272,6 +285,7 @@ that catches what a human reviewer rejects, so it reads source, not the binary.
 | Account deletion | if the app creates accounts, an in-app deletion path exists, plus the web deletion URL Play requires |
 | Content rating | the questionnaire answers match the app's actual content |
 | Signing | Play App Signing configured, upload key distinct from the app signing key |
+| Crash symbolication | a `mapping.txt` upload exists: the Firebase Crashlytics Gradle plugin, or the Play App Bundle deobfuscation file |
 
 For each: `pass` / `fail` / `not-applicable` with the evidence path that justifies
 it. `not-applicable` needs a reason  -  an unexamined area is not a pass.
@@ -303,6 +317,12 @@ Advisory
 
 Not run
   Gate 2: no local Play validator  -  authoritative check is server-side only
+
+Before rollout (human inputs, not verified)
+  Phased rollout: <1% -> 10% -> 50% -> 100% | full>
+  Halt thresholds: crash-free < 99.5% (iOS, Android) or ANR > 0.47% (Android) => pause the rollout
+  Rollback / forward-fix owner: <name>
+  Forward-fix plan: <one line>
 ```
 
 Rules for the report:
@@ -311,6 +331,8 @@ Rules for the report:
   skip. An Android run therefore reads `2 of 3 gates cleared, 1 skipped` at best.
 - Every blocking finding carries a file path or a store code. A finding the user
   cannot act on is noise.
+- The `Before rollout` block is filled by a human, never inferred. When it is
+  left unfilled the verdict line gains the suffix `, rollout plan missing`.
 - Humanize via `--lang en` by default (`promptLanguage` is locked to `"en"`); pass
   `--lang=tr` explicitly to opt into Turkish.
 - No AI or assistant attribution anywhere, per
@@ -329,7 +351,7 @@ Print, and stop:
     declares  -  never run it
 - `/multi-agent:store-ready --resume` to re-run after fixes
 - `/multi-agent:channels` to land the findings in Jira / Confluence / Wiki / PR
-- `/multi-agent:fix-bug` when Gate 3 produced code-level findings
+- the enabled stack plugin's `fix-bug` skill (`ai-ios-toolkit:fix-bug` or the stack equivalent) when Gate 3 produced code-level findings
 
 Never upload, never commit a Play edit, never bump the build number, never commit.
 

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -60,7 +60,7 @@ Run every step automatically:
 Step 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Step 1.5: DETECT    Compare timestamps, find stale targets
 Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 55 sub-command skills)
-Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 51 specs as refs + 8 agent TOML)
+Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 55 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
@@ -117,7 +117,7 @@ If nothing is stale → report "All targets up to date" and stop.
    - `~/.claude/CLAUDE.md`, `~/.claude/rules/`, `~/.claude/knowledge/`
    - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh`, `agent-guard.sh`, `agent-guard.py`, and `build-stack-plugins.mjs` (generic, synced)
    - `~/.claude/settings.json`
-   - **Any `~/.claude/commands/multi-agent/*.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin (e.g. corporate `ai-ios-toolkit` skills exposed as `multi-agent:<name>`). Syncing them would leak the private plugin/skill names into the public pipeline. Filter before copy: skip every source file containing `local-only: true`, and after copy assert none reached `pipeline/commands/`.
+   - **Any `~/.claude/commands/multi-agent/*/SKILL.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin's skills exposed as `multi-agent:<name>`. Syncing them would leak the private plugin/skill names into the public pipeline. Filter before copy: skip every source file containing `local-only: true`, and after copy assert none reached `pipeline/commands/`.
      ```bash
      # backstop: no local-only wrapper may exist in the synced target
      grep -rl "^local-only: true" ~/multi-agent-pipeline/pipeline/commands/ 2>/dev/null \

package/pipeline/commands/sim-test.md

@@ -1,6 +1,6 @@
 ---
 description: "Mobile UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb)  -  auto-detects platform"
-allowed-tools: Agent, Bash, Read, Write, Edit, TaskCreate, TaskUpdate, TaskList, TaskGet, mcp__multi-agent-toolkit__ios_list_devices, mcp__multi-agent-toolkit__ios_boot_device, mcp__multi-agent-toolkit__ios_screenshot, mcp__multi-agent-toolkit__ios_tap, mcp__multi-agent-toolkit__ios_swipe, mcp__multi-agent-toolkit__ios_type_text, mcp__multi-agent-toolkit__ios_launch_app, mcp__multi-agent-toolkit__ios_terminate_app, mcp__multi-agent-toolkit__ios_list_apps, mcp__multi-agent-toolkit__ios_go_home, mcp__multi-agent-toolkit__ios_set_appearance, mcp__multi-agent-toolkit__ios_set_content_size, mcp__multi-agent-toolkit__ios_set_locale, mcp__multi-agent-toolkit__ios_open_url, mcp__multi-agent-toolkit__ios_status_bar, mcp__multi-agent-toolkit__ios_push_notification, mcp__multi-agent-toolkit__ios_grant_permission, mcp__multi-agent-toolkit__ios_revoke_permission, mcp__multi-agent-toolkit__ios_reset_permissions, mcp__multi-agent-toolkit__ios_set_location, mcp__multi-agent-toolkit__ios_clear_location, mcp__multi-agent-toolkit__ios_set_increase_contrast, mcp__multi-agent-toolkit__ios_record_video, mcp__multi-agent-toolkit__ios_add_media, mcp__multi-agent-toolkit__ios_keychain_reset, mcp__multi-agent-toolkit__ios_get_app_container, mcp__multi-agent-toolkit__ios_erase_device, mcp__multi-agent-toolkit__ios_get_ui_tree, mcp__multi-agent-toolkit__android_list_devices, mcp__multi-agent-toolkit__android_screenshot, mcp__multi-agent-toolkit__android_tap, mcp__multi-agent-toolkit__android_swipe, mcp__multi-agent-toolkit__android_type_text, mcp__multi-agent-toolkit__android_key_event, mcp__multi-agent-toolkit__android_launch_app, mcp__multi-agent-toolkit__android_stop_app, mcp__multi-agent-toolkit__android_list_packages, mcp__multi-agent-toolkit__android_go_home, mcp__multi-agent-toolkit__android_go_back, mcp__multi-agent-toolkit__android_get_ui_tree, mcp__multi-agent-toolkit__android_set_dark_mode, mcp__multi-agent-toolkit__android_set_font_scale, mcp__multi-agent-toolkit__android_set_locale, mcp__multi-agent-toolkit__android_set_location, mcp__multi-agent-toolkit__android_grant_permission, mcp__multi-agent-toolkit__android_revoke_permission, mcp__multi-agent-toolkit__android_record_screen, mcp__multi-agent-toolkit__android_install_apk, mcp__multi-agent-toolkit__android_uninstall_app, mcp__multi-agent-toolkit__android_logcat, mcp__multi-agent-toolkit__android_get_screen_size, mcp__multi-agent-toolkit__android_open_url, mcp__multi-agent-toolkit__android_clear_app_data
+allowed-tools: Agent, Bash, Read, Write, Edit, TaskCreate, TaskUpdate, TaskList, TaskGet, mcp__multi-agent-toolkit__ios_list_devices, mcp__multi-agent-toolkit__ios_boot_device, mcp__multi-agent-toolkit__ios_screenshot, mcp__multi-agent-toolkit__ios_tap, mcp__multi-agent-toolkit__ios_swipe, mcp__multi-agent-toolkit__ios_type_text, mcp__multi-agent-toolkit__ios_launch_app, mcp__multi-agent-toolkit__ios_terminate_app, mcp__multi-agent-toolkit__ios_list_apps, mcp__multi-agent-toolkit__ios_go_home, mcp__multi-agent-toolkit__ios_set_appearance, mcp__multi-agent-toolkit__ios_set_content_size, mcp__multi-agent-toolkit__ios_set_locale, mcp__multi-agent-toolkit__ios_open_url, mcp__multi-agent-toolkit__ios_status_bar, mcp__multi-agent-toolkit__ios_push_notification, mcp__multi-agent-toolkit__ios_grant_permission, mcp__multi-agent-toolkit__ios_revoke_permission, mcp__multi-agent-toolkit__ios_reset_permissions, mcp__multi-agent-toolkit__ios_set_location, mcp__multi-agent-toolkit__ios_clear_location, mcp__multi-agent-toolkit__ios_set_increase_contrast, mcp__multi-agent-toolkit__ios_record_video, mcp__multi-agent-toolkit__ios_add_media, mcp__multi-agent-toolkit__ios_keychain_reset, mcp__multi-agent-toolkit__ios_get_app_container, mcp__multi-agent-toolkit__ios_erase_device, mcp__multi-agent-toolkit__ios_get_ui_tree, mcp__multi-agent-toolkit__ios_accessibility_audit, mcp__multi-agent-toolkit__ios_accessibility_audit_deep, mcp__multi-agent-toolkit__ios_list_crashes, mcp__multi-agent-toolkit__agent_run_steps, mcp__multi-agent-toolkit__android_list_devices, mcp__multi-agent-toolkit__android_screenshot, mcp__multi-agent-toolkit__android_tap, mcp__multi-agent-toolkit__android_swipe, mcp__multi-agent-toolkit__android_type_text, mcp__multi-agent-toolkit__android_key_event, mcp__multi-agent-toolkit__android_launch_app, mcp__multi-agent-toolkit__android_stop_app, mcp__multi-agent-toolkit__android_list_packages, mcp__multi-agent-toolkit__android_go_home, mcp__multi-agent-toolkit__android_go_back, mcp__multi-agent-toolkit__android_get_ui_tree, mcp__multi-agent-toolkit__android_set_dark_mode, mcp__multi-agent-toolkit__android_set_font_scale, mcp__multi-agent-toolkit__android_set_locale, mcp__multi-agent-toolkit__android_set_location, mcp__multi-agent-toolkit__android_grant_permission, mcp__multi-agent-toolkit__android_revoke_permission, mcp__multi-agent-toolkit__android_record_screen, mcp__multi-agent-toolkit__android_install_apk, mcp__multi-agent-toolkit__android_uninstall_app, mcp__multi-agent-toolkit__android_logcat, mcp__multi-agent-toolkit__android_get_screen_size, mcp__multi-agent-toolkit__android_open_url, mcp__multi-agent-toolkit__android_clear_app_data, mcp__multi-agent-toolkit__android_accessibility_audit, mcp__multi-agent-toolkit__android_list_crashes
 ---
 
 # Mobile UI Bug Hunter
@@ -25,7 +25,7 @@ Auto-detects platform: iOS (simctl) or Android (adb). No external apps needed.
 For iOS: use `mcp__multi-agent-toolkit__ios_*` tools
 For Android: use `mcp__multi-agent-toolkit__android_*` tools
 
-**Android extras**: `get_ui_tree` returns XML with bounds/text/resource-id (uiautomator dump), `logcat` for crash detection, `go_back` button.
+**Android extras**: `get_ui_tree` returns XML with bounds/text/resource-id (uiautomator dump), `logcat` for live output, `list_crashes` for the crash buffer, `go_back` button.
 
 ## Activation
 
@@ -90,23 +90,34 @@ Call: ios_status_bar (time: "09:41", battery_level: 100)
 
 ### Step 3  -  Systematic Screen Exploration
 
-For each screen in the app:
+For each screen in the app, read before you look, and batch what you can:
 
 ```
-Call: ios_screenshot
--> Claude analyzes the image for bugs (see Bug Detection below)
+Call: ios_get_ui_tree            (text: labels, frames, traits; ~0.1 s, no image)
+-> pick tap targets from element frames, never by guessing pixels from a picture
+
+Call: agent_run_steps            (one round trip for a scripted sequence)
+  steps: [ {tool: "ios_tap", args: {x, y}}, {wait_ms: 400},
+           {tool: "ios_screenshot", args: {path: "<dir>/<screen>.png"}},
+           {tool: "ios_get_ui_tree", args: {}} ]
 
-Call: ios_tap (on each tab bar item, button, navigation link)
--> After each tap: ios_screenshot -> analyze
--> Navigate back: ios_swipe (left edge swipe) or tap back button coordinates
+Call: ios_screenshot             (inline, only when a visual judgment is needed)
+-> Claude analyzes the image for bugs (see Bug Detection below)
 ```
 
+Every inline `ios_screenshot` / `android_screenshot` is an 800 px JPEG (about 60 KB) by
+default; pass `format: "png"` or a larger `max_width` only when a pixel-level look is the
+point. Bulk captures (dark mode, dynamic type, locale sweeps) always go through `path`,
+so a run of 100 screens does not push 100 images through the model: look at the ones
+whose tree or diff changed. A screen whose tree is unchanged after a tap is the
+"button did not respond" finding without a second image.
+
 **Navigation strategy:**
 
-1. Screenshot initial screen -> identify tab bar (usually bottom ~680-700y area)
-2. Tap each tab position -> screenshot each
-3. On each screen: tap interactive elements -> screenshot results
-4. Scroll: `ios_swipe(200, 600, 200, 200)` to scroll down -> screenshot
+1. Tree of the initial screen -> tab bar items are the elements with a tab-bar trait or the bottom row of buttons; use their frames
+2. Tap each tab (batched via `agent_run_steps`) -> tree + file capture each
+3. On each screen: tap interactive elements from the tree -> tree after; inline screenshot only where the tree cannot tell (layout, contrast, clipping)
+4. Scroll: `ios_swipe(200, 600, 200, 200)` to scroll down -> tree, capture when new content appeared
 5. Type in text fields: `ios_type_text("test input")`
 
 ### Step 4  -  Variant Testing (based on input argument)
@@ -131,9 +142,24 @@ Call: ios_set_content_size("medium")  // reset
 
 **"accessibility":**
 
-- Check each screenshot for: small tap targets, missing labels, poor contrast
-- Verify minimum 44x44pt touch areas
-- Check text readability at default + large sizes
+Two halves per screen, and the report keeps them apart: what the tool measured and what the screenshot suggests.
+
+```
+On each screen, after ios_screenshot:
+Call: ios_accessibility_audit            (Android: android_accessibility_audit)
+-> findings[]: missing labels / contentDescription, controls a screen reader cannot
+   name, tap targets under 44pt (iOS) / 48dp (Android), missing identifiers,
+   reading order that does not follow the layout. Each finding becomes a BUG task
+   with the element identifier from the tree, not a guess from the pixels.
+-> measurable:false (with a reason) means the tree could not be read (on iOS,
+   Simulator.app itself must be running, a booted device is not enough). Record
+   the screen as "not audited: <reason>" in the report. Never read it as clean.
+-> Pass `scope: "<prefix>"` to narrow to one screen's identifiers when the tree is large.
+```
+
+The screenshot pass still runs on every screen for what the tree cannot see: poor contrast, text readability at default + large sizes, and visual crowding. Report those as screenshot findings, separately from the audit findings.
+
+Optional deep pass (iOS only, minutes rather than seconds): when the project has an XCUITest target whose test calls `performAccessibilityAudit()`, run `ios_accessibility_audit_deep` (`scheme`, `project` or `workspace`, optional `test_identifier`) once at the end. It reaches contrast, Dynamic Type, clipped text, traits and hit regions that a tree dump cannot. The result says whether the named test ran; a test that never called the audit reports as "did not run", never as clean. Skip it, and say so in the report, when no such test exists.
 
 **"screenshot <lang>":**
 
@@ -172,6 +198,17 @@ no Gate 3 and no Android parity, so the copy is gone rather than kept in sync.
 - Run light mode -> all screens
 - Run dark mode -> all screens
 - Run large text -> all screens
+- Crash sweep, after the last screen and before the report:
+
+```
+Call: ios_list_crashes (app: <process name>, since_min: <minutes since Step 1 launch>, limit: 20)
+      Android: android_list_crashes (lines: 200)
+-> Every report / stack newer than the launch becomes a BUG task with severity Critical,
+   the crashed process and the top frame in the description.
+-> Empty result -> "Crashes: none during this run" in the report. Only the bounded window
+   counts; older reports on the host are not this run's.
+```
+
 - Compile complete report
 
 ### Step 5  -  Bug Detection (on EVERY screenshot)
@@ -216,16 +253,18 @@ Then output full report:
 - **Steps**: 1. Open app -> 2. Tap {X} -> 3. Observe {issue}
 - **Expected**: {correct behavior}
 - **Actual**: {what's wrong}
+- **Spec**: "<quoted acceptance criterion from the analysis doc Section 15 / 20, or: no spec, model expectation>" (<source>)
+- **Evidence**: before=<png path> after=<png path>
 
 ### BUG-2: ...
 
 ## Screens Visited ({N})
 
-| #   | Screen   | Light | Dark  | Large Text | Bugs |
-| --- | -------- | ----- | ----- | ---------- | ---- |
-| 1   | Home     | ok    | BUG-1 | ok         | 1    |
-| 2   | Login    | ok    | ok    | BUG-2      | 1    |
-| 3   | Settings | ok    | ok    | ok         | 0    |
+| #   | Screen   | Light | Dark  | Large Text | Bugs | Evidence |
+| --- | -------- | ----- | ----- | ---------- | ---- | -------- |
+| 1   | Home     | ok    | BUG-1 | ok         | 1    | 3        |
+| 2   | Login    | ok    | ok    | BUG-2      | 1    | 4        |
+| 3   | Settings | ok    | ok    | ok         | 0    | 2        |
 
 ## Summary
 
@@ -233,8 +272,13 @@ Then output full report:
 - Clean: {N}
 - With bugs: {N}
 - Critical: {N} | Major: {N} | Minor: {N}
+- Accessibility audit (accessibility scenario): {N} audited, {N} not audited (reason per screen), deep pass: {ran / skipped: reason}
+- Crashes (full scenario): {N} during this run
+- Production readiness: FAILED | NEEDS WORK | READY
 ```
 
+`Evidence` in a bug block is the captures already written to files in Step 4: a tap-driven finding needs both `before` and `after`, a static finding (layout, contrast, dark mode, large text) needs `after` only. The `Evidence` column in Screens Visited is the count of screenshot files written for that screen. Production readiness defaults to FAILED; it is NEEDS WORK when only Minor bugs remain, and READY only when there are zero Critical / Major bugs and every planned screen was visited.
+
 Save to: `$HOME/.claude/logs/sim-test/{bundle_id}/{timestamp}.md`
 
 ### Step 7  -  Fix Offer

package/pipeline/lib/credential-inventory.sh

@@ -46,7 +46,8 @@
 # not to enable, not a problem to report.
 #
 # Exit codes: 0 = inventory produced (or the queried key is present), 1 = queried key
-# absent, 3 = usage error.
+# absent, 2 = no credential helper on this host (nothing could be probed), 3 = usage
+# error.
 
 set -uo pipefail
 
@@ -290,11 +291,23 @@ if [ -n "$QUERY" ]; then
         echo "$QUERY: present  -  can $(capability_of "$QUERY")"
       fi
       exit 0 ;;
-    2) echo "$QUERY: no credential helper on this host" >&2; exit 1 ;;
+    2) echo "$QUERY: no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2; exit 2 ;;
     *) echo "$QUERY: NOT AVAILABLE  -  onboard it via /multi-agent:setup before relying on it" >&2; exit 1 ;;
   esac
 fi
 
+# Without a helper nothing can be probed: every mapped key would read as
+# "mapped-but-missing" and the inventory would send the user to re-onboard
+# tokens that are sitting in the store.
+if [ -z "$STORE" ]; then
+  if [ "$MODE" = "json" ]; then
+    echo '{"status":"no-backend","reason":"credential-store.sh not found on this host","credentials":[]}'
+  else
+    echo "no credential helper on this host  -  run the pipeline installer (credential-store.sh missing)" >&2
+  fi
+  exit 2
+fi
+
 ROWS=""
 while IFS=$'\t' read -r key mapped; do
   [ -z "$key" ] && continue

package/pipeline/lib/credential-store-resolver.sh

@@ -81,12 +81,22 @@ MSG
   return 1
 }
 
-# When sourced (BASH_SOURCE != $0), auto-resolve into the caller's environment.
-# When run directly (./credential-store-resolver.sh), print the resolved path
-# or a non-zero exit code with the message above.
-if [ "${BASH_SOURCE[0]:-$0}" = "${0}" ]; then
+# When sourced, auto-resolve into the caller's environment. When run directly
+# (./credential-store-resolver.sh), print the resolved path or a non-zero exit
+# code with the message above. zsh sources this too (the pipeline's Bash tool
+# is zsh), where BASH_SOURCE is unset and $0 is the sourced file's own name, so
+# the bash test alone always looked like a direct run there.
+_csr_sourced=0
+if [ -n "${ZSH_VERSION:-}" ]; then
+  case "${ZSH_EVAL_CONTEXT:-}" in *:file|*:file:*) _csr_sourced=1 ;; esac
+elif [ -n "${BASH_SOURCE[0]:-}" ] && [ "${BASH_SOURCE[0]}" != "$0" ]; then
+  _csr_sourced=1
+fi
+if [ "$_csr_sourced" -eq 0 ]; then
+  unset _csr_sourced
   resolve_credential_store && echo "$CRED_STORE"
 else
+  unset _csr_sourced
   # `|| :` matters, and it is not cosmetic.
   #
   # A sourced file runs in the caller's shell, so a bare failing command at this top

package/pipeline/lib/credential-store.sh

@@ -164,6 +164,10 @@ do_get() {
       return 0
     fi
     audit_lookup "$logical" false
+    case "$rc" in
+      2) echo "ERR: credential backend unavailable on $PLATFORM" >&2; return 2 ;;
+      4) echo "ERR: credential backend error while reading '$logical'" >&2; return 4 ;;
+    esac
     return 1
   fi
   local val=""
@@ -204,8 +208,10 @@ do_set() {
   if [ "$val" = "-" ]; then
     val=$(cat)
   fi
-  if delegate_to_python; then
-    # Pass the value via stdin to keep it out of process listings / shell history.
+  # macOS writes go through `security -i` below: the secret travels on stdin
+  # and never lands on any argv, which is the property the delegate cannot
+  # promise from here.
+  if [ "$PLATFORM" != "macos" ] && delegate_to_python; then
     printf '%s' "$val" | python3 "$KEYCHAIN_PY" set "$key" -
     return $?
   fi

package/pipeline/lib/extract-conventions.sh

@@ -2,7 +2,7 @@
 # extract-conventions.sh
 #
 # Phase 1c helper for /multi-agent:analysis.
-# Scans a repo and emits 12 convention buckets as a single JSON object on stdout.
+# Scans a repo and emits 13 convention buckets as a single JSON object on stdout.
 #
 # Usage:
 #   extract-conventions.sh <repo-path> <platform>
@@ -202,19 +202,6 @@ files_to_json() {
   printf '%s\n' "$input" | head -5 | jq -R . | jq -s .
 }
 
-# Top-N suffix frequency from a stream of file basenames.
-# stdin: basenames (one per line)
-# arg1: regex (POSIX ERE) capturing the suffix in group 1
-# stdout: lines "count<TAB>suffix" sorted desc
-suffix_freq() {
-  local re="$1"
-  grep -Eo "$re" 2>/dev/null \
-    | sort \
-    | uniq -c \
-    | sort -rn \
-    | sed -E 's/^ *([0-9]+) +/\1\t/'
-}
-
 # Run a bucket function with a soft timeout. We wrap the function in a subshell
 # and use a watchdog so we stay compatible with macOS bash 3.2.
 run_bucket_with_timeout() {

package/pipeline/lib/fetch-confluence.sh

@@ -48,10 +48,12 @@ HOST_OVERRIDE="${CONFLUENCE_HOST_OVERRIDE:-}"
 PAGE_ID=""
 TIMEOUT="${CONFLUENCE_TIMEOUT_SECONDS:-20}"
 
+need_value() { [ $# -ge 2 ] || { echo "ERR: $1 needs a value" >&2; exit 4; }; }
+
 while [ $# -gt 0 ]; do
   case "$1" in
-    --host)    HOST_OVERRIDE="$2"; shift 2 ;;
-    --page-id) PAGE_ID="$2"; shift 2 ;;
+    --host)    need_value "$@"; HOST_OVERRIDE="$2"; shift 2 ;;
+    --page-id) need_value "$@"; PAGE_ID="$2"; shift 2 ;;
     -h|--help)
       echo "usage: $0 <page-url> | $0 --host <host> --page-id <id>" >&2
       exit 4 ;;
@@ -220,11 +222,17 @@ PAGE_ID_FINAL="$PAGE_ID_RESOLVED" \
 SPACE_KEY_FINAL="$SPACE_KEY" \
 PAGE_JSON_RAW="$PAGE_JSON" \
 python3 - <<'PY'
-import json, os, re, datetime, html
+import json, os, re, sys, datetime, html
 from html.parser import HTMLParser
 
 raw = os.environ["PAGE_JSON_RAW"]
-data = json.loads(raw)
+try:
+    data = json.loads(raw)
+except ValueError:
+    # A 200 with an HTML body is an SSO login page or a proxy, not the page.
+    sys.stderr.write("ERR: Confluence GET for pageId=%s returned a non-JSON body (login page or proxy?)\n"
+                     % os.environ.get("PAGE_ID_FINAL", ""))
+    sys.exit(3)
 
 storage = ((data.get("body") or {}).get("storage") or {}).get("value") or ""
 title = data.get("title") or "<untitled>"