@mmerterden/multi-agent-pipeline 16.5.0 → 16.7.0

package/pipeline/scripts/feedback-send.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+// feedback-send.mjs  -  send one user-written feedback message to the
+// maintainer's admin panel.
+//
+// WHAT IS SENT: the text the user typed, and nothing else that the user did not
+// type. No logs, no repo names, no branch names, no file paths, no diffs, no
+// prompts. The only fields this script adds are the ones the maintainer cannot
+// act on the report without: which pipeline version it came from, which host
+// CLI, and when.
+//
+// That restraint is the whole design. Attaching a run log would make a report
+// easier to act on and would also mean a corporate user's internal identifiers
+// leave their machine and land in someone else's database, from a package
+// anyone can install off npm. A person can paste the one line they think
+// matters; a script cannot know which line that is.
+//
+// Auth reuses the usage ingest token (`prefs.global.keychainMapping.usage_ingest`)
+// so nothing new has to be onboarded. Unlike usage telemetry, `optOut` does NOT
+// silence this: telemetry is passive collection, feedback is a deliberate act by
+// the person running the command, and silently dropping something a user chose
+// to send is worse than not offering the command.
+//
+// Usage:
+//   node feedback-send.mjs --text "<message>" [--kind bug|idea|question]
+//                          [--endpoint <url>] [--dry-run]
+//
+// Exit: 0 sent (or dry run), 1 nothing to send / rejected, 2 usage error.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const ENDPOINT_DEFAULT = "https://mmerterden.vercel.app/api/feedback/ingest";
+const TIMEOUT_MS = 8000;
+const TEXT_MAX = 4000;
+const KINDS = new Set(["bug", "idea", "question"]);
+
+function arg(name, fallback = null) {
+  const i = process.argv.indexOf(name);
+  return i === -1 ? fallback : (process.argv[i + 1] ?? fallback);
+}
+
+function readPrefs() {
+  const p = join(homedir(), ".claude", "multi-agent-preferences.json");
+  try {
+    return JSON.parse(readFileSync(p, "utf-8")).global ?? {};
+  } catch {
+    return {};
+  }
+}
+
+function packageVersion() {
+  for (const p of [
+    join(homedir(), ".claude", ".pipeline-version"),
+    join(homedir(), ".copilot", ".pipeline-version"),
+    join(homedir(), ".codex", ".pipeline-version"),
+  ]) {
+    try {
+      const v = readFileSync(p, "utf-8").trim();
+      if (v) return v;
+    } catch {
+      /* try the next host */
+    }
+  }
+  return "unknown";
+}
+
+// Which CLI the person is running. Useful because a report that only reproduces
+// on one host is a different bug from one that reproduces everywhere.
+function host() {
+  if (existsSync(join(homedir(), ".claude", ".pipeline-version"))) return "claude";
+  if (existsSync(join(homedir(), ".copilot", ".pipeline-version"))) return "copilot";
+  if (existsSync(join(homedir(), ".codex", ".pipeline-version"))) return "codex";
+  return "unknown";
+}
+
+function resolveToken() {
+  if (process.env.MULTI_AGENT_USAGE_TOKEN) return process.env.MULTI_AGENT_USAGE_TOKEN;
+  const g = readPrefs();
+  const inline = g.usageLog?.token;
+  if (typeof inline === "string" && inline.trim()) return inline.trim();
+  const name = g.keychainMapping?.usage_ingest;
+  if (typeof name === "string" && name.trim()) {
+    const store = join(homedir(), ".claude", "lib", "credential-store.sh");
+    if (existsSync(store)) {
+      try {
+        const out = execFileSync("bash", [store, "get", name.trim()], {
+          encoding: "utf-8",
+          timeout: 4000,
+          stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (out) return out;
+      } catch {
+        /* keychain unavailable */
+      }
+    }
+  }
+  return "";
+}
+
+// The token rides in a header, so http would put it on the wire in cleartext.
+// Same rule the usage sender follows: https anywhere, http only for loopback.
+function endpointAllowed(endpoint) {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(u.hostname);
+}
+
+async function main() {
+  const text = String(arg("--text", "") ?? "").trim();
+  if (!text) {
+    process.stderr.write('usage: feedback-send.mjs --text "<message>" [--kind bug|idea|question]\n');
+    process.exit(2);
+  }
+  if (text.length > TEXT_MAX) {
+    process.stderr.write(`ERROR: message is ${text.length} chars; the cap is ${TEXT_MAX}\n`);
+    process.exit(2);
+  }
+
+  const kindRaw = String(arg("--kind", "bug") ?? "bug").toLowerCase();
+  const kind = KINDS.has(kindRaw) ? kindRaw : "bug";
+  const endpoint = String(arg("--endpoint", ENDPOINT_DEFAULT) ?? ENDPOINT_DEFAULT);
+
+  const payload = {
+    text,
+    kind,
+    v: packageVersion(),
+    host: host(),
+    at: new Date().toISOString(),
+  };
+
+  if (process.argv.includes("--dry-run")) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    process.exit(0);
+  }
+
+  if (!endpointAllowed(endpoint)) {
+    process.stderr.write(`ERROR: refusing to send over a non-TLS endpoint: ${endpoint}\n`);
+    process.exit(1);
+  }
+
+  const token = resolveToken();
+  if (!token) {
+    process.stderr.write(
+      "ERROR: no ingest token. Run /multi-agent:update once (it registers one) or /multi-agent:setup.\n",
+    );
+    process.exit(1);
+  }
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Usage-Token": token },
+      body: JSON.stringify(payload),
+      signal: ctrl.signal,
+    });
+    if (!res.ok) {
+      // Unlike telemetry, this failure is reported: the person is standing there
+      // waiting to hear whether their message went. Swallowing it would leave
+      // them believing they had been heard.
+      process.stderr.write(`ERROR: the endpoint answered ${res.status}\n`);
+      process.exit(1);
+    }
+    process.stdout.write("feedback sent\n");
+  } catch (err) {
+    process.stderr.write(`ERROR: could not reach the endpoint (${err.name})\n`);
+    process.exit(1);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+main();

package/pipeline/scripts/validate-analysis-doc.mjs

@@ -42,7 +42,9 @@
 
 import { readFileSync } from "node:fs";
 
-const KNOWN_PLATFORMS = new Set(["ios", "android", "backend", "frontend"]);
+// "none" is the stack-optional render (Locked 35): a document produced before
+// any repo was chosen. It is a real platform value, not a missing one.
+const KNOWN_PLATFORMS = new Set(["ios", "android", "backend", "frontend", "none"]);
 const REQUIRED_FM = ["feature", "platform", "language", "mode", "template_version"];
 
 // Never-omitted sections (Locked 2), matched by bilingual title keyword so the
@@ -58,6 +60,26 @@ const REQUIRED_SECTIONS = [
   { key: "references", any: ["References", "Referanslar"] },
 ];
 
+// Corporate profile backbone (Locked 33). These render even with zero evidence,
+// carrying N/A or EKLENECEK, so their absence is a structural failure rather
+// than a legitimate omission.
+const CORPORATE_SECTIONS = [
+  { key: "purpose and scope", any: ["Amaç ve Kapsam", "Amac ve Kapsam", "Purpose and Scope"] },
+  { key: "business analysis", any: ["İş Analizi", "Is Analizi", "Business Analysis"] },
+  { key: "business requirements", any: ["İş Gereksinimleri", "Is Gereksinimleri", "Business Requirements"] },
+  { key: "ai requirements", any: ["Yapay Zeka", "AI Requirements"] },
+  { key: "use cases", any: ["Kullanım Senaryoları", "Kullanim Senaryolari", "Use Cases"] },
+  { key: "hardware and infrastructure", any: ["Donanım", "Donanim", "Hardware"] },
+  { key: "quality requirements", any: ["Kalite Gereksinimleri", "Quality Requirements"] },
+  { key: "regulatory requirements", any: ["Regülasyonel", "Regulasyonel", "Regulatory"] },
+  { key: "content requirements", any: ["İçerik Gereksinimleri", "Icerik Gereksinimleri", "Content Requirements"] },
+  { key: "risks", any: ["Riskler", "Risks"] },
+  { key: "references", any: ["Referanslar", "References"] },
+];
+
+// Sections that need a target repository. Dropped by the stack-optional render.
+const REPO_DEPENDENT_KEYS = new Set(["architecture", "files to add"]);
+
 // Humanizer punctuation policy (Locked 7) - banned codepoints.
 const BANNED_PUNCT = [
   { ch: "—", name: "em-dash" },
@@ -163,6 +185,11 @@ function main() {
     }
   }
   const mode = parsed?.fm?.mode || "full";
+  const profile = (parsed?.fm?.profile || "global").toLowerCase();
+  if (profile !== "global" && profile !== "corporate") {
+    errors.push(`front-matter profile must be global|corporate, got: ${profile}`);
+  }
+  const noPlatform = (parsed?.fm?.platform || "") === "none";
 
   // 2. Never-omitted sections (by heading keyword)
   // Numbered section headings only. Layer headings (`# Bölüm B - Teknik Analiz`)
@@ -173,9 +200,94 @@ function main() {
     .filter((l) => /^#{2,3}\s+\d+(\.\d+)*\.?\s/.test(l))
     .map((l) => l.replace(/^#{2,3}\s/, "").trim());
   const headingBlob = headings.join("\n");
-  for (const sec of REQUIRED_SECTIONS) {
+  const requiredSections = (profile === "corporate" ? CORPORATE_SECTIONS : REQUIRED_SECTIONS)
+    // The development layer is legitimately absent when no repo was selected,
+    // so requiring it there would fail every stack-optional document.
+    .filter((sec) => !(noPlatform && REPO_DEPENDENT_KEYS.has(sec.key)));
+  const rule = profile === "corporate" ? "Locked 33" : "Locked 2";
+  for (const sec of requiredSections) {
     if (!sec.any.some((kw) => headingBlob.includes(kw))) {
-      errors.push(`missing required section (Locked 2): ${sec.key}`);
+      errors.push(`missing required section (${rule}): ${sec.key}`);
+    }
+  }
+
+  // 2a. Corporate profile: every EKLENECEK owes an open question.
+  //
+  // A placeholder with nobody assigned to resolve it is how "to be filled in"
+  // reaches production. The pairing is what makes the backbone guarantee worth
+  // having: the section renders, AND the gap it admits to is tracked.
+  if (profile === "corporate") {
+    const lines = text.split("\n");
+    const risksStart = lines.findIndex((l) =>
+      /^#{2,3}\s+\d+/.test(l) && /(Riskler|Risks)/.test(l),
+    );
+    let risksBlock = "";
+    if (risksStart !== -1) {
+      for (let i = risksStart + 1; i < lines.length; i++) {
+        if (/^#{2,3}\s+\d+/.test(lines[i])) break;
+        risksBlock += `${lines[i]}\n`;
+      }
+    }
+    let currentSection = null;
+    const unpaired = new Set();
+    for (let i = 0; i < lines.length; i++) {
+      const m = lines[i].match(/^#{2,4}\s+(\d+(?:\.\d+)*)\.?\s/);
+      if (m) currentSection = m[1];
+      if (!lines[i].includes("EKLENECEK")) continue;
+      if (risksStart !== -1 && i > risksStart) continue;
+      if (!currentSection) continue;
+      // The number has to stand alone: substring matching would let section "2"
+      // be satisfied by a "2.3" in some other row, and "9" by a "19". The
+      // trailing guard rejects a following digit and a following ".<digit>",
+      // but NOT a sentence-ending period - "etkilediği bölüm 9." is a real
+      // pairing, and rejecting it would block a correct document.
+      const token = new RegExp(
+        `(^|[^\\d.])${currentSection.replace(/\./g, "\\.")}(?!\\d|\\.\\d)`,
+        "m",
+      );
+      if (!token.test(risksBlock)) unpaired.add(currentSection);
+    }
+    for (const sec of unpaired) {
+      errors.push(
+        `section ${sec} carries EKLENECEK but no Risks and Open Questions row references it (Locked 33)`,
+      );
+    }
+
+    // The traceability matrix is the most expensive thing in the document to get
+    // wrong, because every downstream reader trusts it instead of re-deriving
+    // the IG -> UC -> FG chain themselves. A matrix that merely exists is not
+    // the claim worth making; a matrix that agrees with the sections is.
+    const MATRIX_HEADING = /(İzlenebilirlik Matrisi|Izlenebilirlik Matrisi|Traceability Matrix)/;
+    if (mode === "full") {
+      const matrixStart = lines.findIndex((l) => /^#{2,4}\s/.test(l) && MATRIX_HEADING.test(l));
+      if (matrixStart === -1) {
+        errors.push("corporate Full mode requires the requirement traceability matrix (Locked 33)");
+      } else {
+        let matrixBlock = "";
+        for (let i = matrixStart + 1; i < lines.length; i++) {
+          if (/^#{2,4}\s/.test(lines[i])) break;
+          matrixBlock += `${lines[i]}\n`;
+        }
+        // Everything outside the matrix is where ids are defined and used.
+        const outside = lines.slice(0, matrixStart).join("\n");
+
+        for (const prefix of ["IG", "UC", "FG"]) {
+          const idRe = new RegExp(`\\b${prefix}-\\d{2,3}\\b`, "g");
+          const defined = new Set(outside.match(idRe) || []);
+          const inMatrix = new Set(matrixBlock.match(idRe) || []);
+
+          for (const id of defined) {
+            if (!inMatrix.has(id)) {
+              errors.push(`${id} is defined in the document but missing from the traceability matrix`);
+            }
+          }
+          for (const id of inMatrix) {
+            if (!defined.has(id)) {
+              errors.push(`${id} appears in the traceability matrix but is defined nowhere else`);
+            }
+          }
+        }
+      }
     }
   }
 
@@ -206,9 +318,13 @@ function main() {
     }
   }
 
-  // 2c. Section 15 is Phase 3's RED input (phase-3-dev.md step 5b): the tests
+  // 2c. The Test Plan is Phase 3's RED input (phase-3-dev.md step 5b): the tests
   // written first come from it. Full mode without it hands dev an empty matrix.
-  if (mode === "full") {
+  // It is Section 15 in the global profile and Section 19 in the corporate one;
+  // the check matches on the title, so only the stack-optional case needs an
+  // exemption - there the whole development layer is legitimately absent
+  // (Locked 35) and there is no repo for a test to run against yet.
+  if (mode === "full" && !noPlatform) {
     const hasTestPlan = ["Test Planı", "Test Plani", "Test Plan"].some((kw) =>
       headingBlob.includes(kw),
     );
@@ -244,7 +360,9 @@ function main() {
   const hasMermaid = /^\s*```mermaid/m.test(text);
   if (hasFlowSection && !hasMermaid) {
     errors.push("Section 3 is rendered but carries no mermaid block");
-  } else if (!hasFlowSection && mode === "full") {
+  } else if (!hasFlowSection && mode === "full" && profile === "global") {
+    // The corporate profile numbers Section 3 as Business Requirements and puts
+    // its diagrams under 5.(N+1), so "no Section 3 flow chart" is meaningless there.
     warns.push(
       "no Section 3 flow chart; legitimate only for a single screen with a single service and a simple rule",
     );
@@ -319,8 +437,11 @@ function main() {
     }
   }
 
-  // 4. Placeholder whole-section bodies (Locked 2)
-  if (/^\s*(TBD|Not applicable|N\/A)\s*$/im.test(text)) {
+  // 4. Placeholder whole-section bodies (Locked 2).
+  // Not a defect in the corporate profile: there N/A and EKLENECEK are how a
+  // backbone section reports "considered, nothing to state" (Locked 33), and the
+  // EKLENECEK-to-open-question pairing above is what keeps them honest.
+  if (profile === "global" && /^\s*(TBD|Not applicable|N\/A)\s*$/im.test(text)) {
     warns.push(
       'a line is a bare "TBD"/"Not applicable"/"N/A" body; omit the section instead (Locked 2)',
     );
@@ -335,7 +456,7 @@ function main() {
       const key = id.toUpperCase();
       counts.set(key, (counts.get(key) || 0) + 1);
     }
-    if (counts.size === 0) {
+    if (counts.size === 0 && profile === "global") {
       warns.push("Full mode but no BR-<slug>-NN business-rule ids found (Section 4.4 / Locked 31)");
     }
     for (const [id, n] of counts) {

package/pipeline/scripts/website-deploy-commit.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+#
+# website-deploy-commit.sh  -  commit and push the website sync under the identity
+# the deploy platform will actually build, then prove the build happened.
+#
+# Why this is a script and not three lines in the sync doc: the deploy platform
+# refuses to build a commit whose author is not a contributor on the project. The
+# push still succeeds, the deployment is created and sits at UNKNOWN with a 0ms
+# build (API `readyState: BLOCKED`), and the live site keeps serving the previous
+# version. v16.4.0 and v16.5.0 were both pushed that way and neither was built,
+# while the sync reported the website as synced both times.
+#
+# Usage:
+#   website-deploy-commit.sh <identity-name> <identity-email> <version> [repo-dir]
+#
+# Env:
+#   WEBSITE_SYNC_NO_PUSH=1     commit and verify locally, never push (smoke/dry-run)
+#   WEBSITE_SYNC_NO_VERIFY=1   skip the deployment check (offline, or no CLI)
+#   WEBSITE_SYNC_WAIT=<sec>    how long to wait for a Ready build (default 45)
+#
+# Exit: 0 committed+pushed (or nothing to do), 1 wrong author (nothing pushed),
+#       2 usage or environment, 3 pushed but no Ready production build.
+
+set -uo pipefail
+
+NAME="${1:-}"
+EMAIL="${2:-}"
+VERSION="${3:-}"
+DIR="${4:-$PWD}"
+
+if [ -z "$NAME" ] || [ -z "$EMAIL" ] || [ -z "$VERSION" ]; then
+  echo "usage: website-deploy-commit.sh <identity-name> <identity-email> <version> [repo-dir]" >&2
+  exit 2
+fi
+
+# An empty fourth argument is a caller bug, not a request for the current
+# directory: falling back to $PWD there commits whatever repo the caller happens
+# to be standing in.
+[ -n "$DIR" ] || { echo "FAIL: empty repo directory argument" >&2; exit 2; }
+cd "$DIR" 2>/dev/null || { echo "FAIL: cannot enter $DIR" >&2; exit 2; }
+git rev-parse --git-dir >/dev/null 2>&1 || { echo "FAIL: $DIR is not a git repository" >&2; exit 2; }
+
+# Read before writing. The website clone's own config is usually already correct,
+# and overwriting it with whatever identity the caller passed is the failure mode
+# this guard exists to prevent, not a convenience.
+[ "$(git config user.email || true)" = "$EMAIL" ] || git config user.email "$EMAIL"
+[ "$(git config user.name || true)" = "$NAME" ] || git config user.name "$NAME"
+
+git add -A
+if git diff --cached --quiet; then
+  echo "website: already in sync, nothing to commit"
+  exit 0
+fi
+
+git commit -q -m "chore: sync pipeline v${VERSION}" || { echo "FAIL: commit failed" >&2; exit 2; }
+
+# git config loses to an exported GIT_AUTHOR_EMAIL, so the recorded author is read
+# back off the commit itself. Anything else is a hope, not a check.
+ACTUAL="$(git log -1 --format=%ae)"
+if [ "$ACTUAL" != "$EMAIL" ]; then
+  echo "HALT: website commit authored by $ACTUAL, expected $EMAIL." >&2
+  echo "Nothing was pushed. Re-author it (git commit --amend --reset-author) and run this again;" >&2
+  echo "a commit the deploy platform does not recognise is accepted by the push and never built." >&2
+  exit 1
+fi
+
+if [ "${WEBSITE_SYNC_NO_PUSH:-0}" = "1" ]; then
+  echo "website: committed as $ACTUAL (push skipped)"
+  exit 0
+fi
+
+git push -q origin HEAD || { echo "FAIL: push rejected" >&2; exit 2; }
+echo "website: pushed v${VERSION} as $ACTUAL"
+
+# A push is not a deploy.
+if [ "${WEBSITE_SYNC_NO_VERIFY:-0}" = "1" ] || ! command -v vercel >/dev/null 2>&1 \
+  || [ ! -f "$DIR/.vercel/project.json" ]; then
+  echo "website: deployment not verified (no CLI or verification skipped)"
+  exit 0
+fi
+
+WAIT="${WEBSITE_SYNC_WAIT:-45}"
+ELAPSED=0
+while [ "$ELAPSED" -lt "$WAIT" ]; do
+  # `vercel ls` prints its table on STDERR, not stdout. Discarding stderr threw
+  # away the very rows this grep reads, so ROW was always empty and the check
+  # reported "no Ready production build" on every run - including the ones that
+  # deployed fine. A guard that cannot pass is worse than no guard: it trains
+  # the reader to ignore the one message meant to catch a real failure.
+  ROW="$(vercel ls --yes 2>&1 | grep -m1 'Production' || true)"
+  case "$ROW" in
+    *Ready*) echo "website: production build Ready"; exit 0 ;;
+    *Error*) break ;;
+  esac
+  sleep 5
+  ELAPSED=$((ELAPSED + 5))
+done
+
+echo "website: no Ready production build after ${WAIT}s -> ${ROW:-no deployment listed}" >&2
+echo "UNKNOWN with a 0ms build means the commit author was rejected: fix the author and push again," >&2
+echo "or deploy from the CLI with: (cd \"$DIR\" && vercel --prod --yes)" >&2
+exit 3

package/pipeline/skills/shared/core/multi-agent-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multi-agent-analysis
 language: en
-description: "Standalone feature-spec analysis (v3 template). Platform-agnostic concept layer with repo-driven convention extraction and per-platform Pass B render. 23 sections in Full mode; 8 of them in Lite mode (auto for small features). Collects Figma / Swagger / Confluence / Jira / Standards / Firebase / repo inputs, then stops. Does not chain into dev or create branches. Use when a feature needs a written specification before any code, from Figma, Swagger, Confluence, Jira or repo inputs."
+description: "Standalone feature-spec analysis. Two profiles picked at intake: global (23-section development handoff, 8 of them in Lite mode) or corporate (IG/UC/FG requirements document with traceability matrices). Platform-agnostic concept layer with repo-driven convention extraction and per-platform Pass B render; stack selection is optional. Collects Figma / Swagger / Confluence / Jira / Standards / Firebase / repo inputs, then stops. Does not chain into dev or create branches. Use when a feature needs a written specification before any code."
 user-invocable: true
 argument-hint: "[\"<analysis-name>\"] [--lite | --full] [--no-cache] [--preview-conventions]"
 ---
@@ -20,6 +20,21 @@ Produces a stakeholder-ready, platform-agnostic feature-spec document set (one m
 - To refresh a stale Confluence spec page
 - For API-only work (no Figma) or frontend-only work (no API) - the omission rule keeps the output clean
 
+## Profile
+
+Phase 0 Step 1b picks the analysis standard, and that selects the template. Both profiles read the same evidence; only the projection differs, which is what keeps them from drifting into two products.
+
+| Profile | Template | Shape |
+|---|---|---|
+| `global` (default) | `analysis-template.md` | Development handoff. Business rules with Gherkin acceptance criteria, architecture, files, tests. Zero-evidence sections drop. |
+| `corporate` | `analysis-template-corporate.md` | Requirements document. `IG -> UC -> FG` spine with three traceability matrices, current and target state with impact analysis, then technical and development analysis. The Part A backbone always renders, carrying `N/A` or `EKLENECEK`, and each `EKLENECEK` owes an open-question row. |
+
+One run emits one profile. A missing input never blocks either: the gap is written as `EKLENECEK` and raised as an open question instead of halting the run.
+
+**Stack is optional.** With no platform selected the run still completes: everything that does not need a target repository renders in full, only the development layer and the Pass B projection are skipped, and the output is a single file at `~/Desktop/multiAgentAnalysis/<feature-name>/<feature>.md` (never the current working directory, which for a repo-less run is arbitrary).
+
+**References are built, not written.** `build-references.mjs` projects `state.analysisSpec.evidence.*` into Section 21, carrying a precision anchor per row (Figma node id, Confluence pageId plus version, repo commit sha) and an access cell, so a source that could not be fetched is listed as unreachable rather than dropped. A coverage gate blocks dispatch on a consumed-but-unlisted source and on an invented row.
+
 ## Template (v3)
 
 Full mode renders 23 sections (Glossary, Changelog, References). Lite mode renders 7 sections (Summary, Goals + Non-Goals, User Stories, API Contracts, Architecture, Files to Add, References) and auto-activates for small features via three scored signals; `--lite` / `--full` flags always win.
@@ -44,7 +59,8 @@ When the rendered Section 20 (Risks and Open Questions) has open rows, the repor
 ## Detailed implementation
 
 Full steps: `$HOME/.claude/commands/multi-agent/analysis/SKILL.md`.
-Template master copy: `$HOME/.claude/multi-agent-refs/analysis-template.md`.
+Template master copies: `$HOME/.claude/multi-agent-refs/analysis-template.md` (global) and `$HOME/.claude/multi-agent-refs/analysis-template-corporate.md` (corporate).
+References builder: `$HOME/.claude/scripts/build-references.mjs`.
 Schema: `$HOME/.claude/schemas/analysis-spec.schema.json`.
 Convention extractor: `$HOME/.claude/lib/extract-conventions.sh` (output contract: `$HOME/.claude/schemas/conventions-output.schema.json`).
 

package/pipeline/skills/shared/core/multi-agent-feedback/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: multi-agent-feedback
+language: en
+description: "Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows the payload and asks before sending. Use when a run went wrong and the maintainer should know."
+user-invocable: true
+argument-hint: "\"<message>\" [bug | idea | question]  -  with no argument, you are asked for the text"
+---
+
+# multi-agent feedback  -  tell the maintainer
+
+**Input**: $ARGUMENTS
+
+One message to the maintainer's admin panel. It exists because the alternative is a problem nobody hears about: a run goes wrong, the person works around it, and the defect is still there a month later.
+
+## What is sent
+
+Only the text you type, plus `kind` (bug / idea / question), the installed pipeline version, which host CLI, and the timestamp.
+
+**No logs are attached, ever** - not the agent log, the diff, the repo name, the branch, or a file path. This package installs from a public registry, so an automatic log attachment would take a corporate user's internal identifiers off their machine into someone else's database. Paste the one line you think matters; a script cannot know which line that is.
+
+## Flow
+
+1. Take the message from `$ARGUMENTS`; with no argument, ask for the text and then the kind.
+2. Print the exact payload via the script's own dry run, so what is shown is what goes:
+   `node "$HOME/.copilot/scripts/feedback-send.mjs" --text "<message>" --kind <kind> --dry-run`
+3. **Confirm before sending.** Nothing leaves the machine before a yes; autopilot does not exempt this, because a message to a person is never fired unattended.
+4. Send the same command without `--dry-run`.
+5. Report the outcome plainly. A failure is surfaced, not swallowed - the person is waiting to hear whether their message went.
+
+Auth reuses the usage ingest token, so nothing extra is onboarded. `usageLog.optOut` does not silence this: telemetry is passive collection, feedback is a deliberate act. The endpoint must be TLS; only loopback is exempt.

package/pipeline/skills/shared/core/multi-agent-review-analysis/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: multi-agent-review-analysis
+language: en
+description: "Review a written analysis document instead of a diff: resolve it from a path, a Confluence page or a Jira issue, run the deterministic gates first, then a parallel model review. Findings cite the Locked rule they break. Never edits the document. Use when an analysis needs judging before development starts."
+user-invocable: true
+argument-hint: "[path | Confluence URL | pageId | JIRA-KEY] [--state <state.json>]  -  optional; with no argument, pick from recent analyses"
+---
+
+# multi-agent review-analysis  -  analysis document review
+
+**Input**: $ARGUMENTS
+
+`multi-agent-review` judges a diff. This judges the document that diff was supposed to come from, before the code exists. No worktree, no branch, no commit, and the reviewed document is never edited in place.
+
+## Flow
+
+Read `$HOME/.copilot/multi-agent-refs/analysis/review.md` and execute it:
+
+1. **Resolve** from a local path, a Confluence URL or `pageId`, or a Jira key. No argument -> pick from recent analyses in `~/Desktop/multiAgentAnalysis/` and each repo's `analysis/`.
+2. **Deterministic gates first**, output reported verbatim before any model reads the document:
+   `validate-analysis-doc.mjs <doc>`, and `build-references.mjs <state> --check <doc>` when a state JSON is available.
+3. **Parallel model review** against the rubric: buildability, evidence, spine, altitude, admitted gaps, contradiction.
+4. **Triage** into Blocker / Important / Suggestion.
+5. **Report** the profile it judged against and, explicitly, what was NOT checked.
+6. **Output** on request: chat (default), Confluence comment, Jira comment, or a `-review.md` beside the document.
+
+Findings cite `Locked <n>` where one applies, so the author gets a rule and a fix rather than a preference. Anything with no rule behind it is marked as judgement.
+
+## What it never does
+
+Edits the reviewed document (that is `multi-agent-analysis-resolve`), touches a Jira description or a Confluence page body, chains into a dev run, branches, or commits.

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -31,7 +31,7 @@ Run all steps automatically:
 
 ```
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 51 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 53 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 51 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -98,7 +98,7 @@ If nothing is stale -> report "All targets up to date" and stop.
 ## Codex Sync (Step 2b)
 
 This step does **not** hand-copy files. The Codex tree is a *transform* of the Claude
-tree, not a mirror: the 51 sub-command specs become reference files (Codex silently
+tree, not a mirror: the 53 sub-command specs become reference files (Codex silently
 truncates its skills block  -  see `cross-cli-contract.md` 2.6), every reference to a
 CLI-owned tree is retargeted (`agents/<persona>.md` becomes `.toml`, the dispatcher
 becomes the router skill), the 8 personas are regenerated as TOML with a model +
@@ -175,7 +175,7 @@ npm publish --userconfig "$NPMRC"
 
 ## Website Sync (Step 4)
 
-Propagate the pipeline version, phase count, model count, and feature descriptions to the website.
+Propagate version, phase and model counts and feature descriptions to the website.
 
 ```bash
 gh auth switch --user {owner}
@@ -190,9 +190,10 @@ cd "$WEBSITE_DIR" && git pull origin main
 | `src/data/projects.ts` | Version number, tagline, description, feature list |
 
 ```bash
-cd "$WEBSITE_DIR"
-git add -A && git commit -m "chore: sync pipeline v{VERSION}"
-git push origin main  # Vercel auto-deploy
+# A commit the platform does not recognise is pushed fine and never built, so the site
+# keeps the old version. {identity} is the one routed to {owner}, not the run's own.
+# Why, signature, recovery: `$HOME/.claude/multi-agent-refs/website-deploy.md`.
+bash "$HOME/.claude/scripts/website-deploy-commit.sh" "{identity.name}" "{identity.email}" "{VERSION}" "$WEBSITE_DIR"
 ```
 
 
@@ -208,7 +209,7 @@ When invoked with the `release` argument:
 5. Commit + TAG  git commit + git tag v{VERSION}
 6. PUSH          git push --tags -> release.yml auto-publish
 7. DEV-TOOLKIT   Ship the companion MCP server if it moved (Step 3d gates, then publish)
-8. WEBSITE       Version + features -> {website-host}
+8. WEBSITE       Version + features -> {website-host} (maintainer identity, build verified Ready)
 9. COPILOT       Copilot CLI instructions + skills sync
 9b. CODEX        Codex CLI router skill + refs + agent TOML (node install.js --codex)
 10. Report       Summary: version, touched repos, deploy status
@@ -223,15 +224,18 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**51 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**53 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
-analysis, analysis-resolve, autopilot, build-optimize, channels, complaint-analysis, create-jira, design-check, dev,
-dev-autopilot, dev-local, dev-local-autopilot, diff-explain, forget, garbage-collect,
-help, ios-coding-standard, issue, jira, kill, language, local,
-local-autopilot, log, manual-test, prune-logs, prune-prompts, purge, refactor, resume, review, review-issue, review-jira,
-routines, save, scan, search, setup, resume-local, stack, status, store-ready, sync, test, test-accessibility,
-test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation, uninstall, update
+analysis, analysis-resolve, autopilot, build-optimize, channels,
+complaint-analysis, create-jira, design-check, dev, dev-autopilot, dev-local,
+dev-local-autopilot, diff-explain, feedback, forget, garbage-collect, help,
+ios-coding-standard, issue, jira, kill, language, local, local-autopilot,
+log, manual-test, prune-logs, prune-prompts, purge, refactor, resume,
+resume-local, review, review-analysis, review-issue, review-jira, routines,
+save, scan, search, setup, stack, status, store-ready, sync, test,
+test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
+testflight-validation, uninstall, update
 ```
 
 **NOT synced**: `refs/*`  -  Lazy-load references, Claude Code specific