@mmerterden/multi-agent-pipeline 16.6.0 → 16.7.0

package/CHANGELOG.md

@@ -26,6 +26,20 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 - **`smoke-website-deploy-identity.sh` (20 assertions).** It runs the script against throwaway repos with real remotes rather than grepping the doc: the happy path lands and pushes, an exported `GIT_AUTHOR_EMAIL` halts with the commit still local, an unchanged tree makes no empty commit, a matching config is preserved while a wrong name is corrected, and missing or non-repository arguments exit 2. Wiring is asserted separately, since a correct script nothing calls is its own failure mode.
 
+## [16.7.0] - 2026-08-25
+
+Two commands: one that reviews the document instead of the diff, one that lets a user say something went wrong.
+
+### Added
+
+- **`/multi-agent:review-analysis`** reviews a written analysis the way `/multi-agent:review` reviews a diff. It resolves the document from a local path, a Confluence page or a Jira issue, runs the deterministic gates FIRST and reports their output verbatim (`validate-analysis-doc.mjs`, and `build-references.mjs --check` when a state JSON is available), then runs the parallel model review and triage. Findings cite `Locked <n>` where a rule applies, because "I would have written this differently" gives an author nothing to act on while "Locked 34: this Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason; anything with no rule behind it is marked as judgement rather than dressed up as a violation. The verdict states what was NOT checked - without a state file the references coverage claim is exactly the one nobody can verify from the document alone. It never edits the reviewed document: that belongs to its author, and a reviewer who rewrites it has removed the choice to disagree. `/multi-agent:analysis-resolve` remains the command that folds answers back in.
+- **`/multi-agent:feedback "<message>"`** sends one message to the maintainer. **Only the text the user types is sent** - plus the pipeline version, the host CLI and a timestamp, which a report is useless without. No logs, no repo names, no branch names, no file paths, no diffs. That limit is deliberate: this package installs from a public registry, so an automatic log attachment would take a corporate user's internal identifiers off their machine and into someone else's database. A person can paste the one line that matters; a script cannot know which line that is. The exact payload is printed before anything is sent and nothing leaves the machine without a confirmation, autopilot included - a message to a person is never fired unattended. Auth reuses the usage ingest token, so nothing new is onboarded; `usageLog.optOut` does not silence it, because telemetry is passive collection while this is a deliberate act, and silently dropping something somebody chose to send is worse than not offering the command. A send failure is reported rather than swallowed: the person is waiting to hear whether their message went.
+
+### Changed
+
+- **The analysis context-budget gate measures the refs the command declares, not a directory glob.** `multi-agent-refs/analysis/` also holds sibling-command refs - `resolve.md` belongs to `:analysis-resolve`, `review.md` to `:review-analysis` - and an analysis run loads neither, so the glob billed every run for files it never reads. The ceiling goes back to 145000 (from the 155000 v16.6.0 set): with the measurement corrected the real per-run cost is 139672, and that raise had been compensating for the glob rather than for anything the tree costs. A ceiling raised to fit a wrong number stops being a budget. Adding a ref to the analysis command now counts automatically; adding one for a sibling command does not.
+- The command surface is 53. Both new commands carry their `shared/core` counterpart for Copilot and Codex, and the canonical inventory in `cross-cli-contract.md` and both sync skills lists them - `smoke-command-inventory.sh` fails on any of those going stale, and did, which is how the gap was found rather than shipped.
+
 ## [16.6.0] - 2026-08-25
 
 Two analysis standards, one evidence record, and a references section that is built rather than remembered.

package/README.md

@@ -77,7 +77,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 | Audit | `/multi-agent:design-check` | Mock-mode vs Figma conformance, local-only |
 | Audit | `/multi-agent:testflight-validation` | Pre-submission gates for a TestFlight build: static archive audit → Apple's `altool --validate-app` → Review-Guidelines check. Validates only, never uploads |
 
-Helpers: `setup`, `status`, `resume #N`, `kill #N`, `garbage-collect`, `prune-logs`, `purge`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. 51 commands in all  -  full list: `/multi-agent:help`.
+Helpers: `setup`, `status`, `resume #N`, `kill #N`, `garbage-collect`, `prune-logs`, `purge`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. 53 commands in all  -  full list: `/multi-agent:help`.
 
 ## Stacks
 
@@ -91,13 +91,13 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 51 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 53 commands.
 
 | Tool | Flag | What it installs |
 |---|---|---|
 | Claude Code | `--claude` (default) | slash commands + skills + agents + `PreToolUse` secret-scan hook |
-| Copilot CLI | `--copilot` | instructions + 51 sub-command skills + scripts |
-| Codex CLI | `--codex` | one router skill + 51 specs as refs + 8 agent TOML + `AGENTS.md` block + `codex mcp add` |
+| Copilot CLI | `--copilot` | instructions + 53 sub-command skills + scripts |
+| Codex CLI | `--codex` | one router skill + 53 specs as refs + 8 agent TOML + `AGENTS.md` block + `codex mcp add` |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 

package/README.tr.md

@@ -76,7 +76,7 @@ Bunun arkasındaki disiplin - sınırlı loop'lar, kanıt kapıları, token-büt
 | Audit | `/multi-agent:design-check` | Mock-mode vs Figma uygunluğu, yalnızca lokal |
 | Audit | `/multi-agent:testflight-validation` | TestFlight build için pre-submission kapıları: statik archive denetimi → Apple'ın `altool --validate-app`'i → Review-Guidelines kontrolü. Yalnızca doğrular, asla yüklemez |
 
-Yardımcılar: `setup`, `status`, `resume #N`, `kill #N`, `garbage-collect`, `prune-logs`, `purge`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. Toplam 51 komut - tam liste: `/multi-agent:help`.
+Yardımcılar: `setup`, `status`, `resume #N`, `kill #N`, `garbage-collect`, `prune-logs`, `purge`, `review`, `test`, `channels`, `stack`, `update`, `sync`, `refactor`, `jira`, `issue`, `analysis`, `create-jira`, `save`, `routines`, `forget`. Toplam 53 komut - tam liste: `/multi-agent:help`.
 
 ## Stack'ler
 
@@ -90,13 +90,13 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 51 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 53 komutu alır.
 
 | Araç | Bayrak | Ne kurar |
 |---|---|---|
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + `PreToolUse` secret-scan hook'u |
-| Copilot CLI | `--copilot` | talimatlar + 51 alt-komut skill'i + script'ler |
-| Codex CLI | `--codex` | bir router skill + ref olarak 51 spec + 8 agent TOML + `AGENTS.md` bloğu + `codex mcp add` |
+| Copilot CLI | `--copilot` | talimatlar + 53 alt-komut skill'i + script'ler |
+| Codex CLI | `--codex` | bir router skill + ref olarak 53 spec + 8 agent TOML + `AGENTS.md` bloğu + `codex mcp add` |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 

package/docs/architecture.md

@@ -117,7 +117,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>51 command files]
+        CMD[commands/<br/>53 command files]
         AGT[agents/<br/>8 agent personas]
         RUL[rules/<br/>12 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -170,7 +170,7 @@ revisions of this diagram - Codex CLI and the two independently-shipped repos
 graph TD
     CC["Claude Code<br/>(source of truth)"]
     COP["Copilot CLI<br/>(instructions + 51 skills)"]
-    COD["Codex CLI<br/>(1 router skill + 51 refs)"]
+    COD["Codex CLI<br/>(1 router skill + 53 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(5 stack plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 8-phase flow, the 51 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 8-phase flow, the 53 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 5 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 80 MCP tools across 6 categories (simulator/emulator control, accessibility audit, store compliance, web automation, Figma-vs-mock design audit, an agent-DSL batch runner) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["8 phases · 51 commands"]
+        PHASES["8 phases · 53 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -64,8 +64,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>51 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 51 refs<br/>+ 8 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>53 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 53 refs<br/>+ 8 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -153,7 +153,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 51 slash-command skills, native | 51 skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 51 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 53 slash-command skills, native | 53 skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 53 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.6.0",
+  "version": "16.7.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/feedback/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: "Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows the payload and asks before sending."
+description-tr: "Bakımcıya tek mesaj gönderir: hata, fikir ya da soru. Yalnızca yazdığın metin gider - log yok, repo adı yok, yol yok. Göndermeden önce içeriği gösterip onay ister."
+argument-hint: "\"<message>\" [bug | idea | question]  -  with no argument, you are asked for the text"
+---
+
+# multi-agent feedback  -  tell the maintainer
+
+**Input**: $ARGUMENTS
+
+One message, sent to the maintainer's admin panel. This exists because the alternative is a problem nobody hears about: a run goes wrong, the person shrugs and works around it, and the same defect is still there a month later.
+
+## What is sent
+
+**Only the text you type**, plus three fields the report is useless without:
+
+| Field | Why |
+|---|---|
+| `text` | What you wrote. Verbatim, up to 4000 characters. |
+| `kind` | `bug`, `idea` or `question`. |
+| `v` | The installed pipeline version - a report against 16.4 and one against 16.6 are different reports. |
+| `host` | Claude Code, Copilot CLI or Codex CLI - a bug that only reproduces on one host is a different bug. |
+| `at` | When you sent it. |
+
+**No logs are attached, ever.** Not the agent log, not the diff, not the repo name, not the branch, not a file path. That is a deliberate limit rather than an oversight: this package installs from a public registry, so an automatic log attachment would take a corporate user's internal identifiers off their machine and into someone else's database. You can paste the one line you think matters - a script cannot know which line that is, so it does not guess.
+
+## Flow
+
+1. Take the message from `$ARGUMENTS`. With no argument, ask for it (free text) and then ask the kind.
+2. **Print the exact payload that will be sent**, as JSON, using the script's own dry run so what is shown is what goes:
+
+   ```bash
+   node "$HOME/.claude/scripts/feedback-send.mjs" --text "<message>" --kind <kind> --dry-run
+   ```
+
+3. **Ask for confirmation.** Nothing leaves the machine before a yes. This is an outward-facing action and the pipeline confirms those; showing the payload first is what makes the yes meaningful. Autopilot does not exempt this - a message to a person is never something to fire unattended.
+4. Send:
+
+   ```bash
+   node "$HOME/.claude/scripts/feedback-send.mjs" --text "<message>" --kind <kind>
+   ```
+
+5. Report the result plainly. A failure is surfaced, not swallowed: the person is waiting to hear whether their message went, and silence would leave them believing they had been heard.
+
+## Auth and reachability
+
+Reuses the usage ingest token (`prefs.global.keychainMapping.usage_ingest`), so nothing extra has to be onboarded - `/multi-agent:update` registers one on first run. With no token, the command says so and names the command that fixes it rather than failing quietly.
+
+`usageLog.optOut` does **not** silence this. Telemetry is passive collection and opting out of it is a real choice; feedback is a deliberate act by the person typing the command, and dropping a message somebody chose to send would be worse than not offering the command at all.
+
+The endpoint must be TLS. The token rides in a header, so plain http would put it on the wire in cleartext; only loopback is exempt, for local development.

package/pipeline/commands/multi-agent/review-analysis/SKILL.md

@@ -0,0 +1,32 @@
+---
+description: "Review a written analysis document instead of a diff: resolve it from a path, a Confluence page or a Jira issue, run the deterministic gates first, then a parallel model review. Findings cite the Locked rule they break. Never edits the document."
+description-tr: "Diff yerine yazılmış analiz dokümanını review eder: yol, Confluence sayfası veya Jira issue'sundan getirir, önce deterministik geçitleri koşar, sonra paralel model review. Bulgular ihlal edilen Locked kuralını gösterir. Dokümanı düzenlemez."
+argument-hint: "[path | Confluence URL | pageId | JIRA-KEY] [--state <state.json>]  -  optional; with no argument, pick from recent analyses"
+---
+
+# multi-agent review-analysis  -  analysis document review
+
+**Input**: $ARGUMENTS
+
+`/multi-agent:review` judges a diff. This judges the document that diff was supposed to come from, before anyone writes the code it describes. No worktree, no branch, no commit, and the reviewed document is never edited in place.
+
+## Flow
+
+Read `$HOME/.claude/multi-agent-refs/analysis/review.md` and execute it:
+
+1. **Resolve** the document from a local path, a Confluence URL or `pageId`, or a Jira key. With no argument, offer the recent analyses from `~/Desktop/multiAgentAnalysis/` and from each selected repo's `analysis/`, newest first.
+2. **Deterministic gates first**: `validate-analysis-doc.mjs` on the document, and `build-references.mjs --check` when the run's state JSON is available (`--state`, or a fresh analysis). Their output is reported verbatim, before any model reads the document. A finding a script already proves does not need an opinion.
+3. **Parallel model review** against the rubric (buildability, evidence, spine, altitude, admitted gaps, contradiction), CLI-aware: 2 models on Claude Code, 3 on Copilot CLI.
+4. **Fable triage** into Blocker / Important / Suggestion, dropping duplicates and anything the document answers elsewhere.
+5. **Report**, naming the profile it judged against and, explicitly, what was NOT checked.
+6. **Output** on request only: chat (default), Confluence comment, Jira comment, or a `-review.md` beside the document.
+
+## Why it cites Locked decisions
+
+The analysis flow already declares 35 Locked decisions and two deterministic validators. A reviewer that says "I would have written this differently" gives the author nothing to act on; one that says "Locked 34: the Confluence page is in the evidence record but not in Section 21" gives them a fix and a reason. Findings that map to no rule are still allowed, but they are marked as judgement, not dressed up as a violation.
+
+## What it never does
+
+- Edits the reviewed document. The document belongs to its author; a reviewer who rewrites it has removed the choice to disagree. `/multi-agent:analysis-resolve` is the command that folds answers back in.
+- Touches a Jira description or a Confluence page body. Comments only.
+- Chains into a dev run, creates a branch, or commits.

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -59,7 +59,7 @@ Run every step automatically:
 ```
 Step 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 51 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 53 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 51 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
@@ -166,7 +166,7 @@ If nothing is stale → report "All targets up to date" and stop.
 Unlike the Copilot step, this one does **not** hand-copy files. The Codex tree is a
 *transform* of the Claude tree, not a mirror of it, and the transform is real work:
 
-- the 51 sub-command specs become reference files, because Codex silently truncates
+- the 53 sub-command specs become reference files, because Codex silently truncates
   its skills block (see `cross-cli-contract.md` 2.6 for the measurement)
 - every `$HOME/.claude/...` reference to a CLI-owned tree is retargeted, with
   `agents/<persona>.md` becoming `.toml` and the dispatcher becoming the router skill
@@ -489,15 +489,18 @@ same 51 specs as reference files rather than as peer skills, via Step 2b -  see
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**51 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**53 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
-analysis, analysis-resolve, autopilot, build-optimize, channels, complaint-analysis, create-jira, design-check, dev,
-dev-autopilot, dev-local, dev-local-autopilot, diff-explain, forget, garbage-collect,
-help, ios-coding-standard, issue, jira, kill, language, local,
-local-autopilot, log, manual-test, prune-logs, prune-prompts, purge, refactor, resume, review, review-issue, review-jira,
-routines, save, scan, search, setup, resume-local, stack, status, store-ready, sync, test, test-accessibility,
-test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation, uninstall, update
+analysis, analysis-resolve, autopilot, build-optimize, channels,
+complaint-analysis, create-jira, design-check, dev, dev-autopilot, dev-local,
+dev-local-autopilot, diff-explain, feedback, forget, garbage-collect, help,
+ios-coding-standard, issue, jira, kill, language, local, local-autopilot,
+log, manual-test, prune-logs, prune-prompts, purge, refactor, resume,
+resume-local, review, review-analysis, review-issue, review-jira, routines,
+save, scan, search, setup, stack, status, store-ready, sync, test,
+test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
+testflight-validation, uninstall, update
 ```
 
 **NOT synced**: `$HOME/.claude/multi-agent-refs/*`  -  lazy-load references, Claude Code specific

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -179,7 +179,7 @@ A git clone of the pipeline repo is a maintainer workspace, kept in sync by `/mu
 ```
 Current: v15.6.0   Latest: v15.6.1
   -> npm pack @{npm-scope}/multi-agent-pipeline@15.6.1
-  -> node install.js --all (51 commands, 245 scripts, 208 skills)
+  -> node install.js --all (53 commands, 245 scripts, 208 skills)
   -> migrate-prefs.mjs (0 changes  -  already v2.6.0)
 
 ✓ Updated: v15.6.0 → v15.6.1

package/pipeline/multi-agent-refs/analysis/review.md

@@ -0,0 +1,86 @@
+# Analysis document review (`/multi-agent:review-analysis`)
+
+> Reviews a written analysis the way `/multi-agent:review` reviews a diff. Loaded on demand. Read-only: no branch, no worktree, no commit, and the source document is never edited in place.
+
+`/multi-agent:review` answers "is this code right". This answers "could an implementer build the thing from this document, and does the document keep the promises its own contract makes". The two are different questions with the same failure mode: a reviewer who has opinions instead of rules produces findings nobody can act on. So this flow cites `Locked <n>` the way a code review cites a rule ID.
+
+## Phase 0 - Resolve the document
+
+`$ARGUMENTS` is one of:
+
+| Input | Resolution |
+|---|---|
+| A local path | Read it. |
+| A Confluence page URL or `pageId` | Fetch read-only through `$HOME/.claude/multi-agent-refs/channels/confluence.md`. Record `pageId` and page version - the review is about a specific version, and Confluence pages move under you. |
+| A Jira key | Fetch the issue, then follow its analysis link. If the issue carries the analysis in its description or a comment, review that text and say which it was. |
+| Nothing | Offer the most recent documents from `~/Desktop/multiAgentAnalysis/` and from `analysis/` in each selected repo, newest first, and single-select one. |
+
+Fetch failures are reported and stop the run. Reviewing a document you could not read is the one outcome worse than not reviewing it.
+
+## Phase 1 - Deterministic gates first
+
+Run the machine checks before the model reads anything, and report their output verbatim. A finding a script already proves does not need a model's opinion, and a model that reads the document first tends to argue with the script afterwards.
+
+```bash
+node "$HOME/.claude/scripts/validate-analysis-doc.mjs" "<doc>"
+# when the run's state JSON is available (a fresh analysis, or --state <path>):
+node "$HOME/.claude/scripts/build-references.mjs" "<state>" --check "<doc>"
+```
+
+`validate-analysis-doc.mjs` reads `profile` from the front-matter and applies the matching contract, so the corporate backbone and the global omission rule are each judged by their own rule. Its ERRORs are Blockers in this review, its WARNs are Important unless the document states why the warned-about thing is deliberate.
+
+**No state JSON, no references gate.** Say so in the report rather than passing silently: the coverage claim ("every source the run read is listed") is exactly the claim nobody can verify from the document alone, and marking it unchecked is the honest output.
+
+## Phase 2 - Rubric
+
+Parallel model review, same shape as `/multi-agent:review`: 2 models on Claude Code, 3 on Copilot CLI, then triage. Each reviewer answers the rubric below against the resolved profile and returns findings with `Locked <n>` or a rubric id, a quote from the document, and what a reader cannot do because of it.
+
+**A. Buildability** - could an implementer start from this alone?
+
+- Every screen, state and error path the feature needs is described somewhere, not assumed.
+- Each business requirement or rule is testable: two readers cannot disagree about whether it passed.
+- Nothing important is deferred to a conversation the reader was not in.
+
+**B. Evidence** (Locked 3, 4, 34)
+
+- Every quoted string, endpoint, status code and event name carries a citation.
+- Nothing in a forward-looking section is actually a description of the current code.
+- References carry their precision anchors, and a source that could not be fetched is listed as unreachable rather than dropped.
+
+**C. Spine** (Locked 31 global, Locked 33 corporate)
+
+- Global: every `BR-` id reaches an acceptance criterion and a test row.
+- Corporate: every `IG` is realised by a `UC`, every `FG` names a source that exists, and the traceability matrix agrees with the sections. The matrix half is already machine-checked in Phase 1; the reviewer judges whether the chain is *meaningful*, not merely present.
+
+**D. Altitude** - Part A carries no technology name, Part C carries no business rationale. A row that is unclear in two layers at once is two rows.
+
+**E. Gaps that were admitted** - every `EKLENECEK` and every unverified assumption has an open question naming who can answer it. A gap with an owner is a plan; a gap without one is a defect.
+
+**F. Contradiction** - the document does not say two different things in two places. This is the finding class a human reviewer misses most, because it needs the whole document held at once.
+
+## Phase 3 - Triage and verdict
+
+Fable triages the pooled findings exactly as in `/multi-agent:review`: drop duplicates, drop what the document already answers elsewhere, and keep the rest at one of three severities.
+
+| Severity | Meaning |
+|---|---|
+| Blocker | An implementer would build the wrong thing, or could not start. Deterministic-gate ERRORs land here. |
+| Important | The document is right but a reader will need a conversation to use it. |
+| Suggestion | Clarity and consistency. Never a style preference dressed as a defect. |
+
+The verdict names the profile it judged against, the counts per severity, and what was NOT checked (the references gate without a state file, anything the fetch could not reach). Follow the pipeline rule on claiming: state which findings are mechanically proven and which are judgement.
+
+## Phase 4 - Output
+
+Default is the chat report. Nothing is written anywhere without an explicit choice.
+
+| Target | Behaviour |
+|---|---|
+| Chat only | Default. |
+| Confluence comment | A comment on the reviewed page, never an edit of the page body. The document belongs to its author; a reviewer who rewrites it has removed the choice to disagree. |
+| Jira comment | Comment only, per `channels/issue-comment.md`. The description is never touched. |
+| Local file | `<doc-dir>/<doc-name>-review.md` beside the document, so the review travels with what it reviewed. |
+
+`/multi-agent:analysis-resolve` is the companion that acts on the findings: this command says what is wrong, that one walks the open questions and folds the answers back into the document. Say so in the report when the verdict has open questions, so the reader knows the next command rather than editing by hand.
+
+Non-negotiables: report body follows `prefs.global.outputLanguage`; humanizer punctuation policy (Locked 7) applies to anything posted to a channel; no AI attribution anywhere; no status change, no assignment, no page edit, no commit.

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -6,15 +6,18 @@
 
 ---
 
-## 1. Command Inventory (51 files, 47 live commands)
+## 1. Command Inventory (53 files, 49 live commands)
 
 ```
-analysis, analysis-resolve, autopilot, build-optimize, channels, complaint-analysis, create-jira, design-check, dev,
-dev-autopilot, dev-local, dev-local-autopilot, diff-explain, forget, garbage-collect,
-help, ios-coding-standard, issue, jira, kill, language, local,
-local-autopilot, log, manual-test, prune-logs, prune-prompts, purge, refactor, resume, review, review-issue, review-jira,
-routines, save, scan, search, setup, resume-local, stack, status, store-ready, sync, test, test-accessibility,
-test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation, uninstall, update
+analysis, analysis-resolve, autopilot, build-optimize, channels,
+complaint-analysis, create-jira, design-check, dev, dev-autopilot, dev-local,
+dev-local-autopilot, diff-explain, feedback, forget, garbage-collect, help,
+ios-coding-standard, issue, jira, kill, language, local, local-autopilot,
+log, manual-test, prune-logs, prune-prompts, purge, refactor, resume,
+resume-local, review, review-analysis, review-issue, review-jira, routines,
+save, scan, search, setup, stack, status, store-ready, sync, test,
+test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
+testflight-validation, uninstall, update
 ```
 
 Categories:

package/pipeline/scripts/feedback-send.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+// feedback-send.mjs  -  send one user-written feedback message to the
+// maintainer's admin panel.
+//
+// WHAT IS SENT: the text the user typed, and nothing else that the user did not
+// type. No logs, no repo names, no branch names, no file paths, no diffs, no
+// prompts. The only fields this script adds are the ones the maintainer cannot
+// act on the report without: which pipeline version it came from, which host
+// CLI, and when.
+//
+// That restraint is the whole design. Attaching a run log would make a report
+// easier to act on and would also mean a corporate user's internal identifiers
+// leave their machine and land in someone else's database, from a package
+// anyone can install off npm. A person can paste the one line they think
+// matters; a script cannot know which line that is.
+//
+// Auth reuses the usage ingest token (`prefs.global.keychainMapping.usage_ingest`)
+// so nothing new has to be onboarded. Unlike usage telemetry, `optOut` does NOT
+// silence this: telemetry is passive collection, feedback is a deliberate act by
+// the person running the command, and silently dropping something a user chose
+// to send is worse than not offering the command.
+//
+// Usage:
+//   node feedback-send.mjs --text "<message>" [--kind bug|idea|question]
+//                          [--endpoint <url>] [--dry-run]
+//
+// Exit: 0 sent (or dry run), 1 nothing to send / rejected, 2 usage error.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const ENDPOINT_DEFAULT = "https://mmerterden.vercel.app/api/feedback/ingest";
+const TIMEOUT_MS = 8000;
+const TEXT_MAX = 4000;
+const KINDS = new Set(["bug", "idea", "question"]);
+
+function arg(name, fallback = null) {
+  const i = process.argv.indexOf(name);
+  return i === -1 ? fallback : (process.argv[i + 1] ?? fallback);
+}
+
+function readPrefs() {
+  const p = join(homedir(), ".claude", "multi-agent-preferences.json");
+  try {
+    return JSON.parse(readFileSync(p, "utf-8")).global ?? {};
+  } catch {
+    return {};
+  }
+}
+
+function packageVersion() {
+  for (const p of [
+    join(homedir(), ".claude", ".pipeline-version"),
+    join(homedir(), ".copilot", ".pipeline-version"),
+    join(homedir(), ".codex", ".pipeline-version"),
+  ]) {
+    try {
+      const v = readFileSync(p, "utf-8").trim();
+      if (v) return v;
+    } catch {
+      /* try the next host */
+    }
+  }
+  return "unknown";
+}
+
+// Which CLI the person is running. Useful because a report that only reproduces
+// on one host is a different bug from one that reproduces everywhere.
+function host() {
+  if (existsSync(join(homedir(), ".claude", ".pipeline-version"))) return "claude";
+  if (existsSync(join(homedir(), ".copilot", ".pipeline-version"))) return "copilot";
+  if (existsSync(join(homedir(), ".codex", ".pipeline-version"))) return "codex";
+  return "unknown";
+}
+
+function resolveToken() {
+  if (process.env.MULTI_AGENT_USAGE_TOKEN) return process.env.MULTI_AGENT_USAGE_TOKEN;
+  const g = readPrefs();
+  const inline = g.usageLog?.token;
+  if (typeof inline === "string" && inline.trim()) return inline.trim();
+  const name = g.keychainMapping?.usage_ingest;
+  if (typeof name === "string" && name.trim()) {
+    const store = join(homedir(), ".claude", "lib", "credential-store.sh");
+    if (existsSync(store)) {
+      try {
+        const out = execFileSync("bash", [store, "get", name.trim()], {
+          encoding: "utf-8",
+          timeout: 4000,
+          stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (out) return out;
+      } catch {
+        /* keychain unavailable */
+      }
+    }
+  }
+  return "";
+}
+
+// The token rides in a header, so http would put it on the wire in cleartext.
+// Same rule the usage sender follows: https anywhere, http only for loopback.
+function endpointAllowed(endpoint) {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(u.hostname);
+}
+
+async function main() {
+  const text = String(arg("--text", "") ?? "").trim();
+  if (!text) {
+    process.stderr.write('usage: feedback-send.mjs --text "<message>" [--kind bug|idea|question]\n');
+    process.exit(2);
+  }
+  if (text.length > TEXT_MAX) {
+    process.stderr.write(`ERROR: message is ${text.length} chars; the cap is ${TEXT_MAX}\n`);
+    process.exit(2);
+  }
+
+  const kindRaw = String(arg("--kind", "bug") ?? "bug").toLowerCase();
+  const kind = KINDS.has(kindRaw) ? kindRaw : "bug";
+  const endpoint = String(arg("--endpoint", ENDPOINT_DEFAULT) ?? ENDPOINT_DEFAULT);
+
+  const payload = {
+    text,
+    kind,
+    v: packageVersion(),
+    host: host(),
+    at: new Date().toISOString(),
+  };
+
+  if (process.argv.includes("--dry-run")) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    process.exit(0);
+  }
+
+  if (!endpointAllowed(endpoint)) {
+    process.stderr.write(`ERROR: refusing to send over a non-TLS endpoint: ${endpoint}\n`);
+    process.exit(1);
+  }
+
+  const token = resolveToken();
+  if (!token) {
+    process.stderr.write(
+      "ERROR: no ingest token. Run /multi-agent:update once (it registers one) or /multi-agent:setup.\n",
+    );
+    process.exit(1);
+  }
+
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  try {
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Usage-Token": token },
+      body: JSON.stringify(payload),
+      signal: ctrl.signal,
+    });
+    if (!res.ok) {
+      // Unlike telemetry, this failure is reported: the person is standing there
+      // waiting to hear whether their message went. Swallowing it would leave
+      // them believing they had been heard.
+      process.stderr.write(`ERROR: the endpoint answered ${res.status}\n`);
+      process.exit(1);
+    }
+    process.stdout.write("feedback sent\n");
+  } catch (err) {
+    process.stderr.write(`ERROR: could not reach the endpoint (${err.name})\n`);
+    process.exit(1);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+main();

package/pipeline/scripts/website-deploy-commit.sh

@@ -82,7 +82,12 @@ fi
 WAIT="${WEBSITE_SYNC_WAIT:-45}"
 ELAPSED=0
 while [ "$ELAPSED" -lt "$WAIT" ]; do
-  ROW="$(vercel ls --yes 2>/dev/null | grep -m1 'Production' || true)"
+  # `vercel ls` prints its table on STDERR, not stdout. Discarding stderr threw
+  # away the very rows this grep reads, so ROW was always empty and the check
+  # reported "no Ready production build" on every run - including the ones that
+  # deployed fine. A guard that cannot pass is worse than no guard: it trains
+  # the reader to ignore the one message meant to catch a real failure.
+  ROW="$(vercel ls --yes 2>&1 | grep -m1 'Production' || true)"
   case "$ROW" in
     *Ready*) echo "website: production build Ready"; exit 0 ;;
     *Error*) break ;;

package/pipeline/skills/shared/core/multi-agent-feedback/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: multi-agent-feedback
+language: en
+description: "Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows the payload and asks before sending. Use when a run went wrong and the maintainer should know."
+user-invocable: true
+argument-hint: "\"<message>\" [bug | idea | question]  -  with no argument, you are asked for the text"
+---
+
+# multi-agent feedback  -  tell the maintainer
+
+**Input**: $ARGUMENTS
+
+One message to the maintainer's admin panel. It exists because the alternative is a problem nobody hears about: a run goes wrong, the person works around it, and the defect is still there a month later.
+
+## What is sent
+
+Only the text you type, plus `kind` (bug / idea / question), the installed pipeline version, which host CLI, and the timestamp.
+
+**No logs are attached, ever** - not the agent log, the diff, the repo name, the branch, or a file path. This package installs from a public registry, so an automatic log attachment would take a corporate user's internal identifiers off their machine into someone else's database. Paste the one line you think matters; a script cannot know which line that is.
+
+## Flow
+
+1. Take the message from `$ARGUMENTS`; with no argument, ask for the text and then the kind.
+2. Print the exact payload via the script's own dry run, so what is shown is what goes:
+   `node "$HOME/.copilot/scripts/feedback-send.mjs" --text "<message>" --kind <kind> --dry-run`
+3. **Confirm before sending.** Nothing leaves the machine before a yes; autopilot does not exempt this, because a message to a person is never fired unattended.
+4. Send the same command without `--dry-run`.
+5. Report the outcome plainly. A failure is surfaced, not swallowed - the person is waiting to hear whether their message went.
+
+Auth reuses the usage ingest token, so nothing extra is onboarded. `usageLog.optOut` does not silence this: telemetry is passive collection, feedback is a deliberate act. The endpoint must be TLS; only loopback is exempt.

package/pipeline/skills/shared/core/multi-agent-review-analysis/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: multi-agent-review-analysis
+language: en
+description: "Review a written analysis document instead of a diff: resolve it from a path, a Confluence page or a Jira issue, run the deterministic gates first, then a parallel model review. Findings cite the Locked rule they break. Never edits the document. Use when an analysis needs judging before development starts."
+user-invocable: true
+argument-hint: "[path | Confluence URL | pageId | JIRA-KEY] [--state <state.json>]  -  optional; with no argument, pick from recent analyses"
+---
+
+# multi-agent review-analysis  -  analysis document review
+
+**Input**: $ARGUMENTS
+
+`multi-agent-review` judges a diff. This judges the document that diff was supposed to come from, before the code exists. No worktree, no branch, no commit, and the reviewed document is never edited in place.
+
+## Flow
+
+Read `$HOME/.copilot/multi-agent-refs/analysis/review.md` and execute it:
+
+1. **Resolve** from a local path, a Confluence URL or `pageId`, or a Jira key. No argument -> pick from recent analyses in `~/Desktop/multiAgentAnalysis/` and each repo's `analysis/`.
+2. **Deterministic gates first**, output reported verbatim before any model reads the document:
+   `validate-analysis-doc.mjs <doc>`, and `build-references.mjs <state> --check <doc>` when a state JSON is available.
+3. **Parallel model review** against the rubric: buildability, evidence, spine, altitude, admitted gaps, contradiction.
+4. **Triage** into Blocker / Important / Suggestion.
+5. **Report** the profile it judged against and, explicitly, what was NOT checked.
+6. **Output** on request: chat (default), Confluence comment, Jira comment, or a `-review.md` beside the document.
+
+Findings cite `Locked <n>` where one applies, so the author gets a rule and a fix rather than a preference. Anything with no rule behind it is marked as judgement.
+
+## What it never does
+
+Edits the reviewed document (that is `multi-agent-analysis-resolve`), touches a Jira description or a Confluence page body, chains into a dev run, branches, or commits.

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -31,7 +31,7 @@ Run all steps automatically:
 
 ```
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 51 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 53 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 51 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -98,7 +98,7 @@ If nothing is stale -> report "All targets up to date" and stop.
 ## Codex Sync (Step 2b)
 
 This step does **not** hand-copy files. The Codex tree is a *transform* of the Claude
-tree, not a mirror: the 51 sub-command specs become reference files (Codex silently
+tree, not a mirror: the 53 sub-command specs become reference files (Codex silently
 truncates its skills block  -  see `cross-cli-contract.md` 2.6), every reference to a
 CLI-owned tree is retargeted (`agents/<persona>.md` becomes `.toml`, the dispatcher
 becomes the router skill), the 8 personas are regenerated as TOML with a model +
@@ -224,15 +224,18 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**51 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**53 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
-analysis, analysis-resolve, autopilot, build-optimize, channels, complaint-analysis, create-jira, design-check, dev,
-dev-autopilot, dev-local, dev-local-autopilot, diff-explain, forget, garbage-collect,
-help, ios-coding-standard, issue, jira, kill, language, local,
-local-autopilot, log, manual-test, prune-logs, prune-prompts, purge, refactor, resume, review, review-issue, review-jira,
-routines, save, scan, search, setup, resume-local, stack, status, store-ready, sync, test, test-accessibility,
-test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation, uninstall, update
+analysis, analysis-resolve, autopilot, build-optimize, channels,
+complaint-analysis, create-jira, design-check, dev, dev-autopilot, dev-local,
+dev-local-autopilot, diff-explain, feedback, forget, garbage-collect, help,
+ios-coding-standard, issue, jira, kill, language, local, local-autopilot,
+log, manual-test, prune-logs, prune-prompts, purge, refactor, resume,
+resume-local, review, review-analysis, review-issue, review-jira, routines,
+save, scan, search, setup, stack, status, store-ready, sync, test,
+test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
+testflight-validation, uninstall, update
 ```
 
 **NOT synced**: `refs/*`  -  Lazy-load references, Claude Code specific