@mmerterden/multi-agent-pipeline 17.0.0 → 17.1.0

package/pipeline/scripts/phase-tracker.sh

@@ -575,7 +575,12 @@ tracker_next_hint() {
     # default only up to Opus 4.7 / Sonnet 4.6, a default that landed in
     # v2.1.268. Naming the fallback on the same line is what keeps a newer model
     # from advancing eight phases in silence.
-    codex) mirror="update_plan: set step \"Phase $pid $name\" to $status (send the FULL step list, it is not a delta)" ;;
+    # `subjects` now carries Phase 2's plan steps as indented rows, and
+    # update_plan takes the whole list anyway, so re-reading it is what puts
+    # those steps on the Codex plan without a second mechanism. Codex has no
+    # dependency concept; the "(bekliyor: ...)" suffix inside the step text is
+    # where that information survives on this host.
+    codex) mirror="update_plan: set step \"Phase $pid $name\" to $status, re-reading the FULL list from \`phase-tracker.sh subjects\` (it is not a delta, and the indented rows are plan steps that belong in it)" ;;
     *) mirror="no task widget on this host - reprint the card above inside your reply text" ;;
   esac
   printf '\n-- NEXT (required) --\n  %s\n' "$mirror"
@@ -717,9 +722,89 @@ subjects() {
       [ -n "$pusd" ] && line="$line - $(printf '~$%.2f' "$pusd" 2>/dev/null || echo '')"
     fi
     printf '%s\n' "$line"
+
+    # Sub-phases ride out on the SAME list, indented in the subject string.
+    #
+    # The card has drawn these since sub-phases existed; the widget never has,
+    # and the widget is the surface the user actually looks at. Phase 2's plan
+    # is the case that made the gap matter: the tasks, their order and their
+    # dependencies are computed, stored and used to drive Phase 3's picker, and
+    # none of it was visible anywhere the user was looking.
+    #
+    # Indentation is two spaces INSIDE the subject because the widget takes
+    # exactly one string per row and has no parent field - there is no nesting
+    # to ask for, so the only place a hierarchy can be expressed is the string.
+    if [ -z "$want" ] || [ "$want" = "$pid" ]; then
+      echo "$state" | jq -r --arg pid "$pid" '
+        ([.phases[] | select(.id == $pid)][0].subs) // []
+        | .[]
+        | "  " + (.id // "") + " " + (.name // "")
+          + (if ((.deps // []) | length) > 0
+             then " (bekliyor: " + ((.deps // []) | join(", ")) + ")"
+             else "" end)'
+    fi
   done <<< "$rows"
 }
 
+# The TaskCreate/TaskUpdate script for this host, in creation order.
+#
+# Creation order is the ONLY ordering the native widget has - it renders by the
+# order tiles were made, not by any id inside them - so a plan that arrives at
+# Phase 2 cannot simply be appended: its rows would land after Phase 7. The
+# answer is a rebuild at that one boundary, which is the same thing `:resume`
+# already does for a different reason.
+tiles_script() {
+  need_jq
+  local state; state=$(load_state)
+  local has_subs
+  has_subs=$(echo "$state" | jq '[.phases[]?.subs[]?] | length')
+
+  if [ "${has_subs:-0}" -gt 0 ]; then
+    printf 'The tile list has sub-steps now, and the widget orders by CREATION.
+'
+    printf 'Delete every existing tile (TaskUpdate status="deleted"), then create
+'
+    printf 'these in this exact order. Rebuilding is cheaper than a list whose
+'
+    printf 'steps sit after the phase they belong to.
+
+'
+  else
+    printf 'REQUIRED  -  create one native tile per phase, in this exact order,
+'
+    printf 'BEFORE any TaskUpdate. The widget renders by creation order, not by
+'
+    printf 'phase number, so an out-of-order call scrambles the stack.
+
+'
+  fi
+
+  subjects | sed 's/^/  TaskCreate(subject: "/; s/$/")/'
+
+  # Dependencies are a second pass on purpose: a tile cannot be blocked by one
+  # that does not exist yet, and TaskCreate has no dependency field.
+  #
+  # The lines below name tiles by their SUBJECT, not by the plan's own `t1`/`t2`
+  # ids. `addBlockedBy` takes the ids TaskCreate handed back, which no shell
+  # script can know - printing `addBlockedBy: ["t1"]` would be a line that looks
+  # executable and is not, which is worse than a line that admits what it needs.
+  local deps
+  deps=$(echo "$state" | jq -r '
+    [.phases[]? | .subs[]?] as $all
+    | $all[] | select(((.deps // []) | length) > 0)
+    | . as $s
+    | "  TaskUpdate(<tile \"  " + ($s.name // "") + "\">, addBlockedBy: [" +
+      (($s.deps // [])
+        | map(. as $d | (($all[] | select(.id == $d) | "<tile \"  " + (.name // "") + "\">") // $d))
+        | join(", ")) + "])"')
+  if [ -n "$deps" ]; then
+    printf '\nThen the dependencies, so the widget says WHY a step has not started.\n'
+    printf 'addBlockedBy takes the ids TaskCreate returned; <tile "..."> below is\n'
+    printf 'the tile whose subject is that string.\n'
+    printf '%s\n' "$deps"
+  fi
+}
+
 render() {
   need_jq
   local state
@@ -888,11 +973,14 @@ render() {
       if [ "$sub_count" != "0" ] && [ "$sub_count" -gt 0 ] 2>/dev/null; then
         local sub_data
         sub_data=$(echo "$state" | jq -r --arg pid "$pid" '
-          ([.phases[] | select(.id == $pid)][0].subs) // [] | .[] | [(.id // ""), (.name // ""), (.status // "")] | join("")
+          ([.phases[] | select(.id == $pid)][0].subs) // [] | .[] | [(.id // ""), (.name // ""), (.status // ""), ((.deps // []) | join(", "))] | join("")
         ')
         local j=0
-        local sid sname sstatus sg connector
-        while IFS=$'\x1f' read -r sid sname sstatus; do
+        local sid sname sstatus sdeps sg connector
+        while IFS=$'\x1f' read -r sid sname sstatus sdeps; do
+          # The card is the only surface a Copilot session has, so a dependency
+          # that is invisible here is invisible to that user entirely.
+          [ -n "$sdeps" ] && sname="$sname (bekliyor: $sdeps)"
           sg=$(glyph_for "$sstatus")
           connector="├─"
           if [ "$j" = "$((sub_count - 1))" ]; then connector="└─"; fi
@@ -1052,10 +1140,45 @@ GATE
     usage_live_ping "$(basename "$TRACKER_DIR")" "$PID"
     ;;
 
+  plan)
+    # Phase 2's plan, turned into sub-phases of the phase that will execute it.
+    #
+    # The parsing lives here rather than in the phase document for one reason:
+    # sub-phases are this file's structure, and a jq blob in a phase doc is a
+    # second definition of that structure which nothing keeps in step. It also
+    # keeps the doc to one line, which the aggregate phase-doc budget cares about.
+    #
+    # Reads planning-output.schema.json on stdin: tasks[] with id, title and an
+    # optional dependsOn[]. Status is `pending` for all of them - Phase 3 moves
+    # them with `sub`, and pre-marking work as started is the lie the tracker
+    # exists to avoid.
+    need_jq
+    [ "$#" -ge 1 ] || { echo "plan needs <phase_id> (plan JSON on stdin)" >&2; exit 64; }
+    PID="$1"
+    PLAN_IN=$(cat)
+    printf '%s' "$PLAN_IN" | jq empty 2>/dev/null || {
+      echo "phase-tracker: plan input is not valid JSON" >&2
+      exit 65
+    }
+    N=0
+    while IFS=$'\x1f' read -r tid ttitle tdeps; do
+      [ -n "$tid" ] || continue
+      "$SELF_PATH" sub "$PID" "$tid" "$ttitle" pending "$tdeps" >/dev/null || true
+      N=$((N + 1))
+    done <<EOF
+$(printf '%s' "$PLAN_IN" | jq -r '
+  (.tasks // [])[]
+  | [(.id // ""), (.title // ""), ((.dependsOn // []) | join(","))]
+  | join("\u001f")')
+EOF
+    [ "$N" -gt 0 ] || { echo "phase-tracker: plan carried no tasks[]" >&2; exit 65; }
+    printf 'phase-tracker: %s plan step(s) attached to phase %s\n' "$N" "$PID"
+    tiles_script
+    ;;
   sub)
     need_jq
-    [ "$#" -ge 3 ] || { echo "sub needs <phase_id> <sub_id> <name> [status]" >&2; exit 64; }
-    PID="$1"; SID="$2"; SNAME="$3"; SSTATUS="${4:-pending}"
+    [ "$#" -ge 3 ] || { echo "sub needs <phase_id> <sub_id> <name> [status] [deps]" >&2; exit 64; }
+    PID="$1"; SID="$2"; SNAME="$3"; SSTATUS="${4:-pending}"; SDEPS="${5:-}"
     case "$SSTATUS" in
       pending|in_progress|completed|failed|skipped) ;;
       *) echo "bad status: $SSTATUS" >&2; exit 64 ;;
@@ -1065,13 +1188,15 @@ GATE
     # If sub with this id exists under this phase, update; else append.
     new=$(echo "$state" | jq \
       --arg pid "$PID" --arg sid "$SID" --arg sname "$SNAME" --arg ss "$SSTATUS" \
+      --argjson deps "$(printf '%s\n' "$SDEPS" | jq -Rc 'split(",") | map(select(length > 0))')" \
       '
       .phases |= map(
         if .id == $pid then
           if any(.subs[]?; .id == $sid) then
-            .subs |= map(if .id == $sid then .name = $sname | .status = $ss else . end)
+            .subs |= map(if .id == $sid then .name = $sname | .status = $ss
+                         | (if ($deps | length) > 0 then .deps = $deps else . end) else . end)
           else
-            .subs += [{"id":$sid,"name":$sname,"status":$ss}]
+            .subs += [{"id":$sid,"name":$sname,"status":$ss,"deps":$deps}]
           end
         else . end
       )')
@@ -1243,10 +1368,7 @@ GATE
         # tools it has. And the fallback is not enough on its own: a user looking
         # at a missing widget needs the one command that brings it back, which is
         # why the opt-in is printed next to it.
-        echo "REQUIRED  -  create one native tile per phase, in this exact order,"
-        echo "BEFORE any TaskUpdate. The widget renders by creation order, not by"
-        echo "phase number, so an out-of-order call scrambles the stack."
-        subjects | sed 's/^/  TaskCreate(subject: "/; s/$/")/'
+        tiles_script
         echo
         echo "At every phase boundary re-run \`phase-tracker.sh subjects <id>\` and"
         echo "pass that line as the subject of the TaskUpdate. The subject is the only"

package/pipeline/scripts/probe-evidence-capability.sh

@@ -22,7 +22,7 @@
 #      second copy is a second place for the answer to drift.
 #
 # Usage:
-#   probe-evidence-capability.sh --platform <ios|android> [--repo <path>]
+#   probe-evidence-capability.sh --platform <ios|android|web> [--repo <path>]
 #                                [--changed <f>[,<f>...]] [--json]
 #                                [--json-out <path>] [--only all|device]
 #
@@ -57,8 +57,8 @@ case "$ONLY" in all | device) ;; *)
   echo "probe-evidence-capability: --only takes 'all' or 'device'" >&2; exit 2 ;;
 esac
 
-case "$PLATFORM" in ios | android) ;; *)
-  echo "usage: probe-evidence-capability.sh --platform <ios|android> [--repo <path>] [--changed <f>] [--json]" >&2
+case "$PLATFORM" in ios | android | web) ;; *)
+  echo "usage: probe-evidence-capability.sh --platform <ios|android|web> [--repo <path>] [--changed <f>] [--json]" >&2
   exit 2 ;;
 esac
 [ -d "$REPO" ] || { echo "probe-evidence-capability: no such repo directory: $REPO" >&2; exit 2; }
@@ -120,6 +120,21 @@ case "$PLATFORM" in
       [ -n "$DEVICE" ] || DEVICE_REASON="no attached device or running emulator"
     fi
     ;;
+  web)
+    # The "device" on web is the browser the runner drives, and it is installed
+    # per project rather than per machine. `npx --no-install` is the same guard
+    # run-ui-tests.sh uses, so this answers the question the run will actually
+    # face instead of a friendlier one.
+    if ! command -v npx >/dev/null 2>&1; then
+      DEVICE_REASON="npx unavailable; cannot tell whether a browser runner is installed"
+    elif (cd "$REPO" && npx --no-install playwright --version >/dev/null 2>&1); then
+      DEVICE="playwright"
+    elif (cd "$REPO" && npx --no-install cypress version >/dev/null 2>&1); then
+      DEVICE="cypress"
+    else
+      DEVICE_REASON="no browser runner installed in this project (npm install first)"
+    fi
+    ;;
 esac
 
 # ---- Recorder -----------------------------------------------------------------
@@ -136,6 +151,15 @@ case "$PLATFORM" in
       RECORDER="false"; RECORDER_REASON="adb unavailable"
     fi
     ;;
+  web)
+    # Nothing external records a browser here: Playwright and Cypress both write
+    # their own video, so the recorder IS the runner. Claiming a recorder when
+    # the runner is absent would open tier 1 on a machine that cannot produce a
+    # single frame.
+    if [ -n "$DEVICE" ]; then RECORDER="true"; else
+      RECORDER="false"; RECORDER_REASON="${DEVICE_REASON:-no browser runner}"
+    fi
+    ;;
 esac
 if [ "$RECORDER" = "true" ] && ! command -v ffprobe >/dev/null 2>&1; then
   # Not fatal. ffprobe only verifies the result, so its absence downgrades what

package/pipeline/scripts/run-ui-tests.sh

@@ -15,7 +15,7 @@
 # asked which test depth to run, and a second copy of "does this repo have a UI
 # test target" is a second place for the answer to drift.
 #
-#   run-ui-tests.sh detect --platform <ios|android> [--repo <path>] [--changed <f>[,<f>...]]
+#   run-ui-tests.sh detect --platform <ios|android|web> [--repo <path>] [--changed <f>[,<f>...]]
 #       Print KEY=VALUE lines and exit. Never builds, never runs a test.
 #         UI_TEST_TARGET=<name>|            (empty until one candidate is chosen)
 #         UI_TEST_TARGETS=<name[,name...]> (every candidate found)
@@ -25,7 +25,7 @@
 #         UI_TEST_CONTAINER=<-project X|-workspace X>|
 #         UI_TEST_SCHEME=<name>|
 #
-#   run-ui-tests.sh run --platform <ios|android> [--repo <path>] [--changed <f>...]
+#   run-ui-tests.sh run --platform <ios|android|web> [--repo <path>] [--changed <f>...]
 #                       [--device <udid|serial>] [--log <path>] [--all]
 #       Run the matching tests (or the whole UI suite with --all).
 #
@@ -59,10 +59,10 @@ while [ "$#" -gt 0 ]; do
 done
 
 case "$MODE" in detect | run) ;; *)
-  echo "usage: run-ui-tests.sh detect|run --platform <ios|android> [--repo <path>] [--changed <f>]" >&2
+  echo "usage: run-ui-tests.sh detect|run --platform <ios|android|web> [--repo <path>] [--changed <f>]" >&2
   exit 2 ;;
 esac
-case "$PLATFORM" in ios | android) ;; *)
+case "$PLATFORM" in ios | android | web) ;; *)
   echo "run-ui-tests: unsupported platform '$PLATFORM'" >&2; exit 2 ;;
 esac
 [ -d "$REPO" ] || { echo "run-ui-tests: no such repo directory: $REPO" >&2; exit 2; }
@@ -277,9 +277,94 @@ EOF
   fi
 }
 
+# Web had no arm here at all until v17.1.0, which meant a repo with a full
+# Playwright suite reported "no UI test target" and every downstream consumer
+# believed it: the evidence probe closed tier 1, the PR body said UI tests were
+# not run, and the reason it gave was true of the runner rather than of the repo.
+# That is the failure mode this file exists to avoid, and it was shipped for web.
+web_spec_files() {
+  find "$REPO" \
+    -name ".*" -type d -prune -o \
+    -type d \( -name node_modules -o -name dist -o -name build -o -name out \
+               -o -name coverage -o -name .next -o -name test-results \
+               -o -name playwright-report \) -prune -o \
+    -type f \( -name "*.spec.ts" -o -name "*.spec.tsx" -o -name "*.spec.js" \
+               -o -name "*.spec.mjs" -o -name "*.e2e.ts" -o -name "*.e2e.js" \
+               -o -name "*.cy.ts" -o -name "*.cy.tsx" -o -name "*.cy.js" \) \
+    -print 2>/dev/null
+}
+
+# The signal is the import, not a directory called e2e. A `*.spec.ts` under
+# `src/` is almost always a vitest or jest unit test rendering into jsdom: no
+# browser, no navigation, nothing to record a flow from. `@playwright/test` and
+# `cy.visit(` are the two APIs that actually drive a browser, which is the same
+# precondition XCUIApplication carries on iOS - and the same reason the iOS arm
+# refuses to treat 477 snapshot tests as UI tests.
+detect_web() {
+  local f pw="" cy="" n
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    if grep -qF '@playwright/test' "$f" 2>/dev/null; then
+      pw="${pw}${f}
+"
+    elif grep -qE 'cy\.(visit|get)\(' "$f" 2>/dev/null; then
+      cy="${cy}${f}
+"
+    fi
+  done <<EOF
+$(web_spec_files)
+EOF
+
+  [ -n "$pw$cy" ] || { TARGET_REASON="no spec imports @playwright/test and none calls cy.visit() under $REPO"; return; }
+
+  CONTAINER="$REPO"
+  [ -n "$pw" ] && TARGETS="playwright"
+  [ -n "$cy" ] && TARGETS="${TARGETS:+$TARGETS,}cypress"
+  case "$TARGETS" in
+    *,*) TARGET="" ;;
+    *) TARGET="$TARGETS"; SCHEME="$TARGET" ;;
+  esac
+
+  [ -n "$CHANGED" ] || { MATCH_REASON="no changed-file list supplied"; return; }
+  local names hits="" hit_runner=""
+  names=$(changed_names)
+  [ -n "$names" ] || { MATCH_REASON="changed-file list held no usable names"; return; }
+
+  # Matches are spec FILES, not test titles: both runners take a path on the
+  # command line, and a title filter (`-g`) silently matches nothing when the
+  # title was reworded.
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    while IFS= read -r n; do
+      [ -n "$n" ] || continue
+      if grep -qF "$n" "$f" 2>/dev/null; then
+        rel="${f#"$REPO"/}"
+        case ",$hits," in *",$rel,"*) ;; *) hits="${hits:+$hits,}$rel" ;; esac
+        if [ -z "$hit_runner" ]; then
+          grep -qF '@playwright/test' "$f" 2>/dev/null && hit_runner="playwright" || hit_runner="cypress"
+        fi
+        break
+      fi
+    done <<EOF2
+$names
+EOF2
+  done <<EOF
+$pw$cy
+EOF
+
+  MATCHES="$hits"
+  if [ -n "$MATCHES" ]; then
+    [ -n "$TARGET" ] || { TARGET="$hit_runner"; SCHEME="$TARGET"; }
+  else
+    MATCH_REASON="no browser-driving spec mentions any changed file name"
+    [ -n "$TARGET" ] || TARGET_REASON="both playwright and cypress specs exist and no match chose between them"
+  fi
+}
+
 case "$PLATFORM" in
   ios) detect_ios ;;
   android) detect_android ;;
+  web) detect_web ;;
 esac
 
 if [ "$MODE" = "detect" ]; then
@@ -366,6 +451,30 @@ case "$PLATFORM" in
     (cd "$REPO" && "$GRADLE" "$TARGET" $ARGS) >"$LOG" 2>&1
     RC=$?
     ;;
+  web)
+    command -v npx >/dev/null 2>&1 || { echo "run-ui-tests: npx unavailable" >&2; exit 2; }
+    WEB_ARGV=()
+    case "$TARGET" in
+      playwright)
+        # --no-install: npx would otherwise DOWNLOAD the runner on a machine that
+        # does not have it, which turns "this repo has no UI tests" into a silent
+        # network fetch mid-phase.
+        WEB_ARGV=(npx --no-install playwright test --reporter=line)
+        if [ "$RUN_ALL" -eq 0 ]; then
+          OLDIFS="$IFS"; IFS=','
+          for m in $MATCHES; do WEB_ARGV+=("$m"); done
+          IFS="$OLDIFS"
+        fi
+        ;;
+      cypress)
+        WEB_ARGV=(npx --no-install cypress run)
+        [ "$RUN_ALL" -eq 0 ] && WEB_ARGV+=(--spec "$MATCHES")
+        ;;
+      *) echo "run-ui-tests: unknown web runner '$TARGET'" >&2; exit 2 ;;
+    esac
+    (cd "$REPO" && "${WEB_ARGV[@]}") >"$LOG" 2>&1
+    RC=$?
+    ;;
 esac
 
 printf 'UI_TEST_LOG=%s\n' "$LOG"

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-13T12:09:01Z",
-  "skillCount": 209,
+  "generatedAt": "2026-09-14T11:56:29Z",
+  "skillCount": 212,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -23,6 +23,18 @@
       "path": "shared/core/multi-agent-analysis/SKILL.md",
       "sha256": "21bb520e781123d998e4ef5f6ee54e7403774f64e094153645cbde4112a7a8a6"
     },
+    {
+      "path": "shared/core/multi-agent-autopilot-off/SKILL.md",
+      "sha256": "c141ad85bcba8320d5108708db2045cb3d3b1578b564eb1724f4c81202bdd133"
+    },
+    {
+      "path": "shared/core/multi-agent-autopilot-on/SKILL.md",
+      "sha256": "2d9c12084bb7c74f38a35c810a0a20648847173bf0b1a3bc4c8c4318a5dcb0d1"
+    },
+    {
+      "path": "shared/core/multi-agent-autopilot-status/SKILL.md",
+      "sha256": "065958fb3ff608d7d0ea36b3eef4614da442742dc69b00799cf1658848cee786"
+    },
     {
       "path": "shared/core/multi-agent-autopilot/SKILL.md",
       "sha256": "c02525ad003c34d53834ecd04eb150764b36779f4e08941c9016926418e74333"
@@ -33,7 +45,7 @@
     },
     {
       "path": "shared/core/multi-agent-channels/SKILL.md",
-      "sha256": "e43f5cfa92d5016b296710863b4cab91eb7c0be0ce13018a1c34d15807604fa7"
+      "sha256": "fa128726aa0009699e7ac2de566812e7192681db98c90dfc5da501ad50a05583"
     },
     {
       "path": "shared/core/multi-agent-complaint-analysis/SKILL.md",
@@ -189,7 +201,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "8f033b904e90926b15f6e5a8f8703b47a17373e5450921514633ea0a9edaf327"
+      "sha256": "51e9a8a9053ce9d0450bcaf66555075f83c340203bb753946938f4b29cf93b79"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",

package/pipeline/skills/shared/core/multi-agent-autopilot-off/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: multi-agent-autopilot-off
+language: en
+description: "Turn off continuous mode on this machine: the schedule is removed, work already running finishes, the repo selection is kept. Use when the machine should stop picking work up."
+user-invocable: true
+argument-hint: "[--now]  -  --now also stops the item currently running"
+---
+
+
+# multi-agent autopilot-off  -  stop picking work up
+
+Removes the schedule. **Work already in flight finishes** unless you pass
+`--now`: an item stopped mid-development leaves a worktree and a half-written
+branch, which is the exact state this release spent its time cleaning up.
+
+## Steps
+
+### 1. Say what is in flight before stopping anything
+
+```bash
+bash "$HOME/.claude/scripts/autopilot-status.sh" --short
+```
+
+When something is running, name it and how long it has been going. "Stopped"
+means something different when an item is 2 minutes from a PR than when the queue
+is idle, and the user is the one who knows which.
+
+### 2. Remove the schedule
+
+```bash
+L="com.multi-agent.autopilot"
+launchctl bootout "gui/$(id -u)/$L" 2>/dev/null || launchctl unload "$HOME/Library/LaunchAgents/$L.plist" 2>/dev/null
+rm -f "$HOME/Library/LaunchAgents/$L.plist"
+```
+
+The plist is removed rather than left disabled, because its presence is the
+definition of on: a disabled-but-present job is a third state nobody can read
+from the outside.
+
+### 3. Release the sleep assertion and the indicator
+
+```bash
+pkill -f 'caffeinate -i -w' 2>/dev/null || true       # only the one this mode holds
+pkill -f "$HOME/.claude/autopilot/bin/menubar" 2>/dev/null || true
+```
+
+### 4. `--now` only: end the in-flight item deliberately
+
+Without `--now` nothing here runs. With it, the child session is stopped and the
+run is marked `abandoned`, its worktree is removed **unless it holds uncommitted
+work**, in which case the work is stashed to `autopilot/abandoned/<task-id>` and
+the worktree is kept. Same contract as `gc-abandoned.sh`; losing a day of edits
+is worse than 750 MB.
+
+### 5. Keep the selection
+
+`~/.claude/autopilot/config.json`, `queue.json` and `attempted.jsonl` all stay.
+Turning the mode back on must not re-ask which repos, and the attempt history is
+what stops an item that already failed twice from being retried forever.
+
+To forget the selection as well: `rm -rf ~/.claude/autopilot`. Say that rather
+than doing it - "off" and "forget everything" are different requests.
+
+### 6. Report
+
+State that it is off, what was left running or finishing, and that the repo
+selection is kept. If an item was stashed, name the branch.

package/pipeline/skills/shared/core/multi-agent-autopilot-on/SKILL.md

@@ -0,0 +1,146 @@
+---
+name: multi-agent-autopilot-on
+language: en
+description: "Turn on continuous mode on THIS machine: pick the repos it watches; labelled GitHub issues and assigned+labelled Jira items then run in a worktree and stop at an open PR. Use when the machine should pick work up unattended."
+user-invocable: true
+argument-hint: "(no arguments  -  opens the repo picker)"
+---
+
+
+# multi-agent autopilot-on  -  continuous mode, on this machine
+
+Turns on the mode that picks work up without being asked. **No repo is included
+by default and none is ever added implicitly** - you choose, here, every time.
+
+Why a picker rather than a label alone: measured on one machine, 66 repos grant
+push and a good half belong to other people. A label is a filter; anyone who can
+open an issue in a repo you happen to have push on could add one. The gate is
+this selection, and it is per machine.
+
+## Steps
+
+### 1. Prerequisites, stated before anything is written
+
+```bash
+gh auth status >/dev/null 2>&1 || echo "BLOCKED: gh is not authenticated - run 'gh auth login'"
+command -v jq >/dev/null 2>&1 || echo "BLOCKED: jq is required"
+node "$HOME/.claude/scripts/doctor.mjs" >/dev/null 2>&1; [ "$?" -ge 2 ] && echo "BLOCKED: doctor reports a blocking problem - fix it first"
+```
+
+Any BLOCKED line stops here and is reported. Arming unattended work on an install
+that `doctor` calls broken produces a queue of failures, one per item.
+
+### 2. The repo list, both halves of it
+
+```bash
+bash "$HOME/.claude/lib/autopilot-activation.sh" list
+```
+
+Two states come back and **both are shown**:
+
+- `eligible` - push rights and a checkout on this machine
+- `unavailable` - push rights, no local checkout, listed WITH that reason
+
+Never hide the second list. Dropping 51 of 66 rows silently looks exactly like a
+permissions problem, and the user goes hunting for a token fault that does not
+exist.
+
+### 3. Pick, with the current selection already checked
+
+Read `~/.claude/autopilot/config.json` if it exists, then one `AskUserQuestion`
+(`multiSelect: true`) over the **eligible** rows:
+
+- `question` (in `outputLanguage`): which repos this machine should pick work up from
+- `header`: "Repos" (English, UI contract)
+- `options`: one per eligible repo, currently-selected ones marked "(seçili)" / "(selected)"
+
+**This is how repos are added and removed.** Checking a new one adds it;
+unchecking an existing one removes it. There is no `add-repo` / `remove-repo`
+command, because two entry points to one list is two lists.
+
+Unavailable repos are printed above the question as a plain list with their
+reason, not offered as options.
+
+### 4. Sources and label, per selected repo
+
+One `AskUserQuestion` per newly added repo (already-configured ones keep their
+answers - re-running must not re-ask what was already settled):
+
+- Sources: `GitHub issues` / `Jira` / both
+- Label: default **`agent-queue`** on both sides, editable
+
+The same name works on both sides and both mechanisms already exist:
+
+| Source | Query | Extra condition |
+|---|---|---|
+| GitHub | `gh issue list --repo <r> --label <label> --state open` | none - the label is the whole gate |
+| Jira | `assignee = currentUser() AND labels = "<label>" AND resolution = EMPTY AND status not in (Done, Closed, Cancelled)` | **assigned to you**, so a label somebody else adds is not enough |
+
+Two Jira caveats worth saying out loud when Jira is selected: labels are one
+global namespace across the whole instance and anyone can write them, so on a
+shared instance prefer a qualified name (`agent-queue-<team>`); and the Labels
+field has to be on the edit screen for the issue types in play. An instance where
+neither holds is a `jiraJql` config change - a saved filter, a component - not a
+redesign.
+
+### 5. Write the config
+
+Validate against `schemas/autopilot-config.schema.json`, then write
+`~/.claude/autopilot/config.json` (0600, in a 0700 directory) via
+`ma_ap_write` in `lib/autopilot-state.sh`. Defaults that are not asked:
+`slots: 1`, `scanIntervalSeconds: 120`, `maxAttempts: 2`,
+`askOnLowMaturity: true`, `costCeilingUsd: 25`, `depthRouter: "off"`.
+
+### 6. Build the menu bar indicator (best effort)
+
+```bash
+SRC="$HOME/.claude/scripts/autopilot-menubar.swift"
+OUT="$HOME/.claude/autopilot/bin/menubar"
+if command -v swiftc >/dev/null 2>&1; then
+  swiftc -O "$SRC" -o "$OUT" 2>/dev/null && chmod 700 "$OUT"
+fi
+```
+
+Built from source on demand, never shipped as a binary: the package contains only
+text today, and a compiled artifact in it would need signing and notarization to
+be distributable. No `swiftc` means no indicator and nothing else changes - say
+so in one line rather than failing. `autopilot-status` works either way.
+
+### 7. Confirm the schedule, naming the file
+
+Render `templates/multi-agent-autopilot.plist.template` and show the resolved
+**path** and interval, then `AskUserQuestion`:
+
+- `question`: install the schedule at `~/Library/LaunchAgents/com.multi-agent.autopilot.plist` and start picking work up?
+- options: `{ label: "Start" }` / `{ label: "Configure only", description: "Save the repo selection, do not schedule anything yet" }`
+
+"Configure only" is a real answer and the safe default to offer first: the queue
+can be watched with `autopilot-status` for a while before anything runs.
+
+On **Start**:
+
+```bash
+launchctl bootstrap "gui/$(id -u)" "$HOME/Library/LaunchAgents/com.multi-agent.autopilot.plist" 2>/dev/null \
+  || launchctl load "$HOME/Library/LaunchAgents/com.multi-agent.autopilot.plist"
+```
+
+### 8. Report what is now true
+
+Say all five, because each one is something a user has asked about after the
+fact: which repos and which labels; that it survives a restart with no command to
+run (launchd loads at **login** - not boot, and that is correct, because the login
+keychain is what unlocks the tokens, so a run before login could not reach Jira or
+GitHub anyway); that the machine will be kept awake **only on AC**; the slot count
+and the ceiling this machine would allow (`ma_ap_slot_ceiling`); and that
+`/multi-agent:autopilot-off` is the only way to stop it.
+
+## What this does not do
+
+- **No cap on PRs.** As many items as carry the label become as many PRs. The
+  bounds are `costCeilingUsd` over a rolling 24 hours and what the machine can
+  hold - never a daily count.
+- **Does not merge.** The runner stops at an open PR; the merge decision stays
+  yours.
+- **Does not touch an attended run.** Both are worktrees and per-repo concurrency
+  is 1, so the queue skips a repo you are working in rather than competing for
+  `.git/index.lock`.