@mmerterden/multi-agent-pipeline 17.5.1 → 18.0.0

package/CHANGELOG.md

@@ -14,6 +14,282 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [18.0.0] - 2026-09-17
+
+Major, for two behaviour changes rather than a renamed command: a run's state now
+has ONE canonical directory, and four publish paths refuse to send when the leak
+gate cannot be loaded.
+
+### Added
+
+- **`multi-agent-pipeline verify`** answers "is this install the thing that was
+  published". The install is a copy, and from the moment `install.js` writes it
+  the two halves drift independently: an edit in the installed tree is behaviour
+  with no source, and a file the installer skipped is a script the docs describe
+  and nobody has. `manifest.json` (SHA-256 per shipped file, version, source
+  commit) is built at pack time by `prepack` and never committed - a manifest in
+  git is stale one commit after it is written, and a stale manifest reports
+  honest edits as tampering.
+
+  `commands/` is compared by presence, not bytes, because `install.js` rewrites
+  each description into the user's `outputLanguage`: measured here, all 57
+  command files differ and 56 of them differ by nothing else. Dev-only files are
+  excluded, or 252 smokes and linters read as "the installer skipped this".
+
+  What a green result proves is stated in the output's own reference: the bytes
+  match what the publisher recorded. Not who published them - the manifest, the
+  signature and the verifier travel in the same tarball, so provenance belongs
+  to npm's integrity field. Signing is optional, and an unverifiable signature
+  says so rather than claiming valid.
+
+- **`cost-analyze.mjs`** - projection, anomaly, burn and diff. `cost-budget-check`
+  watches one run against one ceiling, which is blind to both ways a budget
+  actually empties: a drift no single run trips, and one session that burns a
+  week in an hour while every run stays under its cap.
+
+  The series is not where the schema says it is. `tracker-state.json` carries
+  per-phase token fields that are written only when a phase reports them; of 98
+  trackers on a working machine, zero carry any. The dense series is the host's
+  own transcripts, so that is what this reads - and the consequences are printed
+  rather than buried: it covers everything Claude Code did on the machine, the
+  figures are LIST-price estimates rather than a bill, and a host with no
+  transcripts reports UNMEASURED instead of zero.
+
+  Anomalies use the median and the MAD, because the expensive session the check
+  exists to find is the observation that inflates a mean and a standard
+  deviation - it hides inside the statistic measured against it.
+
+- **`install --unattended`** writes a documented permission profile, and prints
+  it with a reason per line before writing. autopilot passes
+  `--permission-prompts none`, which stops Claude Code asking and grants
+  nothing; on a fresh machine the run stops at the first tool call with no
+  prompt for anyone to answer, which is indistinguishable from an empty queue. A
+  default install still writes no permissions at all.
+
+- **`doctor --profile=server`** adds four checks that only matter when nobody is
+  at the keyboard: the unattended contract, the permission posture, the
+  scheduler, and the keychain. The default run is unchanged - same 17 checks,
+  same verdict - because a laptop told it fails a server check learns to ignore
+  doctor.
+
+- **`docs/server-readiness.md`** sets up nothing and says so first. It covers the
+  permission posture, why the scheduler is a LaunchAgent rather than a
+  LaunchDaemon (the keychain is locked until login, and that failure arrives
+  much later wearing a 401), and which credential each phase needs.
+
+- **`scorecard-snapshot.mjs --diff`** keeps what the scorecard said and reports
+  what moved. Deliberately no 0-100 score: the scorecard reports twelve measured
+  metrics AND four it refuses to measure, and one figure would hide both halves.
+
+### Changed
+
+- **A run's state has one canonical directory.** `{project}/{taskId}/` is
+  canonical and the flat `{taskId}/` is read for compatibility; every reader
+  resolves through `lib/run-paths.sh` / `scripts/_run-paths.mjs`, so a run that
+  exists in both layouts is counted once.
+
+- **Five publish paths refuse rather than send when the leak gate is missing.**
+  Jira comments and descriptions, PR review bodies and inline comments, the
+  GitHub issue progress comment, the issue-CREATION path, and Confluence page
+  create/update all run their outbound text through `lib/outbound-gate.mjs`
+  first. A missing gate file refuses; opening the gate because the gate is not
+  there would be the one failure mode that matters. The count is part of the
+  gate: a sixth publisher cannot ship without the smoke's list naming it.
+
+- **`set -e` on the four destructive scripts, and deliberately not on the two
+  collectors.** `gc-abandoned`, `gc-worktrees`, `purge` and `worktree-finalize`
+  delete things, so the command after an unnoticed failure is the dangerous one.
+  `pre-push-check` runs the gates and counts failures, and `pre-commit-check` is
+  a hook built out of greps that are supposed to find nothing - under `-e` the
+  first clean detector would end the scan and report "no secrets" for a file it
+  never finished reading.
+
+### Fixed
+
+- **A script that dies now prints one line instead of a stack dump, and releases
+  what it held.** `lib/fatal.mjs` catches the sync throw, the rejection nobody
+  awaited and the throw from inside a callback; the last two are invisible to a
+  try/catch around `main()`. `write-state` releases its advisory lock on the way
+  out, so the next writer never has to judge a lock on age alone. EPIPE is
+  deliberately not fatal: `runs-index.mjs --json | head` is the ordinary way to
+  read a large output.
+
+- **Build junk no longer reaches an install.** A CI runner shipped 147 files
+  where every developer tree shipped 146, for four rounds, and the extra was
+  `__pycache__/*.pyc` - untracked, so no diff of the source could show it, and
+  copied verbatim into all three install trees. `copyDir` now filters
+  `__pycache__`, `*.pyc` and `.DS_Store` on every path.
+
+- **`jq` is required rather than optional on the nine paths that publish or
+  decide.** A missing `jq` renders as empty DATA and the work carries on with
+  it; those nine now exit 3.
+
+- **The autopilot runner survives a month unwatched.** `runner.log` is truncated
+  in place past 5MB (renaming it leaves launchd's `O_APPEND` descriptor writing
+  into the renamed file while the new one stays empty - the rotation that looks
+  right and silently stops logging), three consecutive empty attempts stop new
+  work being taken, and one JSON line per tick goes to `ticks.jsonl`.
+
+- **`github-ssh-setup.sh` no longer waits forever on a headless machine**, and
+  `write-state.mjs` gained `--if-rev=<n>` compare-and-swap so a second writer
+  cannot silently overwrite the first.
+
+- **A direct-run guard that compared `import.meta.url` to `file://${argv[1]}`**
+  is false whenever argv[1] is not already resolved - a `/var` path that
+  resolves to `/private/var`, or the symlink `install --link` writes. The script
+  then does nothing at all, silently.
+
+---
+
+## [17.6.0] - 2026-09-15
+
+### Added
+
+- **The maturity check now has an effect (`prefs.global.maturityFollowup`).** It
+  has always produced a machine-readable gap list - stable codes in `blockers[]`
+  and `warnings[]` - and then thrown most of it away. A blocker halted the run,
+  an autopilot queue moved to the next item, and the item stayed exactly as
+  immature as it was found. Nobody was told, so nothing changed, so the next
+  scan halted on the same item for the same reason. The check was doing its job
+  and producing no effect.
+
+  **Interactive runs ask at the step instead of ending at it**: open the item and
+  fix it, continue without it (recording in `state.maturity.accepted[]` *which*
+  gap was waved through, which is what separates an informed continue from a
+  skipped check), or abort. `askInteractively: false` restores the old halt.
+
+  **Autopilot can ask on the item itself**, behind
+  `autopilotCommentsOnIssue` (**off by default**, because it is an outward-facing
+  write). One comment naming what is missing, then a halt on the circuit breaker
+  with `state.waitingFor = "maturity"`. A question, never a state change: no
+  transition, no resolution, no assignee, no label, no close. `Ref:` never
+  `Closes:`. Copy in `outputLanguage`, and the gap wording is the fetcher's own
+  `maturity.summary` verbatim rather than a second copy of that table.
+
+  **"Have we already asked" is read off the ITEM, not off our state file.** An
+  autopilot scan is a new run with a fresh `agent-state.json`, so a state-only
+  record would make every scan a first ask - the wall of identical bot comments
+  this feature exists to prevent. The comment therefore carries its own gap set
+  on a last line (`multi-agent gaps: code,code`) and the next pass takes the
+  newest comment of ours. Neither the marker nor that line uses square brackets:
+  `[text]` is a link in Jira wiki markup, and Jira is where this comment is most
+  likely to land. The contract is carried on all three hosts - the Claude command
+  tree, and the `shared/core` skills that Copilot dispatches and Codex reads.
+
+  **The rule that shapes the rest: an edit is a reason to look again, never proof
+  the gap closed.** A reply reading "will do later" moves the timestamp and fixes
+  nothing, so a changed item is re-fetched and re-scored and the *check* decides.
+  Only a genuinely DIFFERENT gap set earns a second comment - otherwise an
+  unattended queue turns an item into a wall of identical bot text. "Cannot tell
+  whether it moved" resolves to re-check, never to wait, because folding unknown
+  into "nothing changed" parks a run forever on a tracker that omits the field.
+
+  Warnings still auto-continue under autopilot. Converting them to halts in a
+  release would stall queues overnight on items that ran fine yesterday;
+  `commentOnWarnings` raises them opt-in, and the gaps are recorded either way.
+
+> Four of the additions below started as ideas in a public Claude Code
+> configuration repo (`worldflowai/everything-claude-code`). No code was taken:
+> that copy ships no LICENSE file and the GitHub API reports none, and the same
+> call was already made twice here (ADR-0010 on `graphify`, and swiftlens). Each
+> idea was re-derived against this pipeline's own constraints - zero runtime
+> dependencies, macOS only, stdout is the MCP server's JSON-RPC channel - and
+> most of what that repo does was already covered here, in a gated form.
+
+- **The node stacks no longer type `npm` (`pipeline/scripts/package-manager.mjs`).**
+  Phase 3's web test arm and its build step were hardcoded, so a repo on pnpm,
+  yarn or bun failed in Phase 3 - with a worktree and a branch already created -
+  or, worse, npm resolved against a lock file it does not own and the run
+  continued on a tree the repo's own tooling would never have produced. The
+  manager is now resolved from the repo: `$MA_PACKAGE_MANAGER`, then
+  `package.json#packageManager`, then a lock file, then npm reported AS a
+  default rather than as evidence. Node core only, per ADR-0004. Two lock files
+  means a migration left one behind: the newest wins and both are named. Exit 3
+  means the repo declares no such script, which is the `--if-present` case
+  answered by an exit code instead of a flag whose support differs per manager.
+  The resolved name goes through the phase's `eval`, so it is held to the shape
+  a binary actually has and the gate proves it by eval'ing the produced line
+  with every manager stubbed out. iOS and Android are untouched.
+  `refs/features/package-manager.md`.
+
+- **A `PreCompact` hook, so a compaction does not eat what a phase learned.**
+  `SessionEnd` capture exists because every durable write used to live in Phase
+  7, the phase a run is least likely to reach. An auto-compaction is that same
+  failure one level down: it summarizes the conversation while a long Phase 3 or
+  Phase 4 is still running, and anything not yet flushed is gone before
+  `SessionEnd` ever fires. The template now wires `capture-flush.sh` there,
+  deliberately WITHOUT `--if-stale` - that test exists so a session exit does not
+  re-flush a finished run, and at a compaction what matters is whether anything
+  is unflushed, not whether the run finished. Both store writes are idempotent.
+  `doctor`'s `hook-coverage` check reports it as missing until the block is
+  merged, at no extra cost, because that check diffs the template generically.
+
+- **`doctor` now counts the MCP servers this host has registered (`mcp-surface`).**
+  `mcp-registration` answers "is ours registered". Nobody was answering the
+  question the user never gets asked: every registered server sends its tool
+  list on every turn, they are added one at a time, and our own toolkit is 99
+  tools by itself. The check only ever REPORTS - INFO above
+  `prefs.global.mcpSurface.infoAbove` (default 8), `--explain` lists the names,
+  and it never blocks, never warns and never disables anything, because how many
+  servers are worth their context is the user's call and not a health failure.
+  The threshold is judgement, which is why it is a pref instead of a constant
+  nobody can see.
+
+- **`GRAPH_REPORT.md` gained "Symbols nothing else references".** The report
+  found unconnected FILES; a file imported for one symbol while three of its
+  other exports were dead has edges, so those exports were invisible. The join
+  is a query over data the graph already held. Candidates, never verdicts, and
+  it gates nothing: ADR-0010 records that the extractor is regex over
+  comment-stripped source, not a parser, so dynamic dispatch, reflection,
+  string-keyed lookup and a public API consumed outside the repo all look like
+  dead code from here. Four classes are excluded and COUNTED rather than listed,
+  because they could not carry a reference edge however heavily used they are: a
+  kind outside the stack's `referenceKinds`, a name declared in more than one
+  place, a nested declaration, and anything in a test file. Symbols referenced
+  only from tests are listed separately - not dead code, but code whose only
+  consumer is its own test.
+
+### Fixed
+
+- **`/multi-agent:resume` started from `currentPhase + 1` unconditionally**, so a
+  run that stopped mid-phase to ask a human resumed past the question. It reads
+  `state.waitingFor` first now. This was already broken for Phase 7's channels
+  pause, which documented itself as resumable through that field while
+  `resume/SKILL.md` never mentioned it - one fix, two callers.
+
+- **Only one machine in the world was reporting usage, and nothing was red.**
+  Operational reporting needs `usageLog.enabled` AND a token that resolves, and
+  both were arranged in exactly one place: `/multi-agent:update`, as forty lines
+  of shell embedded in the skill. A user who installed the package, ran
+  `/multi-agent:setup` (which said registration happens in update) and worked for
+  weeks never registered, never reported, and an empty panel reads exactly like
+  nobody using the pipeline. Copilot and Codex were worse off still: their own
+  `setup` and `update` skills never mentioned registration at all.
+
+  It is now one script (`pipeline/scripts/usage-register.mjs`) called from the
+  five surfaces where a machine can first become real - setup and update on
+  Claude Code, the same two on the cross-CLI surface, and the Phase 0 exit gate
+  as the backstop for a machine that reached neither. Same fence as before, now
+  enforced in one place: the token is REQUESTED and write-only, it lands in the
+  credential store and never in a file, `usageLog.optOut: true` blocks everything
+  permanently and is checked before the network call, and an unreachable endpoint
+  leaves reporting off with one line and exit 0 - a caller is never failed over
+  bookkeeping. `--json` distinguishes "you opted out" from "we could not reach
+  it", because those are different facts about the same empty panel. A machine
+  that has a token but `enabled: false` (a run interrupted between the two
+  writes) is repaired rather than left silent. `refs/features/usage-reporting.md`,
+  `smoke-usage-register.sh`.
+
+- **`state.maturity` was written by every issue-shaped run and forbidden by the
+  schema.** `agent-state.schema.json` has `additionalProperties: false`, and
+  `maturity` was not declared - it survived only on the grandfather list of
+  `smoke-state-keys-declared.sh`. Declared now, along with `maturityFollowup`
+  and `waitingFor`, whose two values (`maturity`, `user-channels-choice`) are the
+  two places a run pauses INSIDE a phase rather than between two. The grandfather
+  list is two entries shorter, and it only ever shrinks.
+
+---
+
 ## [17.5.1] - 2026-09-15
 
 ### Documentation

package/README.md

@@ -17,7 +17,7 @@ Runs natively on Claude Code, Copilot CLI and Codex CLI. macOS only. Zero runtim
 ### Prerequisites
 
 - **Node.js >= 20.11** - required; the pipeline's own tooling runs on it.
-- **`jq`** - optional but recommended. Thirteen shell helpers reach for it and skip in silence without it: cost summaries, the phase tracker's JSON reads, convention extraction, skill signing. The install prints a note when it is missing.
+- **`jq`** - required for nine paths, optional for the rest. 78 shell files call it. The nine that publish or decide - the autopilot queue, Jira comments, PR reviews, issue updates, the plan file, both Figma fetchers, log search and Jira auth - now refuse with exit 3 rather than run, because a missing `jq` renders as empty DATA and the work carries on with it. Everywhere else it still degrades. The install prints a note when it is missing.
 - **`gh`** - for GitHub issue and PR work. Its built-in `--jq` is independent of the `jq` binary.
 
 ## Quick Start
@@ -33,6 +33,41 @@ npx @mmerterden/multi-agent-pipeline install --all       # all three
 /multi-agent:setup          # keychain token scan + git identity + default stack
 ```
 
+### No `npx` on that machine?
+
+`npx` ships with npm, and npm ships with Node - so "npx: command not found" almost
+always means Node is missing from that shell, not that anything is wrong with the
+package. Check first, then pick the row that matches:
+
+```bash
+node -v; npm -v; command -v node npm npx
+```
+
+| What you see | What to do |
+|---|---|
+| nothing at all | Install Node >= 20.11: `brew install node`, or the LTS installer from nodejs.org |
+| `node` works, `npx` does not | `npm i -g @mmerterden/multi-agent-pipeline` then `multi-agent-pipeline install --claude` |
+| nvm is installed but the shell does not see it | `source ~/.nvm/nvm.sh && nvm use --lts`, or just open a new terminal |
+| npm is ancient (< 5.2, which predates npx) | `npm i -g npm@latest`, or use the global-install row above |
+
+And the path that needs neither `npx` nor a global install - clone and run the
+installer directly:
+
+```bash
+git clone https://github.com/mmerterden/multi-agent-pipeline.git
+cd multi-agent-pipeline
+node index.js install --claude        # add --dry-run first to see what it would write
+```
+
+`npm exec @mmerterden/multi-agent-pipeline install --claude` also works on any npm
+7+ without `npx` on `PATH`.
+
+**One error that is not an npx problem.** This package declares `os: ["darwin"]`,
+so npm refuses to install it anywhere else and says `npm ERR! notsup Unsupported
+platform`. That is deliberate ([ADR-0012](./docs/adr/0012-macos-only.md)), not a
+missing tool: every credential read shells `security`, every iOS build
+`xcodebuild`, every piece of visual evidence `simctl`.
+
 Tool flags combine (`--claude --codex`). With no tool flag at all, the installer targets Claude Code only. Other flags: `--dry-run` (show what would be written, write nothing), `--platform=ios|android|all` (skip the stack skills you do not need), `--link` (symlink instead of copy, for local development).
 
 Run a task - the input type is auto-detected:
@@ -72,6 +107,29 @@ checkout):
 
 `/multi-agent:analysis` runs its own shorter chain and, since v16.12.0, reviews what it wrote before publishing it: the draft goes through the same three-reviewer set and triage as a code diff, a blocking finding returns it to synthesis with dispatch closed, and the gaps that survive are either searched, asked about, or recorded with an owner. It used to publish behind a structural validator alone.
 
+### 18.0.0: one state directory, and a way to ask whether your install is real
+
+- **`multi-agent-pipeline verify`.** The install is a copy, and from the moment it is written the two halves drift independently: an edit in the installed tree is behaviour with no source, and a file the installer skipped is a script the docs describe and nobody has. `verify` compares both against a manifest built at pack time. What a green result proves is stated plainly - the bytes match what the publisher recorded, not who published them.
+- **Cost, past the single run.** The per-task ceiling cannot see the two ways a budget actually empties: a drift that trips nothing, and one session that burns a week in an hour while every run stays under its cap. `cost-analyze` projects, finds days out of family by median absolute deviation, and reports acceleration - as LIST-price estimates, which it says on every run rather than in a footnote.
+- **A run's state lives in one place.** `{project}/{taskId}/` is canonical, the flat layout is still read, and a run that exists in both is counted once.
+- **Server readiness, entirely opt-in.** `doctor --profile=server` adds four checks that only matter when nobody is at the keyboard, `install --unattended` writes a permission profile after printing it, and the autopilot runner now survives a month unwatched. The default install writes no permissions and the default doctor run is unchanged, because a laptop told it fails a server check learns to ignore doctor.
+
+### Your package manager, your hooks, your MCP surface
+
+Three smaller things in 17.6.0, each closing a gap where the pipeline assumed instead of looking:
+
+- **Phase 3 stopped typing `npm`.** A repo on pnpm, yarn or bun used to fail in the development phase, with a worktree and a branch already created. The manager is resolved from the repo now - an env override, then `package.json#packageManager`, then the lock file, then npm reported as a default rather than as evidence. iOS and Android are untouched.
+- **A compaction no longer eats what a phase learned.** The capture hook ran at session end; an auto-compaction summarizes a long review or development phase while it is still running, and anything not yet written was gone before session end ever fired. The hooks template now flushes at `PreCompact` too.
+- **`doctor` counts your MCP servers.** Every registered server sends its tool list on every turn and they are added one at a time, so nobody ever sees the total. It reports the count and nothing else: no warning, no blocking, no disabling.
+
+### Maturity: the check now has an effect
+
+Phase 0 scores how ready the item is before anything is built, and until 17.6.0 it scored and stopped: a blocker halted the run, an autopilot queue moved on, and the item stayed exactly as immature as it was found. Nobody was told, so nothing changed, so the next scan halted on the same item for the same reason.
+
+An interactive run now **asks at that step** - open the item and fix it, continue without it, or abort - and records which gap you waved through rather than just that you continued. An autopilot run can be told to **ask on the item itself** (`prefs.global.maturityFollowup.autopilotCommentsOnIssue`, off by default): one comment naming what is missing, then it stops and waits. Never a status change, never an assignee, never a close, `Ref:` and never `Closes:`.
+
+Edit the item and the next scan re-checks it; if the gap closed, development starts on its own. An edit is only a reason to look again - a reply reading "will do later" moves the timestamp and fixes nothing, so the check re-runs against the new content and decides. The same question is never asked twice.
+
 ### Base branch: evidence, then a question
 
 Phase 0 Step 3 collects the candidates **with the evidence behind each one** before it asks. An issue carrying a target version, or linking a separate issue that represents the release, already names the branch on a repo whose release branches encode the version - so that becomes a ranked row whose description says why, next to rows that say "the repository's default branch" or "you used this last time". You still choose; the evidence only reorders.

package/README.tr.md

@@ -33,6 +33,40 @@ npx @mmerterden/multi-agent-pipeline install --all       # üçü birden
 /multi-agent:setup          # keychain token taraması + git kimliği + varsayılan stack
 ```
 
+### O makinede `npx` yoksa
+
+`npx` npm ile, npm de Node ile gelir - yani "npx: command not found" neredeyse her
+zaman o kabukta Node olmadığı anlamına gelir, pakette bir sorun olduğu değil. Önce
+bak, sonra sana uyan satırı uygula:
+
+```bash
+node -v; npm -v; command -v node npm npx
+```
+
+| Gördüğün | Yapılacak |
+|---|---|
+| hiçbiri yok | Node >= 20.11 kur: `brew install node` ya da nodejs.org'dan LTS installer |
+| `node` çalışıyor, `npx` çalışmıyor | `npm i -g @mmerterden/multi-agent-pipeline` sonra `multi-agent-pipeline install --claude` |
+| nvm kurulu ama kabuk görmüyor | `source ~/.nvm/nvm.sh && nvm use --lts`, ya da yeni bir terminal aç |
+| npm çok eski (< 5.2, npx'ten önceki sürümler) | `npm i -g npm@latest`, ya da üstteki global kurulum satırı |
+
+Ne `npx` ne de global kurulum isteyen yol - klonla ve installer'ı doğrudan çalıştır:
+
+```bash
+git clone https://github.com/mmerterden/multi-agent-pipeline.git
+cd multi-agent-pipeline
+node index.js install --claude        # önce --dry-run ile ne yazacağını görebilirsin
+```
+
+`npm exec @mmerterden/multi-agent-pipeline install --claude` de, `PATH`'te `npx`
+olmayan her npm 7+ üzerinde çalışır.
+
+**npx sorunu olmayan bir hata.** Bu paket `os: ["darwin"]` beyan eder; npm başka
+hiçbir yerde kurmaz ve `npm ERR! notsup Unsupported platform` der. Bu kasıtlıdır
+([ADR-0012](./docs/adr/0012-macos-only.md)), eksik bir araç değil: her credential
+okuması `security`, her iOS build'i `xcodebuild`, her görsel kanıt `simctl`
+çağırıyor.
+
 Tool flag'leri birleştirilebilir (`--claude --codex`). Hiç tool flag'i verilmezse installer sadece Claude Code'u hedefler. Diğer flag'ler: `--dry-run` (ne yazılacağını gösterir, hiçbir şey yazmaz), `--platform=ios|android|all` (ihtiyacın olmayan stack skill'lerini atlar), `--link` (kopyalamak yerine symlink, lokal geliştirme için).
 
 Bir görev çalıştır - girdi tipi otomatik algılanır:
@@ -72,6 +106,29 @@ mu):
 
 `/multi-agent:analysis` kendi kısa zincirini koşar ve v16.12.0'dan beri yazdığını yayınlamadan önce review ediyor: taslak, bir kod diff'iyle aynı üç-reviewer setinden ve triyajdan geçiyor, bloklayıcı bulgu dokümanı sentez fazına geri gönderip dispatch'i kapatıyor, hayatta kalan boşluklar ya aranıyor ya sana soruluyor ya da sahibiyle birlikte kayda giriyor. Önceden yalnızca yapısal bir validator'ın arkasından yayınlıyordu.
 
+### 18.0.0: tek bir durum dizini, ve kurulumun gerçekten o kurulum olup olmadığını sorma yolu
+
+- **`multi-agent-pipeline verify`.** Kurulum bir kopyadır ve yazıldığı andan itibaren iki taraf birbirinden bağımsız kayar: kurulu ağaçtaki bir düzenleme kaynağı olmayan bir davranıştır, kurulumun atladığı dosya ise dokümanın anlattığı ama kimsede olmayan bir script. `verify` ikisini de paketleme anında üretilen bir manifest'e karşı karşılaştırır. Yeşil sonucun ne kanıtladığı açıkça yazılıdır: baytlar yayıncının kaydettiğiyle aynıdır, kimin yayınladığı değil.
+- **Maliyet, tek koşunun ötesinde.** Görev başına tavan, bütçeyi gerçekten bitiren iki şeyi göremez: hiçbir koşuyu aşmayan kayma, ve her koşu tavanın altında kalırken bir saatte bir haftayı yakan tek oturum. `cost-analyze` projeksiyon yapar, medyan mutlak sapmayla aileden ayrılan günü bulur ve ivmeyi raporlar - liste fiyatından tahmin olarak, ve bunu dipnotta değil her koşuda söyler.
+- **Bir koşunun durumu tek yerde.** `{project}/{taskId}/` kanonik, düz yerleşim hâlâ okunuyor, ve iki yerde birden duran koşu bir kez sayılıyor.
+- **Sunucu hazırlığı, tamamen opt-in.** `doctor --profile=server` yalnızca klavyede kimse yokken anlamı olan dört kontrol ekler, `install --unattended` izin profilini yazmadan önce gösterir, autopilot runner artık bir ay gözetimsiz ayakta kalır. Varsayılan kurulum hiçbir izin yazmaz ve varsayılan doctor koşusu değişmez: sunucu kontrolünden kaldığı söylenen bir dizüstü, doctor'ı görmezden gelmeyi öğrenir.
+
+### Paket yöneticisi, hook'lar ve MCP yüzeyi
+
+17.6.0'da üç küçük iş; üçü de pipeline'ın bakmak yerine varsaydığı bir yeri kapatıyor:
+
+- **Faz 3 artık `npm` yazmıyor.** pnpm, yarn ya da bun kullanan bir repo geliştirme fazında, worktree ve branch zaten açılmışken patlıyordu. Yönetici artık reponun kendisinden çözülüyor: önce ortam değişkeni, sonra `package.json#packageManager`, sonra lock dosyası, sonra kanıt değil varsayılan olarak bildirilen npm. iOS ve Android'e dokunulmadı.
+- **Compaction bir fazın öğrendiğini artık yemiyor.** Yakalama hook'u oturum sonunda koşuyordu; otomatik compaction ise uzun bir review ya da geliştirme fazını tam koşarken özetliyor ve henüz yazılmamış olan her şey oturum sonu hiç gelmeden kayboluyordu. Hook şablonu artık `PreCompact`'te de yazıyor.
+- **`doctor` MCP sunucularını sayıyor.** Kayıtlı her sunucu her turda araç listesini gönderiyor ve sunucular teker teker ekleniyor, yani toplamı kimse görmüyor. Sadece sayıyı bildiriyor: uyarı yok, engelleme yok, kapatma yok.
+
+### Olgunluk: kontrolün artık bir sonucu var
+
+Faz 0 hiçbir şey inşa edilmeden önce maddenin ne kadar hazır olduğunu puanlıyor, ve 17.6.0'a kadar puanlayıp duruyordu: bir blocker koşuyu durduruyor, autopilot sırası bir sonraki maddeye geçiyor, madde bulunduğu kadar olgunlaşmamış kalıyordu. Kimseye söylenmediği için hiçbir şey değişmiyor, bir sonraki tarama aynı maddede aynı sebeple duruyordu.
+
+İnteraktif koşu artık **o adımda soruyor** - maddeyi açıp düzelt, onsuz devam et, ya da iptal - ve yalnızca devam ettiğini değil, hangi eksiği görmezden geldiğini kaydediyor. Autopilot koşusuna ise **maddenin kendisine sorması** söylenebiliyor (`prefs.global.maturityFollowup.autopilotCommentsOnIssue`, varsayılan kapalı): eksiği adıyla söyleyen tek bir yorum, sonra durup bekliyor. Durum değişmiyor, atanan kişi değişmiyor, kapatma yok; `Ref:` var, `Closes:` yok.
+
+Maddeyi düzenlediğinde bir sonraki tarama yeniden kontrol ediyor; eksik kapandıysa geliştirme kendiliğinden başlıyor. Düzenleme yalnızca yeniden bakma sebebi - "sonra yaparım" diyen bir yorum da damgayı ilerletir ve hiçbir şeyi düzeltmez, o yüzden kontrol yeni içerik üzerinde yeniden koşup karar veriyor. Aynı soru iki kez sorulmuyor.
+
 ### Temel branch: önce kanıt, sonra soru
 
 Faz 0 Adım 3 sormadan önce adayları **her birinin arkasındaki kanıtla** topluyor. Hedef sürüm alanı taşıyan ya da release'i temsil eden ayrı bir maddeye bağlı bir issue, release dallarını sürümle adlandıran bir repoda branch'i zaten söylüyor - bu, nedenini açıklayan sıralı bir satır oluyor; yanında "reponun varsayılan dalı" ya da "geçen sefer bunu kullandın" diyen satırlar duruyor. Seçim yine senin; kanıt yalnızca sıralamayı değiştiriyor.

package/docs/adr/0011-dormant-ci.md

@@ -1,6 +1,6 @@
 # 11. CI stays in the repository but dormant; the pre-push gate is primary
 
-**Status:** Accepted · 2026-08-31 · amended 2026-09-13
+**Status:** Accepted · 2026-08-31 · amended 2026-09-13 · amended 2026-09-17
 
 > **Amendment, 2026-09-13 (ADR-0012, macOS only).** Linux and Windows support
 > was removed. `package.json` now declares `os: ["darwin"]`, which npm enforces
@@ -91,6 +91,30 @@ gate already covers everything except the three items listed above.
 only macOS, disappears when the laptop is closed, and a self-hosted runner on a
 public repository executes code from any fork's pull request.
 
+> **Amendment, 2026-09-17.** Two of those three reasons have moved.
+>
+> "Covers only macOS" stopped being a cost when ADR-0012 removed the other
+> platforms: macOS is now the only target, so a macOS-only runner covers all of
+> it.
+>
+> The fork argument is weaker than it was but is NOT gone, and the difference is
+> worth stating precisely because the plan that revisited this got it wrong.
+> The repository is private, which is the important half. It is not
+> fork-free: measured on 2026-09-17 it has **one fork**, owned by another
+> account. GitHub requires approval before a fork's pull request runs a
+> workflow, so the exposure is gated - but the gate is a setting and an
+> approval given by reflex puts that code on the runner, with the runner's
+> keychain.
+>
+> "Disappears when the laptop is closed" is the reason this is still not the
+> default. It becomes a real option only on a machine that stays awake, which
+> is what `docs/server-readiness.md` describes and why that page is a
+> prerequisite rather than a companion.
+>
+> The decision is unchanged: CI stays dormant and the pre-push gate stays
+> primary. What changed is that a self-hosted runner is now a supported option
+> for someone who has read that page, rather than a rejected one.
+
 **Delete the workflows.** Honest but lossy. The files encode which steps matter
 and in what order, and the possible issue-triggered direction would have to
 rebuild them from nothing.

package/docs/features.md

@@ -48,6 +48,8 @@ A deterministic, LLM-free map of what a repo declares and what refers to what, e
 
 Phase 1 queries it to hand Explore a ranked starting file set instead of a full scan, and Phase 7 rebuilds it after the branch changed code - a rebuild is seconds, so staleness is a `baseCommit` comparison rather than a date heuristic. Off by default behind `prefs.global.codeGraph.enabled`; with it off the pipeline behaves exactly as before.
 
+`GRAPH_REPORT.md` also ends with **Symbols nothing else references**: symbols no other file in the repo names, split from the ones referenced only by their own tests. Candidates, never verdicts - the extractor is regex, not a parser, so the four classes that could not carry a reference edge either way (a kind outside the stack's `referenceKinds`, a name declared twice, a nested declaration, a test file) are counted and excluded rather than listed, and nothing gates on the result.
+
 Measured on a 4,300-file Swift app against a grep-and-read baseline at the same 30,000-token retrieval budget: 80.4% key-fact coverage at 18,465 tokens against 66.0% at 24,555. The gain is entirely in searches phrased in domain words (63.3% against 32.0%, at under half the cost). When the task already names an exact type, `grep -lw` is still slightly better and slightly cheaper, and the command says so rather than overselling. Reasoning, trade and limits: `docs/adr/0010-own-code-graph.md`.
 
 ### Stack Auto-Detection
@@ -76,6 +78,26 @@ Stack skill sets ship as versioned plugins in the `multi-agent-plugins` marketpl
 /multi-agent:stack all         # every stack plugin
 ```
 
+### Package Manager Resolution (Phase 3, node-shaped stacks)
+
+Phase 3's web test arm and its build step used to type `npm`. A repo on pnpm, yarn or bun then failed in Phase 3 - with a worktree and a branch already created - or, worse, npm resolved against a lock file it does not own and the run continued on a tree the repo's own tooling would never have produced.
+
+`scripts/package-manager.mjs` resolves it from the repo instead: `$MA_PACKAGE_MANAGER`, then `package.json#packageManager`, then a lock file, then npm - reported AS a default, never as evidence, because "npm because nothing said otherwise" and "npm because the repo committed a package-lock" are different answers. Node core only (ADR-0004): a resolver that shelled out would need a working install of the tool it is identifying. The walk goes up to the directory holding `.git` and stops there, so a monorepo's root lock file is found and a stray one in a home directory is not. Two lock files means a migration left one behind: the newest wins and both are named.
+
+Every manager gets the explicit `run` form (a script named `test` or `add` would otherwise lose to the builtin), only npm gets the `--` separator, and `bun run test` never `bun test`. Exit 3 means the repo declares no such script - the `--if-present` case, answered by an exit code rather than a flag whose support differs per manager. The resolved name is pasted into the phase's `eval`, so it is held to the shape a binary actually has, and the gate proves that by eval'ing the produced line with every manager stubbed out. iOS and Android are untouched. `refs/features/package-manager.md`.
+
+### Maturity Follow-Up (`prefs.global.maturityFollowup`)
+
+The maturity check has always produced a machine-readable gap list - stable codes in `blockers[]` and `warnings[]` - and then thrown most of it away. A blocker halted the run, an autopilot queue moved to the next item, and the item stayed exactly as immature as it was found. Nobody was told, so nothing changed, so the next scan halted on the same item for the same reason.
+
+**Interactive runs ask at the step rather than ending at it**: open the item and fix it, continue without it, or abort. Continuing records which gap was waved through in `state.maturity.accepted[]` - that is what separates an informed continue from a skipped check. An answer typed into a picker improves this run and leaves the item as immature for the next person, so the step offers to write the supplied content back, as a separately approved write.
+
+**Autopilot can ask on the item itself**, behind `autopilotCommentsOnIssue` (off by default, because it is an outward-facing write). One comment naming what is missing, then a halt on the circuit breaker with `state.waitingFor = "maturity"` so `resume` re-enters that step. A question, never a state change: no transition, no resolution, no assignee, no label, no close; `Ref:` never `Closes:`; copy in `outputLanguage`, with the gap wording taken verbatim from the fetcher's own summary rather than re-derived.
+
+**An edit is a reason to look again, never proof the gap closed.** A reply reading "will do later" moves the timestamp and fixes nothing, so a changed item is re-fetched and re-scored and the check decides. Only a different gap set earns a second comment; "cannot tell whether it moved" re-checks rather than waiting, because folding unknown into "nothing changed" parks a run forever on a tracker that omits the field.
+
+Warnings still auto-continue under autopilot - converting them to halts would stall queues on items that ran fine yesterday. `commentOnWarnings` raises them opt-in.
+
 ### Base-Branch Evidence (Phase 0 Step 3, `prefs.global.baseBranchEvidence.enabled`)
 
 Step 3 used to ask one question with a list it could not vouch for. `git fetch origin` ran, its exit code was discarded, and `git branch -r` printed the remote-tracking cache either way - so on a restricted network a weeks-old local list was presented as the remote's answer, with nothing saying so. And the answer was usually derivable: an issue carrying a target version, or linking a separate issue that represents the release, already names the branch on a repo whose release branches encode the version.
@@ -240,6 +262,8 @@ Phase 3 treats the issue-tracker status update as a required step with a post-mu
 
 - **Pre-Commit Secret Detection** (12 patterns): `PreToolUse` hook scans staged files for API keys/tokens, AWS access keys, private keys, `.env` files, service account JSON. Commit **blocked** if found.
 - **Read-Size Gate** (opt-in, `prefs.global.bulkRead.mode`): a `PreToolUse` hook inspects `Read` and the shell commands that read a file whole. In `observe` it only logs what it would have caught - the baseline you measure before routing anything. In `enforce` a file over `minLines` (default 350) is blocked and delegated to a haiku-rung worker (`bulk-read.sh`), which returns a line-numbered summary so the follow-up is a bounded `Read(offset:limit:)` instead of the whole file; the full text is parked under `.multi-agent/refs/`. The development phase and any file the run has already touched are exempt, because Claude Code's `Edit` requires its own `Read` first.
+- **Capture Hooks** (`SessionEnd`, `PreCompact`, `SessionStart`): every durable write used to live in Phase 7, the phase a run is least likely to reach. `SessionEnd` flushes a run that never got there; `PreCompact` flushes before an auto-compaction summarizes a long phase mid-flight, which is the same loss one level down; `SessionStart` prints at most two lines about an unfinished run. None calls a model, none reads a payload, and all exit 0 on every path - a hook that fails a session over bookkeeping is worse than the bookkeeping.
+- **Operational Reporting** (`prefs.global.usageLog`): coarse run metadata - task id, phase, status, durations, token counts - and never prompts, code, diffs or absolute paths. The per-machine token is REQUESTED from the endpoint by `usage-register.mjs` (setup, update, and the Phase 0 exit gate as a backstop), is write-only, and lives in the OS credential store; prefs hold only the entry name and the switch. `usageLog.optOut: true` blocks registration permanently and is checked before the network call. An unreachable endpoint leaves reporting off with one line and exit 0 - a run is never failed over bookkeeping.
 - **Build Queue**: All `xcodebuild` calls acquire a lock. Each worktree uses own `-derivedDataPath`. Stale locks auto-clean after 15 min. Non-Xcode builds don't need the lock.
 - **Context Management**: `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=65` - compaction at 65% usage (prevents degradation in 8-phase sessions).
 - **3-Iteration Hard Kill**: Any retry loop stops after 3 attempts, then pauses for user. No infinite loops.