@mmerterden/multi-agent-pipeline 17.6.0 → 18.0.0

package/pipeline/scripts/write-state.mjs

@@ -16,12 +16,22 @@
  *
  *   # Replace: full overwrite from stdin JSON
  *   cat new-state.json | node write-state.mjs --replace /path/to/agent-state.json
+ *   cat patch.json | node write-state.mjs --if-rev=7 /path/to/agent-state.json
+ *
+ * `--if-rev=<n>` is compare-and-swap: write only if the record on disk is
+ * still at revision n. The lock closes the window between two WRITERS; it does
+ * nothing about the one between a read and a write, which is where an editor
+ * lives - `/multi-agent:steer` reads the state, a human thinks, and the run may
+ * move three phases before the edit lands. Without this the edit merges over
+ * the top and reinstates decisions the run already replaced.
  *
  * Exit codes:
  *   0  -  write succeeded
  *   1  -  invalid JSON on stdin
  *   2  -  lock timeout (another writer held the lock past the acquire window)
+ *   4  -  the lock was taken from us mid-write; nothing was written, retry
  *   3  -  I/O error (disk full, permission denied, parent dir missing)
+ *   5  -  --if-rev did not match; the record moved, nothing was written
  *
  * Tunables (env):
  *   WRITE_STATE_LOCK_TIMEOUT_MS  acquire window before exit 2 (default 15000)
@@ -52,9 +62,11 @@ import {
 } from "fs";
 import { dirname, basename } from "path";
 import { Buffer } from "node:buffer";
+import { runMain } from "../lib/fatal.mjs";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
 
 /**
- * @typedef {{ replace: boolean, path: string }} ParsedArgs
+ * @typedef {{ replace: boolean, path: string, ifRev: number|null }} ParsedArgs
  */
 
 /** @returns {ParsedArgs} */
@@ -62,18 +74,26 @@ function parseArgs() {
   const args = process.argv.slice(2);
   let replace = false;
   let path = null;
+  let ifRev = null;
   for (const a of args) {
     if (a === "--replace") replace = true;
-    else if (a.startsWith("--")) {
+    else if (a.startsWith("--if-rev=")) {
+      const v = Number(a.slice("--if-rev=".length));
+      if (!Number.isInteger(v) || v < 0) {
+        console.error(`write-state: --if-rev takes a non-negative integer, got ${a.slice(9)}`);
+        process.exit(3);
+      }
+      ifRev = v;
+    } else if (a.startsWith("--")) {
       console.error(`write-state: unknown flag ${a}`);
       process.exit(3);
     } else path = a;
   }
   if (!path) {
-    console.error("usage: write-state.mjs [--replace] <path>");
+    console.error("usage: write-state.mjs [--replace] [--if-rev=<n>] <path>");
     process.exit(3);
   }
-  return { replace, path };
+  return { replace, path, ifRev };
 }
 
 /**
@@ -103,8 +123,13 @@ async function acquireLock(
     try {
       writeFileSync(stagePath, String(process.pid));
       linkSync(stagePath, lockPath); // fails EEXIST if another writer holds it
+      // The inode of the lock WE created. Everything after this point checks
+      // against it: a lock at the same path with a different inode is somebody
+      // else's, and both releasing it and writing under it are the same bug the
+      // reclaim path below already refuses to commit.
+      const ino = statSync(lockPath).ino;
       unlinkSync(stagePath);
-      return;
+      return ino;
     } catch (err) {
       try {
         unlinkSync(stagePath);
@@ -208,16 +233,46 @@ function lockIdentityIfStale(lockPath, staleMs) {
 // Path whose lock this process currently holds (null when none). Lets the
 // top-level error handler release our lock on unexpected failures.
 let heldLockFor = null;
+// The inode of that lock. The path alone does not identify it: a lock deleted
+// and re-created at the same path is a different file and a different owner.
+let heldLockIno = null;
+
+/**
+ * True when the lock at `path` is still the one this process created.
+ *
+ * @param {string} path
+ * @param {number | null} ino
+ * @returns {boolean}
+ */
+function stillOurs(path, ino) {
+  if (ino === null) return true; // nothing was ever locked; nothing to lose
+  try {
+    return statSync(`${path}.lock`).ino === ino;
+  } catch {
+    return false; // our lock is gone, which means somebody removed it
+  }
+}
 
 /** @param {string} path */
-function releaseLock(path) {
+function releaseLock(path, ino = heldLockIno) {
   const lockPath = `${path}.lock`;
   try {
+    // By identity, never by path - the same rule acquireLock states and this
+    // function used to break. If our lock was reclaimed as stale while we were
+    // starved (the abandon ceiling, or the unreadable-PID window), the lock now
+    // at this path belongs to a LIVE writer, and unlinking it puts two writers
+    // inside at once and loses one update. That is the third point in this
+    // cycle where "delete by path" produces the same data loss; the other two
+    // are documented in acquireLock.
+    if (ino !== null && statSync(lockPath).ino !== ino) return;
     unlinkSync(lockPath);
   } catch {
     /* already gone  -  fine */
   }
-  if (heldLockFor === path) heldLockFor = null;
+  if (heldLockFor === path) {
+    heldLockFor = null;
+    heldLockIno = null;
+  }
 }
 
 /**
@@ -225,6 +280,22 @@ function releaseLock(path) {
  * @param {object} patch
  * @returns {object}
  */
+/**
+ * The version a NEWLY created state document is stamped with, read from the
+ * schema so the writer and the schema cannot disagree. The literal is a
+ * fallback for an unreadable schema, which validate-schemas.mjs would already
+ * have failed on.
+ */
+const STATE_SCHEMA_VERSION = (() => {
+  try {
+    const schemaPath = new URL("../schemas/agent-state.schema.json", import.meta.url);
+    const sv = JSON.parse(readFileSync(schemaPath, "utf-8"))?.properties?.schemaVersion;
+    return sv?.const ?? sv?.enum?.at(-1) ?? "2.1.0";
+  } catch {
+    return "2.1.0";
+  }
+})();
+
 function deepMerge(base, patch) {
   if (Array.isArray(patch)) return patch; // arrays replace
   if (typeof patch !== "object" || patch === null) return patch;
@@ -236,7 +307,7 @@ function deepMerge(base, patch) {
 }
 
 async function main() {
-  const { replace, path } = parseArgs();
+  const { replace, path, ifRev } = parseArgs();
 
   // Read stdin
   const chunks = [];
@@ -257,7 +328,7 @@ async function main() {
   }
 
   try {
-    await acquireLock(path);
+    heldLockIno = await acquireLock(path);
     heldLockFor = path;
   } catch (err) {
     if (err.code === "LOCK_TIMEOUT") {
@@ -272,6 +343,8 @@ async function main() {
   // here must release OUR lock explicitly before exiting - otherwise a corrupt
   // state file (or any I/O error) leaks agent-state.json.lock and blocks the
   // next writer until the stale-lock window elapses.
+  const fileExistedBefore = existsSync(path);
+
   try {
     let next;
     if (replace) {
@@ -304,16 +377,67 @@ async function main() {
     // carries a `rev` from before the record moved, and following it down
     // would tell the next reader that nothing changed.
     let priorRev = Number.isInteger(next.rev) ? next.rev : 0;
+    let diskRev = null;
     if (existsSync(path)) {
       try {
         const parsed = JSON.parse(readFileSync(path, "utf-8"));
-        if (Number.isInteger(parsed?.rev)) priorRev = Math.max(priorRev, parsed.rev);
+        if (Number.isInteger(parsed?.rev)) {
+          diskRev = parsed.rev;
+          priorRev = Math.max(priorRev, parsed.rev);
+        }
       } catch {
         /* unreadable on disk - the merge path above already threw for that */
       }
     }
+
+    // Compare-and-swap. `rev` already told a reader whether the record moved;
+    // --if-rev is what lets it ACT on that instead of merging over the top.
+    //
+    // The lock closes the window between two writers. It does not close the
+    // one between a READ and a write, and `/multi-agent:steer` puts a second
+    // writer in exactly that window on purpose: it reads the state, a human
+    // thinks, and by the time the edit lands the run may have moved three
+    // phases. A merge then reinstates decisions the run already replaced.
+    //
+    // Refusing costs a re-read. Merging costs a phase that silently reverts.
+    if (ifRev !== null) {
+      const seen = diskRev ?? 0;
+      if (seen !== ifRev) {
+        console.error(
+          `write-state: rev is ${seen}, expected ${ifRev}  -  the record moved since you read it; re-read and retry`,
+        );
+        releaseLock(path);
+        process.exit(5);
+      }
+    }
+
     next.rev = priorRev + 1;
 
+    // schemaVersion is stamped only when this call CREATES the document. The
+    // migration runner keys on it, and a document that never carries one can
+    // never be migrated - measured on a real install, 43 of 43 state files had
+    // no schemaVersion, so pipeline/schemas/migrations/ was unreachable code.
+    // A merge into an existing unstamped file is deliberately left alone:
+    // stamping there would claim a conformance nothing verified.
+    if (!fileExistedBefore && typeof next.schemaVersion !== "string") {
+      next.schemaVersion = STATE_SCHEMA_VERSION;
+    }
+
+    // Last check before the write lands: is the lock still ours? Everything
+    // above read the file under a lock we believed we held, and if that belief
+    // stopped being true the rename would overwrite a concurrent writer's
+    // update with a merge that never saw it. Reporting success while losing an
+    // update is the one outcome this script exists to prevent, so it refuses
+    // instead - a caller that sees exit 4 can read and retry, which a caller
+    // that saw exit 0 never will.
+    if (!stillOurs(path, heldLockIno)) {
+      console.error(
+        `write-state: the lock was taken from us mid-write (${path}.lock). ` +
+          `Nothing was written. Re-read the state and retry.`,
+      );
+      process.exit(4);
+    }
+
     const tmp = `${dirname(path)}/.${basename(path)}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
     renameSync(tmp, path); // atomic on POSIX
@@ -327,8 +451,23 @@ async function main() {
   process.exit(0);
 }
 
-main().catch((err) => {
-  console.error(`write-state: unhandled  -  ${err.message}`);
-  if (heldLockFor) releaseLock(heldLockFor);
-  process.exit(3);
-});
+// Only run when invoked as a program. The lock helpers are the part with the
+// subtle behaviour and they are unreachable from a test otherwise: the window
+// they guard is microseconds wide, so a test that drives this file as a CLI
+// measures the scheduler rather than the code.
+const isDirectRun = invokedDirectly(import.meta.url);
+if (isDirectRun) {
+  // Exit 3 is this file's documented "died without writing" code, and the
+  // cleanup is the reason the handler exists at all: a writer that dies holding
+  // the advisory lock makes the NEXT writer wait out the acquire window and
+  // then decide, on nothing but age, whether to take a lock that may still be
+  // live. Releasing on the abnormal path keeps that decision from arising.
+  runMain("write-state", main, {
+    code: 3,
+    cleanup: () => {
+      if (heldLockFor) releaseLock(heldLockFor);
+    },
+  });
+}
+
+export { acquireLock, releaseLock, stillOurs, lockIdentityIfStale };

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-15T20:06:53Z",
+  "generatedAt": "2026-09-17T11:16:58Z",
   "skillCount": 212,
   "entries": [
     {
@@ -189,7 +189,7 @@
     },
     {
       "path": "shared/core/multi-agent-status/SKILL.md",
-      "sha256": "436d1716ce5fc4977dadfce8a85b09877f93c626953739a7ad70eefbbcd25869"
+      "sha256": "3305fcce80bdad9ea0032e382276c5692a197749d9c012910daaea7a332bce0e"
     },
     {
       "path": "shared/core/multi-agent-steer/SKILL.md",

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 207,
+  "skillCount": 212,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -959,6 +959,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-analysis/SKILL.md"
     },
+    {
+      "name": "multi-agent-analysis-jira",
+      "description": "Turn a rendered analysis document into a Jira story tree: derive stories from the document's own rule ids, check coverage both ways, preview every byte, then create only what does not already exist. Use when an analysis is final and the work needs tickets.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-analysis-jira",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-analysis-jira/SKILL.md"
+    },
     {
       "name": "multi-agent-analysis-resolve",
       "description": "Resolve the Section 20 Risks and Open Questions of an analysis v3 document one row at a time: up to 3 source-labeled answer candidates per row (evidence / repo / AI reasoned), chosen answer merged into the target section, doc updated in place with a changelog bump. Same locked decisions as /multi-ag",
@@ -981,6 +992,39 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-autopilot/SKILL.md"
     },
+    {
+      "name": "multi-agent-autopilot-off",
+      "description": "Turn off continuous mode on this machine: the schedule is removed, work already running finishes, the repo selection is kept. Use when the machine should stop picking work up.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-autopilot-off",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-autopilot-off/SKILL.md"
+    },
+    {
+      "name": "multi-agent-autopilot-on",
+      "description": "Turn on continuous mode on THIS machine: pick the repos it watches; labelled GitHub issues and assigned+labelled Jira items then run in a worktree and stop at an open PR. Use when the machine should pick work up unattended.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-autopilot-on",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-autopilot-on/SKILL.md"
+    },
+    {
+      "name": "multi-agent-autopilot-status",
+      "description": "Show what continuous mode is doing here: what runs at which phase, what is queued, what waits for an answer, what PRs it opened today. Use when asked whether autopilot is on.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-autopilot-status",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-autopilot-status/SKILL.md"
+    },
     {
       "name": "multi-agent-build-optimize",
       "description": "Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analyzers, produces a recommend-first optimization plan in .build-benchmark/, and re-benchmarks after the developer approves changes. Fails fast on non-iOS stacks. U",
@@ -1047,6 +1091,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-diff-explain/SKILL.md"
     },
+    {
+      "name": "multi-agent-doctor",
+      "description": "Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit code is the verdict. Use when a run failed for an environmental reason, before a sync, or after an update.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-doctor",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-doctor/SKILL.md"
+    },
     {
       "name": "multi-agent-feedback",
       "description": "Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows the payload and asks before sending. Use when a run went wrong and the maintainer should know.",

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 207 skills (54 core + 153 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 212 skills (59 core + 153 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  54 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  59 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  153 iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  54
+- [Pipeline Orchestration](#pipeline-orchestration)  -  59
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  90
 - [Android / Kotlin](#android-kotlin)  -  13
 - [Web](#web)  -  10
@@ -29,14 +29,19 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`google-play-compliance`](./core/google-play-compliance/) | `core` | Google Play Store publication compliance  -  bundletool + aapt2 + apksigner orchestration + 21-rule policy catalog with Play Console error c |
 | [`multi-agent`](./core/multi-agent/) | `core` | Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable  |
 | [`multi-agent-analysis`](./core/multi-agent-analysis/) | `core` | Standalone feature-spec analysis. Two profiles picked at intake: global (23-section development handoff, 8 of them in Lite mode) or corporat |
+| [`multi-agent-analysis-jira`](./core/multi-agent-analysis-jira/) | `core` | Turn a rendered analysis document into a Jira story tree: derive stories from the document's own rule ids, check coverage both ways, preview |
 | [`multi-agent-analysis-resolve`](./core/multi-agent-analysis-resolve/) | `core` | Resolve the Section 20 Risks and Open Questions of an analysis v3 document one row at a time: up to 3 source-labeled answer candidates per r |
 | [`multi-agent-autopilot`](./core/multi-agent-autopilot/) | `core` | Launch any task in autopilot mode: skips every confirmation, runs end-to-end autonomously. Use when a task should run end to end with no con |
+| [`multi-agent-autopilot-off`](./core/multi-agent-autopilot-off/) | `core` | Turn off continuous mode on this machine: the schedule is removed, work already running finishes, the repo selection is kept. Use when the m |
+| [`multi-agent-autopilot-on`](./core/multi-agent-autopilot-on/) | `core` | Turn on continuous mode on THIS machine: pick the repos it watches; labelled GitHub issues and assigned+labelled Jira items then run in a wo |
+| [`multi-agent-autopilot-status`](./core/multi-agent-autopilot-status/) | `core` | Show what continuous mode is doing here: what runs at which phase, what is queued, what waits for an answer, what PRs it opened today. Use w |
 | [`multi-agent-build-optimize`](./core/multi-agent-build-optimize/) | `core` | Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analy |
 | [`multi-agent-channels`](./core/multi-agent-channels/) | `core` | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | [`multi-agent-complaint-analysis`](./core/multi-agent-complaint-analysis/) | `core` | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
 | [`multi-agent-create-jira`](./core/multi-agent-create-jira/) | `core` | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
 | [`multi-agent-design-check`](./core/multi-agent-design-check/) | `core` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | [`multi-agent-diff-explain`](./core/multi-agent-diff-explain/) | `core` | Map Phase 4 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
+| [`multi-agent-doctor`](./core/multi-agent-doctor/) | `core` | Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit  |
 | [`multi-agent-feedback`](./core/multi-agent-feedback/) | `core` | Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows t |
 | [`multi-agent-forget`](./core/multi-agent-forget/) | `core` | Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one an |
 | [`multi-agent-garbage-collect`](./core/multi-agent-garbage-collect/) | `core` | Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before d |

package/pipeline/skills/shared/core/multi-agent-status/SKILL.md

@@ -11,20 +11,44 @@ Show every active and completed task as a table.
 
 ## Steps
 
-1. **Detect project**  -  Find the repo root from cwd (if none, look at all known repos):
-   - `~/my-ui-components/.worktrees/`
-   - `~/my-figma-app/.worktrees/`
-   - `~/my-ios-app/.worktrees/`
+1. **Ask the producer, do not go looking.** One command answers the whole
+   question:
 
-2. **Scan worktrees**  -  Read the `agent-state.json` file in each worktree directory:
    ```bash
-   find {repo}/.worktrees/ -name "agent-state.json" -maxdepth 2
+   node "$HOME/.claude/scripts/runs-index.mjs"          # grouped table
+   node "$HOME/.claude/scripts/runs-index.mjs" --json   # the same records
    ```
 
-3. **Parse state**  -  For each task:
-   - `taskId`, `branch`, `currentPhase`, `status`, `startedAt`, `autopilot`
+   `runs-index.mjs` resolves through `lib/run-paths.sh` / `scripts/_run-paths.mjs`,
+   so it sees both directory layouts (`<project>/<id>/` and the flat `<id>/`),
+   the salvaged `artifacts/` copy Phase 6 leaves behind, and every spelling of a
+   task id - and it counts a run that exists in both layouts once. Do NOT
+   re-scan the tree by hand: the earlier instruction here listed three
+   hard-coded `.worktrees/` paths and a single `find` depth, and on a real
+   install that combination missed a quarter of the runs and double-counted
+   others. It also scanned worktrees for `agent-state.json`, which Phase 0 has
+   never written there ("never inside the worktree", `phases/phase-0-init.md`).
 
-4. **Show as a table**:
+2. **Fields per run** (already in the output): `taskId`, `project`, `branch`,
+   `currentPhase`, `status`, `startedAt`, `worktreePath`, `prUrl`, `autopilot`,
+   `phases[]`, `tokens`, `estUsd`, `group`, plus `duplicateOf` when the run also
+   exists in the other layout and `salvaged` when its state is the Phase 6 copy.
+
+3. **Groups are computed, not judged.** Report the `group` the producer
+   returns rather than re-deriving it.
+
+   | Group | Test | Action offered |
+   |---|---|---|
+   | `waiting` - Waiting on you | `status == "awaiting_input"`, or a `pr.url`, or phase >= 6 | `resume #N` - the work landed, it needs your answer |
+   | `stopped` - Stopped mid-development | anything else past phase 0 | `resume #N` or `kill #N` |
+   | `question` - Left at a question | phase 0 | `garbage-collect --abandoned` - nothing was built |
+   | `unknown` - Status not recorded | no `status` field | say so; offer nothing |
+
+   A run with no `status` is **not** placed in an actionable group. Unknown is
+   not a finding, and calling it dead is the same false claim in the other
+   direction.
+
+4. **Show as a table**, grouped per step 3:
    ```
    🤖 Multi-Agent Tasks
 

package/pipeline/skills/shared/external/macos-spm-app-packaging/assets/templates/package_app.sh

@@ -19,7 +19,10 @@ else
   BUILD_NUMBER=${BUILD_NUMBER:-1}
 fi
 
-ARCH_LIST=( ${ARCHES:-} )
+# read -ra, not ( $ARCHES ): a bare expansion into an array splits on IFS and
+# then GLOBS each word, so an ARCHES carrying a * builds for whatever files are
+# in the working directory.
+read -ra ARCH_LIST <<< "${ARCHES:-}"
 if [[ ${#ARCH_LIST[@]} -eq 0 ]]; then
   HOST_ARCH=$(uname -m)
   ARCH_LIST=("$HOST_ARCH")

package/pipeline/skills/shared/external/macos-spm-app-packaging/assets/templates/setup_dev_signing.sh

@@ -15,7 +15,10 @@ fi
 echo "Creating self-signed certificate '$CERT_NAME'..."
 
 TEMP_CONFIG=$(mktemp)
-trap "rm -f $TEMP_CONFIG" EXIT
+# Single-quoted on purpose: the path is read when the trap FIRES, not when it is
+# installed. Double quotes bake in whatever the variable held at install time,
+# which is a template users copy into scripts where the order differs.
+trap 'rm -f "$TEMP_CONFIG"' EXIT
 
 cat > "$TEMP_CONFIG" <<EOFCONF
 [ req ]

package/pipeline/skills/shared/external/macos-spm-app-packaging/assets/templates/sign-and-notarize.sh

@@ -17,7 +17,8 @@ echo "$APP_STORE_CONNECT_API_KEY_P8" | sed 's/\\n/\n/g' > /tmp/app-store-connect
 trap 'rm -f /tmp/app-store-connect-key.p8 /tmp/${APP_NAME}Notarize.zip' EXIT
 
 ARCHES_VALUE=${ARCHES:-"arm64 x86_64"}
-ARCH_LIST=( ${ARCHES_VALUE} )
+# See package_app.sh: a bare expansion into an array globs as well as splits.
+read -ra ARCH_LIST <<< "${ARCHES_VALUE}"
 for ARCH in "${ARCH_LIST[@]}"; do
   swift build -c release --arch "$ARCH"
 done

package/pipeline/skills/skills-index.md

@@ -3,7 +3,7 @@
 > Auto-generated by `pipeline/scripts/build-skills-index.mjs`  -  do not hand-edit.
 > Regenerate with `node pipeline/scripts/build-skills-index.mjs`.
 
-**207 skills** across 2 groups.
+**212 skills** across 2 groups.
 
 | Group | Name | Platform | Description |
 |-------|------|----------|-------------|
@@ -94,14 +94,19 @@
 | external | `monorepo-architect` |  -  | Expert in monorepo architecture, build systems, and dependency management at scale. Masters Nx, Turborepo, Bazel, and Lerna for efficient mu |
 | core | `multi-agent` |  -  | Task orchestrator: runs the full pipeline from a Jira ID or GitHub Issue URL  -  analysis → plan → TDD development → parallel review (Fable  |
 | core | `multi-agent-analysis` |  -  | Standalone feature-spec analysis. Two profiles picked at intake: global (23-section development handoff, 8 of them in Lite mode) or corporat |
+| core | `multi-agent-analysis-jira` |  -  | Turn a rendered analysis document into a Jira story tree: derive stories from the document's own rule ids, check coverage both ways, preview |
 | core | `multi-agent-analysis-resolve` |  -  | Resolve the Section 20 Risks and Open Questions of an analysis v3 document one row at a time: up to 3 source-labeled answer candidates per r |
 | core | `multi-agent-autopilot` |  -  | Launch any task in autopilot mode: skips every confirmation, runs end-to-end autonomously. Use when a task should run end to end with no con |
+| core | `multi-agent-autopilot-off` |  -  | Turn off continuous mode on this machine: the schedule is removed, work already running finishes, the repo selection is kept. Use when the m |
+| core | `multi-agent-autopilot-on` |  -  | Turn on continuous mode on THIS machine: pick the repos it watches; labelled GitHub issues and assigned+labelled Jira items then run in a wo |
+| core | `multi-agent-autopilot-status` |  -  | Show what continuous mode is doing here: what runs at which phase, what is queued, what waits for an answer, what PRs it opened today. Use w |
 | core | `multi-agent-build-optimize` |  -  | Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analy |
 | core | `multi-agent-channels` |  -  | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | core | `multi-agent-complaint-analysis` |  -  | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
 | core | `multi-agent-create-jira` |  -  | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
 | core | `multi-agent-design-check` |  -  | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | core | `multi-agent-diff-explain` |  -  | Map Phase 4 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
+| core | `multi-agent-doctor` |  -  | Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit  |
 | core | `multi-agent-feedback` |  -  | Send one message to the maintainer: a bug, an idea or a question. Only the text you type is sent - no logs, no repo names, no paths. Shows t |
 | core | `multi-agent-forget` |  -  | Remove a saved /multi-agent routine (created by /multi-agent:save): deletes its local-only command and its registry entry. Asks which one an |
 | core | `multi-agent-garbage-collect` |  -  | Sweep leftover /tmp scratch (picker state, review diffs, channel payloads, analysis drafts) from past runs. Dry-run first; confirms before d |