@mmerterden/multi-agent-pipeline 17.6.0 → 19.0.0

package/pipeline/scripts/learning-curve.mjs

@@ -19,7 +19,7 @@
 //
 // Exit: 0 always (advisory; empty/missing metrics -> friendly note).
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -39,8 +39,11 @@ for (const a of args) {
 const METRICS_FILE =
   process.env.METRICS_FILE || join(homedir(), ".claude", "logs", "multi-agent", "metrics.jsonl");
 
+// Called from module scope and has to stop the script, so the write goes to
+// fd 1 synchronously: console.log would still be in the pipe when process.exit
+// tore the process down.
 function emitEmpty(reason) {
-  if (opts.json) console.log(JSON.stringify({ ok: false, reason, buckets: [] }));
+  if (opts.json) writeFileSync(1, `${JSON.stringify({ ok: false, reason, buckets: [] })}\n`);
   else console.error(`learning-curve: ${reason}`);
   process.exit(0);
 }
@@ -84,9 +87,9 @@ for (const e of events) {
   }
   if (e.ts && (!t.firstTs || e.ts < t.firstTs)) t.firstTs = e.ts;
   const d = e.details || {};
-  // phase-4-review.md's actual review.completed emission (raw_count=/
+  // phase-3-review.md's actual review.completed emission (raw_count=/
   // accepted=/deferred=/rejected=/approved=/duration_ms=) carries no
-  // review_cycles field - that name only appears on Phase 7's task.completed
+  // review_cycles field - that name only appears on Phase 5's task.completed
   // summary event, which this never matched. Phase 4 re-runs (and logs its
   // own review.completed) once per rework cycle, so the cycle count for a
   // task is how many review.completed events share its task_id - the same
@@ -183,35 +186,37 @@ if (buckets.length >= 2) {
 
 const out = { ok: true, bucketDays: opts.bucketDays, buckets, trend };
 
+// else, not process.exit(0) after the write: stdout to a pipe is asynchronous
+// and exiting drops whatever has not drained, so the JSON arrived truncated to
+// anything reading it through a pipe.
 if (opts.json) {
   console.log(JSON.stringify(out, null, 2));
-  process.exit(0);
-}
-
-// Markdown / text (default)
-const arrow = (v, goodIsUp) => {
-  if (v == null || v === 0) return "-";
-  const up = v > 0;
-  const good = up === goodIsUp;
-  return `${up ? "+" : ""}${v} ${good ? "(better)" : "(worse)"}`;
-};
-console.log(`# Learning curve (${opts.bucketDays}-day buckets)\n`);
-console.log(
-  "| Bucket | Tasks | First-pass clean | Avg review cycles | Rework/task | Tokens/task | Cache ratio | Memory precision | Mined lessons/task | Offload bytes saved/task |",
-);
-console.log("|---|---|---|---|---|---|---|---|---|---|");
-for (const b of buckets) {
+} else {
+  // Markdown / text (default)
+  const arrow = (v, goodIsUp) => {
+    if (v == null || v === 0) return "-";
+    const up = v > 0;
+    const good = up === goodIsUp;
+    return `${up ? "+" : ""}${v} ${good ? "(better)" : "(worse)"}`;
+  };
+  console.log(`# Learning curve (${opts.bucketDays}-day buckets)\n`);
   console.log(
-    `| ${b.bucketStart} | ${b.tasks} | ${b.firstPassCleanRate ?? "-"} | ${b.avgReviewCycles ?? "-"} | ${b.reworkPerTask} | ${b.tokensPerTask} | ${b.cacheRatio ?? "-"} | ${b.memoryPrecision ?? "-"} | ${b.minedLessonsPerTask ?? "-"} | ${b.offloadBytesSavedPerTask ?? "-"} |`,
+    "| Bucket | Tasks | First-pass clean | Avg review cycles | Rework/task | Tokens/task | Cache ratio | Memory precision | Mined lessons/task | Offload bytes saved/task |",
   );
-}
-if (trend) {
-  console.log(`\n**Trend ${trend.from} -> ${trend.to}:**`);
-  console.log(`- First-pass clean: ${arrow(trend.firstPassCleanRate, true)}`);
-  console.log(`- Avg review cycles: ${arrow(trend.avgReviewCycles, false)}`);
-  console.log(`- Tokens/task: ${arrow(trend.tokensPerTask, false)}`);
-  console.log(`- Cache ratio: ${arrow(trend.cacheRatio, true)}`);
-  console.log(`- Memory precision: ${arrow(trend.memoryPrecision, true)}`);
-} else {
-  console.log("\n(need >= 2 buckets for a trend; keep running the pipeline)");
+  console.log("|---|---|---|---|---|---|---|---|---|---|");
+  for (const b of buckets) {
+    console.log(
+      `| ${b.bucketStart} | ${b.tasks} | ${b.firstPassCleanRate ?? "-"} | ${b.avgReviewCycles ?? "-"} | ${b.reworkPerTask} | ${b.tokensPerTask} | ${b.cacheRatio ?? "-"} | ${b.memoryPrecision ?? "-"} | ${b.minedLessonsPerTask ?? "-"} | ${b.offloadBytesSavedPerTask ?? "-"} |`,
+    );
+  }
+  if (trend) {
+    console.log(`\n**Trend ${trend.from} -> ${trend.to}:**`);
+    console.log(`- First-pass clean: ${arrow(trend.firstPassCleanRate, true)}`);
+    console.log(`- Avg review cycles: ${arrow(trend.avgReviewCycles, false)}`);
+    console.log(`- Tokens/task: ${arrow(trend.tokensPerTask, false)}`);
+    console.log(`- Cache ratio: ${arrow(trend.cacheRatio, true)}`);
+    console.log(`- Memory precision: ${arrow(trend.memoryPrecision, true)}`);
+  } else {
+    console.log("\n(need >= 2 buckets for a trend; keep running the pipeline)");
+  }
 }

package/pipeline/scripts/log-metric.sh

@@ -6,11 +6,19 @@
 #   {
 #     "ts":      "<ISO 8601 timestamp>",
 #     "task_id": "<jira id, github issue, or run id>",
-#     "phase":   "<0..7>",
+#     "phase":   "<0..5>",
 #     "event":   "<event name>",
-#     "details": { ...arbitrary key/value pairs... }
+#     "details": { ...arbitrary key/value pairs... },
+#     "phaseSchema": 2
 #   }
 #
+# phaseSchema names the phase vocabulary the line was written under, because
+# this file is append-only and v19.0.0 renumbered the phases. A line with
+# phase 3 means Dev under schema 1 and Review under schema 2. Lines with no
+# phaseSchema field predate v19.0.0 and are schema 1. Aggregators pick their
+# name table from this field; without it the two vocabularies are
+# indistinguishable and every historical roll-up is quietly wrong.
+#
 # Usage:
 #   log-metric.sh <task_id> <phase> <event> [key=value ...]
 #
@@ -18,7 +26,7 @@
 #   log-metric.sh PROJ-1234 4 review.completed raw_count=8 accepted=3 deferred=2 rejected=3 approved=true duration_ms=42000
 #   log-metric.sh PROJ-1234 4 triage.edge_case case=high-rejection-rate
 #   log-metric.sh PROJ-1234 3 rework.started iteration=2 accepted_blocking=2
-#   log-metric.sh #316 7 task.completed phases=8 review_cycles=2 lang=tr
+#   log-metric.sh #316 5 task.completed phases=6 review_cycles=2 lang=tr
 #
 # Atomic append: each call uses `>> "$file"` which the kernel guarantees
 # atomic for writes ≤ PIPE_BUF (4 KB on macOS/Linux). One JSONL line is well
@@ -64,8 +72,13 @@ for kv in "$@"; do
 done
 DETAILS="${DETAILS}}"
 
+# Read from the phase contract rather than hardcoding: the next renumbering
+# bumps one JSON field instead of hunting for a literal in a shell script.
+PHASE_SCHEMA="$(node -e 'const c=require("'"$(cd "$(dirname "$0")" && pwd)"'/../schemas/phases.json"); process.stdout.write(String(c.phaseSchema))' 2>/dev/null)"
+[ -n "$PHASE_SCHEMA" ] || PHASE_SCHEMA=2
+
 TS="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
-LINE="{\"ts\":\"${TS}\",\"task_id\":\"${TASK_ID}\",\"phase\":\"${PHASE}\",\"event\":\"${EVENT}\",\"details\":${DETAILS}}"
+LINE="{\"ts\":\"${TS}\",\"task_id\":\"${TASK_ID}\",\"phase\":\"${PHASE}\",\"event\":\"${EVENT}\",\"details\":${DETAILS},\"phaseSchema\":${PHASE_SCHEMA}}"
 
 # Atomic append (one line, well under PIPE_BUF).
 echo "$LINE" >> "$METRICS_FILE" 2>/dev/null || {

package/pipeline/scripts/make-manifest.mjs

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+/**
+ * make-manifest.mjs  -  a digest of everything the package ships.
+ *
+ * "Is my install the one that was published, or has something edited it" is a
+ * question this tree could not answer. The install is a COPY: `install.js`
+ * writes into ~/.claude, ~/.copilot and ~/.codex, and from that moment the two
+ * halves drift independently. An edit made in the installed copy looks like a
+ * feature nobody can find the source of; a file the installer failed to write
+ * looks like a bug in a script that was never there.
+ *
+ * The manifest turns both into one command. It records a SHA-256 for every
+ * file the package ships, the version, and the commit it was built from, and
+ * `multi-agent-pipeline verify` compares an installed tree against it, file by
+ * file.
+ *
+ * The file set is not guessed: it comes from `npm pack --dry-run --json`, so
+ * it is by construction the same set npm will publish, `files` globs and all.
+ * `--ignore-scripts` is on the inner call because this script runs FROM
+ * prepack, and without it npm would run prepack again.
+ *
+ * Two things the manifest cannot cover, said here rather than discovered later:
+ * it cannot hash itself (it does not exist when the list is taken), and a
+ * signature over it does not authenticate the tarball - the verifier and the
+ * public key travel inside the same tarball, so anyone able to rewrite one can
+ * rewrite the others. What a signature DOES catch is a manifest damaged in
+ * transit or edited after install, which is the failure this file exists for.
+ * Provenance belongs to npm's own integrity field, not to us.
+ *
+ * Usage:
+ *   make-manifest.mjs              write manifest.json at the repo root
+ *   make-manifest.mjs --sign       also write manifest.sig (needs a signing key)
+ *   make-manifest.mjs --check      recompute and report drift, write nothing
+ *   make-manifest.mjs --json
+ *
+ * Exit codes:
+ *   0  written, or --check found no drift
+ *   1  --check found drift
+ *   2  usage or environment error
+ */
+
+import { execFileSync } from "node:child_process";
+import { createHash, createPrivateKey, sign as cryptoSign } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runMain } from "../lib/fatal.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const MANIFEST = join(ROOT, "manifest.json");
+
+const argv = process.argv.slice(2);
+const has = (f) => argv.includes(f);
+
+/** The exact set npm would publish, in npm's own words. */
+function shippedFiles() {
+  const out = execFileSync("npm", ["pack", "--dry-run", "--json", "--ignore-scripts"], {
+    cwd: ROOT,
+    encoding: "utf-8",
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  const parsed = JSON.parse(out);
+  const files = parsed?.[0]?.files;
+  if (!Array.isArray(files) || !files.length) {
+    throw new Error("npm pack --dry-run returned no file list");
+  }
+  return files
+    .map((f) => f.path)
+    .filter((p) => p !== "manifest.json" && p !== "manifest.sig")
+    .sort();
+}
+
+function sha256(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+function gitCommit() {
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], {
+      cwd: ROOT,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    // A tarball unpacked outside a checkout has no git. The manifest is still
+    // valid; only the provenance line is unknown, and saying so beats writing
+    // a placeholder that reads like a real commit.
+    return null;
+  }
+}
+
+function build() {
+  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
+  const files = {};
+  for (const rel of shippedFiles()) {
+    const abs = join(ROOT, rel);
+    if (!existsSync(abs)) continue;
+    files[rel] = sha256(abs);
+  }
+  return {
+    name: pkg.name,
+    version: pkg.version,
+    commit: gitCommit(),
+    generatedAt: new Date().toISOString(),
+    algorithm: "sha256",
+    fileCount: Object.keys(files).length,
+    files,
+  };
+}
+
+/**
+ * Sign the manifest with an ed25519 key. Optional, and silent about its absence
+ * on the common path: a package with no signature still verifies on hashes
+ * alone, which is the property that actually gets used.
+ *
+ * The key is read through the credential store, never taken from argv and never
+ * printed. MULTI_AGENT_SIGNING_KEY is the fallback for a build host that has no
+ * store (CI), and it holds the PEM itself.
+ *
+ * @param {string} manifestJson exact bytes that were written to disk
+ * @returns {string|null} base64 signature, or null when no key is configured
+ */
+function sign(manifestJson) {
+  let pem = process.env.MULTI_AGENT_SIGNING_KEY || "";
+  if (!pem) {
+    try {
+      pem = execFileSync(
+        join(ROOT, "pipeline", "lib", "credential-store.sh"),
+        ["get", "pipeline_signing"],
+        {
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "ignore"],
+        },
+      ).trim();
+    } catch {
+      pem = "";
+    }
+  }
+  if (!pem) {
+    process.stderr.write(
+      "make-manifest: no signing key configured - manifest written unsigned (hashes still verify)\n",
+    );
+    return null;
+  }
+  const privateKey = createPrivateKey(pem);
+  return cryptoSign(null, Buffer.from(manifestJson), privateKey).toString("base64");
+}
+
+function main() {
+  if (has("--check")) {
+    if (!existsSync(MANIFEST)) {
+      process.stderr.write("make-manifest: no manifest.json to check\n");
+      process.exit(2);
+    }
+    const stored = JSON.parse(readFileSync(MANIFEST, "utf-8"));
+    const fresh = build();
+    const changed = [];
+    for (const [rel, hash] of Object.entries(fresh.files)) {
+      if (stored.files[rel] !== hash) changed.push(rel);
+    }
+    const gone = Object.keys(stored.files).filter((r) => !(r in fresh.files));
+    const report = { changed, gone, stale: changed.length + gone.length > 0 };
+    if (has("--json")) process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    else if (!report.stale)
+      process.stdout.write(`manifest.json is current (${fresh.fileCount} files)\n`);
+    else {
+      process.stdout.write(
+        `manifest.json is stale: ${changed.length} changed, ${gone.length} gone\n`,
+      );
+      for (const r of [...changed, ...gone].slice(0, 20)) process.stdout.write(`  ${r}\n`);
+    }
+    process.exitCode = report.stale ? 1 : 0;
+    return;
+  }
+
+  const manifest = build();
+  const json = `${JSON.stringify(manifest, null, 2)}\n`;
+  writeFileSync(MANIFEST, json);
+  if (has("--sign")) {
+    const sig = sign(json);
+    if (sig) writeFileSync(join(ROOT, "manifest.sig"), `${sig}\n`);
+  }
+  if (has("--json"))
+    process.stdout.write(
+      `${JSON.stringify({ written: MANIFEST, ...manifest, files: undefined }, null, 2)}\n`,
+    );
+  else
+    // STDERR, not stdout. This runs as `prepack`, and npm passes a prepack
+    // script's stdout straight through - so one friendly line here lands INSIDE
+    // `npm pack --dry-run --json` and every consumer that parses that JSON
+    // fails with "Unexpected token 'm'". Two gates caught it within minutes;
+    // a publish would not have.
+    process.stderr.write(
+      `manifest.json: ${manifest.fileCount} files, version ${manifest.version}, commit ${manifest.commit?.slice(0, 12) ?? "unknown"}\n`,
+    );
+}
+
+runMain("make-manifest", main);

package/pipeline/scripts/memory-save.sh

@@ -2,7 +2,7 @@
 # memory-save.sh  -  v6.2.E
 #
 # Writes a single per-repo memory file and updates the MEMORY.md index.
-# Called by Phase 7's synthesis step (or any user skill that wants to
+# Called by Phase 5's synthesis step (or any user skill that wants to
 # persist a finding). Opt-in via prefs.global.perRepoMemory.
 #
 # Usage:

package/pipeline/scripts/migrate-prefs.mjs

@@ -14,12 +14,30 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
+import { runMain } from "../lib/fatal.mjs";
 
 const DEFAULT_FILE = path.join(os.homedir(), ".claude", "multi-agent-preferences.json");
 
-// Single source of truth for the migration target version. Referenced by the
-// migrate() bump chain AND every user-facing message, so they cannot drift.
-const TARGET_VERSION = "2.6.0";
+// The migration target, read from the schema rather than written here. It was
+// a literal, and a literal is how it came to say 2.6.0 while the schema had
+// moved to 2.7.0 - the runner then reported every current file as needing a
+// migration it had already had. Referenced by the migrate() bump chain AND
+// every user-facing message, so they cannot drift from each other either.
+const TARGET_VERSION = (() => {
+  const schemaPath = path.join(
+    path.dirname(fileURLToPath(import.meta.url)),
+    "..",
+    "schemas",
+    "prefs.schema.json",
+  );
+  const sv = JSON.parse(fs.readFileSync(schemaPath, "utf-8"))?.properties?.schemaVersion;
+  const v = sv?.const ?? sv?.enum?.at(-1);
+  if (!v) {
+    console.error("migrate-prefs: prefs.schema.json declares no schemaVersion");
+    process.exit(1);
+  }
+  return v;
+})();
 
 const USAGE = "Usage: migrate-prefs.mjs [--dry-run] [--file <path>]";
 
@@ -326,7 +344,7 @@ function migrate(prefs) {
     out.global.routines = [];
     changes.push("added empty routines (v2.4.0 user-defined /multi-agent:save routines)");
   }
-  // v2.5.0 / v14.0.0: Phase 4 Review entered the --dev phase sets and Step 1.78
+  // v2.5.0 / v14.0.0: Phase 3 Review entered the --dev phase sets and Step 1.78
   // (criteria resolution) landed. Default false because only Swift plus the two
   // store-compliance catalogs ship a scoped registry today, so blocking on a
   // coverage gap would stop every Kotlin/Python/Node/ObjC run from day one. The
@@ -487,7 +505,7 @@ function migrateReportChannels(out, changes) {
   if (typeof g.autopilotReportTimeoutSeconds !== "number") {
     g.autopilotReportTimeoutSeconds = 1800;
     changes.push(
-      "added autopilotReportTimeoutSeconds: 1800 (30 min)  -  Phase 7 always-pause timeout",
+      "added autopilotReportTimeoutSeconds: 1800 (30 min)  -  Phase 5 always-pause timeout",
     );
   }
 
@@ -544,4 +562,4 @@ function main() {
   console.log(`✓ wrote migrated prefs to ${args.file}`);
 }
 
-main();
+runMain("migrate-prefs", main);

package/pipeline/scripts/migrate-state.mjs

@@ -13,6 +13,8 @@
  *   node migrate-state.mjs --type=state <path>      # force state type
  *   node migrate-state.mjs --type=prefs <path>      # force prefs type
  *   node migrate-state.mjs --dry-run <path>         # preview, no write
+ *   node migrate-state.mjs --all                    # sweep every run on disk
+ *   node migrate-state.mjs --all --dry-run          # sweep, report only
  *
  * Exit codes:
  *   0  -  migration applied (or file already current)
@@ -56,20 +58,101 @@ function parseArgs() {
   const args = process.argv.slice(2);
   let type = null;
   let dryRun = false;
+  let all = false;
   let path = null;
   for (const a of args) {
     if (a.startsWith("--type=")) type = a.slice(7);
     else if (a === "--dry-run") dryRun = true;
+    else if (a === "--all") all = true;
     else if (a.startsWith("--")) {
       console.error(`unknown flag: ${a}`);
       process.exit(1);
     } else path = a;
   }
-  if (!path) {
-    console.error("usage: migrate-state.mjs [--type=state|prefs] [--dry-run] <path>");
+  if (!path && !all) {
+    console.error("usage: migrate-state.mjs [--type=state|prefs] [--dry-run] <path> | --all");
     process.exit(1);
   }
-  return { type, dryRun, path };
+  return { type, dryRun, all, path };
+}
+
+/**
+ * Sweep every run on disk and report what the migration chain can and cannot
+ * do with it.
+ *
+ * This exists because a per-file runner answers "is THIS file current" and
+ * nobody was asking it. Measured on a real install: 43 of 43 agent-state.json
+ * files carried no schemaVersion, so the whole schemas/migrations/ chain had
+ * never run on real data and nothing said so.
+ *
+ * A file with no schemaVersion is REPORTED, never stamped. Stamping it would
+ * assert that it conforms to a version nothing checked; validate-state.mjs
+ * already treats such files as resume-safe, which is the property that matters.
+ *
+ * @param {boolean} dryRun
+ * @returns {Promise<number>} process exit code
+ */
+async function sweepAll(dryRun) {
+  const { listRuns } = await import("./_run-paths.mjs");
+  const runs = listRuns();
+  let current = 0;
+  let migrated = 0;
+  let legacy = 0;
+  let unreadable = 0;
+  const legacyIds = [];
+
+  for (const run of runs) {
+    const file = join(run.dir, "agent-state.json");
+    if (!existsSync(file)) continue;
+    let doc;
+    try {
+      doc = JSON.parse(readFileSync(file, "utf-8"));
+    } catch {
+      unreadable++;
+      console.log(`  ✗ ${run.taskId}  unreadable JSON`);
+      continue;
+    }
+    const from = doc?.schemaVersion;
+    if (typeof from !== "string") {
+      legacy++;
+      legacyIds.push(run.taskId);
+      continue;
+    }
+    if (from === TARGET_VERSIONS.state) {
+      current++;
+      continue;
+    }
+    const chain = resolveChain("state", from, TARGET_VERSIONS.state);
+    if (!chain) {
+      console.log(`  ✗ ${run.taskId}  no path ${from} → ${TARGET_VERSIONS.state}`);
+      unreadable++;
+      continue;
+    }
+    let next = doc;
+    for (const step of chain) {
+      const mod = await import(pathToFileURL(step.path).href);
+      next = mod.default(next);
+    }
+    if (!dryRun) writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
+    migrated++;
+    console.log(
+      `  ✓ ${run.taskId}  ${from} → ${TARGET_VERSIONS.state}${dryRun ? " (dry run)" : ""}`,
+    );
+  }
+
+  console.log(
+    `\nmigrate-state --all: ${runs.length} runs, ${current} current, ` +
+      `${migrated} migrated${dryRun ? " (dry run)" : ""}, ${legacy} legacy-unstamped, ${unreadable} unreadable`,
+  );
+  if (legacy) {
+    console.log(
+      `\n${legacy} state file(s) predate schemaVersion stamping and are reported, not stamped -\n` +
+        `stamping would claim a conformance nothing verified. They stay resume-safe\n` +
+        `(validate-state.mjs tolerates them by design). New runs are stamped by write-state.mjs.\n` +
+        `  ${legacyIds.slice(0, 8).join(", ")}${legacyIds.length > 8 ? ", ..." : ""}`,
+    );
+  }
+  return unreadable ? 1 : 0;
 }
 
 /**
@@ -139,6 +222,11 @@ function resolveChain(type, from, to) {
 }
 
 async function main() {
+  const parsed = parseArgs();
+  if (parsed.all) {
+    process.exit(await sweepAll(parsed.dryRun));
+  }
+
   const { type: forced, dryRun, path } = parseArgs();
 
   if (!existsSync(path)) {
@@ -199,9 +287,11 @@ async function main() {
   }
 
   if (dryRun) {
+    // return, not process.exit(0): a state file is the payload here, and exiting
+    // truncates it when stdout is a pipe - which is how a dry run gets reviewed.
     console.log("--- dry run, not writing ---");
     console.log(JSON.stringify(current, null, 2));
-    process.exit(0);
+    return;
   }
 
   writeFileSync(path, JSON.stringify(current, null, 2) + "\n");

package/pipeline/scripts/phase-banner.sh

@@ -12,9 +12,9 @@
 #   phase-banner.sh label <phase>                               (print canonical name)
 #
 # Examples:
-#   phase-banner.sh start 4 "Review" "deterministic gates + parallel + triage"
-#   phase-banner.sh start 4 auto                   # resolves to "Review" (en) or "İnceleme" (tr)
-#   PHASE_LANG=tr phase-banner.sh start 4 auto     # "Faz 4: İnceleme"
+#   phase-banner.sh start 3 "Review" "parallel + triage + user test"
+#   phase-banner.sh start 3 auto                   # resolves to "Review" (en) or "İnceleme" (tr)
+#   PHASE_LANG=tr phase-banner.sh start 3 auto     # "Faz 3: İnceleme"
 #
 # Status values for `end`: done | failed | skipped
 #
@@ -23,7 +23,8 @@
 #   Turkish. The `auto` sentinel in place of [name] triggers a table lookup.
 #   Canonical label set mirrors pipeline/multi-agent-refs/phases.md.
 #
-# Output is colored when stdout is a TTY (TERM != dumb). Plain otherwise so
+# Output is colored when stdout is a TTY (TERM != dumb) and the run is not
+# marked unattended. Plain otherwise so
 # logs and CI artifacts stay readable. Always written to stdout  -  log
 # capture is the caller's responsibility.
 
@@ -31,28 +32,28 @@ set -uo pipefail
 
 PHASE_LANG="${PHASE_LANG:-en}"
 
-# Canonical phase label table. Keep synced with
-# pipeline/multi-agent-refs/phases.md and the table in
-# pipeline/skills/shared/multi-agent/SKILL.md.
+# Canonical phase label table. The English half is checked against
+# pipeline/schemas/phases.json by smoke-phase-contract.sh, so it cannot drift
+# from the contract in silence the way it did through the eight-phase era. It
+# stays a case statement rather than a jq read because this runs on every
+# banner and the pipeline's zero-dependency rule (ADR-0004) applies to the hot
+# path. The Turkish half has no contract entry - labels are translations, not
+# identifiers - and is kept beside it.
 phase_label() {
   local phase="$1" lang="${2:-en}"
   case "$lang:$phase" in
     en:0) echo "Init" ;;
-    en:1) echo "Analysis" ;;
-    en:2) echo "Planning" ;;
-    en:3) echo "Dev" ;;
-    en:4) echo "Review" ;;
-    en:5) echo "Test" ;;
-    en:6) echo "Commit & PR" ;;
-    en:7) echo "Report" ;;
+    en:1) echo "Plan" ;;
+    en:2) echo "Dev" ;;
+    en:3) echo "Review" ;;
+    en:4) echo "Commit & PR" ;;
+    en:5) echo "Report" ;;
     tr:0) echo "Başlangıç" ;;
-    tr:1) echo "Analiz" ;;
-    tr:2) echo "Planlama" ;;
-    tr:3) echo "Geliştirme" ;;
-    tr:4) echo "İnceleme" ;;
-    tr:5) echo "Kullanıcı Testi" ;;
-    tr:6) echo "Commit & PR" ;;
-    tr:7) echo "Rapor" ;;
+    tr:1) echo "Plan" ;;
+    tr:2) echo "Geliştirme" ;;
+    tr:3) echo "İnceleme" ;;
+    tr:4) echo "Commit & PR" ;;
+    tr:5) echo "Rapor" ;;
     *) echo "" ;;
   esac
 }
@@ -88,7 +89,10 @@ fi
 PHASE_WORD="$(phase_word "$PHASE_LANG")"
 
 # Color helpers (skip if not a TTY or TERM=dumb).
-if [ -t 1 ] && [ "${TERM:-}" != "dumb" ]; then
+# Sunucuda terminal olabilir ve renk kimseye gitmez; log dosyasına ANSI
+# kaçışları yazmak onu greplenemez yapar. MULTI_AGENT_UNATTENDED=1 bunu da
+# kapatır; tanımsızken karar bugünküyle aynı.
+if [ -t 1 ] && [ "${TERM:-}" != "dumb" ] && [ "${MULTI_AGENT_UNATTENDED:-}" != "1" ]; then
   C_RESET=$'\033[0m'
   C_DIM=$'\033[2m'
   C_BOLD=$'\033[1m'