@mmerterden/multi-agent-pipeline 18.0.0 → 19.0.0

package/pipeline/multi-agent-refs/audit-guide.md

@@ -19,16 +19,16 @@ Standalone audit commands  -  runs directly via Bash, **no MCP server dependency
 **These audits are on-demand.** They run when:
 
 1. User explicitly requests: `/multi-agent test "accessibility"`, `/multi-agent test "store-ready"`
-2. User asks during Phase 5: "run accessibility audit", "check store compliance"
+2. User asks during the Phase 3 user test: "run accessibility audit", "check store compliance"
 3. Pipeline suggests and user confirms: "UI changes detected  -  want to run accessibility audit?"
 
-**Pipeline never runs audits without user intent.** Phase 4 does code-level review (free, automatic). Phase 5 does device-level audit only when requested.
+**Pipeline never runs audits without user intent.** Phase 3 does code-level review (free, automatic) and the device-level audit only when requested - both live in Review now, at different steps, which is why "Review ran" does not mean a device was touched.
 
 ---
 
 ### iOS Accessibility Audit
 
-**When**: Phase 5  -  user requests, app is running on simulator
+**When**: Phase 3 user test  -  user requests, app is running on simulator
 **What it checks**: Missing labels, small tap targets (<44pt), missing identifiers
 
 **How to run** (requires ui-tree-dumper.swift in project or ~/.claude/scripts/):
@@ -73,7 +73,7 @@ Accessibility Audit:
 
 ### Android Accessibility Audit
 
-**When**: Phase 5  -  user requests, app is running on emulator
+**When**: Phase 3 user test  -  user requests, app is running on emulator
 **What it checks**: Missing contentDescription, small touch targets (<48dp), missing resource-id
 
 ```bash
@@ -98,7 +98,7 @@ cat /tmp/_audit_ui.xml
 
 ### iOS Biometric Test
 
-**When**: Phase 5  -  auth flow testing
+**When**: Phase 3 user test  -  auth flow testing
 
 ```bash
 DEVICE_ID=$(xcrun simctl list devices booted -j | python3 -c "import sys,json; devs=json.load(sys.stdin)['devices']; print(next(d['udid'] for ds in devs.values() for d in ds if d['state']=='Booted'))")
@@ -119,7 +119,7 @@ xcrun simctl keychain $DEVICE_ID biometric-match --face --no-match
 
 ### Android Launch Time
 
-**When**: Phase 5  -  performance baseline
+**When**: Phase 3 user test  -  performance baseline
 
 ```bash
 # Force stop first (cold start)
@@ -143,7 +143,7 @@ adb shell am start -W -n {package_name}/.MainActivity 2>&1
 
 ### iOS Archive Audit (App Store Compliance)
 
-**When**: Phase 6  -  release branches only, user confirms
+**When**: Phase 4  -  release branches only, user confirms
 **Input**: Path to .xcarchive
 
 ```bash
@@ -198,7 +198,7 @@ ls "$APP_DIR/Frameworks/" 2>/dev/null
 
 ### Android APK Audit (Play Store Compliance)
 
-**When**: Phase 6  -  release branches only, user confirms
+**When**: Phase 4  -  release branches only, user confirms
 **Input**: Path to .apk
 
 ```bash
@@ -238,11 +238,11 @@ unzip -l "$APK" 2>/dev/null | grep "classes.*\.dex" | wc -l
 
 | Phase            | What Happens                                        | Method                          |
 | ---------------- | --------------------------------------------------- | ------------------------------- |
-| Phase 4 (Review) | Accessibility check  -  **code-level only**           | AI reads source code, no device |
-| Phase 5 (Test)   | Accessibility audit  -  **device-level, on-demand**   | Bash commands above             |
-| Phase 5 (Test)   | Biometric test  -  **on-demand**                      | `xcrun simctl keychain`         |
-| Phase 5 (Test)   | Launch time  -  **on-demand**                         | `adb shell am start -W`         |
-| Phase 6 (Commit) | Archive/APK audit  -  **release branches, on-demand** | Bash commands above             |
+| Phase 3 (Review)      | Accessibility check  -  **code-level only**           | AI reads source code, no device |
+| Phase 3 (user test)   | Accessibility audit  -  **device-level, on-demand**   | Bash commands above             |
+| Phase 3 (user test)   | Biometric test  -  **on-demand**                      | `xcrun simctl keychain`         |
+| Phase 3 (user test)   | Launch time  -  **on-demand**                         | `adb shell am start -W`         |
+| Phase 4 (Commit)      | Archive/APK audit  -  **release branches, on-demand** | Bash commands above             |
 
 ### Graceful Degradation
 

package/pipeline/multi-agent-refs/channels/issue-comment.md

@@ -124,10 +124,10 @@ Token resolution: `gh auth status` for the active GitHub account selected in Pha
 
 ## Pairing with the Progress flag updater
 
-Every issue comment post is paired with `$HOME/.claude/scripts/update-issue-progress.sh "$TASK_ID"` in the same Phase 7 step. Order: comment FIRST (so the timestamp marks the run), flags SECOND (so the body diff is one logical change).
+Every issue comment post is paired with `$HOME/.claude/scripts/update-issue-progress.sh "$TASK_ID"` in the same Phase 5 step. Order: comment FIRST (so the timestamp marks the run), flags SECOND (so the body diff is one logical change).
 
 ```bash
-# Phase 7 Step 5  -  issue channel
+# Phase 5 Step 5  -  issue channel
 gh issue comment "$ISSUE_NUMBER" --repo "$ORG/$REPO" --body-file /tmp/channels-$TASK_ID-issue.md
 bash $HOME/.claude/scripts/update-issue-progress.sh "$TASK_ID"
 ```

package/pipeline/multi-agent-refs/channels/jira.md

@@ -42,7 +42,7 @@ it is the PR body (`channels/pr.md`).
 
 **`summary`**  -  2-5 sentences in `outputLanguage`. What changed, why, and the user-visible impact. No "we", no marketing tone. Past tense (the work is done at the time the comment goes up).
 
-**Visual evidence inside these sections.** When `state.visualEvidence` carries artefacts, they render INSIDE `summary` and `test_scenarios` - never as a section of their own, which the fixed section order forbids. Phase 6 Step 2.9 has already uploaded them and written the returned name to `visualEvidence.*[].jiraFilename`: reference that name, and call `jira-attach.sh <issue> <file>...` only for an artefact whose `jiraFilename` is absent. Uploading unconditionally here attaches every file a second time whenever the comment is re-rendered - which is exactly what a post-hoc `/multi-agent:channels` run does.
+**Visual evidence inside these sections.** When `state.visualEvidence` carries artefacts, they render INSIDE `summary` and `test_scenarios` - never as a section of their own, which the fixed section order forbids. Phase 4 Step 2.9 has already uploaded them and written the returned name to `visualEvidence.*[].jiraFilename`: reference that name, and call `jira-attach.sh <issue> <file>...` only for an artefact whose `jiraFilename` is absent. Uploading unconditionally here attaches every file a second time whenever the comment is re-rendered - which is exactly what a post-hoc `/multi-agent:channels` run does.
 
 - `summary`, after its sentences: one line naming the pair in `outputLanguage` (`Düzeltme öncesi / Düzeltme sonrası`), then the thumbnails on the next line - `!<file>-before.png|thumbnail! !<file>-after.png|thumbnail!`.
 - `test_scenarios`, under the scenario the recording demonstrates: `!<file>-flow.mp4!` plus one line stating the tier used.
@@ -191,7 +191,7 @@ The adapter prepends the linked PR URL on the **first line** so reviewers can ju
 ```
 PR: https://github.com/<org>/<repo>/pull/4321
 
-Phase 4 review accepted 2 findings...
+Phase 3 review accepted 2 findings...
 ```
 
 In multi-repo mode, `channels-multi-repo.sh render-jira <state> <body>` prepends a bulleted `* PR:` list  -  primary first, extras after. Single-repo tasks fall through to the unchanged body.
@@ -255,6 +255,6 @@ When the **Wiki** adapter writes pages on the same run AND `prefs.global.wikiToJ
 - UTF-8 in, UTF-8 out  -  the body file is UTF-8 and `--data-binary` ships its bytes verbatim. Never round-trip the body through `unicode_escape`, `latin-1`, or any re-encode step, and never hand-roll a Python/curl helper that re-decodes it: that mangles Turkish chars (ç ş ı ö ü ğ) into mojibake (`Çözüm` → `Ãözüm`). Use the `jq --rawfile` + `--data-binary @file` path above as-is. Same rule for the PR / Confluence / Wiki adapters.
 - Section order is fixed: `summary` → `test_scenarios` → `context_refs`. Never insert sections between them; never reorder.
 - Humanizer pass runs **after** body assembly and **before** wiki-markup conversion. Tone target: informal but technical. No marketing voice, no "we are excited", no "I have...".
-- **No decorative glyphs anywhere in the comment body**  -  neither emotive (    ) nor status glyphs ([done] [pending] failed skipped active ). The comment is plain technical prose. Status is written in words: `[done]` / `[pending]`, and `done · active · failed · skipped · pending` in the phase strip. This applies to every channel, not only Jira  -  see `channels/README` note in `phase-7-report.md`.
+- **No decorative glyphs anywhere in the comment body**  -  neither emotive (    ) nor status glyphs ([done] [pending] failed skipped active ). The comment is plain technical prose. Status is written in words: `[done]` / `[pending]`, and `done · active · failed · skipped · pending` in the phase strip. This applies to every channel, not only Jira  -  see `channels/README` note in `phase-5-report.md`.
 - Body content language follows `prefs.global.outputLanguage`. Code identifiers, file paths, type names, branch names, and the wiki-markup syntax stay verbatim. The `promptLanguage="en"` lock means any LLM prompt that produces the body is in English; the body itself is then rendered in the user's language.
 - Adapter failures are non-blocking  -  a missing token or 401 returns `skipped`/`failed`, the loop keeps going for PR / Confluence / Wiki.

package/pipeline/multi-agent-refs/channels/pr.md

@@ -45,7 +45,7 @@ all - it is the section whose absence over there is the point.
 
 **`technical`**  -  the account for someone holding the diff: a short paragraph on the mechanism (what the code was actually doing wrong, or what the new code does), then the per-file bullets, then one line of diff stat (`2 files, 8 deletions, 0 insertions`). Where a change is safe for a reason that is not obvious from the diff - an equality relation preserved, an invariant kept, a call site left alone deliberately - that reason belongs here in a sentence, because it is the question the reviewer would otherwise ask in a comment. Tables are welcome when several symbols share a property worth listing side by side.
 
-The bullet list is one item per logically distinct change. Each bullet starts with the touched component and ends with a one-line "what". The source is `$WORKTREE/.pipeline/scope-check.json` `files[].reason` (Phase 3 Step 3.7): a file the dev could not justify there is a file this list cannot describe either, so the bullet quotes the gate output instead of inventing a reason. Use the stack's native file extensions / module paths  -  the example below shows the **shape**, not a stack lock-in:
+The bullet list is one item per logically distinct change. Each bullet starts with the touched component and ends with a one-line "what". The source is `$WORKTREE/.pipeline/scope-check.json` `files[].reason` (Phase 2 Step 3.7): a file the dev could not justify there is a file this list cannot describe either, so the bullet quotes the gate output instead of inventing a reason. Use the stack's native file extensions / module paths  -  the example below shows the **shape**, not a stack lock-in:
 
 ```markdown
 ## Changes
@@ -135,7 +135,7 @@ The base sha matters because "it builds" is a claim about a merge base, and the
 
 Pick commands for the project's stack  -  the pipeline supports iOS (Swift/Xcode), Android (Gradle), web (npm/pnpm/yarn) and backend (pytest/jest/go test/etc). Multi-repo PRs (one PR per repo) emit the commands for that repo's stack only  -  never mix iOS + Android commands into a single PR body.
 
-**`risk`**  -  only when `state.diffRisk.signals` (Phase 4 Step 1.75) contains a high-stakes signal. Four fixed lines, each answered, never left as a placeholder; the source is Phase 1 `touchedAreas` plus the signals themselves, and when a signal is present the absence of this section is a Phase 6 Step 3 blocker:
+**`risk`**  -  only when `state.diffRisk.signals` (Phase 3 Step 1.75) contains a high-stakes signal. Four fixed lines, each answered, never left as a placeholder; the source is Phase 1 `touchedAreas` plus the signals themselves, and when a signal is present the absence of this section is a Phase 4 Step 3 blocker:
 
 ```markdown
 ## Risk and Security
@@ -146,7 +146,7 @@ Pick commands for the project's stack  -  the pipeline supports iOS (Swift/Xcode
 - Rollback: feature flag <name> | git revert <sha> | none, and why
 ```
 
-**`visuals`**  -  only when `state.visualEvidence.required`. What this section can show depends on where the artefacts are hosted, which Phase 6 resolves into `state.visualEvidence.host`. Render the form for that host and no other.
+**`visuals`**  -  only when `state.visualEvidence.required`. What this section can show depends on where the artefacts are hosted, which Phase 4 resolves into `state.visualEvidence.host`. Render the form for that host and no other.
 
 **`host: jira`.** Filenames, never URLs. A Jira attachment URL is auth-gated and renders as a broken image for anyone reading the PR outside a Jira session, and a broken image is worse than a filename because it looks like the evidence is missing.
 
@@ -192,7 +192,7 @@ Pick commands for the project's stack  -  the pipeline supports iOS (Swift/Xcode
 
 **Video is Jira-only.** On a GitHub-hosted run no recording is made and none is published: an mp4 behind a blob link is a download, not something a reviewer opens mid-review, and paying for a recording nobody watches is worse than saying plainly that there is none. The gap line carries that reason.
 
-Every `state.visualEvidence.gaps[]` entry becomes its own line with the reason instead of a filename (`- Before: none  -  the ticket carries no image attachment`). Phase 6 Step 3 blocks on a required artefact that is neither listed nor explained. Contract: `$HOME/.claude/multi-agent-refs/features/visual-evidence.md`.
+Every `state.visualEvidence.gaps[]` entry becomes its own line with the reason instead of a filename (`- Before: none  -  the ticket carries no image attachment`). Phase 4 Step 3 blocks on a required artefact that is neither listed nor explained. Contract: `$HOME/.claude/multi-agent-refs/features/visual-evidence.md`.
 
 **`dependencies`**  -  only when `Package.swift` / `Podfile` / `build.gradle` / `package.json` changed. Each entry: `package@old → new  -  reason`.
 

package/pipeline/multi-agent-refs/channels/wiki.md

@@ -64,4 +64,4 @@ Adapter implementation chooses the right git push target + commit message format
 - Screenshots cover light/dark + LTR/RTL  -  wiki adapter refuses to commit if any quadrant is missing.
 - Body content language follows `prefs.global.outputLanguage`. Code identifiers, file paths, type names, design token names, and Markdown formatting stay verbatim across languages (wiki pages are `.md` files  -  "wiki markup" in this doc set means Jira's dialect, which never appears here). The template (this doc) is English because `promptLanguage="en"` is locked.
 - No decorative/emotive emoji or smileys (    ) in the page prose. Only functional/structural marks a fixed template defines are allowed.
-- Autopilot always pauses at the channels menu (per `phase-7-report.md` autopilot contract)  -  even in autopilot mode the user gets to confirm wiki scope.
+- Autopilot always pauses at the channels menu (per `phase-5-report.md` autopilot contract)  -  even in autopilot mode the user gets to confirm wiki scope.

package/pipeline/multi-agent-refs/component-dispatch.md

@@ -13,7 +13,7 @@
 
 > **TLDR**  -  When `taskType === "component"` (Figma URL in task description or instruction-driven figma workflow), multi-agent Phase 3 **does not run the TDD loop**. It delegates the entire phase to the enabled `ai-<platform>-toolkit` **marketplace plugin's** component skill (`create-component`, falling back to `create-ui-component`) via the Skill tool. Implementation lives in the plugin; multi-agent's job is classification, dispatch, and state report. The pipeline no longer bundles its own `figma-to-component` orchestrator  -  component skills live in one place, the plugin marketplace.
 
-This doc is referenced from `$HOME/.claude/multi-agent-refs/phases/phase-3-dev.md`. Keeping it separate lets `phase-3-dev.md` remain tight (it's already the largest phase doc) and gives the orchestrator-report contract a stable URL for both Claude-side and Copilot-side implementations.
+This doc is referenced from `$HOME/.claude/multi-agent-refs/phases/phase-2-dev.md`. Keeping it separate lets `phase-2-dev.md` remain tight (it's already the largest phase doc) and gives the orchestrator-report contract a stable URL for both Claude-side and Copilot-side implementations.
 
 ## Entry conditions
 
@@ -122,9 +122,9 @@ On failure (the plugin skill returns an unrecoverable build/test error, or the d
 
 ## Short-run behaviour
 
-When the Phase 0 Step 7.5 depth picker answered Short (`state.onlyDevelop === true`), the dispatch layer passes `mode: "dev"` so the plugin skill can elide unit tests and wiki (structural + snapshot still required; wiki deferred to Phase 7). If the plugin does not honor a `mode` hint, dispatch simply skips the post-build wiki step itself.
+When the Phase 0 Step 7.5 depth picker answered Short (`state.onlyDevelop === true`), the dispatch layer passes `mode: "dev"` so the plugin skill can elide unit tests and wiki (structural + snapshot still required; wiki deferred to Phase 5). If the plugin does not honor a `mode` hint, dispatch simply skips the post-build wiki step itself.
 
-Phase 4 runs in a Short run as it does in a Full one, and its reviewer count is **not** Phase 3's concern  -  the Step 1.77 scope gate decides that from diff risk, independently of `mode`. What the dispatch layer owes Phase 4 is the record of which plugin skill it delegated to, appended to `state.telemetry.skillCalls[]`, so the review can check the delivered component against the criteria that skill imposes.
+Phase 3 runs in a Short run as it does in a Full one, and its reviewer count is **not** Phase 3's concern  -  the Step 1.77 scope gate decides that from diff risk, independently of `mode`. What the dispatch layer owes Phase 4 is the record of which plugin skill it delegated to, appended to `state.telemetry.skillCalls[]`, so the review can check the delivered component against the criteria that skill imposes.
 
 ## Cross-CLI behaviour (intentional divergence)
 

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -1,9 +1,10 @@
 # Cross-CLI Contract (Claude Code · Copilot CLI · Codex CLI)
 
 <!-- toc -->
-- [1. Command Inventory (56 commands)](#1-command-inventory-56-commands)
+- [1. Command Inventory (60 commands)](#1-command-inventory-60-commands)
 - [2. Canonical Placeholder Vocabulary](#2-canonical-placeholder-vocabulary)
 - [2.6 Intentional structural divergence  -  thin dispatcher vs inlined orchestrator](#26-intentional-structural-divergence---thin-dispatcher-vs-inlined-orchestrator)
+- [2.7 One command, three different meanings: `/multi-agent:model`](#27-one-command-three-different-meanings-multi-agentmodel)
 - [3. Frontmatter Transform Rules (Claude ↔ Copilot)](#3-frontmatter-transform-rules-claude-copilot)
 - [4. Progress Signalling Parity](#4-progress-signalling-parity)
 - [5. Argument Parsing Invariants](#5-argument-parsing-invariants)
@@ -19,16 +20,17 @@
 
 ---
 
-## 1. Command Inventory (56 commands)
+## 1. Command Inventory (60 commands)
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
 autopilot-on, autopilot-status, build-optimize, channels, complaint-analysis,
 create-jira, design-check, diff-explain, doctor, feedback, forget,
 garbage-collect, graph, help, ios-coding-standard, issue, jira, kill,
-language, local, local-autopilot, log, manual-test, prune-logs,
+language, local, local-autopilot, log, manual-test, model, prune-logs,
 prune-prompts, purge, refactor, resume, resume-local, review,
-review-analysis, review-issue, review-jira, routines, save, scan, search,
+review-analysis, review-issue, review-jira, route-off, route-on,
+route-status, routines, save, scan, search,
 setup, stack, status, steer, store-ready, sync, test, test-accessibility,
 test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation,
 uninstall, update
@@ -199,7 +201,7 @@ on skill directories would demand exactly the layout that breaks it.
 
 **What must stay identical** (byte-level) across the two files:
 
-- Phase canonical labels (Phase 0-7)
+- Phase canonical labels (Phase 0-5)
 - Input parsing table (Section 5 of this doc)
 - Routing decisions for each input type
 - Placeholder vocabulary (Section 2 of this doc)
@@ -216,7 +218,7 @@ Future changes that break an item in the "stay identical" list must update **bot
 
 ### Panel diversity per host
 
-Phase 4 runs three reviewers everywhere, but the diversity those three buy is not the
+Phase 3 runs three reviewers everywhere, but the diversity those three buy is not the
 same on every host. Copilot CLI gets cross-VENDOR disagreement for free: GPT-5.4 sits
 beside two Claude models. Claude Code and Codex each run a one-vendor panel - three
 Anthropic models on one, three OpenAI models on the other - so the same three-way
@@ -236,6 +238,29 @@ members available there are closer to each other than Fable and Sonnet are. That
 weaker axis, not an equivalent one, and treating it as equivalent is the error this
 section exists to prevent.
 
+## 2.7 One command, three different meanings: `/multi-agent:model`
+
+Most commands do the same thing on all three hosts. This one does not, and the
+divergence is stated here rather than discovered at runtime, because a command
+that quietly no-ops is worse than one that says it cannot act.
+
+| Host | What `model on|off` does | Why |
+|---|---|---|
+| Claude Code | live switch: flips `modelFallback.fableEnabled` and realigns `costBudget.pricingModel` | the only host where the `fable` rung is Fable 5 |
+| Copilot CLI | writes the preference, changes no dispatch | Fable 5 is not offered there; its personas never sat on this rung |
+| Codex CLI | writes the preference, changes no dispatch, **deliberately** | the `fable` rung on Codex means `gpt-5.6 @ xhigh` - a different model on a different account. A knob named after an Anthropic model must not silently retune a Codex run |
+
+`model-rung.sh` prints which of the three it is on every invocation. The rule it
+follows: report the host's actual behaviour, never claim a change that did not
+happen.
+
+The routing trio (`route-on`, `route-off`, `route-status`) has no such split -
+it writes `prefs.global.modelRouting` identically everywhere. Its honest limit is
+different and applies on every host: a subagent cannot be dispatched to a
+non-Anthropic model, because subagent dispatch belongs to the host. External
+providers are reachable only where the pipeline makes the HTTP call itself
+(`bulk-read.sh`, `research_ask`). `route-status` prints that on every run.
+
 ## 3. Frontmatter Transform Rules (Claude ↔ Copilot)
 
 Each file has a different frontmatter schema. The sync flow transforms between them:

package/pipeline/multi-agent-refs/features/autopilot-circuit-breaker.md

@@ -9,7 +9,7 @@
 - [Two more things a long-running runner needs](#two-more-things-a-long-running-runner-needs)
 <!-- /toc -->
 
-**Pattern**: autopilot runs with zero interaction, which is exactly when a silent failure loop is most expensive  -  an agent can burn a budget re-attempting the same broken fix, or thrash between two phases, with nobody watching. A circuit-breaker converts "keep going no matter what" into "keep going until a defined unsafe condition, then halt and hand back to the user." This is the sanctioned autopilot pause (same class as the Phase 7 channels pause): the run stops, records why, and waits for an explicit `resume`.
+**Pattern**: autopilot runs with zero interaction, which is exactly when a silent failure loop is most expensive  -  an agent can burn a budget re-attempting the same broken fix, or thrash between two phases, with nobody watching. A circuit-breaker converts "keep going no matter what" into "keep going until a defined unsafe condition, then halt and hand back to the user." This is the sanctioned autopilot pause (same class as the Phase 5 channels pause): the run stops, records why, and waits for an explicit `resume`.
 
 **Gated by `prefs.global.autopilotCircuitBreaker`** (`enabled` default true, `identicalFindingCycles` default 2, `maxReworkCycles` default 3; `schemas/prefs.schema.json`). Halting is always safe, so the breaker itself defaults on. Disable per-run only with an explicit override. Complements, does not replace, the existing autopilot safety rules (build-fail max 3 retries, Phase 4 blocking-finding rework, destructive-op confirmations).
 
@@ -23,7 +23,7 @@ Any one trips the breaker. All are evaluated from `agent-state.json` + telemetry
 | 2 | **Identical repeated failure** | same normalized build-error signature, or the same Phase 4 finding fingerprint, recurs across consecutive Phase 3 rework cycles | 2 cycles |
 | 3 | **Rework storm** | Phase 4 -> Phase 3 rework cycles exceed the cap (distinct from the build-retry cap) | `maxReworkCycles` = 3 |
 | 4 | **Cost drift** | cumulative spend crosses the `costBudget` ceiling, or the projected next-phase spend would exceed it, after model-fallback has already downgraded | `costBudget` ceiling |
-| 5 | **Merge/rebase conflict** | Phase 6 push blocked by a conflict that requires history reconciliation | any conflict |
+| 5 | **Merge/rebase conflict** | Phase 4 push blocked by a conflict that requires history reconciliation | any conflict |
 
 Trigger 2 is the key addition over the plain build-retry cap: a build can "fail differently" three times (legitimate iteration) or "fail identically" twice (stuck). Only the identical-failure case is a stall; the retry cap catches the rest.
 
@@ -31,12 +31,12 @@ Trigger 2 is the key addition over the plain build-retry cap: a build can "fail
 
 | Trigger | Evaluated by | Status |
 |---|---|---|
-| 2, finding half | `review-delta.mjs` exit 3 at Phase 4 Step 3.8: a blocking/important finding whose `fingerprint` (finding-fingerprint.mjs) stays in the accepted set for `identicalFindingCycles` consecutive rounds | **code** (v16.20.0) |
+| 2, finding half | `review-delta.mjs` exit 3 at Phase 3 Step 3.8: a blocking/important finding whose `fingerprint` (finding-fingerprint.mjs) stays in the accepted set for `identicalFindingCycles` consecutive rounds | **code** (v16.20.0) |
 | 3 | Phase 3 re-entry item 6: the `retryCount === 3` hard-kill records the trip | **code** (v16.20.0) |
 | 2, build-error half | needs a build-log signature normaliser | documented behaviour, no script yet |
 | 1 | needs checkpoint-to-checkpoint artifact diffing | documented behaviour, no script yet |
 | 4 | belongs to `cost-budget-check.mjs` | documented behaviour, no script yet |
-| 5 | Phase 6 push | documented behaviour, no script yet |
+| 5 | Phase 4 push | documented behaviour, no script yet |
 
 State shape: `state.circuitBreaker = {tripped, trigger, detail, checkpoint: {phase, step, iteration}, trippedAt, counters: {identicalFindingCycles, reworkCycles}}` (`schemas/agent-state.schema.json`). The per-round classification the finding half reads lives in `state.reviewIterations[i].delta` (`new`, `stillPresent`, `resolved`, `downgraded`, `recurrence`, `plateau`). `smoke-autopilot-circuit-breaker.sh` asserts the schema fields, the scripts and the phase wiring, not only this prose.
 

package/pipeline/multi-agent-refs/features/code-graph.md

@@ -1,8 +1,8 @@
-## Code Graph (Phase 1 Step 2.6 + Phase 7 Step 3)
+## Code Graph (Phase 1 Step 2.6 + Phase 5 Step 3)
 
 <!-- toc -->
 - [Phase 1 Step 2.6  -  query before dispatching Explore](#phase-1-step-26---query-before-dispatching-explore)
-- [Phase 7 Step 3  -  refresh after the branch changed code](#phase-7-step-3---refresh-after-the-branch-changed-code)
+- [Phase 5 Step 3  -  refresh after the branch changed code](#phase-5-step-3---refresh-after-the-branch-changed-code)
 - [What the report answers that a file-level view cannot](#what-the-report-answers-that-a-file-level-view-cannot)
 - [The graph is drawable, and one place already asks for it](#the-graph-is-drawable-and-one-place-already-asks-for-it)
 <!-- /toc -->
@@ -10,7 +10,7 @@
 A deterministic, LLM-free map of what a repo declares and what refers to what,
 written to `~/.claude/knowledge/<project>/code-graph.json`. Gated by
 `prefs.global.codeGraph.enabled` (default `false`); with it off, Phase 1 and
-Phase 7 behave exactly as they did before. Design, trade and measurements:
+Phase 5 behave exactly as they did before. Design, trade and measurements:
 `docs/adr/0010-own-code-graph.md`.
 
 ### Phase 1 Step 2.6  -  query before dispatching Explore
@@ -38,7 +38,7 @@ at a graph that was never built. Pass it.
 
 Build when there is no graph at all, and when `baseCommit` no longer matches
 HEAD. The missing case is the one that matters in practice: `architecture.md`
-and its siblings are written in Phase 7, which is the phase a run is least
+and its siblings are written in Phase 5, which is the phase a run is least
 likely to reach, so a repo can have a long history of tasks and an empty
 knowledge directory. The graph must not inherit that. `--status` exits 1 on a
 missing file, and that exit means build, not skip.
@@ -56,7 +56,7 @@ already spells out. Measured on a 4,300-file Swift app at a fixed 30k retrieval
 budget, it roughly doubled coverage at under half the cost on domain-word
 questions and lost narrowly to `grep -lw` on exact type names.
 
-### Phase 7 Step 3  -  refresh after the branch changed code
+### Phase 5 Step 3  -  refresh after the branch changed code
 
 Runs when `prefs.global.codeGraph.enabled` and `prefs.global.codeGraph.autoRefresh`
 are both true.

package/pipeline/multi-agent-refs/features/design-conformance.md

@@ -21,7 +21,7 @@ Derived generically from an upstream corporate screen-QA tool (recorded in
 catalogs and product examples are not, and were not taken - section 7 says what
 replaces them.
 
-Consumers: `/multi-agent:design-check` (the runner), Phase 4 review when a UI
+Consumers: `/multi-agent:design-check` (the runner), Phase 3 review when a UI
 diff is under review, and `features/visual-evidence.md` when a capture has to
 prove a fix. Gate: `smoke-design-conformance.sh`.
 

package/pipeline/multi-agent-refs/features/dev-critic.md

@@ -1,6 +1,6 @@
-# Feature: Dev Critic (Phase 3 Step 3.5 Evaluator-Optimizer)
+# Feature: Dev Critic (Phase 2 Step 3.5 Evaluator-Optimizer)
 
-**Pattern**: Anthropic's evaluator-optimizer from "Building Effective Agents" (Dec 2024). Generator (Phase 3 Dev) and critic (`agents/dev-critic.md`) loop on deterministic criteria already written in `rules/*.md` before any Phase 4 reviewer call.
+**Pattern**: Anthropic's evaluator-optimizer from "Building Effective Agents" (Dec 2024). Generator (Phase 2 Dev) and critic (`agents/dev-critic.md`) loop on deterministic criteria already written in `rules/*.md` before any Phase 3 reviewer call.
 
 **Gated by `prefs.global.devCritic.enabled`** (default: `false`). When enabled, after the generator's last edit and BEFORE Phase 4:
 
@@ -25,7 +25,7 @@
 
 ## Telemetry
 
-Each critic call emits `dev_critic.call` with `iteration`, `pass`, `gates_failed`, `blocking`, `important`, `duration_ms`, `tokens_in/out`. Phase 7 cost rollup lists these as `phase 3.5` line items so the net saving (Phase 4 reviewer/triage calls avoided) is measurable.
+Each critic call emits `dev_critic.call` with `iteration`, `pass`, `gates_failed`, `blocking`, `important`, `duration_ms`, `tokens_in/out`. Phase 5 cost rollup lists these as `phase 3.5` line items so the net saving (Phase 3 reviewer/triage calls avoided) is measurable.
 
 ## Off by default reason
 

package/pipeline/multi-agent-refs/features/doctor.md

@@ -153,7 +153,7 @@ after the user has already answered the pickers.
 ### identity
 
 A git identity resolves for the account the run would commit as. WARN: the run
-reaches Phase 6 and stops there.
+reaches Phase 4 and stops there.
 
 ### hook-coverage
 
@@ -246,7 +246,7 @@ file it was writing at the time.
 
 Worktrees left under `<repo>/.worktrees/` in the repository the caller is
 standing in. WARN at five or more, or at 2 GB. A finished task removes its own
-worktree at PR time, but a run that stops before Phase 6 never reaches that
+worktree at PR time, but a run that stops before Phase 4 never reaches that
 step and nothing else collects it: the finalizer only runs on success, and
 `gc-worktrees` only sweeps entries git has already forgotten. Each survivor is
 a full second checkout, so the total is measured in gigabytes rather than

package/pipeline/multi-agent-refs/features/external-context-injection.md

@@ -54,7 +54,7 @@ ticket that referenced nothing. The run then produced a plan from a partial pict
 reported success, and the user found out by reading the output.
 
 So on exit `3`, classify the stderr and surface an `AskUserQuestion` before continuing.
-The classification is the same shape the Phase 6 remote gate uses, because the failures
+The classification is the same shape the Phase 4 remote gate uses, because the failures
 are the same failures:
 
 | stderr signal | Diagnosis | Question offers |
@@ -78,14 +78,14 @@ Rules that make this actionable rather than decorative:
    "planned without Crashlytics, user's choice at <ts>" in the analysis doc's limitations
    section instead of leaving a silent hole.
 5. **Autopilot still reports.** Autopilot takes "continue without this source" without
-   asking, but the skipped source is logged and carried into the Phase 7 report. An
+   asking, but the skipped source is logged and carried into the Phase 5 report. An
    autopilot run that quietly planned from a partial picture is the same defect with a
    flag on it.
 
 Failures remain non-fatal at Phase 1 by default - the agent still runs analysis. What
 changed is that the user learns about it while the choice is still theirs to make.
 
-**Graylog specifics.** `fetch-graylog.sh` degrades to empty on any network/VPN failure: it emits a normalized empty object and exits `0`, so an unreachable host reads as `{status:"skipped", reason:"vpn-unreachable"}` and never blocks. **Exiting `0` is not permission to stay quiet.** The payload carries `degraded: true` and a `degradeReason`; when it does, log one line naming the host and the reason, and carry it into the Phase 7 report. Logs are advisory, so this never asks a question and never blocks - but "I searched the logs and found nothing" and "I never reached the log server" are different statements, and only one of them is true. Only a genuine auth rejection on a reachable host exits `3` (marked `failed`, still non-fatal here). `state.graylogContext` is prepended to the analysis prompt inside the **Referenced External Sources** section as diagnostic context that is **advisory only**  -  the agent may use it to orient on a reported error, but code remains ground truth, and there is no Phase 4 review gate for logs.
+**Graylog specifics.** `fetch-graylog.sh` degrades to empty on any network/VPN failure: it emits a normalized empty object and exits `0`, so an unreachable host reads as `{status:"skipped", reason:"vpn-unreachable"}` and never blocks. **Exiting `0` is not permission to stay quiet.** The payload carries `degraded: true` and a `degradeReason`; when it does, log one line naming the host and the reason, and carry it into the Phase 5 report. Logs are advisory, so this never asks a question and never blocks - but "I searched the logs and found nothing" and "I never reached the log server" are different statements, and only one of them is true. Only a genuine auth rejection on a reachable host exits `3` (marked `failed`, still non-fatal here). `state.graylogContext` is prepended to the analysis prompt inside the **Referenced External Sources** section as diagnostic context that is **advisory only**  -  the agent may use it to orient on a reported error, but code remains ground truth, and there is no Phase 3 review gate for logs.
 
 ## Prompt injection shape
 

package/pipeline/multi-agent-refs/features/maturity-followup.md

@@ -128,15 +128,15 @@ maturity step has `currentPhase: 0`, so resuming would start at Phase 1 and skip
 the check - the halt would be permanent in the one direction that matters.
 
 So resume reads `state.waitingFor` first: when it names a step, the run re-enters
-THAT step rather than the next phase. `waitingFor` already existed and Phase 7's
+THAT step rather than the next phase. `waitingFor` already existed and Phase 5's
 channels pause already documented itself as resumable through it
-(`phases/phase-7-report.md`), while `resume/SKILL.md` never mentioned the field -
+(`phases/phase-5-report.md`), while `resume/SKILL.md` never mentioned the field -
 so that pause had the same gap and this fixes both.
 
 | `waitingFor` | Re-entry |
 |---|---|
 | `maturity` | Phase 0, the maturity step, with the item re-fetched |
-| `user-channels-choice` | Phase 7, the channels menu |
+| `user-channels-choice` | Phase 5, the channels menu |
 | absent | `currentPhase + 1`, as before |
 
 `waitingFor` is cleared by the write that records the answer. A field that

package/pipeline/multi-agent-refs/features/model-fallback.md

@@ -42,7 +42,7 @@ architect/reviewer roles with no file edits.
 Personas and dispatch read the **rung** (`fable`, `opus`, `sonnet`, `haiku`). The wire
 model ID each rung resolves to lives in exactly two places: `scripts/cost-table.json`
 (`prices.<rung>.modelId`) and the per-host reviewer table in
-`phases/phase-4-review.md`. A generation move edits those; it never renames a rung and
+`phases/phase-3-review.md`. A generation move edits those; it never renames a rung and
 never touches a persona file.
 
 Current resolution: `fable` -> `claude-fable-5`, `opus` -> `claude-opus-5`,
@@ -61,7 +61,7 @@ Three shifts on the current opus rung are worth knowing when reading a run that
 different rather than broken, and none of them are bugs in this contract:
 
 - **Longer user-facing output.** Effort is not the lever; prompt-level conciseness is.
-  Phase 7 report length and reviewer prose are where this shows.
+  Phase 5 report length and reviewer prose are where this shows.
 - **Self-verification without being asked.** Explicit "double-check your work"
   scaffolding now causes over-verification rather than preventing under-verification.
   Phase 4's deterministic gates already carry that load.
@@ -162,7 +162,7 @@ prints it once instead:
    with `PHASE_MODEL_OVERRIDE=<floorModel>`. A failure at the floor (or when no
    floor is configured) falls through to the normal phase-error path (pause ->
    resume). Never silent-skip the persona. Each downgrade emits its own
-   `model_fallback` metric line so a two-step degrade is visible in Phase 7.
+   `model_fallback` metric line so a two-step degrade is visible in Phase 5.
 3. **Cost budget ceiling (existing gate).** When `cost-budget-check.mjs` exits 11
    (exceeded) mid-run, the run already pauses per the cost-budget contract; on
    user-approved continue, `preferredModel` personas downgrade to `fallbackModel` for the
@@ -172,7 +172,7 @@ prints it once instead:
 
 Every fallback emits one `log-metric.sh` line (`metric: model_fallback`,
 attributes: `persona`, `from`, `to`, `trigger: date-gate|dispatch-error|budget`)
-and one agent-log line so Phase 7 reports show which phases ran degraded.
+and one agent-log line so Phase 5 reports show which phases ran degraded.
 The cost ledger prices the dispatch at the model actually used (the tracker's
 per-phase `model` field already carries the override).
 
@@ -213,5 +213,5 @@ parent model and reasoning effort and silently discards the override, so a
 fallback that omits it appears to apply while changing nothing.
 
 The three model ids above live in exactly three places - this table,
-`pipeline/scripts/cost-table.json`, and the Phase 4 reviewer matrix - so an OpenAI
+`pipeline/scripts/cost-table.json`, and the Phase 3 reviewer matrix - so an OpenAI
 rename is a three-file change.

package/pipeline/multi-agent-refs/features/plan-todos.md

@@ -1,6 +1,6 @@
 # Feature: Plan Todos Iteration (Phase 3)
 
-**Gated by `prefs.global.planTodos.enabled`** (default: `false`). When enabled and Phase 2 Step 4.5 emitted a `plan.todos[]` (conforming to `$HOME/.claude/schemas/plan-todos.schema.json`), Phase 3 iterates with the helper instead of walking `tasks[]` directly:
+**Gated by `prefs.global.planTodos.enabled`** (default: `false`). When enabled and Phase 1 Step 11 emitted a `plan.todos[]` (conforming to `$HOME/.claude/schemas/plan-todos.schema.json`), Phase 2 iterates with the helper instead of walking `tasks[]` directly:
 
 ```bash
 while next=$(bash "$HOME/.claude/lib/plan-todos.sh" next "$TASK_ID"); [ -n "$next" ]; do

package/pipeline/multi-agent-refs/features/repo-map.md

@@ -23,7 +23,7 @@ fi
 - **Deterministic**  -  same worktree state → same map. No embeddings, no network. Sub-second on monorepos.
 - **Advisory**  -  Explore agents may ignore the map if they have stronger signals (Phase 0 knowledge cache, explicit user context). Never gates the pipeline.
 - **Truncation-safe**  -  output is capped at `tokenBudget`; the script falls back to "no files extracted within budget" rather than over-spending.
-- **Cost ledger**  -  emit `phase-1.repo_map_emitted bytes=$(wc -c <<<"$REPO_MAP") budget=$BUDGET` so Phase 7 cost summary can show the size injected.
+- **Cost ledger**  -  emit `phase-1.repo_map_emitted bytes=$(wc -c <<<"$REPO_MAP") budget=$BUDGET` so Phase 5 cost summary can show the size injected.
 
 ## When to enable
 

package/pipeline/multi-agent-refs/features/review-delta.md

@@ -6,7 +6,7 @@ Gated by `prefs.global.autopilotCircuitBreaker` (`enabled` default true, `identi
 
 ## Files per round
 
-Phase 4 Step 3.2.1 writes `$WORKTREE/.pipeline/triage-round-<N>.json` (N = `state.reviewIterations | length`), validates it, annotates it and copies it to `$WORKTREE/triage-output.json`, the name Phase 7, `worktree-finalize.sh`, `render-work-summary.sh` and `diff-explain.mjs` read. A copy rather than a symlink because the salvage is `cp -R`, and `.pipeline/` is on the salvage list, so every round survives into `artifactsPath`. Step 3.7 rewrites the round file; the copy is repeated after it.
+Phase 3 Step 3.2.1 writes `$WORKTREE/.pipeline/triage-round-<N>.json` (N = `state.reviewIterations | length`), validates it, annotates it and copies it to `$WORKTREE/triage-output.json`, the name Phase 5, `worktree-finalize.sh`, `render-work-summary.sh` and `diff-explain.mjs` read. A copy rather than a symlink because the salvage is `cp -R`, and `.pipeline/` is on the salvage list, so every round survives into `artifactsPath`. Step 3.7 rewrites the round file; the copy is repeated after it.
 
 ## Step 2.1 block: previous-round findings (iteration >= 2)
 
@@ -34,7 +34,7 @@ The cap of 40 entries drops `important` before `blocking` so the prefix stays bo
 
 ## Step 2.2 block: scope self-check (every iteration)
 
-Phase 3 Step 3.7 wrote `$WORKTREE/.pipeline/scope-check.json` (contract: `features/scope-check.md`). Render it so reviewers judge the diff against the dev's stated scope and do not re-propose what was rejected:
+Phase 2 Step 3.7 wrote `$WORKTREE/.pipeline/scope-check.json` (contract: `features/scope-check.md`). Render it so reviewers judge the diff against the dev's stated scope and do not re-propose what was rejected:
 
 ```bash
 SCOPE_JSON="$WORKTREE/.pipeline/scope-check.json"
@@ -82,7 +82,7 @@ Same argument `shortId()` in `_retrieval.mjs` makes for corpus rows: derived fro
 
 ## Telemetry
 
-`review.delta` once per iteration >= 2: `iteration`, `new`, `still_present`, `resolved`, `plateau`, `tripped`. `run-metrics.mjs` reports `reviewDelta.stillPresentFinal`, `resolvedTotal` and `tripped`; Phase 7 renders the three counts per round.
+`review.delta` once per iteration >= 2: `iteration`, `new`, `still_present`, `resolved`, `plateau`, `tripped`. `run-metrics.mjs` reports `reviewDelta.stillPresentFinal`, `resolvedTotal` and `tripped`; Phase 5 renders the three counts per round.
 
 ## Reference
 

package/pipeline/multi-agent-refs/features/review-multi-repo.md

@@ -1,6 +1,6 @@
 # Phase 4 Review  -  Multi-Repo Mode
 
-> Loaded on demand from `phases/phase-4-review.md`. Conditional on
+> Loaded on demand from `phases/phase-3-review.md`. Conditional on
 > `state.projects[].length > 1`; a single-repo run (the common case) never needs
 > it and used to pay for it on every review.
 

package/pipeline/multi-agent-refs/features/scope-check.md

@@ -1,6 +1,6 @@
-# Feature: Scope self-check (Phase 3 Step 3.7)
+# Feature: Scope self-check (Phase 2 Step 3.7)
 
-**Pattern**: Phase 4 reconstructs everything from the diff. The one thing it cannot reconstruct is why each file was touched and what was left out on purpose, so Dev states both before the handoff, and a deterministic gate checks the statement against the real diff. The record also carries the code-simplifier rationales (Step 3.6) that used to be discarded, and it feeds two later consumers: the `<scope-self-check>` block in the Phase 4 reviewer prefix and the PR body in Phase 6.
+**Pattern**: Phase 3 reconstructs everything from the diff. The one thing it cannot reconstruct is why each file was touched and what was left out on purpose, so Dev states both before the handoff, and a deterministic gate checks the statement against the real diff. The record also carries the code-simplifier rationales (Step 3.6) that used to be discarded, and it feeds two later consumers: the `<scope-self-check>` block in the Phase 3 reviewer prefix and the PR body in Phase 4.
 
 ## The record
 
@@ -33,8 +33,8 @@ Output `{ok, justified, unjustified[], unlisted[], notDone}`. Exit 1 lists `unju
 
 ## Consumers
 
-- Phase 4 Step 2.2 renders file reasons, unjustified files and `notDone[]` into the shared reviewer prefix (`features/review-delta.md`).
-- Phase 6 Step 3 builds the PR `## Changes` bullets from `files[].reason` and lists `notDone[]` under `## Related` as "Follow-ups not done in this PR", merged with the final triage `deferred[]` (`channels/pr.md`).
+- Phase 3 Step 2.2 renders file reasons, unjustified files and `notDone[]` into the shared reviewer prefix (`features/review-delta.md`).
+- Phase 4 Step 3 builds the PR `## Changes` bullets from `files[].reason` and lists `notDone[]` under `## Related` as "Follow-ups not done in this PR", merged with the final triage `deferred[]` (`channels/pr.md`).
 
 ## Reference
 

package/pipeline/multi-agent-refs/features/skill-conformance.md

@@ -13,7 +13,7 @@
 - [Preference](#preference)
 <!-- /toc -->
 
-> **TLDR**  -  Phase 4 Step 1.78 resolves, deterministically and before any reviewer runs, WHAT the changed code was supposed to honour: declared rule registries scoped to the diff's languages, in-repo module guides, and the toolchains those registries delegate to. The result is `criteria-manifest.json`: a bounded set of rule IDs that becomes the denominator for "was this applied completely". Reviewers answer per rule ID. An ID that is neither checked nor explicitly waived fails the stage.
+> **TLDR**  -  Phase 3 Step 1.78 resolves, deterministically and before any reviewer runs, WHAT the changed code was supposed to honour: declared rule registries scoped to the diff's languages, in-repo module guides, and the toolchains those registries delegate to. The result is `criteria-manifest.json`: a bounded set of rule IDs that becomes the denominator for "was this applied completely". Reviewers answer per rule ID. An ID that is neither checked nor explicitly waived fails the stage.
 
 ## Why this exists
 
@@ -88,7 +88,7 @@ Cheap, language-agnostic, and it answers "completely" head on  -  an exception i
 |---|---|
 | `detectedStack` (Phase 1) | language census of the diff by file extension. Describes what the diff CONTAINS, not what the repo is nominally built in, so one Objective-C bridging file in a Swift repo is classified correctly |
 | Phase 1 analysis summary (triage scope) | the task description plus the inline task list Phase 3 generated for itself |
-| Phase 2 plan | same inline task list |
+| Phase 1 plan | same inline task list |
 | `state.evidence.figma[]` (Step 1.8) | recorded as `not-applicable (no Phase 1 evidence)` |
 | Step 2.8 visual conformance | recorded as `not-applicable (no Phase 1 evidence)` |
 

package/pipeline/multi-agent-refs/features/stack-skill-routing.md

@@ -67,7 +67,7 @@ Append one `state.telemetry.skillCalls[]` entry per skill actually loaded:
 
 `routedBy` names the index and version that chose it. That is the difference between "the model happened to read a skill" and "the toolkit said this skill governs this task".
 
-What Phase 4 actually does with it, precisely: Step 1.78 lists these entries in the manifest under `ledger.routedByToolkit`, so a reviewer and the Phase 7 report can see which skills the project's own toolkit selected. It does **not** give them extra weight in the coverage maths. The deterministic resolver stays primary because an unrecorded load and no load are indistinguishable in state, and no `routedBy` tag changes that  -  the tag says who chose the skill, not that the code honoured it.
+What Phase 4 actually does with it, precisely: Step 1.78 lists these entries in the manifest under `ledger.routedByToolkit`, so a reviewer and the Phase 5 report can see which skills the project's own toolkit selected. It does **not** give them extra weight in the coverage maths. The deterministic resolver stays primary because an unrecorded load and no load are indistinguishable in state, and no `routedBy` tag changes that  -  the tag says who chose the skill, not that the code honoured it.
 
 ## Failure modes, and why none of them halt