@mmerterden/multi-agent-pipeline 18.0.0 → 19.1.0

package/pipeline/schemas/route-config.schema.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/route-config.schema.json",
+  "title": "Model routing configuration",
+  "description": "Policy-driven model selection, OFF by default. Lives under prefs.global.modelRouting. Two layers, and the difference is the whole safety argument. Layer 1 chooses a rung INSIDE the Anthropic ladder and writes to the existing PHASE_MODEL_OVERRIDE seam - no new network path, no new account. Layer 2 sends a call to a non-Anthropic provider, and only at the call sites the pipeline makes itself (bulk-read.sh, research_ask), never at a call site the host owns. `scope` has no `host-session` member and that absence is enforced here rather than written in prose: rewriting the host's base URL would route the user's ENTIRE session, including work that has nothing to do with this pipeline, through a third layer - breaking the subscription's auth model and silently changing which model answers. Shipping this disabled is the same reasoning as modelFallback.fableEnabled: a cost control that is on by default is not a control.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["enabled"],
+  "properties": {
+    "enabled": {
+      "type": "boolean",
+      "default": false,
+      "description": "Master switch, ships false. While false not one line of dispatch behaviour changes: rules are read by route-status and by nothing else. route-off sets this to false and KEEPS the rules, so turning it back on does not re-ask for a configuration the user already gave."
+    },
+    "strategy": {
+      "type": "string",
+      "enum": ["manual", "task-fit", "cost-ceiling"],
+      "default": "manual",
+      "description": "manual: only the explicit rules[] apply, nothing is inferred. task-fit: a rule may match on taskKind and the router picks the cheapest rung that clears it. cost-ceiling: rungs downgrade as the run approaches budgetCeilingUsd."
+    },
+    "scope": {
+      "type": "array",
+      "default": ["subagent"],
+      "uniqueItems": true,
+      "description": "Where routing is allowed to act. Every member names a call site the pipeline itself owns. There is deliberately no `host-session` member - see the title description.",
+      "items": {
+        "type": "string",
+        "enum": ["subagent", "bulk-read", "research"]
+      }
+    },
+    "rules": {
+      "type": "array",
+      "default": [],
+      "description": "Ordered; first match wins. An empty list with enabled:true is valid and means 'routing is armed but nothing matches yet' - which route-status reports as such rather than as an error.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["when", "prefer"],
+        "properties": {
+          "when": {
+            "type": "object",
+            "additionalProperties": false,
+            "minProperties": 1,
+            "properties": {
+              "persona": { "type": "string" },
+              "phase": { "type": "integer", "minimum": 0, "maximum": 5 },
+              "taskKind": {
+                "type": "string",
+                "enum": ["bugfix", "feature", "refactor", "chore", "component"]
+              }
+            }
+          },
+          "prefer": {
+            "type": "array",
+            "minItems": 1,
+            "description": "Rungs in descending preference. Rung NAMES are the contract; model ids are not - they live in cost-table.json and change without a config edit.",
+            "items": { "type": "string" }
+          }
+        }
+      }
+    },
+    "budgetCeilingUsd": {
+      "type": ["number", "null"],
+      "default": null,
+      "minimum": 0,
+      "description": "Only consulted by the cost-ceiling strategy. null means no ceiling, which is not the same as a ceiling of 0."
+    },
+    "recordDecisions": {
+      "type": "boolean",
+      "default": true,
+      "description": "Write every routing decision to the cost ledger: which rule matched, which rung it chose, and why. On by default because a router whose choices are not recorded cannot be audited after the fact - and the question that always arrives later is 'why did this run cost that'."
+    }
+  }
+}

package/pipeline/schemas/scope-check.schema.json

@@ -3,7 +3,7 @@
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/scope-check.schema.json",
   "version": "1.0.0",
   "title": "Multi-Agent Pipeline  -  Phase 3 scope self-check",
-  "description": "Written by Phase 3 Step 3.7 to $WORKTREE/.pipeline/scope-check.json before the Phase 4 handoff: one stated reason per file in the diff, the changes deliberately not made, and the code-simplifier rationales. scope-check-gate.mjs compares files[] with the real diff; Phase 4 injects the record as <scope-self-check>; Phase 6 builds the PR Changes bullets and the follow-up list from it.",
+  "description": "Written by Phase 2 Step 3.7 to $WORKTREE/.pipeline/scope-check.json before the Phase 4 handoff: one stated reason per file in the diff, the changes deliberately not made, and the code-simplifier rationales. scope-check-gate.mjs compares files[] with the real diff; Phase 4 injects the record as <scope-self-check>; Phase 4 builds the PR Changes bullets and the follow-up list from it.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "taskId", "files"],

package/pipeline/schemas/secret-patterns.json

@@ -0,0 +1,124 @@
+{
+  "$comment": "Provider shapes for smoke-secret-parity.sh, which proves both secret surfaces block the same set. Each row is SPLIT into a prefix, a filler character and a length, and the gate joins them at run time. No complete credential-shaped string is stored here, so the scanners this file exists to test do not block the file itself - which is exactly what happened when the samples were stored whole and the commit hook refused them. Adding a provider means adding a row here first; the gate then fails until both surfaces catch it.",
+  "providers": [
+    {
+      "id": "github-pat",
+      "prefix": "ghp_",
+      "fill": "A",
+      "len": 36,
+      "suffix": ""
+    },
+    {
+      "id": "github-fine-grained",
+      "prefix": "github_pat_",
+      "fill": "A",
+      "len": 66,
+      "suffix": ""
+    },
+    {
+      "id": "slack",
+      "prefix": "xoxb-",
+      "fill": "A",
+      "len": 16,
+      "suffix": ""
+    },
+    {
+      "id": "aws",
+      "prefix": "AKIA",
+      "fill": "A",
+      "len": 16,
+      "suffix": ""
+    },
+    {
+      "id": "google",
+      "prefix": "AIza",
+      "fill": "A",
+      "len": 35,
+      "suffix": ""
+    },
+    {
+      "id": "npm",
+      "prefix": "npm_",
+      "fill": "A",
+      "len": 36,
+      "suffix": ""
+    },
+    {
+      "id": "gitlab",
+      "prefix": "glpat-",
+      "fill": "A",
+      "len": 20,
+      "suffix": ""
+    },
+    {
+      "id": "stripe",
+      "prefix": "sk_live_",
+      "fill": "A",
+      "len": 20,
+      "suffix": ""
+    },
+    {
+      "id": "anthropic",
+      "prefix": "sk-ant-",
+      "fill": "A",
+      "len": 36,
+      "suffix": ""
+    },
+    {
+      "id": "openai",
+      "prefix": "sk-proj-",
+      "fill": "A",
+      "len": 36,
+      "suffix": ""
+    },
+    {
+      "id": "perplexity",
+      "prefix": "pplx-",
+      "fill": "A",
+      "len": 36,
+      "suffix": ""
+    },
+    {
+      "id": "huggingface",
+      "prefix": "hf_",
+      "fill": "A",
+      "len": 32,
+      "suffix": ""
+    },
+    {
+      "id": "figma-pat",
+      "prefix": "figd_",
+      "fill": "A",
+      "len": 24,
+      "suffix": ""
+    },
+    {
+      "id": "figma-mcp",
+      "prefix": "figu_",
+      "fill": "A",
+      "len": 24,
+      "suffix": ""
+    },
+    {
+      "id": "service-account",
+      "prefix": "\"type\": \"service_",
+      "fill": "",
+      "len": 0,
+      "suffix": "account\""
+    },
+    {
+      "id": "url-with-credentials",
+      "prefix": "https://user:",
+      "fill": "s",
+      "len": 12,
+      "suffix": "@example.com/x.git"
+    },
+    {
+      "id": "bearer-header",
+      "prefix": "Authorization: Bearer ",
+      "fill": "A",
+      "len": 24,
+      "suffix": ""
+    }
+  ]
+}

package/pipeline/schemas/test-gap.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/test-gap.schema.json",
   "version": "1.0.0",
-  "title": "Multi-Agent Pipeline  -  Phase 5 test gap report",
+  "title": "Multi-Agent Pipeline  -  Phase 3 test gap report",
   "description": "Output of test-gap-scan.mjs. Lists symbols added/changed in the diff that have no paired test file or no matching test method. Advisory in default mode; opt-in blocking via prefs.testGap.blockingThreshold.",
   "type": "object",
   "additionalProperties": false,

package/pipeline/schemas/token-budget.json

@@ -1,32 +1,26 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/token-budget.json",
-  "description": "Per-phase token ceilings for the lazy-loaded pipeline docs, enforced by smoke-token-budget.sh. Only the ACTIVE phase is loaded at run time and nothing truncates a phase document, so these numbers govern what may be written, not what a run receives. Two rules, and the split is the point. `max_tokens` and `total_max_tokens` are committed constants a human owns: computing them would end the gate, because a ceiling that is always current x k can never fail. The warn tier is NOT stored - the gate derives it per phase from that phase's own git history (median + 3*MAD of its historical per-commit deltas, which is robust to the one 980-token release that makes sigma meaningless on phase-4), because a soft line maintained by hand rots, and this one rotted twice: it was reset at v13.6.0 when five lines had gone permanently amber, and six of eight were amber again by v17.1.0. A ceiling more than 25% above the measurement is stale and fails, which is the 'only ratchets down' rule the SKILL.md grace list always had and this budget never did. Change history: docs/token-budget-history.md.",
+  "description": "Per-phase token ceilings for the lazy-loaded pipeline docs, enforced by smoke-token-budget.sh. Only the ACTIVE phase is loaded at run time and nothing truncates a phase document, so these numbers govern what may be written, not what a run receives. Two rules, and the split is the point. `max_tokens` and `total_max_tokens` are committed constants a human owns: computing them would end the gate, because a ceiling that is always current x k can never fail. The warn tier is NOT stored - the gate derives it per phase from that phase's own git history (median + 3*MAD of its historical per-commit deltas, which is robust to the one 980-token release that makes sigma meaningless on phase-4), because a soft line maintained by hand rots, and this one rotted twice: it was reset at v13.6.0 when five lines had gone permanently amber, and six of eight were amber again by v17.1.0. A ceiling more than 25% above the measurement is stale and fails, which is the 'only ratchets down' rule the SKILL.md grace list always had and this budget never did. Ceilings are DERIVED from schemas/phases.json and re-measured after the v19.0.0 six-phase merge, not summed from the eight old ones: the two-sided rule fails a ceiling more than 25% above the measurement, so a sum would have shipped stale by construction. Change history: docs/token-budget-history.md.",
   "phases": {
     "phase-0-init": {
       "max_tokens": 13400
     },
-    "phase-1-analysis": {
-      "max_tokens": 4600
+    "phase-1-plan": {
+      "max_tokens": 10000
     },
-    "phase-2-planning": {
-      "max_tokens": 6500
-    },
-    "phase-3-dev": {
-      "max_tokens": 9450
+    "phase-2-dev": {
+      "max_tokens": 10650
     },
-    "phase-4-review": {
-      "max_tokens": 15150
+    "phase-3-review": {
+      "max_tokens": 17200
     },
-    "phase-5-test": {
-      "max_tokens": 3050
-    },
-    "phase-6-commit": {
-      "max_tokens": 6550
+    "phase-4-commit": {
+      "max_tokens": 6500
     },
-    "phase-7-report": {
-      "max_tokens": 6350
+    "phase-5-report": {
+      "max_tokens": 5550
     }
   },
-  "total_max_tokens": 63150
+  "total_max_tokens": 63300
 }

package/pipeline/schemas/triage-output.schema.json

@@ -2,8 +2,8 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/triage-output.schema.json",
   "version": "3.4.0",
-  "title": "Multi-Agent Pipeline  -  Phase 4 triage output",
-  "description": "Contract for the Opus triage agent's JSON output in Phase 4 Step 3. Triage consumes merged reviewer findings and splits them into accepted/deferred/rejected. Only `accepted` blocking/important items trigger Phase 3 rework. v3.1.0 adds the optional `consensus` block so triage can surface reviewer-agreement risk (false consensus among same-base-model reviewers) instead of silently merging. v3.2.0 adds the optional per-finding `verification` block written by Phase 4 Step 3.7 (verify-by-test): the empirical repro-test outcome for accepted blocking findings. v3.3.0 carries ruleId + criteriaSource through triage so a finding that cites a stable rule ID keeps that citation into Phase 6 and Phase 7, and the lesson loop can key durable learnings by rule. v3.4.0 adds the optional per-finding fingerprint (finding-fingerprint.mjs) so review-delta.mjs can tell still-present, resolved and new findings apart between rounds.",
+  "title": "Multi-Agent Pipeline  -  Phase 3 triage output",
+  "description": "Contract for the Opus triage agent's JSON output in Phase 4 Step 3. Triage consumes merged reviewer findings and splits them into accepted/deferred/rejected. Only `accepted` blocking/important items trigger Phase 3 rework. v3.1.0 adds the optional `consensus` block so triage can surface reviewer-agreement risk (false consensus among same-base-model reviewers) instead of silently merging. v3.2.0 adds the optional per-finding `verification` block written by Phase 3 Step 3.7 (verify-by-test): the empirical repro-test outcome for accepted blocking findings. v3.3.0 carries ruleId + criteriaSource through triage so a finding that cites a stable rule ID keeps that citation into Phase 4 and Phase 5, and the lesson loop can key durable learnings by rule. v3.4.0 adds the optional per-finding fingerprint (finding-fingerprint.mjs) so review-delta.mjs can tell still-present, resolved and new findings apart between rounds.",
   "type": "object",
   "additionalProperties": false,
   "required": ["accepted", "deferred", "rejected", "approved"],
@@ -17,7 +17,7 @@
     },
     "deferred": {
       "type": "array",
-      "description": "Findings that are real but out of current task scope. Surfaced in Phase 7 report; not actioned.",
+      "description": "Findings that are real but out of current task scope. Surfaced in Phase 5 report; not actioned.",
       "items": {
         "type": "object",
         "additionalProperties": false,
@@ -55,7 +55,7 @@
     },
     "approved": {
       "type": "boolean",
-      "description": "True if no accepted BLOCKING items remain. The pipeline uses this to gate Phase 5 / Phase 6 entry."
+      "description": "True if no accepted BLOCKING items remain. The pipeline uses this to gate Phase 5 / Phase 4 entry."
     },
     "consensus": {
       "$ref": "#/$defs/consensus"
@@ -111,7 +111,7 @@
         },
         "disagreements": {
           "type": "array",
-          "description": "Findings where reviewers split (existence or severity). Surfaced verbatim in the Phase 7 report and at the Step 4 user checkpoint.",
+          "description": "Findings where reviewers split (existence or severity). Surfaced verbatim in the Phase 5 report and at the Step 4 user checkpoint.",
           "items": {
             "type": "object",
             "additionalProperties": false,
@@ -142,7 +142,7 @@
     "verification": {
       "type": "object",
       "additionalProperties": false,
-      "description": "v3.2.0 verify-by-test outcome (Phase 4 Step 3.7, opt-in via prefs.global.verifyByTest). confirmed = repro test failed as the finding predicts (finding stands, test kept as the Phase 3 RED test); not-reproduced = repro test passed under evidence-gate (finding downgraded to deferred); inconclusive = compile error / timeout / not unit-testable (judgment verdict stands).",
+      "description": "v3.2.0 verify-by-test outcome (Phase 3 Step 3.7, opt-in via prefs.global.verifyByTest). confirmed = repro test failed as the finding predicts (finding stands, test kept as the Phase 3 RED test); not-reproduced = repro test passed under evidence-gate (finding downgraded to deferred); inconclusive = compile error / timeout / not unit-testable (judgment verdict stands).",
       "required": ["result"],
       "properties": {
         "result": {

package/pipeline/scripts/README.md

@@ -19,10 +19,10 @@ Validate contracts. Each emits `══ <name> smoke: N passed, M failed ══`
 
 ### Phase contracts
 - `smoke-phase-0-multi-repo.sh`  -  Phase 0 multi-repo mode fetch + worktree atomicity
-- `smoke-phase-6-multi.sh`  -  Phase 6 multi-repo commit/PR cross-linking
+- `smoke-phase-6-multi.sh`  -  Phase 4 multi-repo commit/PR cross-linking
 - `smoke-phase-banner.sh` + `smoke-phase-tracker.sh`  -  Phase UI output contracts
-- `smoke-phase4-triage.sh`  -  Phase 4 reviewer → triage flow
-- `smoke-verify-by-test.sh`  -  Phase 4 Step 3.7 verify-by-test contract (v10.8.0)
+- `smoke-phase4-triage.sh`  -  Phase 3 reviewer → triage flow
+- `smoke-verify-by-test.sh`  -  Phase 3 Step 3.7 verify-by-test contract (v10.8.0)
 - `smoke-handoff-contract.sh`  -  phase-boundary structured handoff + handoff-first resume (v10.8.0)
 - `smoke-update-check.sh`  -  Phase 0 Step 0.6 update-check + required-floor contract (v10.9.0, floor v15.14.0)
 - `smoke-context-links.sh`  -  context-link-extractor classification contract, all types (v15.14.0)

package/pipeline/scripts/_code-graph.mjs

@@ -1,7 +1,7 @@
 /**
- * @file _code-graph.mjs  -  deterministic, LLM-free code graph for Phase 1 and Phase 7.
+ * @file _code-graph.mjs  -  deterministic, LLM-free code graph for Phase 1 and Phase 5.
  *
- * Phase 1 narrows its Explore fan-out with this graph, and Phase 7 refreshes it
+ * Phase 1 narrows its Explore fan-out with this graph, and Phase 5 refreshes it
  * instead of hand-writing architecture.md from a single task's window. The
  * design follows graphify (Graphify-Labs/graphify): AST-quality extraction with
  * zero LLM cost, one graph file, an incremental manifest gate, god-node hubs,

package/pipeline/scripts/_run-paths.mjs

@@ -76,7 +76,7 @@ export function canonicalRunDir(taskId, project) {
 }
 
 /**
- * Phase 6 removes the worktree and salvages the run's files into an
+ * Phase 4 removes the worktree and salvages the run's files into an
  * `artifacts/` subdirectory of the same run directory. A finished run therefore
  * keeps its state one level deeper, and a reader that only looks at the top
  * level reports a shipped task as having no state at all.
@@ -232,7 +232,7 @@ export function resolveRunFile(taskId, filename, project) {
   for (const v of taskIdVariants(taskId)) {
     const dir = resolveRunDir(v, project);
     if (!dir) continue;
-    // Top level first, then the salvaged copy Phase 6 leaves behind.
+    // Top level first, then the salvaged copy Phase 4 leaves behind.
     for (const base of [dir, join(dir, ARTIFACTS_SUBDIR)]) {
       const p = join(base, filename);
       if (existsSync(p)) return p;

package/pipeline/scripts/_smoke-root.sh

@@ -20,7 +20,7 @@
 #
 # Usage (from any script in pipeline/scripts/):
 #   . "$(dirname "${BASH_SOURCE[0]}")/_smoke-root.sh"
-#   grep -q needle "$MA_REFS/phases/phase-4-review.md"
+#   grep -q needle "$MA_REFS/phases/phase-3-review.md"
 #
 # Exports:
 #   MA_LAYOUT     "repo" | "install"

package/pipeline/scripts/aggregate-metrics.mjs

@@ -6,7 +6,7 @@
 // by --since=<ISO date> / --task-id=<id> / --phase=<N>.
 //
 // Output is plain-text by default; pass --json for machine-readable output
-// (used by Phase 7 to embed a metrics block in the run report).
+// (used by Phase 5 to embed a metrics block in the run report).
 //
 // Aggregations:
 //   - Tasks completed

package/pipeline/scripts/build-references.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // build-references.mjs  -  deterministic Section 21 References table for an
-// /multi-agent:analysis document (Locked 34).
+// /multi-agent:analysis document (Locked 33).
 //
 // The references table used to be prose the model filled in. That lists what an
 // author remembers consulting, which is a different set from what the run
@@ -364,7 +364,7 @@ function main() {
     const problems = check(spec, docPath, lang);
     if (problems.length) {
       for (const p of problems) process.stderr.write(`${p}\n`);
-      process.stderr.write(`\n${problems.length} references coverage failure(s)\n`);
+      process.stderr.write(`\n${problems.length} references coverage failure(s) (Locked 33)\n`);
       process.exitCode = 1;
       return;
     }

package/pipeline/scripts/bulk-read.sh

@@ -43,7 +43,7 @@ while [ $# -gt 0 ]; do
     --file) FILE="${2:?--file needs a value}"; shift 2 ;;
     --question) QUESTION="${2:?--question needs a value}"; shift 2 ;;
     --phase) PHASE="${2:?--phase needs a value}"; shift 2 ;;
-    --model) MODEL="${2:?--model needs a value}"; shift 2 ;;
+    --model) MODEL="${2:?--model needs a value}"; MODEL_EXPLICIT=1; shift 2 ;;
     --timeout) TIMEOUT="${2:?--timeout needs a value}"; shift 2 ;;
     --json) AS_JSON=1; shift ;;
     -h|--help) sed -n '2,30p' "$0"; exit 0 ;;
@@ -90,6 +90,15 @@ if command -v jq >/dev/null 2>&1; then
   done
 fi
 [ -n "$MODEL" ] || MODEL="${PREF_MODEL:-haiku}"
+
+# bulk-read is one of the two call sites the pipeline makes itself, so routing
+# may send it outside the Anthropic ladder - unlike a subagent, nothing here
+# belongs to the host. An explicit --model still wins: a caller that named a
+# rung asked for that rung.
+if [ -z "${MODEL_EXPLICIT:-}" ] && [ -x "$HERE/../lib/model-dispatch.sh" ]; then
+  MODEL=$("$HERE/../lib/model-dispatch.sh" bulk-read \
+            --phase "$PHASE" --default "$MODEL" 2>/dev/null) || MODEL="${PREF_MODEL:-haiku}"
+fi
 case "$TIMEOUT" in "" ) TIMEOUT="$PREF_TIMEOUT" ;; esac
 case "$TIMEOUT" in ""|*[!0-9]*|0) TIMEOUT=60 ;; esac
 

package/pipeline/scripts/capture-flush.sh

@@ -5,14 +5,14 @@
 #
 # WHY THIS EXISTS
 #
-# Every persistent write used to live in Phase 7: triage ingest, the learnings
-# ledger distill, the knowledge-base append, the code-graph refresh. And Phase 7
+# Every persistent write used to live in Phase 5: triage ingest, the learnings
+# ledger distill, the knowledge-base append, the code-graph refresh. And Phase 5
 # is, by the pipeline's own admission in features/code-graph.md, the phase a run
 # is LEAST likely to reach. A run killed in Phase 3, a session that hits its
 # context ceiling, a crash after review - each one threw away everything it had
 # established, and the next run on the same repo rediscovered it from scratch.
 #
-# So the writes move here, and Phase 7 becomes the LAST flush rather than the
+# So the writes move here, and Phase 5 becomes the LAST flush rather than the
 # only one. Phase boundaries call this, and so does SessionEnd. Nothing about
 # the trigger depends on a model noticing that a moment qualifies: it hangs on
 # a phase transition and on process exit, both objectively visible without any
@@ -20,15 +20,15 @@
 #
 # What it does NOT do: call a model. Everything here is derived from artefacts
 # already on disk (triage-output.json) plus agent-state.json. The parts of
-# Phase 7 that genuinely need a model - the knowledge-base extraction, the
-# per-repo memory synthesis - stay in Phase 7, because a hook cannot think.
+# Phase 5 that genuinely need a model - the knowledge-base extraction, the
+# per-repo memory synthesis - stay in Phase 5, because a hook cannot think.
 #
 # Usage:
 #   ./capture-flush.sh [--state <agent-state.json>] [--if-stale] [--json] [--quiet]
 #
 #   --state     the run to flush. Default: resolved from the newest task dir
 #               under $HOME/.claude/logs/multi-agent (see resolve_state).
-#   --if-stale  flush only when the run did NOT complete Phase 7 - the
+#   --if-stale  flush only when the run did NOT complete Phase 5 - the
 #               SessionEnd case. A finished run has already flushed.
 #   --json      machine-readable result for a caller that wants to count rows.
 #   --quiet     no stdout. Exit status still distinguishes the outcomes.
@@ -101,13 +101,13 @@ WORKTREE=$(jq -r '.worktreePath // empty' "$STATE" 2>/dev/null)
 PHASE7=$(jq -r '[.phases[]? | select((.id // "") == "7") | .status] | first // ""' "$STATE" 2>/dev/null)
 
 if [ "$IF_STALE" -eq 1 ] && [ "$PHASE7" = "completed" ]; then
-  say "capture-flush: ${TASK_ID:-run} already completed Phase 7 - nothing stale"
+  say "capture-flush: ${TASK_ID:-run} already completed Phase 5 - nothing stale"
   [ "$JSON" -eq 1 ] && printf '{"status":"noop","reason":"already-flushed","taskId":"%s"}\n' "$TASK_ID"
   exit 0
 fi
 
 # The triage artefact is the only input either store needs, and it has two homes:
-# Phase 6 removes the worktree once the PR is open, so the salvaged copy under
+# Phase 4 removes the worktree once the PR is open, so the salvaged copy under
 # artifactsPath is tried FIRST. Reading the worktree path first would degrade
 # silently for exactly the runs this script exists to rescue.
 TRIAGE=""

package/pipeline/scripts/capture-resume.sh

@@ -11,7 +11,7 @@
 #      the user learns to skip, which costs more than it saves.
 #
 # It answers two questions:
-#   - Is there a pipeline run that stopped before Phase 7? Name it and the resume
+#   - Is there a pipeline run that stopped before Phase 5? Name it and the resume
 #     command, because that run's work is recoverable and its findings are not
 #     yet in the durable stores until it flushes.
 #   - Is the pipeline's own observation queue stale? (>= REVIEW_DAYS since the
@@ -32,7 +32,7 @@ REVIEW_DAYS=7
 # Three buckets, not one line. Measured on the development machine: 22 runs read
 # `in_progress` and every one was over a day old, but they are not one failure.
 # 13 stopped at Phase 0, which is almost entirely questions - those runs never
-# started. 3 had their PR already open and were waiting at Phase 6/7, where the
+# started. 3 had their PR already open and were waiting at Phase 4/7, where the
 # pipeline pauses ON PURPOSE for channel selection. 4 died mid-development.
 #
 # Reporting the newest one of those as "stopped at Phase N" told the truth about
@@ -71,7 +71,7 @@ if [ -d "$LOGS" ] && command -v jq >/dev/null 2>&1; then
     PR=$(jq -r 'if (.pr|type)=="string" then .pr elif (.pr|type)=="object" then (.pr.url // .pr.number // "") else "" end | tostring' "$f" 2>/dev/null)
 
     # Waiting for you, not broken: an open PR means the work landed, and
-    # Phase 7 pauses for channel selection by design (modes.md).
+    # Phase 5 pauses for channel selection by design (modes.md).
     if [ "$STATUS" = "awaiting_input" ] || [ -n "$PR" ] ||
       [ "$PHASE" = "6" ] || [ "$PHASE" = "7" ]; then
       AWAITING_N=$((AWAITING_N + 1))

package/pipeline/scripts/classify-plan-safety.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // classify-plan-safety.mjs  -  v7.0.G
 //
-// Heuristic safety classifier for a Phase 2 plan. Autopilot's "zero user
+// Heuristic safety classifier for a Phase 1 plan. Autopilot's "zero user
 // interaction" contract is fine for small, predictable tasks but dangerous
 // when a plan touches the security path, deletes files without paired
 // tests, or sprawls across many files. This script inspects the plan and

package/pipeline/scripts/cost-table.json

@@ -1,5 +1,5 @@
 {
-  "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-07-28 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits (~10% of inPerMtok); the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
+  "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-07-28 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. `provider` says which layer a rung belongs to: an `anthropic` rung is reachable from every call site, a non-anthropic one only from the call sites the pipeline makes itself (bulk-read, research), which is what model-dispatch.sh enforces. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits (~10% of inPerMtok); the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
   "schemaVersion": "1.1.0",
   "prices": {
     "fable": {
@@ -7,6 +7,7 @@
       "outPerMtok": 50.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "claude-fable-5",
+      "provider": "anthropic",
       "note": "Top tier (restored v10.6.0)  -  architects, Reviewer 1, triage. Verified against Anthropic pricing 2026-07-02."
     },
     "opus": {
@@ -14,6 +15,7 @@
       "outPerMtok": 25.0,
       "cacheReadPerMtok": 0.5,
       "modelId": "claude-opus-5",
+      "provider": "anthropic",
       "note": "Second tier - dev phase on a Short run, Reviewer 1 and triage on Copilot CLI, and the opus rung of the fable -> opus -> sonnet fallback ladder. Same rate as the Opus 4.8 it replaces, so the ledger needed no reprice on the generation move. Claude Opus 5 draws on a rate-limit pool SEPARATE from the combined Opus 4.x pool - moving traffic here neither frees headroom on the old bucket nor inherits it."
     },
     "sonnet": {
@@ -21,6 +23,7 @@
       "outPerMtok": 15.0,
       "cacheReadPerMtok": 0.3,
       "modelId": "claude-sonnet-5",
+      "provider": "anthropic",
       "note": "Floor tier for Claude-family dispatch - Reviewer 3 on both hosts, and the terminal rung of the fallback ladder. Priced at the standard 3/15 rather than the 2/10 introductory rate that runs through 2026-08-31: over-reporting during the intro window is the safe direction for a cost ledger, and it needs no dated edit when the intro ends."
     },
     "haiku": {
@@ -28,6 +31,7 @@
       "outPerMtok": 5.0,
       "cacheReadPerMtok": 0.1,
       "modelId": "claude-haiku-4-5",
+      "provider": "anthropic",
       "note": "Speed tier - task-clarifier and other latency-sensitive dispatches, plus the terminal rung of the fallback ladder. Named by its alias like every other rung here rather than by a dated snapshot, so the four rungs stay comparable at a glance."
     },
     "gpt-5.4": {
@@ -35,6 +39,7 @@
       "outPerMtok": 30.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "gpt-5.4",
+      "provider": "openai",
       "note": "Copilot CLI Reviewer 2 and Codex CLI Reviewer 2  -  approximate; verify against OpenAI pricing page before relying on totals."
     },
     "gpt-5.6": {
@@ -42,6 +47,7 @@
       "outPerMtok": 30.0,
       "cacheReadPerMtok": 1.0,
       "modelId": "gpt-5.6",
+      "provider": "openai",
       "note": "Codex CLI top tier  -  Reviewer 1 at xhigh effort, Reviewer 3 at medium, triage at max, and the fable/opus rungs of the Codex persona tier map. Reasoning effort changes output volume, not the per-token rate, so one entry covers every effort level. Approximate; verify against OpenAI pricing before relying on totals."
     },
     "gpt-5.6-terra": {
@@ -49,6 +55,7 @@
       "outPerMtok": 5.0,
       "cacheReadPerMtok": 0.1,
       "modelId": "gpt-5.6-terra",
+      "provider": "openai",
       "note": "Codex CLI floor tier  -  speed-optimised, maps the haiku rung of the Codex persona tier map (task-clarifier). Approximate; verify against OpenAI pricing before relying on totals."
     }
   }

package/pipeline/scripts/diff-explain.mjs

@@ -3,7 +3,7 @@
 /**
  * @file diff-explain.mjs  -  v7.8.0 Paket B
  *
- * Bridges Phase 4 triage output to the actual git diff. For each accepted /
+ * Bridges Phase 3 triage output to the actual git diff. For each accepted /
  * deferred / rejected finding, locates the corresponding hunk in the branch's
  * diff against base and renders an annotated markdown report.
  *

package/pipeline/scripts/doctor.mjs

@@ -658,7 +658,7 @@ function checkMcpRegistration() {
 // checkMcpRegistration answers "is OURS registered". This answers the question the
 // user never gets asked: every registered server's tool list is sent with every
 // turn, they are added one at a time, and nobody sees the running total - our own
-// toolkit is 99 tools by itself. This check only ever REPORTS. It never disables
+// toolkit is 115 tools by itself. This check only ever REPORTS. It never disables
 // anything, and it never blocks or warns, because how many servers are worth their
 // context is the user's call and not a health failure.
 //
@@ -744,7 +744,7 @@ function checkDiskSpace() {
 }
 
 // A finished task removes its own worktree at PR time, but a run that dies
-// before Phase 6 never reaches that step and nothing else collects it: the
+// before Phase 4 never reaches that step and nothing else collects it: the
 // finalizer only runs on success and gc-worktrees only sweeps entries git no
 // longer knows about. So worktrees accumulate silently, and each one is a full
 // second checkout. Measured on one real iOS repo: 15 left behind, 11 GB.
@@ -788,7 +788,7 @@ function checkWorktreeResidue() {
     report(
       "worktree-residue",
       "WARN",
-      `${entries.length} worktree(s) left under ${wt}${size}; runs that stopped before Phase 6 are never collected`,
+      `${entries.length} worktree(s) left under ${wt}${size}; runs that stopped before Phase 4 are never collected`,
       "run /multi-agent:garbage-collect, or /multi-agent:kill for a task you know is dead",
     );
     return;