@mmerterden/multi-agent-pipeline 18.0.0 → 19.1.0

package/pipeline/lib/model-rung.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# model-rung.sh  -  read or flip the top model rung, and keep cost pricing with it.
+#
+# Backs /multi-agent:model. Two preference keys move as ONE write:
+#   prefs.global.modelFallback.fableEnabled   the rung itself
+#   prefs.global.costBudget.pricingModel      what the ledger prices against
+#
+# They were always meant to move together - model-fallback.md says so in prose -
+# but nothing enforced it, so a hand edit that flipped one left the estimate
+# pricing every call at a rung that was not in play. With the rung off and
+# pricing still `fable`, the budget ceiling trips early and triggers a downgrade
+# nothing needed. One write, or none.
+#
+# Usage:
+#   model-rung.sh            report current state (exit 0)
+#   model-rung.sh on         enable the fable rung
+#   model-rung.sh off        disable it
+#
+# Exit codes:
+#   0  -  reported or applied
+#   2  -  bad argument
+#   3  -  preferences file missing or unparseable (nothing written)
+
+set -uo pipefail
+
+PREFS="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
+ACTION="${1:-report}"
+
+case "$ACTION" in
+  report | on | off) ;;
+  *)
+    echo "usage: model-rung.sh [on|off]" >&2
+    exit 2
+    ;;
+esac
+
+# A missing `jq` must not look like a missing setting. Without this the reads
+# below return empty, the command reports the rung as already off, and a user
+# who asked to turn it off is told it was never on.
+if ! command -v jq >/dev/null 2>&1; then
+  echo "model-rung: jq not found  -  cannot read or write preferences (install: brew install jq)" >&2
+  exit 3
+fi
+
+if [ ! -f "$PREFS" ]; then
+  echo "model-rung: preferences not found at $PREFS  -  run /multi-agent:setup first" >&2
+  exit 3
+fi
+
+if ! jq -e . "$PREFS" >/dev/null 2>&1; then
+  echo "model-rung: $PREFS is not valid JSON  -  refusing to write over it" >&2
+  exit 3
+fi
+
+CUR=$(jq -r '.global.modelFallback.fableEnabled // false' "$PREFS")
+PRICING=$(jq -r '.global.costBudget.pricingModel // "fable"' "$PREFS")
+
+host_note() {
+  # Which host this is decides whether the switch is a switch or a status line.
+  # Saying "enabled" on a host where the rung means something else entirely is
+  # the surprise this block exists to avoid.
+  case "${MULTI_AGENT_HOST:-claude}" in
+    claude)
+      echo "Claude Code: the fable rung is Fable 5. This switch is live here."
+      ;;
+    copilot)
+      echo "Copilot CLI: Fable 5 is not offered; its personas never sat on this rung."
+      echo "This setting is recorded but changes nothing on this host."
+      ;;
+    codex)
+      echo "Codex CLI: the fable rung means gpt-5.6 @ xhigh, a different model on a"
+      echo "different account. This switch deliberately does NOT touch it  -  a knob"
+      echo "named after an Anthropic model must not silently retune a Codex run."
+      ;;
+    *)
+      echo "Unknown host '${MULTI_AGENT_HOST}'; reporting the stored value only."
+      ;;
+  esac
+}
+
+if [ "$ACTION" = "report" ]; then
+  echo "fable rung:    $CUR"
+  echo "cost pricing:  $PRICING"
+  if [ "$CUR" = "true" ] && [ "$PRICING" != "fable" ]; then
+    echo "MISMATCH: rung is on but the ledger prices against '$PRICING'  -  run 'model on' to realign"
+  elif [ "$CUR" != "true" ] && [ "$PRICING" = "fable" ]; then
+    echo "MISMATCH: rung is off but the ledger still prices against fable  -  this trips"
+    echo "          the budget ceiling early. Run 'model off' to realign."
+  fi
+  echo ""
+  host_note
+  exit 0
+fi
+
+if [ "$ACTION" = "on" ]; then
+  WANT=true
+  WANT_PRICING=fable
+else
+  WANT=false
+  WANT_PRICING=opus
+fi
+
+TMP=$(mktemp) || { echo "model-rung: mktemp failed" >&2; exit 3; }
+trap 'rm -f "$TMP"' EXIT
+
+# Both keys in one filter. A two-step write can leave the pair half-applied if
+# the second step fails, which is the exact state this command exists to prevent.
+if ! jq --argjson want "$WANT" --arg pricing "$WANT_PRICING" '
+      .global.modelFallback //= {}
+    | .global.modelFallback.fableEnabled = $want
+    | .global.costBudget //= {}
+    | .global.costBudget.pricingModel = $pricing
+  ' "$PREFS" > "$TMP"; then
+  echo "model-rung: jq failed  -  preferences left untouched" >&2
+  exit 3
+fi
+
+if ! jq -e . "$TMP" >/dev/null 2>&1; then
+  echo "model-rung: produced invalid JSON  -  preferences left untouched" >&2
+  exit 3
+fi
+
+mv "$TMP" "$PREFS"
+trap - EXIT
+
+echo "fable rung:    $CUR -> $WANT"
+echo "cost pricing:  $PRICING -> $WANT_PRICING"
+echo ""
+
+if [ "$WANT" = "false" ]; then
+  # Said at the moment of the change rather than left in a doc: the panel
+  # shrinking is the part people discover later and read as a bug.
+  echo "Phase 3 reviewer panel: 3 models -> 2 (opus + sonnet)."
+  echo "Reviewer 1 lands on opus, which Reviewer 2 already holds, and dispatching"
+  echo "one model twice is not cross-model review. consensus.reviewerCount records 2."
+  echo "Triage also runs on opus, so it shares a model with Reviewer 1  -  the Phase 3"
+  echo "Step 3 anonymisation requirement is not optional while the rung is off."
+  echo ""
+fi
+
+host_note
+exit 0

package/pipeline/lib/outbound-gate.mjs

@@ -68,6 +68,20 @@ export const RULES = [
   { name: "anthropic-key", certain: true, re: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g },
   { name: "figma-token", certain: true, re: /\bfig[a-z]_[A-Za-z0-9_-]{20,}\b/g },
   { name: "npm-token", certain: true, re: /\bnpm_[A-Za-z0-9]{36}\b/g },
+  // This list and the one in scripts/pre-commit-check.sh cover the same
+  // provider set. smoke-secret-parity.sh holds them to it by running a fake
+  // token of each shape through both, rather than comparing the regexes: a
+  // pattern that matches in one dialect and not the other reads as agreement
+  // and is not.
+  { name: "gitlab-pat", certain: true, re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g },
+  { name: "stripe-key", certain: true, re: /\b[sr]k_live_[A-Za-z0-9]{20,}\b/g },
+  { name: "perplexity-key", certain: true, re: /\bpplx-[A-Za-z0-9]{32,}\b/g },
+  { name: "huggingface-token", certain: true, re: /\bhf_[A-Za-z0-9]{30,}\b/g },
+  {
+    name: "service-account-json",
+    certain: true,
+    re: /"type"\s*:\s*"service_account"/g,
+  },
   {
     name: "jwt",
     certain: true,

package/pipeline/lib/phase-schema.mjs

@@ -0,0 +1,88 @@
+/**
+ * @file phase-schema.mjs  -  read a phase number that may have been written
+ * under either phase vocabulary.
+ *
+ * metrics.jsonl is append-only and v19.0.0 renumbered the phases, so the same
+ * field means two different things depending on when the line was written:
+ * `phase: 3` is Dev in a pre-v19 row and Review in a post-v19 one. Rows from
+ * v19.0.0 on carry `phaseSchema: 2`; rows without the field are generation 1.
+ *
+ * Every aggregator that compares a phase number to a literal, or prints a
+ * phase name, goes through here. Comparing directly is the bug this module
+ * exists to prevent - it does not throw, it silently attributes work to the
+ * wrong phase and the roll-up still looks plausible.
+ *
+ * @module pipeline/lib/phase-schema
+ */
+
+import { readFileSync } from "node:fs";
+
+const CONTRACT = JSON.parse(
+  readFileSync(new URL("../schemas/phases.json", import.meta.url), "utf8"),
+);
+
+export const CURRENT_SCHEMA = CONTRACT.phaseSchema;
+
+/** Generation 1 number -> current number, derived from each phase's `was`. */
+const GEN1_TO_CURRENT = new Map();
+for (const p of CONTRACT.phases) {
+  for (const old of p.was) GEN1_TO_CURRENT.set(Number(old), p.id);
+}
+
+const CURRENT_NAMES = new Map(CONTRACT.phases.map((p) => [p.id, p.name]));
+const GEN1_NAMES = new Map(
+  Object.entries(CONTRACT.legacyPhaseNames)
+    .filter(([k]) => /^\d+$/.test(k))
+    .map(([k, v]) => [Number(k), v]),
+);
+
+/**
+ * Which vocabulary a metrics row was written under.
+ *
+ * @param {object} row  -  a parsed metrics.jsonl line
+ * @returns {number}    -  1 or 2
+ */
+export function schemaOf(row) {
+  const s = Number(row?.phaseSchema);
+  return Number.isInteger(s) && s > 0 ? s : 1;
+}
+
+/**
+ * A row's phase expressed in the CURRENT vocabulary, so rows from both
+ * generations can be counted together.
+ *
+ * @param {string|number} phase
+ * @param {number} schema  -  from schemaOf()
+ * @returns {number|null}  -  null when the value is not a phase number at all
+ */
+export function toCurrentPhase(phase, schema) {
+  const n = Number(phase);
+  if (!Number.isInteger(n)) return null;
+  if (schema >= CURRENT_SCHEMA) return CURRENT_NAMES.has(n) ? n : null;
+  return GEN1_TO_CURRENT.has(n) ? GEN1_TO_CURRENT.get(n) : null;
+}
+
+/**
+ * The name the phase number carried WHEN IT WAS WRITTEN. A historical row is
+ * labelled with its own vocabulary's name; relabelling it with today's name
+ * would make the archive disagree with the log it came from.
+ *
+ * @param {string|number} phase
+ * @param {number} schema
+ * @returns {string}
+ */
+export function phaseNameAsWritten(phase, schema) {
+  const n = Number(phase);
+  const table = schema >= CURRENT_SCHEMA ? CURRENT_NAMES : GEN1_NAMES;
+  return table.get(n) ?? `Phase ${phase}`;
+}
+
+/**
+ * Convenience for the common shape: a row in, its current-vocabulary phase out.
+ *
+ * @param {object} row
+ * @returns {number|null}
+ */
+export function rowPhase(row) {
+  return toCurrentPhase(row?.phase, schemaOf(row));
+}

package/pipeline/lib/plan-todos.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
 #
-# plan-todos.sh  -  manage the Phase 2 plan as a live Todo list.
+# plan-todos.sh  -  manage the Phase 1 plan as a live Todo list.
 #
-# The Phase 2 plan is broken into a live, reviewable Todo list that updates
+# The Phase 1 plan is broken into a live, reviewable Todo list that updates
 # step-by-step as Phase 3 works through it.
 #
 # State lives in `agent-state.json` under `.plan.todos[]` per
 # pipeline/schemas/plan-todos.schema.json. Phase 2 (Planning) emits the
 # initial plan; Phase 3 (Dev) iterates step-by-step; Phase 4 (Review)
-# inspects completion; Phase 7 (Report) renders the rollup.
+# inspects completion; Phase 5 (Report) renders the rollup.
 #
 # Subcommands:
 #   init      <task-id> [title]            Initialize with empty todos[] (Phase 2 usually pipes the JSON instead)
@@ -19,7 +19,7 @@
 #   skip      <task-id> <todo-id> <reason> Mark skipped (counts as satisfied for dependents)
 #   next      <task-id>                    Print next pending todo (deps-respecting); empty if none
 #   list      <task-id>                    Render Markdown checklist
-#   status    <task-id>                    Print one-line summary: "3/7 done, 1 in progress"
+#   status    <task-id>                    Print one-line summary: "2/5 done, 1 in progress"
 #   show      <task-id>                    Print the full plan JSON
 #
 # Exit codes:
@@ -117,7 +117,7 @@ do_set() {
   fi
   # A planning-output document is accepted directly and converted here.
   #
-  # The conversion used to live as a jq blob inside phase-2-planning.md, which
+  # The conversion used to live as a jq blob inside phase-1-plan.md, which
   # made the mapping from `tasks[]` to `todos[]` a thing two files defined - and
   # the phase doc was the copy nothing tested. Accepting both shapes costs four
   # lines and removes the second definition.

package/pipeline/lib/route-state.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# route-state.sh  -  read and write prefs.global.modelRouting.
+#
+# Backs /multi-agent:route-on, route-off and route-status. Ships disabled and
+# stays that way until someone turns it on; while `enabled` is false nothing in
+# this file changes one dispatch.
+#
+# The `off` contract is borrowed from autopilot-off and for the same reason: it
+# clears the ON STATE, never the rules. Turning routing back on must not re-ask
+# for a configuration the user already gave.
+#
+# Usage:
+#   route-state.sh status                       print the current policy
+#   route-state.sh on  [--strategy=S] [--scope=a,b]
+#   route-state.sh off
+#   route-state.sh set-rules <file.json>        replace rules[] from a JSON array
+#
+# Exit codes:
+#   0  -  done
+#   2  -  bad usage
+#   3  -  preferences missing/unparseable, or a scope value this refuses
+
+set -uo pipefail
+
+PREFS="${MULTI_AGENT_PREFS:-$HOME/.claude/multi-agent-preferences.json}"
+
+# The scope values this accepts, spelled once. `host-session` is NOT here and
+# must never be added: it would mean rewriting the host's base URL, which routes
+# the user's whole session - work that has nothing to do with this pipeline
+# included - through a third layer, breaks the subscription's auth model, and
+# silently changes which model answers. The schema encodes the same list so a
+# hand-edited preferences file is rejected too, rather than only this entry point.
+ALLOWED_SCOPE="subagent bulk-read research"
+
+die() { echo "route-state: $1" >&2; exit "${2:-3}"; }
+
+# A missing `jq` must not look like routing being off. Every read below would
+# come back empty, `route-status` would report disabled, and a user with rules
+# armed would be told there are none.
+command -v jq >/dev/null 2>&1 || die "jq not found  -  cannot read or write preferences (install: brew install jq)"
+[ -f "$PREFS" ] || die "preferences not found at $PREFS  -  run /multi-agent:setup first"
+jq -e . "$PREFS" >/dev/null 2>&1 || die "$PREFS is not valid JSON  -  refusing to write over it"
+
+ACTION="${1:-status}"; shift 2>/dev/null || true
+
+write_prefs() {
+  local filter="$1"; shift
+  local tmp
+  tmp=$(mktemp) || die "mktemp failed"
+  if ! jq "$@" "$filter" "$PREFS" > "$tmp"; then rm -f "$tmp"; die "jq failed  -  preferences left untouched"; fi
+  jq -e . "$tmp" >/dev/null 2>&1 || { rm -f "$tmp"; die "produced invalid JSON  -  preferences left untouched"; }
+  mv "$tmp" "$PREFS"
+}
+
+case "$ACTION" in
+  status)
+    ENABLED=$(jq -r '.global.modelRouting.enabled // false' "$PREFS")
+    STRATEGY=$(jq -r '.global.modelRouting.strategy // "manual"' "$PREFS")
+    SCOPE=$(jq -r '(.global.modelRouting.scope // ["subagent"]) | join(", ")' "$PREFS")
+    NRULES=$(jq -r '(.global.modelRouting.rules // []) | length' "$PREFS")
+    CEIL=$(jq -r '.global.modelRouting.budgetCeilingUsd // "none"' "$PREFS")
+    REC=$(jq -r '.global.modelRouting.recordDecisions // true' "$PREFS")
+
+    echo "routing:   $ENABLED"
+    echo "strategy:  $STRATEGY"
+    echo "scope:     $SCOPE"
+    echo "rules:     $NRULES"
+    echo "ceiling:   $CEIL"
+    echo "decisions: $REC"
+    echo ""
+
+    if [ "$ENABLED" != "true" ]; then
+      echo "Disabled. Rules are stored but read by nothing; dispatch is unchanged."
+      [ "$NRULES" -gt 0 ] && echo "route-on turns these $NRULES rule(s) back on without re-asking."
+      exit 0
+    fi
+
+    if [ "$NRULES" -eq 0 ]; then
+      echo "Armed with no rules. Nothing matches, so nothing is routed  -  this is a"
+      echo "configuration state, not an error."
+    else
+      jq -r '(.global.modelRouting.rules // [])[] |
+        "  when " + ([.when | to_entries[] | "\(.key)=\(.value)"] | join(" ")) +
+        "  ->  " + (.prefer | join(" > "))' "$PREFS"
+    fi
+
+    echo ""
+    # The limit is printed every time rather than documented once, because the
+    # question it answers ("routing is on, why is the reviewer still on Opus")
+    # otherwise arrives days later as a bug report.
+    echo "Honest limit: on Claude Code a subagent cannot be sent to a non-Anthropic"
+    echo "model  -  subagent dispatch belongs to the host. Phase 1/2/3 personas stay"
+    echo "inside the Anthropic ladder whatever the rules say. External providers apply"
+    echo "only where this pipeline makes the call itself (bulk-read, research)."
+    ;;
+
+  on)
+    STRATEGY="manual"; SCOPE_ARG=""
+    for arg in "$@"; do
+      case "$arg" in
+        --strategy=*) STRATEGY="${arg#*=}" ;;
+        --scope=*)    SCOPE_ARG="${arg#*=}" ;;
+        *) die "unknown option: $arg" 2 ;;
+      esac
+    done
+    case "$STRATEGY" in
+      manual|task-fit|cost-ceiling) ;;
+      *) die "strategy must be manual, task-fit or cost-ceiling (got '$STRATEGY')" 2 ;;
+    esac
+
+    if [ -n "$SCOPE_ARG" ]; then
+      SCOPE_JSON="[]"
+      IFS=',' read -r -a parts <<< "$SCOPE_ARG"
+      for one in "${parts[@]}"; do
+        one="${one// /}"
+        # shellcheck disable=SC2076
+        case " $ALLOWED_SCOPE " in
+          *" $one "*) ;;
+          *) die "scope '$one' is not allowed (allowed: $ALLOWED_SCOPE). 'host-session' is refused by design: it would route the whole session, not this pipeline's calls." ;;
+        esac
+        SCOPE_JSON=$(jq -c --arg s "$one" '. + [$s]' <<< "$SCOPE_JSON")
+      done
+      write_prefs '
+          .global.modelRouting //= {}
+        | .global.modelRouting.enabled = true
+        | .global.modelRouting.strategy = $st
+        | .global.modelRouting.scope = ($sc | fromjson)
+      ' --arg st "$STRATEGY" --arg sc "$SCOPE_JSON"
+    else
+      write_prefs '
+          .global.modelRouting //= {}
+        | .global.modelRouting.enabled = true
+        | .global.modelRouting.strategy = $st
+        | .global.modelRouting.scope //= ["subagent"]
+      ' --arg st "$STRATEGY"
+    fi
+    echo "routing enabled (strategy: $STRATEGY)"
+    exec "$0" status
+    ;;
+
+  off)
+    # Rules survive on purpose. Clearing them here would make route-off a
+    # destructive action wearing the name of a toggle.
+    write_prefs '.global.modelRouting //= {} | .global.modelRouting.enabled = false'
+    echo "routing disabled. Rules kept  -  route-on restores this configuration as it is."
+    ;;
+
+  set-rules)
+    FILE="${1:-}"
+    [ -n "$FILE" ] || die "set-rules needs a JSON file containing an array of rules" 2
+    [ -f "$FILE" ] || die "no such file: $FILE" 2
+    jq -e 'type == "array"' "$FILE" >/dev/null 2>&1 || die "$FILE must contain a JSON ARRAY of rules" 2
+    write_prefs '.global.modelRouting //= {} | .global.modelRouting.rules = $r' --slurpfile _ignore /dev/null --argjson r "$(cat "$FILE")"
+    echo "rules replaced: $(jq -r 'length' "$FILE")"
+    ;;
+
+  *)
+    echo "usage: route-state.sh [status|on|off|set-rules <file>]" >&2
+    exit 2
+    ;;
+esac

package/pipeline/lib/run-paths.sh

@@ -40,7 +40,7 @@ ma_logs_root() {
 }
 
 # ma_is_run_dir <dir> -> 0 when the directory holds at least one run marker
-# Phase 6 removes the worktree and salvages the run's files into `artifacts/`
+# Phase 4 removes the worktree and salvages the run's files into `artifacts/`
 # inside the same run directory, so a shipped run keeps its state one level
 # deeper. A reader that only looks at the top level reports it as stateless.
 MA_ARTIFACTS_SUBDIR=artifacts
@@ -242,7 +242,7 @@ ma_resolve_run_file() {
       printf '%s\n' "$dir/$filename"
       return 0
     fi
-    # The salvaged copy Phase 6 leaves behind.
+    # The salvaged copy Phase 4 leaves behind.
     if [ -f "$dir/$MA_ARTIFACTS_SUBDIR/$filename" ]; then
       printf '%s\n' "$dir/$MA_ARTIFACTS_SUBDIR/$filename"
       return 0

package/pipeline/multi-agent-refs/_account-picker.md

@@ -12,7 +12,7 @@ First step of every `multi-agent` flow **that touches a remote provider**.
 > question, no token lookup. Detection: `freetext` flow first fetches local
 > repos (`repo-cache.sh local "$HOME"`); if the picker resolves to local-only
 > repos, account-picker is bypassed and the state file's `accountId` is left
-> `null` with `tokens={}`. Phases 6/7 read these as "local-only" signals.
+> `null` with `tokens={}`. Phases 4/5 read these as "local-only" signals.
 
 > **Language**: see `picker-contract.md` + `rules.md` Language Application matrix.
 

package/pipeline/multi-agent-refs/_dev-context.md

@@ -63,14 +63,14 @@ Selects extra repos the pipeline may touch beyond the primary repo(s)  -  typica
    entry, plus any selected `extras[]` that is not being given a worktree. The
    phases that consume them run hours later and have no access to the picker's
    return value, so a result that is not written here is a result nothing can
-   read. Phase 4's platform-parity cross-check reads `state.siblings[]` as the
+   read. Phase 3's platform-parity cross-check reads `state.siblings[]` as the
    fourth of its four counterpart sources, after `--with`,
    `prefs.projects[<slug>].counterpartRoots[]` and the primary checkout's sibling
    directories (`platform-parity.md`), so a submodule or a hand-picked repo that
    is not written here is a candidate the check can never see.
 
    Resolve each entry's `stack` from its local checkout, with the marker table
-   in `phases/phase-1-analysis.md` Step 2 (`.xcodeproj` / `Package.swift` →
+   in `phases/phase-1-plan.md` Step 2 (`.xcodeproj` / `Package.swift` →
    `ios`, `build.gradle(.kts)` → `android`, and so on). No checkout, or no
    marker matched → `stack: "unknown"` and `root: null`. Never infer a stack
    from the repo NAME: `my-app-android` is a naming convention, not a marker,
@@ -142,14 +142,14 @@ When `MULTI_AGENT_AUTOPILOT=1`:
 
 ## Pipeline contract for read-only siblings
 
-When a read-only sibling is present (e.g. a vendored SDK checkout), Phase 3 (Dev) MUST:
+When a read-only sibling is present (e.g. a vendored SDK checkout), Phase 2 (Dev) MUST:
 - Treat it as **read-only context**  -  code may be read for understanding, never edited or committed.
 - Prefer solving the task in the primary repo(s) (e.g. by wrapping/extending in consumer code) rather than patching the sibling.
-- Surface this constraint in the Phase 3 plan output so reviewers know why a workaround was chosen.
+- Surface this constraint in the Phase 2 plan output so reviewers know why a workaround was chosen.
 
 A **counterpart app repo** is a legitimate read-only sibling: the same product's
-other mobile platform, added here so Phase 4 can compare the change against it.
-Phase 3 treats it exactly like any other sibling  -  read, never edited. Phase 4
+other mobile platform, added here so Phase 3 can compare the change against it.
+Phase 2 treats it exactly like any other sibling  -  read, never edited. Phase 3
 additionally runs the parity cross-check over it
 (`$HOME/.claude/multi-agent-refs/platform-parity.md`), which is also read-only.
 Adding one is worthwhile when the feature exists on both platforms and their

package/pipeline/multi-agent-refs/_input-parser.md

@@ -35,7 +35,7 @@ The top-level `multi-agent` command classifies user arguments per the rules belo
 
 ¹ Account picker is **skipped** when the resolved primary repo is local-only
   (`provider="local"`). No token lookup, no provider auth  -  the pipeline
-  proceeds with `accountId=null` and Phases 6/7 honor the local-only mode.
+  proceeds with `accountId=null` and Phases 4/5 honor the local-only mode.
 
 ² Free-text flow merges `github`+`bitbucket`+`local` repo caches into a
   single picker list; `(local)` rows come from `repo-cache.sh local "$HOME"`.

package/pipeline/multi-agent-refs/analysis/evidence.md

@@ -164,7 +164,7 @@ The index answers "does this component exist and is it bound". It does not answe
 
 Output: `state.analysisSpec.evidence.variantMatrix[<component>] = { axis, allValues[], usedValues[] }`, which fills Section 6.X.
 
-Why it lives here and nowhere later: Locked 30 forbids Figma access from Phase 2 onward, so an axis not captured now cannot be recovered - Section 13.6 Preview and Section 15.2 Snapshot would then be validated against a subset nobody could check.
+Why it lives here and nowhere later: Locked 29 forbids Figma access from Phase 2 onward, so an axis not captured now cannot be recovered - Section 13.6 Preview and Section 15.2 Snapshot would then be validated against a subset nobody could check.
 
 A component with no variant axis (a plain component, not a set) records `axis: null` and is not a finding.
 
@@ -202,7 +202,7 @@ Phase 2 Section 20 Risks reads this list and emits one open question per entry.
 
 **Fallback source**: when `confidence == "none"` AND `evidence.standards[]` does not contain an explicit rule for that field, the renderer reads `$HOME/.claude/multi-agent-refs/conventions-defaults.md` and applies the platform default.
 
-**Caching (Locked 27)**: compute `evidence_digest = sha256(featureName || sorted(platforms) || options.redesign || hash(evidence.repoEvidence) || hash(evidence.conventions))`. `options.redesign` is a digest input: without it a redesign within a day of a normal run on the same feature reuses that cache, skips Phase 1b, and renders an empty current-behaviour table every redesign check then passes over. Cache key on disk: `/tmp/multi-agent-analysis-cache/<digest>.json` with mtime <= 24h. Cache hit skips Phase 1b and Phase 1c. `--no-cache` flag forces re-run.
+**Caching (Locked 26)**: compute `evidence_digest = sha256(featureName || sorted(platforms) || options.redesign || hash(evidence.repoEvidence) || hash(evidence.conventions))`. `options.redesign` is a digest input: without it a redesign within a day of a normal run on the same feature reuses that cache, skips Phase 1b, and renders an empty current-behaviour table every redesign check then passes over. Cache key on disk: `/tmp/multi-agent-analysis-cache/<digest>.json` with mtime <= 24h. Cache hit skips Phase 1b and Phase 1c. `--no-cache` flag forces re-run.
 
 Phase 1d is deliberately absent from the digest inputs. Community signal changes by the hour, so folding it in would produce a new digest on every run, invalidate the cache every time, and re-run the two expensive repo phases the cache exists to skip. The consequence is worth stating plainly: a cache hit reuses yesterday's signal rows. That is the correct trade for an advisory tier, and `--no-cache` is the way to refresh them.
 
@@ -225,12 +225,3 @@ The tier boundary is not advisory. A signal row that reaches Section 4 (business
 
 Per source: reachable and answered, reachable and empty, or unreachable. All three are recorded; only the third produces a `fetchErrors[]` entry, and none of them halts.
 
-**Lite mode auto-detection (Locked 25, v9.1.0 scoring)**: at the end of Phase 1c, evaluate three signals and score each:
-
-| Signal | True condition | Score |
-|---|---|---|
-| Confluence spec body lines | < 100 | 1 |
-| Figma frames count | <= 1 | 1 |
-| Repo evidence direct-match count | >= 8 | 1 |
-
-`liteModeAuto = (totalScore >= 2)`. Two of three signals true is enough; the v8.12.0..v9.0.x AND-threshold (all three) forced too many small features into Full mode when one signal was marginal (e.g. a tiny spec with 2 Figma frames). User overrides via `--full` or `--lite` always win over scoring.

package/pipeline/multi-agent-refs/analysis/intake.md

@@ -1,6 +1,6 @@
 # Intake (analysis Phase 0)
 
-> The picker chain that fills `state.analysisSpec.*` before any fetch runs. Loaded by `/multi-agent:analysis`. Pipeline Phase 1 does NOT load this file: in a pipeline run the account, project, repos and task already came from the orchestrator's own Phase 0, and only the source and coverage batches below are asked (see `phase-1-analysis.md` Step 4).
+> The picker chain that fills `state.analysisSpec.*` before any fetch runs. Loaded by `/multi-agent:analysis`. Pipeline Phase 1 does NOT load this file: in a pipeline run the account, project, repos and task already came from the orchestrator's own Phase 0, and only the source and coverage batches below are asked (see `phase-1-plan.md` Step 4).
 
 ### Phase 0 - Intake
 
@@ -19,7 +19,7 @@ Result: `state.analysisSpec.featureName` (state key kept for backward compatibil
 
 #### Step 1b - Analysis profile
 
-Asked once, immediately after the analysis name and before anything is fetched, because the profile decides which template the whole run renders against (Locked 32). Never re-asked mid-run.
+Asked once, immediately after the analysis name and before anything is fetched, because the profile decides which template the whole run renders against (Locked 31). Never re-asked mid-run.
 
 Read the available profiles from `prefs.global.analysisProfiles` (default `["global", "corporate"]`). When only one is available, auto-resolve and print the breadcrumb with the resolution noted rather than asking a question whose answer is already settled.
 
@@ -36,7 +36,7 @@ options:
 
 Result: `state.analysisSpec.profile` (`global` | `corporate`). Empty submit re-asks; an empty answer does not imply the default (`feedback_no-inferred-defaults-from-empty-answer`).
 
-The profile changes nothing about intake, fetching, repo evidence or convention extraction - those are shared. It selects the template at Phase 3 and switches the omission rule for the corporate backbone (Locked 33).
+The profile changes nothing about intake, fetching, repo evidence or convention extraction - those are shared. It selects the template at Phase 3 and switches the omission rule for the corporate backbone (Locked 32).
 
 **Corporate profile bindings.** Publication targets and house terminology are read from `prefs.global.analysisProfile.corporate` when present: `confluenceSpaceKey`, `confluenceParentPageId`, `titleFormat`, `titlePrefix`, `apiSpecCommand` and a `glossary` map. The key set is closed in `prefs.schema.json`, so a typo is caught by `validate-prefs.mjs` rather than silently ignored at emit time. They are deployment configuration, not part of the shipped template: an unconfigured corporate run still renders the full document and asks for the destination at Phase 3.5 like any other run.
 
@@ -69,13 +69,13 @@ Empty submit → re-ask. Result: `state.analysisSpec.platforms[]`.
 `web` is the canonical id; the pre-rename `frontend` is still read back (older state,
 `:stack frontend`, the `ai-frontend-toolkit` plugin id) and normalises to `web`.
 
-**`No platform yet` is a real answer, not a cancel** (Locked 35). It leaves
+**`No platform yet` is a real answer, not a cancel** (Locked 34). It leaves
 `platforms[]` empty, skips Step 4 entirely, and the run continues: evidence is still
 fetched from every declared source, and the document renders every layer that does not
 need a target repository. Only the development layer and the Pass B projection drop,
 and Section 20 records that they await a repo selection.
 
-**The channel split is then derived from the evidence, not abandoned** (Locked 35,
+**The channel split is then derived from the evidence, not abandoned** (Locked 34,
 which carries the reasoning). After evidence collection, classify the run's channels
 from what the sources say:
 
@@ -135,7 +135,7 @@ tool call, and an improvised retry separates the spec sources from each other.
 - **Batch 2/2  -  what constrains it**: Swagger, Standards, Firebase.
 
 **Development-layer questions are gated on a platform being selected.** With
-`platforms[]` empty that layer does not render (Locked 35), so a question feeding only
+`platforms[]` empty that layer does not render (Locked 34), so a question feeding only
 it spends attention on an answer nothing consumes.
 
 Two questions feed only that layer and are therefore skipped:
@@ -270,7 +270,7 @@ layer; `options.a11yDepth` gates the Section 16 VoiceOver / TalkBack walkthrough
 does not. Both default to the lighter choice so the doc stays lean unless the user opts in.
 
 `options.redesign` gates Sections 4.5, 4.6 and 9.5 and loads `analysis/redesign.md`, read
-on no other run (Locked 37).
+on no other run (Locked 36).
 
 #### Step 5b - Repo-evidence collector (automatic, no prompt)