@mmerterden/multi-agent-pipeline 20.0.0 → 20.1.0

package/CHANGELOG.md

@@ -14,6 +14,35 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [20.1.0] - 2026-09-21
+
+### Added
+
+- **`/multi-agent:security-review` and a wired security audit.** A defensive,
+  static security review: build a run-scoped threat model (attacker, trust
+  boundaries, attack surface, severity calibration), find vulnerabilities joined
+  to OWASP (Web/API Top 10 2021 and Mobile Top 10 2024) and a CWE, score them
+  with CVSS 3.1, and emit reviewer-shaped findings carrying evidence,
+  counterevidence, confidence and a before/after fix. No live target, no
+  payloads. `security-finding.schema.json` makes a finding a reviewer-output
+  finding plus a required `security` envelope, so the security-auditor's output
+  now merges at Phase 3 Step 3.0 and a blocking finding blocks Phase 4 - the
+  audit runs at Step 2.7 on the `security_path` signal, and the command is the
+  standalone entry point. An always-on `ai-common-toolkit:security-review` skill
+  carries the method.
+
+### Fixed
+
+- **Six-phase leftovers and stale shipped claims.** Renumbered the eight-phase
+  literals that misfired under six phases (a Report-phase run reaped by
+  gc-abandoned, an eight-name work-summary strip, stale personas and dispatch
+  docs), derived the reaped-phase and work-summary labels from the contract, and
+  removed dead config (`componentDevWorkflow`, `shortRunFromPhase`). Corrected
+  claims the code does not back: a phantom phase count, a scan skill pointing at
+  a workflow and a flag that do not exist, a SECURITY.md table five majors
+  behind (now derived and gated), and CONTRIBUTING.md / ADR-0011 describing CI as
+  dormant while its workflows run on every push.
+
 ## [20.0.0] - 2026-09-21
 
 ### Removed

package/README.md

@@ -175,7 +175,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 57 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 58 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -369,17 +369,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 57 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 58 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + three `PreToolUse` hooks (secret scan, agent-guard, read-size gate) |
-| Copilot CLI | `--copilot`          | instructions + 57 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 57 specs as refs + 9 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 58 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 58 specs as refs + 9 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 57.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 58.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single

package/README.tr.md

@@ -155,7 +155,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 57 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 58 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -350,17 +350,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 57 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 58 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 57 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 57 spec + 9 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 58 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 58 spec + 9 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 57 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 58 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/SECURITY.md

@@ -6,9 +6,9 @@ We provide security fixes for the latest minor of the current major. Older versi
 
 | Version | Supported              |
 | ------- | ---------------------- |
-| 15.x    | ✅ active              |
-| 14.x    | ⚠️ security fixes only |
-| ≤ 13.x  | ❌ end-of-life         |
+| 20.x    | ✅ active              |
+| 19.x    | ⚠️ security fixes only |
+| ≤ 18.x  | ❌ end-of-life         |
 
 ## Reporting a Vulnerability
 

package/docs/adr/0011-dormant-ci.md

@@ -1,6 +1,15 @@
 # 11. CI stays in the repository but dormant; the pre-push gate is primary
 
-**Status:** Accepted · 2026-08-31 · amended 2026-09-13 · amended 2026-09-17
+**Status:** Accepted · 2026-08-31 · amended 2026-09-13 · amended 2026-09-17 · superseded 2026-09-21 (GitHub-hosted CI reawakened)
+
+> **Amendment, 2026-09-21 (supersedes the conclusion below).** `test.yml` and
+> `ci-lite.yml` now run on every push and pull request to `main`
+> (`workflow_dispatch` also triggers them by hand); their `on:` blocks are the
+> source of truth for what runs. The dormancy decision recorded in this ADR no
+> longer holds for the GitHub-hosted workflows. The pre-push gate stays the
+> primary check and CI is the backstop, so the reasoning below still explains
+> why local verification leads; only "no workflow runs" has changed. The
+> self-hosted-runner discussion in the 2026-09-17 amendment is unaffected.
 
 > **Amendment, 2026-09-13 (ADR-0012, macOS only).** Linux and Windows support
 > was removed. `package.json` now declares `os: ["darwin"]`, which npm enforces

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>57 command files]
+        CMD[commands/<br/>58 command files]
         AGT[agents/<br/>8 agent personas]
         RUL[rules/<br/>12 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -169,7 +169,7 @@ revisions of this diagram - Codex CLI and the two independently-shipped repos
 graph TD
     CC["Claude Code<br/>(source of truth)"]
     COP["Copilot CLI<br/>(instructions + 56 skills)"]
-    COD["Codex CLI<br/>(1 router skill + 57 refs)"]
+    COD["Codex CLI<br/>(1 router skill + 58 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(5 stack plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 57 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 58 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 5 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 115 MCP tools across 13 categories (simulator/emulator control, memory, crash diagnostics, accessibility audit, store compliance, web automation, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index, provider-backed research, video key frames) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 57 commands"]
+        PHASES["6 phases · 58 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>57 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 57 refs<br/>+ 8 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>58 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 58 refs<br/>+ 8 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -157,7 +157,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 57 slash-command skills, native | 57 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 57 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 58 slash-command skills, native | 58 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 58 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
   "generatedAt": "2026-09-21",
-  "version": "20.0.0",
+  "version": "20.1.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,12 +35,12 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 3, 4, 5]
   },
-  "commandCount": 57,
-  "skillCount": 153,
-  "skillCountAll": 213,
+  "commandCount": 58,
+  "skillCount": 154,
+  "skillCountAll": 215,
   "agentCount": 9,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 115,
+  "toolCount": 117,
   "toolCategories": {
     "ios": 40,
     "android": 31,
@@ -51,8 +51,9 @@
     "context": 3,
     "agent": 2,
     "research": 2,
+    "security": 2,
     "media": 1
   },
-  "pluginSkillCount": 239,
+  "pluginSkillCount": 240,
   "toolkitVersion": "3.13.1"
 }

package/install/_codex-agents.mjs

@@ -27,7 +27,7 @@ import { ensureDir, ensureRealDir, isDryRun, writeFile } from "./_common.mjs";
  * Claude Code.
  *
  * This table resolves a persona's DEFAULT tier, which is not the same thing as
- * a per-slot override. Phase 4 dispatches Reviewer 3 with an explicit
+ * a per-slot override. Phase 3 dispatches Reviewer 3 with an explicit
  * `gpt-5.6` @ `medium` (see `phases/phase-3-review.md`, `claude-md-template.md`
  * and `reviewer-output.schema.json`, which all state that value) even though
  * the persona's own tier is `sonnet` and resolves here to `gpt-5.4`. That is

package/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.0.0",
-  "commit": "c29a8a41ead4aeff49a8b819ccd5079ea9b1509c",
-  "generatedAt": "2026-09-21T12:41:49.081Z",
+  "version": "20.1.0",
+  "commit": "38f7f25ee095f1e4cf32c3f15c3360b5f3bc62b8",
+  "generatedAt": "2026-09-21T16:56:18.450Z",
   "algorithm": "sha256",
-  "fileCount": 1054,
+  "fileCount": 1061,
   "files": {
-    "CHANGELOG.md": "061d9db8982099717a1e32921b810c28f448bd7f72cd5a260ae93ac532882117",
+    "CHANGELOG.md": "3db9489cf93a588156f4d4bbd90587d0a9a828c7ca49108c8509241a33d44600",
     "LICENSE": "8d8c51aaf1e1538b180c69965fa038db71be86798cc3e26a143bebfefe16a43e",
-    "README.md": "de96f541042247eac87361519a2df3b8cf45caf38f40cdc3b3cb03bf5cb9f4db",
-    "README.tr.md": "6ec6f52f33f6c8b1bc5e0b6d92a3f21f60195f199f5ece96f0a25a4c6a4d235b",
-    "SECURITY.md": "3fb38c517a8e2c6cea84c871b98a0c91ef3df17379028ba4f1686e07369e4c6e",
+    "README.md": "ec8d6035f973ea42bafdc0661794e0f19d1881bd8b8f3e434b922f75767a2152",
+    "README.tr.md": "8dc75f9402a4c0f81542ff5c7ce9fcc677bbf4ff2785d363753ad17b04843c0c",
+    "SECURITY.md": "0eb89553ddcfc56bfe9712315b55a6630ee2f579631aaeccd6ad24f8ac769a0b",
     "docs/FIGMA_PIPELINE.md": "24155e13690ade810d99cda6a350051f0810bc971ae341bdef561a0a46f5032a",
     "docs/adr/0001-three-model-triage.md": "79a6f1025469f607a5859add21854052d7433bc213f4aceee2e159b613eeb6a1",
     "docs/adr/0002-instruction-driven-flag.md": "dadb169a547522aa8d81334e4fa6b1d57185684b471270cfca87ab098b4baf8d",
@@ -22,18 +22,18 @@
     "docs/adr/0008-installer-modularization-and-secret-leak-defense.md": "97c8b5181b56f0fda7de6131048d0190ecc1524c89daa06f968fe651ba11b8d2",
     "docs/adr/0009-claude-stack-skills-plugin-only.md": "cd15ec05a52fa659421e66dbb239e6ced1db48c7ecb38b30dbd26be6ad2b08e4",
     "docs/adr/0010-own-code-graph.md": "453cae12c76522f583ede9c2cd31b41f8871bb3631ac7844654e448f910ee71b",
-    "docs/adr/0011-dormant-ci.md": "ff0e780df9d011cca6adaf5d28d77817e968e61e7c04d9d6b7f84b4feaacbb00",
+    "docs/adr/0011-dormant-ci.md": "48ad4c76652751d8cb9fa9584df4b0ceca0e0b19a9650e18abd7fb92a38199da",
     "docs/adr/0012-macos-only.md": "680e1cff8ebf583be443470caefc76b4728aa4440480f383a5f22dd980f76601",
     "docs/adr/0013-lsp-code-intelligence.md": "4ad0bac363a8e9a7f2e548c1866f056308784708ea41e6bf1e8ca91af8f206c8",
     "docs/adr/0014-six-phase-consolidation.md": "83db6bfd0a19800d53af241a72df21525f3bcfb6d4e8d0c8941faae152ee1acd",
     "docs/adr/0015-one-pipeline-no-depth-answer.md": "cf7b97e92a5b6b7df14067477fa4fa2e8425ea67a14307553343a6359d66e7a6",
     "docs/adr/0016-the-run-shape-is-asked-not-typed.md": "c8236b9d319f53ba1e5e948608b09c6b0ae21db4d42d3fd5111eef01cbf5dfa8",
     "docs/adr/README.md": "6ff58bc97dde4f1d94df60e4e221396a46906682b429ef275fd813cd288956e1",
-    "docs/architecture.md": "c41190ba9a755f6c54da97f03f50c16ff2cb1923ecbab67696d993e09f43b154",
+    "docs/architecture.md": "c7ee81c07ff1d489d7b04745500036c8343d4fc28f9ad55fef7f81d728d0076d",
     "docs/best-practices.md": "aeaaa12d518233cb09577c1dbaee00d62cd26f9f7e0400c681fe38742d6a7ba2",
-    "docs/ecosystem.md": "ec398a66e3ee990516e1821227405d2b302c6f97ed3c178be57b3c7a5bc3b540",
+    "docs/ecosystem.md": "5cda3cb488cc41a1f9cda01c0d86ae313f7ad034655732184db81739a9698a82",
     "docs/engineering.md": "550528cd47c7d2c921729c68d0782a00ac8e77a4bdfec479f6749f9c3235d188",
-    "docs/facts.json": "bef6fe20a6ef98961c24d61b11e45669f0d1a93e4e806a0ce1b029e3be9f249a",
+    "docs/facts.json": "79fd57b4a43deb135b5536ea81db4285bdd40a51b40c1bcf0bc79ca369e9ed32",
     "docs/features.md": "0143ca5a5415a30d18799f809833b704529ad1417e1b0d4a2753fdbf260e6d94",
     "docs/performance.md": "bbf2f3922c25dcba0c1a9e69ef420e3871a729af5b35009a49b48a5d3c5cd151",
     "docs/recovery-guide.md": "1cc014295f8c8ffba1f1c44397b657e925f1bc0e4757217d6e69e8cfb271f3cb",
@@ -41,7 +41,7 @@
     "docs/token-budget-history.md": "aa2ec7458918afd68b61adfee1222439b338afeffe54b0898facf69cee87e33d",
     "index.js": "4d245fa375e21406d77363694cacca3be6c1c48a36adfaa23302c3f9f5170df2",
     "install.js": "b2d71a926a62c96c994c76735f40dff068c429b5a368005fb62e60972da41c2a",
-    "install/_codex-agents.mjs": "ef9364c6b7001f083be24f8bf3ef1658adadc50195c64e46ffdee388a6419fe9",
+    "install/_codex-agents.mjs": "406b9343922d493c8331542d0fdcc2503d2c8abab518413c4154e1828706e874",
     "install/_codex-instructions.mjs": "add75ffc0e8d8db0e3bf275b46017a897a4cadb83dc66c7d3affd73bcead20f8",
     "install/_common.mjs": "996277d3e6d36294e99b08ec6167a061caed024929e8354aa998fbec6cdf882e",
     "install/_copilot-instructions.mjs": "73e4b82b2af0f3e1669f772fa0788dac6b540c131e56d5fe38dcf29be85cc019",
@@ -60,21 +60,21 @@
     "install/templates/codex-instructions.md": "dd78eb9553e725c039380457245793a5fc748ae37ebf5ccfe11be5ed5b9a4025",
     "install/templates/copilot-instructions.md": "d300b3bcb8d81ec1f3937eb388f993c256fda78de83aaad9efe6fe1a0865c065",
     "install/templates/multi-agent-autopilot.plist.template": "d79de637b17330e720be43b96bfcdd51797bd9ce219eafaa3dd5a8ece96e4814",
-    "package.json": "53379baabe34f1eed7b0dcb7c0505dc461cb8700f036920ad93ec70f06fe0ffe",
+    "package.json": "cd0638df37433a97592cd97d1965a6aa1caa051a3617a953bbe5adda6dbfb9a3",
     "pipeline/agents/android-architect.md": "baa5787b3a4c800dd065e27e05f44462927c9938c8bb676c80f18cb10e2b12c4",
     "pipeline/agents/backend-architect.md": "a83bd7f8b0a5289a1ef9a9b59d60fc759b8db260606ff2df427cf5ade5db8530",
     "pipeline/agents/bulk-reader.md": "0b9d415fab2c449d43329d759049af9401255d06b32d57a38c95e684837b19bf",
-    "pipeline/agents/code-reviewer.md": "0181049bea927c6b9835ab8ced268eddd25d27e2b1aa053ad32f67e455378a8d",
-    "pipeline/agents/dev-critic.md": "2b0a17d58b1570c646fc12e8e182403913493b9f5d4ff933b73651303344836f",
+    "pipeline/agents/code-reviewer.md": "80fee35f53733897b9913fdd8e16a94c84c24e02428586705661d72cef1b55f5",
+    "pipeline/agents/dev-critic.md": "93598bf9c2b27430a38966491fcce37ffdec56b58c3811221e274316cc7c94e1",
     "pipeline/agents/explorer.md": "9e72db35159b455a21a956375ffa457871131c7234f6ff5ae1e46c97a8112563",
     "pipeline/agents/ios-architect.md": "31d9415e4a6e5daade3246c401f4e5b44627f850313f624b72747c8479c9ff2f",
-    "pipeline/agents/security-auditor.md": "68417627d35b398f684983a8e9599bb9eefba026e30d0ef80dd8d765e0ccaa00",
+    "pipeline/agents/security-auditor.md": "f123a999e50fff1e568268a4cd92efd235c6c33c30e05b82f12f84215c168611",
     "pipeline/agents/task-clarifier.md": "8b3779c24e3a7b599c0fa23c10acde00345069fbda7ac182eebe24860c40e5e3",
     "pipeline/claude-md-template.md": "bcc75808a54f32f11e688875cda23d3be3c1524511258e3d4ea5e7c0d2a92a92",
     "pipeline/commands/archive-guard.md": "16c5d3feaa91950402d62e66adc7fcf519a25d028a9303cb1e9c08af2765c04b",
     "pipeline/commands/deploy.md": "d20f95f3b1d2357c8c92f3047e8fe11eadf539ff13cab9b54f072f0ad697242a",
-    "pipeline/commands/figma-to-swiftui.md": "34d52373216100774450950256b5f45402e033029d918de20425356632f26356",
-    "pipeline/commands/multi-agent/SKILL.md": "145af10ba07fd70fd741c0e032756a6d60cec2645cd4c1f35f00b895a77229f2",
+    "pipeline/commands/figma-to-swiftui.md": "9840ba4725149fa03484b32c3dec032e2554dd913c65e3f95cb0a9906860090f",
+    "pipeline/commands/multi-agent/SKILL.md": "61c0a34adb1c6c3c24ae340505ee8ffcaa9ef2ae86c87afb8f04a912c39540e5",
     "pipeline/commands/multi-agent/analysis-jira/SKILL.md": "c3c34546e2147707d6deaa1b3b401deeb560e57356a6e0966200fd27fc1bd126",
     "pipeline/commands/multi-agent/analysis-resolve/SKILL.md": "fcf452c47f6a9adff77c11f108545a7472fd101f0a5e10abbac3b27bd707a4a9",
     "pipeline/commands/multi-agent/analysis/SKILL.md": "f16000a5e807ae438b9085cf46df39aebfba8b33aa3e6c7f3cde2f3651732230",
@@ -83,17 +83,17 @@
     "pipeline/commands/multi-agent/autopilot-status/SKILL.md": "e2a82876ea03f86f6e7481a08de6f01ab73195a05a59ffe40915e5a9448eae09",
     "pipeline/commands/multi-agent/autopilot/SKILL.md": "252179a8dcb2af8c1a8120c4661bd35fa362c242defe2cf37389ddc6496e9364",
     "pipeline/commands/multi-agent/build-optimize/SKILL.md": "1a665559ad1a512ea1c326a0d45d89cd5b889f8b7b39979bd24a67dc2db5b56a",
-    "pipeline/commands/multi-agent/channels/SKILL.md": "cdbe91a97e6381f226a25e78ebf802bc6a435c5d159ac16113dbe7a1b17b97c1",
+    "pipeline/commands/multi-agent/channels/SKILL.md": "a1b4eec23e479fa2f7764f299f748d9fc1d2787313877776e773c2a8e89d38df",
     "pipeline/commands/multi-agent/complaint-analysis/SKILL.md": "0e1327d6214bc921a330cadfef61c1d68aa6fdc80a5f188820362d24a114e453",
     "pipeline/commands/multi-agent/create-jira/SKILL.md": "02ab2e3a015e05446a8df68ad294819b7790add5fce3444f868881b30f96e8da",
     "pipeline/commands/multi-agent/design-check/SKILL.md": "f6cdbefd3edc2eb99ac906c60c7b9608dd6469fb10f0db505dbd77eac866bd43",
-    "pipeline/commands/multi-agent/diff-explain/SKILL.md": "7e44c24c453b102677c6bf9729749e690f24adc56aec7431f3f2911d6940a442",
+    "pipeline/commands/multi-agent/diff-explain/SKILL.md": "f122f3bed06fed26ae4fc5b2e435f49dd3ef28562012d624dd4ab4046217e6e3",
     "pipeline/commands/multi-agent/doctor/SKILL.md": "12d383391e56fc4e1b5da3b9209dfcbf9deb4c4ea15f3d83eb664cb5f226836e",
     "pipeline/commands/multi-agent/feedback/SKILL.md": "7e22521946b8a992d6f70c8cde6685f70ca0fec9d46bf91b359bfc70e0e7c4fe",
     "pipeline/commands/multi-agent/forget/SKILL.md": "a92bd569879efb15e31add438d10b7eac93ff69209fc1c57fe30ff9ab941ad46",
     "pipeline/commands/multi-agent/garbage-collect/SKILL.md": "a05dbf2be00580ff13870bdc75db2c18c5accfaad0e76bc6e73eb72f4922af36",
     "pipeline/commands/multi-agent/graph/SKILL.md": "86b1bde22324c4bd7acefbb0b994233ff39370c1e22e7e730907aab50e96ab62",
-    "pipeline/commands/multi-agent/help/SKILL.md": "ed01aacce29d0692b28b63a9cc253aa32104dc2b55ba1fb8ec23f0484cb0a001",
+    "pipeline/commands/multi-agent/help/SKILL.md": "e9ba71d262bc609d8938890ef72e1ac39419a6a0bb778f0af4c8824e807dd7f9",
     "pipeline/commands/multi-agent/ios-coding-standard/SKILL.md": "1e7e2c3c896dc08c09eae161c78e732c990736e4b0d1820dc0374c5591ab1703",
     "pipeline/commands/multi-agent/issue/SKILL.md": "919bb73d571fc364bfb1080e6883040f858f158e1f022c900551f39f888fd80a",
     "pipeline/commands/multi-agent/jira/SKILL.md": "388bd0b072bc98cb88d8bb6261da4a2f407c101aa7e0e793830ff280ca0799cc",
@@ -116,14 +116,15 @@
     "pipeline/commands/multi-agent/route-status/SKILL.md": "5a70b5af46907fa5895a93aa011796ecaf1e53e629b766a0ad11677dcae2d0e2",
     "pipeline/commands/multi-agent/routines/SKILL.md": "236012b7ce40bff052d23ed400b5107f9e1ba41ab0716a7a7b5cd082b2cee00c",
     "pipeline/commands/multi-agent/save/SKILL.md": "507b3916d97863d82ef3b24e8e92d10c549e33e4ddde0e6daf35d9308faff369",
-    "pipeline/commands/multi-agent/scan/SKILL.md": "5d326f6929f43164eec5da44ccc44ef6956255b180a09798fdebd99c0fe4ebd0",
+    "pipeline/commands/multi-agent/scan/SKILL.md": "95fc4abfaa4c469dbdfe46638204917d1dc5b5e3c046773895f430e2dd024097",
     "pipeline/commands/multi-agent/search/SKILL.md": "2ed15dc7d71c7044e0410e8cff192cb795a64d8110fa615903288a7de7eb8565",
+    "pipeline/commands/multi-agent/security-review/SKILL.md": "8c9c8a47f5aa3c86df05014fdc2d78e45eb49a923d874d4f99aa8f933094776b",
     "pipeline/commands/multi-agent/setup/SKILL.md": "0a77ce3247a7112cb64fe87300a42f5f3e58ee01f3c1cd190622fb32b88e36a9",
     "pipeline/commands/multi-agent/stack/SKILL.md": "aa1f98fa388e237bc0a07965b30f21176e6edf41b0795e65db1929368649fda2",
     "pipeline/commands/multi-agent/status/SKILL.md": "2e682a88c7e0d0cfb5a98cb6fb039c156ae79edf3e020bc158569a7541ee44b4",
     "pipeline/commands/multi-agent/steer/SKILL.md": "891628bc4b215ee68fd4b4507ee2e780a3d38f1a872f6778fcd12ba3d3207a74",
     "pipeline/commands/multi-agent/store-ready/SKILL.md": "0757de6ba82c98fd44e6f93bdd5192cf9454d7b225f1a41c0e0c920f9afba939",
-    "pipeline/commands/multi-agent/sync/SKILL.md": "fe0f5655e64c9702856db619d05f58432f7122b3556f1dd71fed3b89d6f8fbd5",
+    "pipeline/commands/multi-agent/sync/SKILL.md": "9983290be4caea2ef9f93857288477a711c28456656c8d8ce72be482046d26ea",
     "pipeline/commands/multi-agent/test-accessibility/SKILL.md": "4346eb3fb6fa573e67c1d30d786a24701b13d6e45c7c802a82f3ae17bd5fbd95",
     "pipeline/commands/multi-agent/test-dark-mode/SKILL.md": "90c7f5f771c08fb1e47b22226ef6562a702f8f054eb5fe054394ff3328846b38",
     "pipeline/commands/multi-agent/test-dynamic-type/SKILL.md": "453fc50f0f641d0a7f67e0a801b4563c9bbdf2457d62f7d225655308c4834241",
@@ -132,7 +133,6 @@
     "pipeline/commands/multi-agent/testflight-validation/SKILL.md": "70e85b007562157193eff8c6fb6bb069b3f4c19965c4778bd7e74f8d51f2db6f",
     "pipeline/commands/multi-agent/uninstall/SKILL.md": "002f0d37354bbbf8d8ea616c2b74104d0a9b18746319870baaf1685098fa666a",
     "pipeline/commands/multi-agent/update/SKILL.md": "d938dc180878118abea1213482effe30229860b473e9a947d040576f584ae874",
-    "pipeline/commands/security-review.md": "2485ac912eebc61f6470075bd7d9c8bf759a22384514fcc3997a9a674a4766b3",
     "pipeline/commands/sim-test.md": "17fcefc2030f0ab24b3ee59807dfc11264b34d7455138081996859b1fee8664e",
     "pipeline/lib/_jira-auth.sh": "534080c9f53666f7aadd6fdd998ff98e61cb54c53739006f07eecb6b86d6e210",
     "pipeline/lib/account-resolver.sh": "61e99f28699dcd8f12d66072ea55165ea7d78211bf2ee39bc5d68a96f7d4d491",
@@ -205,10 +205,10 @@
     "pipeline/multi-agent-refs/channels/pr.md": "a6d5244a3bf5cf5f15d961a07972c9917db98c436f1a9cfdfe6c3c3dba7d5b69",
     "pipeline/multi-agent-refs/channels/wiki.md": "ba52c5efaedc067dd8456fe9076af694d7e3dae9bda621f1df65c9159cd422da",
     "pipeline/multi-agent-refs/complaint-analysis-template.md": "dd5f12a8f56ee4dc177fa7bfba4ffe9ad021e5f1b9e661a49031f02dd6e37109",
-    "pipeline/multi-agent-refs/component-dispatch.md": "9c7e739d2f8d8f20d30154134e9639ddb101fec0dee6e69ed03f59bfeb0b09dd",
+    "pipeline/multi-agent-refs/component-dispatch.md": "2b8ae88ab7769e19f346366ea617743c85ccf0eaaa548d7c59e4bdb7d12f3195",
     "pipeline/multi-agent-refs/component-generation.md": "04fdb3fd0f1c129e1df8243184a3225cebd9c4f63511d6015eb356a92eda8891",
     "pipeline/multi-agent-refs/conventions-defaults.md": "73d40d628b10078eb9d06c99575c23a297ab5bc011f8df05d97802957ad64923",
-    "pipeline/multi-agent-refs/cross-cli-contract.md": "441c5629e3b91f4bdab6771a5874fde69b196d3012ca60e9ef4cbb16d6367d50",
+    "pipeline/multi-agent-refs/cross-cli-contract.md": "efc1457c983d41ae4c538f26299b3be2b7f085897ca2690098f1a6cf9a3260de",
     "pipeline/multi-agent-refs/features/analysis-jira.md": "5542735d39a96d288cf99d1dfe18ec30270d2777a260c80d74ab6e5121edc9fb",
     "pipeline/multi-agent-refs/features/autopilot-circuit-breaker.md": "1995fb86bee28600c727cd6c94f39da33efd67f2bce3092705b354f4b2cd3aad",
     "pipeline/multi-agent-refs/features/base-branch-evidence.md": "7b875d61cf11ecc9119b440037be0e849931b0c00f4c102640590f7e59e1646b",
@@ -230,6 +230,7 @@
     "pipeline/multi-agent-refs/features/review-file-set.md": "a751888bce82a8e6970c9abe7f354c5c0704956e5278aeb091b893be0df5c1ef",
     "pipeline/multi-agent-refs/features/review-multi-repo.md": "f06857b2fa984ee6ca8cdf4360485947b55217056e5e439839c56871f9eb7595",
     "pipeline/multi-agent-refs/features/scope-check.md": "4f8844de8137256df4b83a5c54852353df1bbf7387c3f76f42e09058a04153b7",
+    "pipeline/multi-agent-refs/features/security-audit.md": "2c9745c26f91e74715bf00b63b5b84e3b2ee255d05f3f15587efca5d8428e7aa",
     "pipeline/multi-agent-refs/features/shadow-git.md": "d020c7b99a993eb11398d08e0518207b990b3ec3807fbcf0926c6cb304777ce9",
     "pipeline/multi-agent-refs/features/skill-conformance.md": "8e74c2458ad8a5d8356b4093d63cd57f7d2428aa12e9f26a7690fc467a07f382",
     "pipeline/multi-agent-refs/features/stack-skill-routing.md": "8d45fb7331509411617d2bf5c42e752eaaa7ada24dcf38140f2710b28ab4fc0f",
@@ -248,14 +249,14 @@
     "pipeline/multi-agent-refs/payload-contracts.md": "20449737c1079b5965547d85c4ab987c1d0b819df1239239ffb50f4d58ab61e1",
     "pipeline/multi-agent-refs/phases.md": "3caa132e368ecaf259a17e8328fb6301bd18672e15cddb6c31bad563a9be3c87",
     "pipeline/multi-agent-refs/phases/log-format.md": "e03a93239ee0f06048c1f22cacfc76d485b53285cbcebd4e2eb034a67f017b22",
-    "pipeline/multi-agent-refs/phases/modes.md": "d350fb56188fff52d202310ca0566716fb8b06ad397b996e88e19276da394aee",
+    "pipeline/multi-agent-refs/phases/modes.md": "4f3e6fb1e1e35e14efecb20059fbc05c5e31b461662efb5e269c3d763ae215a9",
     "pipeline/multi-agent-refs/phases/operations.md": "f5fa36f490e4162fa0cb464983f9ca94b74b4a8fee8ea0d7093343b0513f8e61",
     "pipeline/multi-agent-refs/phases/phase-0-init.md": "3fe2faaf676fb528e594febb71e2a76ed79b8dd984a6e9620c877c6885646b49",
     "pipeline/multi-agent-refs/phases/phase-1-plan.md": "739e4075024fb46aa8c47c02ee5a05eb63cbf9e2f8f0177f2ab44410ff08e344",
     "pipeline/multi-agent-refs/phases/phase-2-dev.md": "780df67e38fe9818e879dfda68688d4f97e5d58df33307ce6ce93b878651b906",
-    "pipeline/multi-agent-refs/phases/phase-3-review.md": "923b3e0dae5d44f359187bd95e5778443d720dc230fb16bc8612e57c3886e9cd",
+    "pipeline/multi-agent-refs/phases/phase-3-review.md": "2d44cf5238cb91626262297ffbf14f2d323f35d8d089726b91aa58197addf1e8",
     "pipeline/multi-agent-refs/phases/phase-4-commit.md": "b50120c94f022bc0ed72af8f3ce011804ae6182a79717a0e5073535f85fc08a2",
-    "pipeline/multi-agent-refs/phases/phase-5-report.md": "a719b7febfaa6fb2abb61aea13082e5b4731cb387fcac08a908b0767e9a8688e",
+    "pipeline/multi-agent-refs/phases/phase-5-report.md": "330eb1d05003ef01fca27ead3105605bf3e72777de417ebbc9114ddcc1d305bb",
     "pipeline/multi-agent-refs/picker-contract.md": "8be36ac84a1cb0aaec514698f32f8cd54fb3864e71163ee14fea9a49a8af03c1",
     "pipeline/multi-agent-refs/platform-parity.md": "43a3836efc359c6b7d30af38d66408d8d18661e72e5165b25bb8e15953e6feaf",
     "pipeline/multi-agent-refs/progress-contract.md": "c95453f5275da499a7312012f52bcb917ce3eeb9704ff1e6ba434857b3f8c2cc",
@@ -268,6 +269,7 @@
     "pipeline/multi-agent-refs/setup/firebase.md": "a82031c67993762303a7ecd222e2574fbbf8d65dcc6b17e051a8dd53a9e31474",
     "pipeline/multi-agent-refs/setup/repo-discovery.md": "1cee0cc448a6359c04a3b9dca6030ea69636e57b720a4a52169760ffd0559a1e",
     "pipeline/multi-agent-refs/swiftui-guide.md": "3f86cb3e2161389da5a466793dae570d854e35354490f58249b5defbaccb1375",
+    "pipeline/multi-agent-refs/threat-model.md": "3628881538b846f94decd78e389b34b473ba6f91b6e6dcf5c927d307ed264bea",
     "pipeline/multi-agent-refs/tracker-contract.md": "b703014e73ce9c1642057291ec807f76023542632fd1c5f85fb013cc1f71936d",
     "pipeline/multi-agent-refs/unattended-contract.md": "2099fce693158517ce28eb63bf64c9a995d04d059c892344e40a7168d198d1d3",
     "pipeline/multi-agent-refs/web-guide.md": "714cba0d92fa45bf71fbff21bb2f09c88534ebf785b3a2ea96d18037e2e7f7f9",
@@ -287,7 +289,7 @@
     "pipeline/rules/swiftui-qa.md": "8c4afe9e72413e7bdab655f3d17588469e80ac34cb7ad2a690901fc5b6534818",
     "pipeline/rules/tdd.md": "4c1b3114506aa9794c9bb1e1aee1b1bbb4a993d192342e5697cc00bc2f6ea4a2",
     "pipeline/rules/testing.md": "695be5520b65451f0aa300a9643df2c05e607ff6ad372201ea34798dc5998bd5",
-    "pipeline/schemas/agent-state.schema.json": "2d629a9a37b3db170091e2bc79da7a9c4e53b7ed39d175f80c944997daf290c9",
+    "pipeline/schemas/agent-state.schema.json": "d13dd638a6991b3fef04dc534f7ea90f38c37e571dbc9162e554e77d015b7aa1",
     "pipeline/schemas/analysis-output.schema.json": "41826f4bf7c96778f8cdbcc68531e984087897d438b7b49ac5a93fc29db47916",
     "pipeline/schemas/analysis-spec.schema.json": "245b1be914f16d716e354b1125cf392a51f2ba3c3cd504113b5437183e0c57ae",
     "pipeline/schemas/autopilot-config.schema.json": "112aae6e5dfb9cf5874d96652a5f45b4efb9c4edc62e927a751541f865bffbc8",
@@ -314,15 +316,16 @@
     "pipeline/schemas/migrations/prefs-2.7.0-to-2.8.0.mjs": "56e3bdd076500825782726eb14f48c1f989c802bbd6374873999a949afee968f",
     "pipeline/schemas/migrations/state-2.0.0-to-2.1.0.mjs": "b7058a8922dfa85a817616ab130d6e962a1e1b8e9ed42b8700ff82747a0f3fec",
     "pipeline/schemas/migrations/state-2.1.0-to-2.2.0.mjs": "96c14fcc6375d630681e69c27dc0cad1783596fa93e1426d1a03d6257f1bd053",
-    "pipeline/schemas/phases.json": "4d73c2cf5c6a7e3e76b1c22f1d71be45eb6c2230565bfc833139444caf8089da",
+    "pipeline/schemas/phases.json": "e063daf30685671cef7eaf2d07f35f49d7671b82e572e78463600db2a0aeea8c",
     "pipeline/schemas/plan-todos.schema.json": "98fe2b9ba902425f13f067a494113d0c5fe03a2676e2c54fefbb319730214278",
     "pipeline/schemas/planning-output.schema.json": "af1d8189a82398702f4db3460b3b0c78038d40f6aab210c191e9d491ad5d96e6",
-    "pipeline/schemas/prefs.schema.json": "cec2ea6f9f2ae93c1115e713b3f1e374563961666e059f1b717665d15d627ac1",
+    "pipeline/schemas/prefs.schema.json": "75450dd8cebdcb0785e390593256905ac57710cfe65652003986a0d3cca29fdd",
     "pipeline/schemas/review-file-exclusions.json": "2e8c44b45d21d2c82fc95aa2bf76ad3fbf2d5c68180c7b2ebf89c4a926688d77",
-    "pipeline/schemas/reviewer-output.schema.json": "1bc8dd8feb416ea2101457e071d72b5a6ab0aefa7da3d42063bbe1c153755754",
+    "pipeline/schemas/reviewer-output.schema.json": "5e3421e72a2e26ff65943bfdb7dc9afcfc10edad79a72407ecef6b1fafa40f8c",
     "pipeline/schemas/route-config.schema.json": "6f606926c257b7ad3d2972e53d0b772714774140c473b9cb8c7cd9e52731020f",
     "pipeline/schemas/scope-check.schema.json": "f96973c59372b36b7d68b9ac4b03490e7da8d54acf29a35947f5f610e82b98ea",
     "pipeline/schemas/secret-patterns.json": "d9a7bec7b2ba704b73f2302c3498874c6298cde69bde0f181932c282d3fe0b0e",
+    "pipeline/schemas/security-finding.schema.json": "623d965edf2de8ab0f2a49c33fa5be507d479d5bc3067ccd72cdf90a480b498a",
     "pipeline/schemas/skill-observation.schema.json": "05f16c6e5055ef99a102b12b578ba841251267d41dd7343f8ab66cd8070180ff",
     "pipeline/schemas/test-gap.schema.json": "175a268fca49a5e7a7388693b3dc397de45217c64fe333f7867ea6372610ad03",
     "pipeline/schemas/token-budget.json": "09b691ae343faf7b9c288a92de6aef2447194a62995cce22c5f2c701ad0b60e2",
@@ -336,7 +339,7 @@
     "pipeline/scripts/_retrieval.mjs": "c887d90701b610cdc25ad49090c3e2786de4135e73b8d423dc01aa56336edf2f",
     "pipeline/scripts/_run-paths.mjs": "ab29814a53490db99c295c227abddd1453bbe3ad0f1ea87459a8662b869939a3",
     "pipeline/scripts/_smoke-root.sh": "dad129959a4e37a0cd0f4f6c04f6d66c5a43752b2bf33989db9c002eb106b832",
-    "pipeline/scripts/_stack-routing.mjs": "c66dfd0f6a3b77f87d34942fc6849a94b7f1f62ce4837c2db041e4d458157613",
+    "pipeline/scripts/_stack-routing.mjs": "6d2d256e0000860b76261ebc4e719b220bb89c47456e617e889c217817cabc53",
     "pipeline/scripts/agent-guard.py": "b45ea8d0f25c334ab4b9046cca24924abf3e76d51b5d6a998804b7dbe0d8bc21",
     "pipeline/scripts/agent-guard.sh": "3b1741189a1e047511f9d677b0fafc709c1298f3daf1fe4c15813faca5949209",
     "pipeline/scripts/aggregate-metrics.mjs": "c324e349993fb154a885263cf6665af0ff656e9c987b455a263dad8b96cca667",
@@ -379,7 +382,7 @@
     "pipeline/scripts/feedback-send.mjs": "8ec3f8fcafbe0de6c916a13a151d009cb804522537621b239a183591dddeec85",
     "pipeline/scripts/finding-fingerprint.mjs": "fa12ab10701db5d2bfff014e41d1cd4c0b2b772aee5fc69205de14b2761b0c83",
     "pipeline/scripts/firebase-app-discovery.sh": "dbbc5710cf12b086a50c3f24a4cf67df431d1eb1a121b98d4dc67023f8633c67",
-    "pipeline/scripts/gc-abandoned.sh": "6e5ed204364343ebe529d2de8c827715c44a3e0428a06eada2841a6dbe72f8ce",
+    "pipeline/scripts/gc-abandoned.sh": "0f72888dc3d3afb5043384051b8c41b89aee908ab9973383effe866da1e1dcd4",
     "pipeline/scripts/gc-refs.sh": "437f41fa700277a3d5ac55409916418af5abc26c8bd90d0f6e7de042661d9fcf",
     "pipeline/scripts/gc-tmp.sh": "5cf9519c53173e7541a7589425679aa57af2c80f95a3681ae95544a09d57b02f",
     "pipeline/scripts/gc-worktrees.sh": "f6b405306b603797e950274fdf3b732140c3fd45d5d15788374d2e33bc21b534",
@@ -428,7 +431,7 @@
     "pipeline/scripts/purge.sh": "95c60b272ae47209893dba9b17528538592bb5636da47940a02734cd9b4f0ce5",
     "pipeline/scripts/render-agent-log-cost.sh": "015f3ee23ed044045de4094296ae5a6e31a9bfab66f5c40544bf85e072f73a4e",
     "pipeline/scripts/render-cost-summary.sh": "efca7333cc421e81f7f2ad65ca476603853be08e2418ecb2d0898cf723cb9150",
-    "pipeline/scripts/render-work-summary.sh": "265ab6f5a2a4800696e81ce354a6f49ca213d6b7315268c3469f5cc6d2aaa586",
+    "pipeline/scripts/render-work-summary.sh": "9343d8173f9173c7bdfba56fae56dbfa2c6241f4ce8e01865f532cbe313d1c12",
     "pipeline/scripts/repo-map.mjs": "175dcaeb548e8a018ad36cf661f3bdcb9340d32439fd4d92918fd6b3ab175730",
     "pipeline/scripts/require-supported-version.sh": "b56852dd92b1fdbe388bdab9dbc75510abc07e2e8483f7ba51525939a0c7cbc9",
     "pipeline/scripts/review-delta.mjs": "14a2de7ac81e7f43a634423f920f9931bb4a27441b8ba3dc8e53ec1f6a6ed54a",
@@ -480,7 +483,7 @@
     "pipeline/scripts/website-deploy-commit.sh": "523482438b265ca1f1883ec5fb450e803566a1239eaccdc423e12c5426140a84",
     "pipeline/scripts/worktree-finalize.sh": "ca2bb363bec738cfce57ce5f46962d69664810003cc56dde0a82ab9133dbf557",
     "pipeline/scripts/write-state.mjs": "5552665f05c16edae63f038baee0390d5fa69396535d29e6b46ff87f6182786f",
-    "pipeline/skills/.skill-manifest.json": "7a3a9d0396b1b1c934d510e4a9e5ac1272a26c760c6cd1470a6a502b57e8955d",
+    "pipeline/skills/.skill-manifest.json": "87b1033433e96cb0970df8cda48044618c91cb5795f2a933bf7207d77e47f4f0",
     "pipeline/skills/.skills-index.json": "095eabd96a9d126beffbc4069c631ad69b6cd04d24000dadab24717125a2174f",
     "pipeline/skills/shared/README.md": "a03d06e9aa6683f4d9065d92a8e44f40cbb0a8d68823c894866d3519fdef893c",
     "pipeline/skills/shared/core/apple-archive-compliance/SKILL.md": "6675a53441f2f3bedc82284998f402bd51fa251c7491a595e12c6c4016830337",
@@ -528,14 +531,15 @@
     "pipeline/skills/shared/core/multi-agent-route-status/SKILL.md": "f104d3de6974837b8ebbcc6242269c06ea78a0d97a3e216c1b62cf6d91a72fd8",
     "pipeline/skills/shared/core/multi-agent-routines/SKILL.md": "a8cc83140b5d84365348a2b0858f06a9e92808f608544eea61ab5760c82f9f97",
     "pipeline/skills/shared/core/multi-agent-save/SKILL.md": "e1b005e2a8eddfd61c03f3e84eb829c67314403c73e04c674a7d6f48d90edde3",
-    "pipeline/skills/shared/core/multi-agent-scan/SKILL.md": "544b29d001e677c579c89705c81c8bc7fb9e8037297e512a2bfad379bd07ee55",
+    "pipeline/skills/shared/core/multi-agent-scan/SKILL.md": "71cdbf40a40edf80b61985ea4cd6b7d43511e91ad3d7c4121512134a9e94f2a8",
     "pipeline/skills/shared/core/multi-agent-search/SKILL.md": "32541ceca20c489814f9d948763d5237d4a71473a05683d9da262b8f6dea815b",
+    "pipeline/skills/shared/core/multi-agent-security-review/SKILL.md": "a3d4d1e99a8be67f179b08d79ee421108f3e62c8d4190cf4e9af7dd4391a8c11",
     "pipeline/skills/shared/core/multi-agent-setup/SKILL.md": "d2c167082f40af3c2a7cbb0be55a8cdf8076a4f06a3df54c89b1318759421a29",
     "pipeline/skills/shared/core/multi-agent-stack/SKILL.md": "59de347bc1bec703aef4d339c494f0e180f4d5c37ee96d4f0d32674535a376a7",
     "pipeline/skills/shared/core/multi-agent-status/SKILL.md": "ae9a7507e0a0291d8e786820b1a0394363f416fd7715f2deb162c9f542ae5351",
     "pipeline/skills/shared/core/multi-agent-steer/SKILL.md": "d2a3602c1acbd1a01b30fcba65fbbe669ac825ec4ac9b0d6679bba07e0d1207c",
     "pipeline/skills/shared/core/multi-agent-store-ready/SKILL.md": "0060d1d7a8ec1e8cce30975f125faf46e9e384d23100ae46e82c9f194a0bf9fa",
-    "pipeline/skills/shared/core/multi-agent-sync/SKILL.md": "34aea52bbbe86018011edc1c96a986d1ee2aba8bdb82b19212714bac80bea076",
+    "pipeline/skills/shared/core/multi-agent-sync/SKILL.md": "70b81f275fa430eb7382d0fa16f0a07ec29d92d9476655c496ce38565833fa13",
     "pipeline/skills/shared/core/multi-agent-test-accessibility/SKILL.md": "131bd7deb6648ddc4b4ff7faf7571837de93e3450edf87994d081ad9e55235ca",
     "pipeline/skills/shared/core/multi-agent-test-dark-mode/SKILL.md": "4288a8218b218736cd10b97d1ad75002f288065bb6d74a535f0ac079dae4fe4a",
     "pipeline/skills/shared/core/multi-agent-test-dynamic-type/SKILL.md": "734e045d99dc46108ee7d353d598bd365d20191ab3da88840089f01cc1b4ff91",
@@ -544,7 +548,7 @@
     "pipeline/skills/shared/core/multi-agent-testflight-validation/SKILL.md": "0f770a279e12a5edf73cb947ca2d128c013c78646d983c3d4bdfe722a4a990ef",
     "pipeline/skills/shared/core/multi-agent-uninstall/SKILL.md": "b7940b4ab305ac8bcdc1798dbc0d56e96018ba6959566657878b6a583dc6183d",
     "pipeline/skills/shared/core/multi-agent-update/SKILL.md": "8a0b089ea5c0d81813dc936d8b9d012f956e6381f71e025ca8878e538a8e9303",
-    "pipeline/skills/shared/core/multi-agent/SKILL.md": "ca1286f3f17d76b75547320ec9b39af575a88828da14b4ed4ffe79932c7406a3",
+    "pipeline/skills/shared/core/multi-agent/SKILL.md": "7a8a1e51d7e1f9e6cf00e09a5b1d680db4609d79cb629ab4b80e7a27bee5ef5e",
     "pipeline/skills/shared/external/NOTICE-dimillian-skills.md": "402a96240476446ac284e1cf7c64ed66a7bc1119e92464bb632e737176aa494a",
     "pipeline/skills/shared/external/NOTICE-swift-ios-skills.md": "a2b150f2ad92ee4564d5bec2681d5b7943e8fddbf5eaab8fcdbece722e626a03",
     "pipeline/skills/shared/external/NOTICE-xcode-build-skills.md": "1c9c1790d3173928dae0964f653583936d0b40cb7a7fe6b732f132b104fef3ef",
@@ -796,6 +800,9 @@
     "pipeline/skills/shared/external/retrofit-networking/SKILL.md": "364a13c739105be702bfcd84e9a5711edaf5be5de734918ffcc9544044aee3b2",
     "pipeline/skills/shared/external/room-database/SKILL.md": "95be733ec77acc8cbabccc072d59f3faf4f6e083410bf179cc0a6632b746e93e",
     "pipeline/skills/shared/external/search-first/SKILL.md": "4730d95babebecb3070a23e09cfce57f687467e0d45bbc332ae612cf01066e10",
+    "pipeline/skills/shared/external/security-review/SKILL.md": "6bf82c336b7067d3e8a874e09916fcdbad4867634881f0a58d721b78fc9e83b2",
+    "pipeline/skills/shared/external/security-review/references/owasp-mobile-top10-2024.md": "0fdf1aebc92b720ee980c94f915dec174121c90a10fef2dd5565e822b6b6eb7f",
+    "pipeline/skills/shared/external/security-review/references/owasp-web-api-top10-2021.md": "721da7ea1c3cab214e15cfd6c58f93c6da5ceef61c6ffc0c7e56d06209a95015",
     "pipeline/skills/shared/external/shareplay-activities/SKILL.md": "508e3123039bc114e4239e66d86f8d550fe94fc259d827e4985e0aed3ff54090",
     "pipeline/skills/shared/external/shareplay-activities/evals/evals.json": "3e61cb97316f526ea57b2d38cf8d23e36c6e3f6d7e17ab1a031c82a0d1708192",
     "pipeline/skills/shared/external/shareplay-activities/references/shareplay-patterns.md": "1a9a51931d4da4254b9ddc7c8a99207c3ffc70c239b22241ba0866c2bc290d00",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.0.0",
+  "version": "20.1.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/agents/code-reviewer.md

@@ -1,9 +1,9 @@
 ---
 name: code-reviewer
-description: "Code reviewer for multi-agent Phase 4  -  security, architecture, quality, performance. Default model is fable (opus is the first fallback); Phase 4 orchestrator overrides to sonnet for Reviewer 3."
+description: "Code reviewer for multi-agent Phase 3  -  security, architecture, quality, performance. Default model is fable (opus is the first fallback); Phase 3 orchestrator overrides to sonnet for Reviewer 3."
 model: fable
 preferredModel: fable
-modelRationale: "Reviewer 1 tier  -  deep security + architecture review runs on opus (top available intelligence tier). Phase 4 orchestrator overrides to sonnet for Reviewer 3 (quality/correctness focus) via CLAUDE_CODE_SUBAGENT_MODEL before dispatch. Copilot CLI adds Reviewer 2 on gpt-5.4 for cross-model diversity."
+modelRationale: "Reviewer 1 tier  -  deep security + architecture review runs on opus (top available intelligence tier). Phase 3 orchestrator overrides to sonnet for Reviewer 3 (quality/correctness focus) via CLAUDE_CODE_SUBAGENT_MODEL before dispatch. Copilot CLI adds Reviewer 2 on gpt-5.4 for cross-model diversity."
 ---
 
 # Code Reviewer Agent

package/pipeline/agents/dev-critic.md

@@ -1,6 +1,6 @@
 ---
 name: dev-critic
-description: "Phase 2.5 evaluator  -  runs after Dev's last edit, before Phase 4. Verifies build/test/checklist gates; returns pass | fix-list. Sonnet by default; Phase 3 orchestrator may override."
+description: "Phase 2.5 evaluator  -  runs after Dev's last edit, before Phase 3. Verifies build/test/checklist gates; returns pass | fix-list. Sonnet by default; Phase 3 orchestrator may override."
 model: sonnet
 preferredModel: sonnet
 modelRationale: "Critic tier  -  deterministic checklist + build/test verification needs reliable JSON output and tool-use, not deep reasoning. Sonnet hits the cost/quality sweet spot. Opus override only when the diff is large (>500 LOC) or touches security-critical paths; orchestrator decides via PHASE_MODEL_OVERRIDE."
@@ -8,9 +8,9 @@ modelRationale: "Critic tier  -  deterministic checklist + build/test verificati
 
 # Dev Critic Agent  -  Phase 2.5
 
-You are the in-loop critic for Phase 2 (Dev). The generator (Sonnet/Opus during Phase 2) has just finished its last edit. **You run BEFORE Phase 4**, on the same worktree, against deterministic criteria that already exist on disk. Your job: catch failures the generator would otherwise send into Phase 4 and waste 2-3 reviewer calls + Fable triage on.
+You are the in-loop critic for Phase 2 (Dev). The generator (Sonnet/Opus during Phase 2) has just finished its last edit. **You run BEFORE Phase 3**, on the same worktree, against deterministic criteria that already exist on disk. Your job: catch failures the generator would otherwise send into Phase 3 and waste 2-3 reviewer calls + Fable triage on.
 
-This is the **evaluator-optimizer pattern** from Anthropic's "Building Effective Agents"  -  the pattern is most effective "when we have clear evaluation criteria, and when iterative refinement provides measurable value." Phase 3 satisfies both: criteria are written in `rules/*.md`, refinement value is measured by Phase 4 fix-cycles avoided.
+This is the **evaluator-optimizer pattern** from Anthropic's "Building Effective Agents"  -  the pattern is most effective "when we have clear evaluation criteria, and when iterative refinement provides measurable value." Phase 2 satisfies both: criteria are written in `rules/*.md`, refinement value is measured by Phase 3 fix-cycles avoided.
 
 ## Inputs
 
@@ -33,7 +33,7 @@ Run ALL of these before scoring the diff. Any failure means **return `pass: fals
 | Build | `xcodebuild -scheme <Scheme> build` (iOS) / `./gradlew assembleDebug` (Android) / `npm run build` (Node) / `python -m build` (Python) | `blocking` |
 | Lint | `swiftlint lint --strict` / `ktlint` / `eslint .` / `ruff check` | `important` (project-pref decides if blocking) |
 | Test | `xcodebuild test` (touched modules only) / `./gradlew test` / `npm test` / `pytest` | `blocking` if existing tests fail; `important` if no test added for a new fn |
-| Secrets | `grep -rE '(sk-[a-zA-Z0-9]{20,}|password\s*=|api[_-]?key\s*=|BEGIN PRIVATE KEY)' <diff-paths>` | `blocking` |
+| Secrets | Run the canonical secret scanner `pre-commit-check.sh` (the one Phase 2 Gate 4 runs, in `.claude/scripts/`), not a private regex. Its providers live in `schemas/secret-patterns.json` and are held in parity with the egress gate by `smoke-secret-parity.sh`; a hand-rolled second list here is how a secret the real gate catches slips past the critic. | `blocking` |
 
 Skip a gate ONLY if its tool isn't installed (xcodebuild on a non-Mac runner, etc.)  -  log `gate.skipped tool=<name> reason=not_installed` and proceed.
 
@@ -140,7 +140,7 @@ LOG_METRIC_FORWARD_TO_TRACKER=1 pipeline/scripts/log-metric.sh "$TASK_ID" 3 \
   duration_ms=$D tokens_in=$TI tokens_out=$TO
 ```
 
-Phase 5 cost rollup includes critic calls as `phase 3.5` line items so cost summary shows the savings (or surplus) vs running Phase 4 directly.
+Phase 5 cost rollup includes critic calls as `phase 2.5` line items so cost summary shows the savings (or surplus) vs running Phase 3 directly.
 
 ## Rationale citation