@mmerterden/multi-agent-pipeline 20.0.0 → 20.1.0

package/pipeline/schemas/agent-state.schema.json

@@ -857,6 +857,29 @@
         }
       }
     },
+    "threatModel": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "The run-scoped threat model produced at Phase 3 Step 2.7 (or by /multi-agent:security-review), mirrored here so a resume reuses it instead of re-deriving it. Contract: multi-agent-refs/threat-model.md.",
+      "properties": {
+        "path": {
+          "type": "string",
+          "description": "Path to .pipeline/threat-model.md in the worktree."
+        },
+        "sha": {
+          "type": "string",
+          "description": "Content hash, so a later step can tell whether the model changed."
+        },
+        "producedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "producedBy": {
+          "type": "string",
+          "description": "Which step or command wrote it (e.g. 'phase-3-step-2.7', 'security-review')."
+        }
+      }
+    },
     "reviewIterations": {
       "type": "array",
       "items": {

package/pipeline/schemas/phases.json

@@ -78,7 +78,6 @@
   "thresholds": {
     "waitingFromPhase": 4,
     "mcpAllowedThroughPhase": 1,
-    "shortRunFromPhase": 2,
-    "note": "Phase numbers other code compares against, named here so a renumbering moves them with the contract. waitingFromPhase: runs-index.mjs groups a run as 'waiting on you' from Commit on. mcpAllowedThroughPhase: Figma MCP is reachable only through Plan; smoke-no-mcp-in-dev-phases.sh fails any recorded call at a higher phase. Its literal threshold is unchanged from the eight-phase contract on purpose - Analysis was 1 and is now inside Plan, also 1, so the permitted set {0,1} is identical. shortRunFromPhase: the depth picker's Short set starts here."
+    "note": "Phase numbers other code compares against, named here so a renumbering moves them with the contract. waitingFromPhase: runs-index.mjs groups a run as 'waiting on you' from Commit on. mcpAllowedThroughPhase: Figma MCP is reachable only through Plan; smoke-no-mcp-in-dev-phases.sh fails any recorded call at a higher phase. Its literal threshold is unchanged from the eight-phase contract on purpose - Analysis was 1 and is now inside Plan, also 1, so the permitted set {0,1} is identical."
   }
 }

package/pipeline/schemas/prefs.schema.json

@@ -2140,10 +2140,6 @@
               "format": "date-time",
               "description": "Timestamp of last task start against this project."
             },
-            "componentDevWorkflow": {
-              "type": "boolean",
-              "description": "Project follows the component (Configuration / View / Modifiers) development workflow, so Phase 2 dispatches the component skills instead of the standard TDD flow."
-            },
             "figmaConfigPath": {
               "type": "string",
               "description": "Path to per-project figma-config.json (for Figma pipeline projects)."

package/pipeline/schemas/reviewer-output.schema.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/reviewer-output.schema.json",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "title": "Multi-Agent Pipeline  -  Phase 3 reviewer output",
-  "description": "Contract for a single code-reviewer subagent's JSON output in Phase 4 Step 2. Every host dispatches 3 parallel reviewers; the middle slot is CLI-aware: Claude Code (Fable, Opus, Sonnet); Copilot CLI (Opus, GPT-5.4, Sonnet); Codex CLI dispatches 3 (gpt-5.6 at xhigh, gpt-5.4, gpt-5.6 at medium). Every reviewer must return an object matching this shape before Opus triage merges them. v1.1.0 adds the rule-ID conformance checklist: when the orchestrator supplies a ${CRITERIA} block (Phase 3 Step 1.78), the reviewer must return one conformance row per selected rule ID. Findings alone cannot answer 'was this applied completely' - a reviewer that opened nothing returns the same empty findings array as one that checked everything. v1.2.0 adds the optional per-finding fingerprint (Phase 3 Step 2.1): the stable id a finding keeps across review rounds.",
+  "description": "Contract for a single code-reviewer subagent's JSON output in Phase 4 Step 2. Every host dispatches 3 parallel reviewers; the middle slot is CLI-aware: Claude Code (Fable, Opus, Sonnet); Copilot CLI (Opus, GPT-5.4, Sonnet); Codex CLI dispatches 3 (gpt-5.6 at xhigh, gpt-5.4, gpt-5.6 at medium). Every reviewer must return an object matching this shape before Opus triage merges them. v1.1.0 adds the rule-ID conformance checklist: when the orchestrator supplies a ${CRITERIA} block (Phase 3 Step 1.78), the reviewer must return one conformance row per selected rule ID. Findings alone cannot answer 'was this applied completely' - a reviewer that opened nothing returns the same empty findings array as one that checked everything. v1.2.0 adds the optional per-finding fingerprint (Phase 3 Step 2.1): the stable id a finding keeps across review rounds. v1.4.0 adds the optional per-finding `security` envelope (OWASP + CWE + CVSS + evidence + remediation): the security-auditor emits reviewer-output objects whose findings carry it, so a blocking security finding merges at Step 3.0 and blocks Phase 4 like any reviewer blocker. General reviewers omit it. Its shape mirrors security-finding.schema.json, kept in step by smoke-security-schema-parity.sh.",
   "type": "object",
   "additionalProperties": false,
   "required": ["findings", "approved"],
@@ -128,6 +128,103 @@
           "type": "string",
           "pattern": "^F:[0-9a-f]{8}$",
           "description": "Stable cross-round identity of the finding, computed by finding-fingerprint.mjs from (file, ruleId or normalized issue text). Never includes the line. On iteration >= 2 a reviewer that recognises an entry from <previous-round-findings> echoes its fingerprint; otherwise leave it unset and the script fills it in."
+        },
+        "security": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["owaspCategory", "cwe", "cvss", "evidence", "confidence", "remediation"],
+          "description": "OPTIONAL security envelope. Present when the finding comes from the security-auditor (Phase 3 Step 3.0 merge) or /multi-agent:security-review; absent on a general code-reviewer finding. Its shape is the security block of security-finding.schema.json, kept in step by smoke-security-schema-parity.sh (self-contained, no cross-file $ref). validate-reviewer.mjs ignores it; triage carries it through unchanged so Phase 5 can report CVSS + CWE + remediation.",
+          "properties": {
+            "owaspCategory": {
+              "type": "string",
+              "pattern": "^(A(0[1-9]|10):2021|M[1-9]:2024|M10:2024)( .+)?$",
+              "description": "OWASP Top 10 2021 id (web/API) or OWASP Mobile Top 10 2024 id, optionally followed by a human title."
+            },
+            "cwe": {
+              "type": "string",
+              "pattern": "^CWE-[0-9]{1,5}$",
+              "description": "The specific CWE weakness id. One per finding."
+            },
+            "cve": {
+              "type": "string",
+              "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$",
+              "description": "A published CVE, for a known-vulnerable dependency finding."
+            },
+            "cvss": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["vector", "baseScore", "band"],
+              "description": "CVSS 3.1 base metrics; baseScore and band are computed from the vector by security_cvss_score.",
+              "properties": {
+                "vector": {
+                  "type": "string",
+                  "pattern": "^CVSS:3[.]1/AV:[NALP]/AC:[LH]/PR:[NLH]/UI:[NR]/S:[UC]/C:[NLH]/I:[NLH]/A:[NLH]$",
+                  "description": "Full CVSS 3.1 base vector."
+                },
+                "baseScore": {
+                  "type": "number",
+                  "minimum": 0,
+                  "maximum": 10,
+                  "description": "0.0 .. 10.0 base score."
+                },
+                "band": {
+                  "type": "string",
+                  "enum": ["none", "low", "medium", "high", "critical"],
+                  "description": "Qualitative band; maps to the finding severity (critical/high -> blocking, medium -> important, low/none -> suggestion)."
+                }
+              }
+            },
+            "evidence": {
+              "type": "string",
+              "minLength": 8,
+              "description": "What in the code proves the finding, cited by file:line."
+            },
+            "counterevidence": {
+              "type": "string",
+              "description": "What would disprove it, or the condition under which it is a false positive."
+            },
+            "confidence": {
+              "type": "string",
+              "enum": ["high", "medium", "low"],
+              "description": "How sure the auditor is the finding is real."
+            },
+            "confidenceRationale": {
+              "type": "string",
+              "description": "Why the confidence is what it is."
+            },
+            "severityChangeConditions": {
+              "type": "string",
+              "description": "The fact that, if learned, would move the severity."
+            },
+            "remediation": {
+              "type": "string",
+              "minLength": 8,
+              "description": "Remediation steps in prose."
+            },
+            "remediationDiff": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["before", "after"],
+              "description": "The fix as a before/after pair.",
+              "properties": {
+                "before": { "type": "string" },
+                "after": { "type": "string" }
+              }
+            },
+            "endpoint": {
+              "type": "string",
+              "description": "The HTTP route or RPC method for a service-layer finding."
+            },
+            "method": {
+              "type": "string",
+              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"],
+              "description": "HTTP method for an endpoint finding."
+            },
+            "fixVerification": {
+              "type": "string",
+              "description": "How to confirm the fix worked - the test to add or check to run."
+            }
+          }
         }
       }
     }

package/pipeline/schemas/security-finding.schema.json

@@ -0,0 +1,144 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/mmerterden/multi-agent-pipeline/pipeline/schemas/security-finding.schema.json",
+  "version": "1.0.0",
+  "title": "Multi-Agent Pipeline  -  security finding",
+  "description": "Contract for one finding produced by the security-auditor subagent (Phase 3) and the /multi-agent:security-review command. A security finding IS a reviewer-output.schema.json finding - same core fields (severity, file, line, issue, fix) - carrying one extra `security` block. That is exactly why it works: the auditor emits reviewer-output objects whose findings have the block, they merge into the Phase 3 reviewer set at Step 3.0, and a blocking one blocks Phase 4 like any reviewer blocker. reviewer-output.schema.json declares the same `security` property as OPTIONAL on its finding; here it is REQUIRED, which is the whole difference between a general finding and a security finding. The severity enum is the reviewer's (blocking|important|suggestion), never a private Critical/High/Medium scale: severity is derived from security.cvss.band by the rule on the `severity` property, and a severity that contradicts the band is the one inconsistency this contract forbids. The two schemas are kept in step by smoke-security-schema-parity.sh, not by a cross-file $ref, matching the self-contained style of the other pipeline schemas.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["severity", "file", "line", "issue", "fix", "security"],
+  "properties": {
+    "severity": {
+      "type": "string",
+      "enum": ["blocking", "important", "suggestion"],
+      "description": "The reviewer severity, derived from security.cvss.band so this finding filters through triage like any other: critical or high band -> blocking; medium -> important; low or none -> suggestion. It is not a free choice - a severity that disagrees with the band is the one inconsistency this schema exists to forbid."
+    },
+    "file": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Path relative to repo root. The auditor must not invent a file that is not in the tree."
+    },
+    "line": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Line number. 0 = whole-file, configuration-level, or dependency-manifest finding."
+    },
+    "issue": {
+      "type": "string",
+      "minLength": 4,
+      "description": "What is wrong, in one sentence. The vulnerability, not the fix."
+    },
+    "fix": {
+      "type": "string",
+      "minLength": 4,
+      "description": "Concrete remediation in one line, for the reviewer-shaped view. The full before/after diff lives in security.remediationDiff."
+    },
+    "ruleId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Stable id of a cited rule (e.g. SEC-03) when the finding comes from a standards registry supplied to the auditor. The author can look the rule up and argue with it rather than with the auditor."
+    },
+    "criteriaSource": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Which source the rule came from: a registry name, a compliance catalog (apple-archive-compliance / google-play-compliance), a reference path, or 'threat-model' when the finding is derived from the run-scoped threat model rather than a fixed rule."
+    },
+    "security": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owaspCategory", "cwe", "cvss", "evidence", "confidence", "remediation"],
+      "description": "The security envelope. Present on every security finding; optional on a general reviewer finding.",
+      "properties": {
+        "owaspCategory": {
+          "type": "string",
+          "pattern": "^(A(0[1-9]|10):2021|M[1-9]:2024|M10:2024)( .+)?$",
+          "description": "The OWASP category: web/API uses OWASP Top 10 2021 ids (A01:2021 .. A10:2021), mobile uses OWASP Mobile Top 10 2024 ids (M1:2024 .. M10:2024). An optional human title may follow the id, e.g. 'A01:2021 Broken Access Control'."
+        },
+        "cwe": {
+          "type": "string",
+          "pattern": "^CWE-[0-9]{1,5}$",
+          "description": "The specific weakness, as a validated CWE id (CWE-89, CWE-798, ...). One weakness per finding; if a line has two, it is two findings."
+        },
+        "cve": {
+          "type": "string",
+          "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$",
+          "description": "A published CVE, when the finding is a known-vulnerable dependency rather than first-party code. Set by the dependency-audit path, not by static code review."
+        },
+        "cvss": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["vector", "baseScore", "band"],
+          "description": "CVSS 3.1 base metrics. The auditor writes the vector; security_cvss_score (toolkit) computes baseScore and band from it, so the two cannot drift from the vector by hand.",
+          "properties": {
+            "vector": {
+              "type": "string",
+              "pattern": "^CVSS:3[.]1/AV:[NALP]/AC:[LH]/PR:[NLH]/UI:[NR]/S:[UC]/C:[NLH]/I:[NLH]/A:[NLH]$",
+              "description": "A full CVSS 3.1 base vector string. All eight base metrics are required; temporal and environmental metrics are out of scope for a static review."
+            },
+            "baseScore": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 10,
+              "description": "The CVSS 3.1 base score computed from the vector by security_cvss_score. 0.0 .. 10.0, one decimal."
+            },
+            "band": {
+              "type": "string",
+              "enum": ["none", "low", "medium", "high", "critical"],
+              "description": "The qualitative band of baseScore: none 0.0, low 0.1-3.9, medium 4.0-6.9, high 7.0-8.9, critical 9.0-10.0. This is what maps to `severity`."
+            }
+          }
+        },
+        "evidence": {
+          "type": "string",
+          "minLength": 8,
+          "description": "What in the code proves the finding, quoted or cited by file:line. A static finding with no evidence is a guess; this is what a reader checks before agreeing."
+        },
+        "counterevidence": {
+          "type": "string",
+          "description": "What in the code would DISPROVE the finding, or the condition under which it is a false positive - a guard elsewhere, a framework default, an unreachable path. Stating it keeps confidence honest; leaving it blank asserts there is none."
+        },
+        "confidence": {
+          "type": "string",
+          "enum": ["high", "medium", "low"],
+          "description": "How sure the auditor is that this is real. Low confidence does not mean do-not-report; it means report with the counterevidence and let triage weigh it."
+        },
+        "confidenceRationale": {
+          "type": "string",
+          "description": "One line on why the confidence is what it is - what was and was not verifiable from the code alone."
+        },
+        "severityChangeConditions": {
+          "type": "string",
+          "description": "The fact that, if learned, would move the severity: 'critical if this endpoint is unauthenticated in production; medium if it is admin-only'. Names the assumption the score rests on."
+        },
+        "remediation": {
+          "type": "string",
+          "minLength": 8,
+          "description": "The remediation steps in prose - what to change and why it closes the weakness. Actionable, not 'sanitize input'."
+        },
+        "remediationDiff": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["before", "after"],
+          "description": "The fix as a before/after pair the author can read as a diff. Optional - some findings are configuration or process changes with no single code hunk - but preferred for first-party code.",
+          "properties": {
+            "before": { "type": "string", "description": "The vulnerable code as it stands." },
+            "after": { "type": "string", "description": "The same region after the fix." }
+          }
+        },
+        "endpoint": {
+          "type": "string",
+          "description": "The HTTP route or RPC method the finding sits on, when it is a service-layer issue. Empty for non-network findings."
+        },
+        "method": {
+          "type": "string",
+          "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"],
+          "description": "The HTTP method for an endpoint finding."
+        },
+        "fixVerification": {
+          "type": "string",
+          "description": "How to confirm the fix worked - the test to add or the check to run. Static review cannot fire an exploit, so this is the empirical step a human or a later dynamic pass takes."
+        }
+      }
+    }
+  }
+}

package/pipeline/scripts/_stack-routing.mjs

@@ -28,6 +28,7 @@ export const COMMON_SKILLS = [
   "skill-creator",
   "backlog",
   "localization-reuse-map",
+  "security-review",
 ];
 
 // The analyst plugin is the second always-enabled toolkit. It carries outside

package/pipeline/scripts/gc-abandoned.sh

@@ -11,9 +11,9 @@
 # Three things keep this from being a foot-gun, and each is a rule rather than a
 # heuristic:
 #
-#   1. A run WAITING FOR YOU is never reaped. An open PR, Phase 4 or 7, or
-#      `status: awaiting_input` means the work landed and the pipeline is
-#      holding for an answer by design. That is finished work, not residue.
+#   1. A run WAITING FOR YOU is never reaped. An open PR, the Commit or Report
+#      phase, or `status: awaiting_input` means the work landed and the pipeline
+#      is holding for an answer by design. That is finished work, not residue.
 #   2. A path that is not strictly inside `<repo>/.worktrees/` is never removed.
 #      This is not theoretical: four state files on that machine record
 #      `worktreePath` as the REPO ROOT, so a sweep that trusted the field would
@@ -96,6 +96,13 @@ case "$DAYS$PHASE0_DAYS" in *[!0-9]*) echo "gc-abandoned: --days and --phase0-da
 command -v jq >/dev/null 2>&1 || { echo "gc-abandoned: jq is required"; exit 0; }
 [ -d "$LOGS" ] || { echo "gc-abandoned: nothing to do (no state at $LOGS)"; exit 0; }
 
+# The phase from which a stopped run is "waiting on you", not residue, is the
+# contract's threshold - Commit onward - not a literal pinned to one numbering.
+# runs-index.mjs groups the same way from the same field.
+SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+WAITING_FROM=$(jq -r '.thresholds.waitingFromPhase' "$SELF_DIR/../schemas/phases.json" 2>/dev/null || echo 4)
+case "$WAITING_FROM" in *[!0-9]*|"") WAITING_FROM=4 ;; esac
+
 # GNU form FIRST. `stat -f` is a valid GNU flag (--file-system) that succeeds and
 # prints a mount point, so BSD-first silently returns a number that is not a
 # timestamp. ADR-0012 lists this among the constructs that look cross-platform
@@ -142,7 +149,7 @@ while IFS= read -r state; do
   wt=$(jq -r '.worktreePath // ""' "$state" 2>/dev/null || true)
 
   # Rule 1: waiting for you is not residue.
-  if [ "$status" = "awaiting_input" ] || [ -n "$pr" ] || [ "$phase" = "6" ] || [ "$phase" = "7" ]; then
+  if [ "$status" = "awaiting_input" ] || [ -n "$pr" ] || { [ "$phase" != "?" ] && [ "$phase" -ge "$WAITING_FROM" ] 2>/dev/null; }; then
     skipped_waiting=$((skipped_waiting + 1))
     continue
   fi
@@ -271,10 +278,10 @@ if [ "$STATE_ONLY" -eq 0 ] && [ -d "$REPOS" ]; then
       ph=$(printf '%s' "$row" | cut -f5)
 
       # Rule 1 again: landed work is not residue, whichever pass finds it. Order
-      # matters here - the phase-4/5 test is a proxy for "still waiting", and a
-      # run whose status already says it FINISHED is not waiting for anyone. A
-      # complete run sitting at phase 7 was read as waiting and never reaped,
-      # which is how three finished worktrees held 5.1 GB indefinitely.
+      # matters here - the waiting-phase test is a proxy for "still waiting", and
+      # a run whose status already says it FINISHED is not waiting for anyone. A
+      # complete run sitting at the report phase was read as waiting and never
+      # reaped, which is how three finished worktrees held 5.1 GB indefinitely.
       case "$st" in
         complete | completed | failed) ;;
         awaiting_input)
@@ -282,7 +289,7 @@ if [ "$STATE_ONLY" -eq 0 ] && [ -d "$REPOS" ]; then
         in_progress | paused)
           continue ;; # pass 1 owns these; do not report them twice
         *)
-          if [ -n "$pr" ] || [ "$ph" = "6" ] || [ "$ph" = "7" ]; then
+          if [ -n "$pr" ] || { [ "$ph" != "?" ] && [ "$ph" -ge "$WAITING_FROM" ] 2>/dev/null; }; then
             skipped_waiting=$((skipped_waiting + 1)); continue
           fi ;;
       esac

package/pipeline/scripts/render-work-summary.sh

@@ -34,7 +34,7 @@
 #   - <A> accepted · <D> deferred · <R> rejected · approved=<bool>
 #
 #   #### Phases
-#   - 0 Init done · 1 Analysis done · 2 Planning done · 3 Dev done · 4 Review done · 5 Test done · 6 Commit done · 7 Report active
+#   - 0 Init done · 1 Plan done · 2 Dev done · 3 Review done · 4 Commit done · 5 Report active
 #
 # Exit codes: 0 = rendered, 2 = missing state (caller should skip section).
 
@@ -171,7 +171,11 @@ fi
 # Phase tick marks
 phase_ticks=""
 if [ -n "$TRACKER_FILE" ]; then
-  phase_ticks=$(jq -r '
+  # The phase vocabulary is the contract's, not a literal pinned to one
+  # numbering: "<id> <name>" per phase, in id order, straight from phases.json.
+  PHASES_JSON="$_MA_RP_HERE/../schemas/phases.json"
+  LABELS=$(jq -c '[.phases | sort_by(.id) | .[] | "\(.id) \(.name)"]' "$PHASES_JSON" 2>/dev/null || echo '[]')
+  phase_ticks=$(jq -r --argjson labels "$LABELS" '
     # Normalize both tracker shapes: phase-tracker.sh writes phases as an
     # array of {id,...}; older fixtures keyed an object by phase id. The
     # string-index below errors on an array and 2>/dev/null would swallow
@@ -179,8 +183,7 @@ if [ -n "$TRACKER_FILE" ]; then
     (if (.phases | type) == "array"
      then (.phases | map({key: (.id | tostring), value: .}) | from_entries)
      else (.phases // {}) end) as $ph |
-    ["0 Init","1 Analysis","2 Planning","3 Dev","4 Review","5 Test","6 Commit","7 Report"] as $labels |
-    [range(0;8) | tostring] as $ids |
+    [range(0; ($labels | length)) | tostring] as $ids |
     $ids
     | map(. as $i |
         ($labels[$i | tonumber]) as $label |

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-21T11:25:15Z",
-  "skillCount": 213,
+  "generatedAt": "2026-09-21T16:14:01Z",
+  "skillCount": 215,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -177,12 +177,16 @@
     },
     {
       "path": "shared/core/multi-agent-scan/SKILL.md",
-      "sha256": "544b29d001e677c579c89705c81c8bc7fb9e8037297e512a2bfad379bd07ee55"
+      "sha256": "71cdbf40a40edf80b61985ea4cd6b7d43511e91ad3d7c4121512134a9e94f2a8"
     },
     {
       "path": "shared/core/multi-agent-search/SKILL.md",
       "sha256": "32541ceca20c489814f9d948763d5237d4a71473a05683d9da262b8f6dea815b"
     },
+    {
+      "path": "shared/core/multi-agent-security-review/SKILL.md",
+      "sha256": "a3d4d1e99a8be67f179b08d79ee421108f3e62c8d4190cf4e9af7dd4391a8c11"
+    },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
       "sha256": "d2c167082f40af3c2a7cbb0be55a8cdf8076a4f06a3df54c89b1318759421a29"
@@ -205,7 +209,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "34aea52bbbe86018011edc1c96a986d1ee2aba8bdb82b19212714bac80bea076"
+      "sha256": "70b81f275fa430eb7382d0fa16f0a07ec29d92d9476655c496ce38565833fa13"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -241,7 +245,7 @@
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
-      "sha256": "ca1286f3f17d76b75547320ec9b39af575a88828da14b4ed4ffe79932c7406a3"
+      "sha256": "7a8a1e51d7e1f9e6cf00e09a5b1d680db4609d79cb629ab4b80e7a27bee5ef5e"
     },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",
@@ -651,6 +655,10 @@
       "path": "shared/external/search-first/SKILL.md",
       "sha256": "4730d95babebecb3070a23e09cfce57f687467e0d45bbc332ae612cf01066e10"
     },
+    {
+      "path": "shared/external/security-review/SKILL.md",
+      "sha256": "6bf82c336b7067d3e8a874e09916fcdbad4867634881f0a58d721b78fc9e83b2"
+    },
     {
       "path": "shared/external/shareplay-activities/SKILL.md",
       "sha256": "508e3123039bc114e4239e66d86f8d550fe94fc259d827e4985e0aed3ff54090"

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -422,9 +422,8 @@ Two halves, one phase, one approval gate (Phases 1 and 2 until 19.0.0).
 
 **1a  -  Analysis** (claude-sonnet-5, `explorer` persona)
 1. Launch **explore agents** (parallel) to scan the codebase: related files, existing patterns and conventions, potential impact areas
-2. Optionally launch **security-auditor** agent for pre-check
-3. Summarize findings
-4. Log: `📊 Phase 1: Plan (analysis)  -  {N} files identified, {summary}`
+2. Summarize findings
+3. Log: `📊 Phase 1: Plan (analysis)  -  {N} files identified, {summary}`
 
 **1b  -  Planning** (claude-fable-5)
 1. Create task breakdown → todos with dependencies
@@ -633,7 +632,7 @@ Sub-agents have embedded skills in their `.agent.md` files. Each agent is pre-lo
 |-------|----------------|----------------|
 | **code-reviewer** | Code Review Excellence, Security Audit, Performance Review, TDD Verification, Error Detective | Phase 3: Review |
 | **ios-architect** | Spec-Driven Architecture, Context Management, Multi-Agent Coordination, API Design, Performance Architecture, Design System Governance | Phase 1: Plan |
-| **security-auditor** | iOS Security Deep Dive, App Store Review Gates, Third-Party SDK Risk, Error Detective (Security) | Phase 1: Plan (analysis half, pre-check) + Phase 3: Review |
+| **security-auditor** | iOS Security Deep Dive, App Store Review Gates, Third-Party SDK Risk, Error Detective (Security) | Phase 3: Review |
 
 ### Phase → Agent → Skills Flow
 

package/pipeline/skills/shared/core/multi-agent-scan/SKILL.md

@@ -3,7 +3,7 @@ name: multi-agent-scan
 language: en
 description: "Skill security scan: walks local skill directories against a tiered pattern catalog. Use when local skill directories need checking for unsafe or unexpected content."
 user-invocable: true
-argument-hint: "[--strict] [--target <path>]  -  optional: --strict enables CI failure mode, --target picks a custom directory"
+argument-hint: "[--strict] [--root PATH]  -  optional: --strict enables strict exit codes, --root picks a custom directory"
 ---
 
 # multi-agent-scan
@@ -55,7 +55,7 @@ multi-agent-scan --root ~/.copilot/skills
 ## Integration
 
 - **install.js** pre-deploy hook (automatic, warn-only high-threshold)
-- **CI** `.github/workflows/smoke.yml` step (strict)
+- **Smoke suite** `smoke-skill-scan.sh` runs it in strict mode under `npm test`
 - **Standalone** this skill
 
 Cross-CLI parity: `/multi-agent:scan` on Claude Code, `multi-agent-scan` on Copilot CLI. Same source script, same behavior.

package/pipeline/skills/shared/core/multi-agent-security-review/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: multi-agent-security-review
+language: en
+description: "Run a standalone defensive, static security review of a diff, branch or repo: run-scoped threat model, reviewer-shaped findings joined to OWASP + CWE with CVSS scoring, evidence and before/after fixes, plus an offline dependency inventory. No live target, no payloads. Use when reviewing code for security outside a full pipeline run, auditing dependencies, or preparing a branch for a security sign-off."
+user-invocable: true
+argument-hint: "[#N | repo#N | PR-URL | branch | path]  -  a PR, a local branch, or a path to scope the review. If omitted: the current branch diff against its base."
+---
+
+# multi-agent security-review  -  standalone defensive static review
+
+**Input**: `$ARGUMENTS`
+
+The same security audit Phase 3 runs at Step 2.7, invoked on its own. Defensive and static: reads code, config and dependency manifests; never runs the target, fires a payload, or reaches a live host.
+
+## Scope
+
+Resolve from `$ARGUMENTS`, same shapes as `/multi-agent:review`: `#N` / `repo#N` / PR URL → that PR's diff; a branch → its diff against base; a path → files under it; omitted → the current branch diff. Cap the diff as Phase 3 Step 1.9 does.
+
+## Steps
+
+1. **Threat model** - produce `.pipeline/threat-model.md` (four sections) if absent, else read it; mirror to `state.threatModel`. Contract: `threat-model.md`.
+2. **Method** - load `ai-common-toolkit:security-review` for the OWASP walk (Web/API Top 10 2021, Mobile Top 10 2024) + CWE join. This command orchestrates, it does not re-derive the method.
+3. **Findings** - dispatch the `security-auditor`; it returns a `reviewer-output.schema.json` object whose `findings[]` carry the `security` envelope (`security-finding.schema.json`). Score every vector with the toolkit `security_cvss_score`; validate with `validate-reviewer.mjs` (one rework then halt).
+4. **Dependencies** - run `security_dep_inventory` on the lockfiles; hand the inventory to `ai-analyst-toolkit:evidence-registry` for known CVEs when it is registered. A vulnerable dependency is an `A06:2021` finding with the advisory CWE + CVE. This command contacts nothing itself.
+5. **Report** - write `.pipeline/security-findings.json` and a human summary (count by severity; each blocking/important finding with OWASP id, CWE, CVSS band, evidence, before/after fix). An empty list with `approved: true` is a clean review.
+
+## Boundaries
+
+Inside a run the same audit is Phase 3 Step 2.7 (`features/security-audit.md`), triggered by the `security_path` signal; this is the standalone entry point. Not the `store-ready` device pass, not a secret scanner (`pre-commit-check.sh` covers secrets). No writes to Jira / GitHub / Confluence. Autopilot reviews the current branch, writes the report, opens no PR.

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -32,7 +32,7 @@ Run all steps automatically:
 ```
 Step 0: DOCTOR      node $HOME/.claude/scripts/doctor.mjs  -  exit 2 or 4 STOPS the sync
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 57 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 58 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 57 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -228,7 +228,7 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**57 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**58 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
@@ -239,7 +239,7 @@ language, log, manual-test, model, prune-logs,
 prune-prompts, purge, refactor, resume, review,
 review-analysis, review-issue, review-jira, route-off, route-on,
 route-status, routines, save, scan, search,
-setup, stack, status, steer, store-ready, sync, test, test-accessibility,
+security-review, setup, stack, status, steer, store-ready, sync, test, test-accessibility,
 test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation,
 uninstall, update
 ```