@mmerterden/multi-agent-pipeline 20.0.0 → 20.2.0

package/CHANGELOG.md

@@ -14,6 +14,61 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [20.2.0] - 2026-09-21
+
+### Added
+
+- **Four new Android knowledge skills**, drawn generically from a mature Compose
+  app: `android-mvi-viewmodel` (a reusable `BaseViewModel<State, Intent, Event>`
+  seam), `android-datastore` (typed and encrypted Jetpack DataStore, the
+  SharedPreferences replacement), `android-design-tokens-codegen` (single-source
+  JSON to typed-Kotlin codegen with a `--check` CI freshness gate) and
+  `android-build-quality-gates` (module and quality rules as build-failing Gradle
+  tasks). They ship in `ai-android-toolkit`.
+
+### Changed
+
+- **Ten Android skills deepened** with current best-practice techniques across
+  coroutines, Compose, Retrofit, Room, security, testing, Gradle, design tokens,
+  architecture and navigation. Cross-cutting topics are owned by one skill and
+  cross-linked from the others rather than duplicated.
+- **Eleven knowledge skills brought under the 500-line rule** by moving long code
+  examples into per-skill `references/` files (progressive disclosure); their
+  line-grace entries are removed. `android_ui_verification` renamed to
+  `android-ui-verification` for kebab-case parity.
+- **Description-surface ceiling raised 88000 -> 90000** for the four new skills;
+  their descriptions were trimmed toward the average first and the average held
+  at 320 against its 420 ceiling.
+
+## [20.1.0] - 2026-09-21
+
+### Added
+
+- **`/multi-agent:security-review` and a wired security audit.** A defensive,
+  static security review: build a run-scoped threat model (attacker, trust
+  boundaries, attack surface, severity calibration), find vulnerabilities joined
+  to OWASP (Web/API Top 10 2021 and Mobile Top 10 2024) and a CWE, score them
+  with CVSS 3.1, and emit reviewer-shaped findings carrying evidence,
+  counterevidence, confidence and a before/after fix. No live target, no
+  payloads. `security-finding.schema.json` makes a finding a reviewer-output
+  finding plus a required `security` envelope, so the security-auditor's output
+  now merges at Phase 3 Step 3.0 and a blocking finding blocks Phase 4 - the
+  audit runs at Step 2.7 on the `security_path` signal, and the command is the
+  standalone entry point. An always-on `ai-common-toolkit:security-review` skill
+  carries the method.
+
+### Fixed
+
+- **Six-phase leftovers and stale shipped claims.** Renumbered the eight-phase
+  literals that misfired under six phases (a Report-phase run reaped by
+  gc-abandoned, an eight-name work-summary strip, stale personas and dispatch
+  docs), derived the reaped-phase and work-summary labels from the contract, and
+  removed dead config (`componentDevWorkflow`, `shortRunFromPhase`). Corrected
+  claims the code does not back: a phantom phase count, a scan skill pointing at
+  a workflow and a flag that do not exist, a SECURITY.md table five majors
+  behind (now derived and gated), and CONTRIBUTING.md / ADR-0011 describing CI as
+  dormant while its workflows run on every push.
+
 ## [20.0.0] - 2026-09-21
 
 ### Removed

package/README.md

@@ -175,7 +175,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 57 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 58 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -369,17 +369,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 57 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 58 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + three `PreToolUse` hooks (secret scan, agent-guard, read-size gate) |
-| Copilot CLI | `--copilot`          | instructions + 57 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 57 specs as refs + 9 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 58 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 58 specs as refs + 9 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 57.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 58.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single

package/README.tr.md

@@ -155,7 +155,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 57 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 58 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -350,17 +350,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 57 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 58 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 57 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 57 spec + 9 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 58 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 58 spec + 9 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 57 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 58 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/SECURITY.md

@@ -6,9 +6,9 @@ We provide security fixes for the latest minor of the current major. Older versi
 
 | Version | Supported              |
 | ------- | ---------------------- |
-| 15.x    | ✅ active              |
-| 14.x    | ⚠️ security fixes only |
-| ≤ 13.x  | ❌ end-of-life         |
+| 20.x    | ✅ active              |
+| 19.x    | ⚠️ security fixes only |
+| ≤ 18.x  | ❌ end-of-life         |
 
 ## Reporting a Vulnerability
 

package/docs/adr/0011-dormant-ci.md

@@ -1,6 +1,15 @@
 # 11. CI stays in the repository but dormant; the pre-push gate is primary
 
-**Status:** Accepted · 2026-08-31 · amended 2026-09-13 · amended 2026-09-17
+**Status:** Accepted · 2026-08-31 · amended 2026-09-13 · amended 2026-09-17 · superseded 2026-09-21 (GitHub-hosted CI reawakened)
+
+> **Amendment, 2026-09-21 (supersedes the conclusion below).** `test.yml` and
+> `ci-lite.yml` now run on every push and pull request to `main`
+> (`workflow_dispatch` also triggers them by hand); their `on:` blocks are the
+> source of truth for what runs. The dormancy decision recorded in this ADR no
+> longer holds for the GitHub-hosted workflows. The pre-push gate stays the
+> primary check and CI is the backstop, so the reasoning below still explains
+> why local verification leads; only "no workflow runs" has changed. The
+> self-hosted-runner discussion in the 2026-09-17 amendment is unaffected.
 
 > **Amendment, 2026-09-13 (ADR-0012, macOS only).** Linux and Windows support
 > was removed. `package.json` now declares `os: ["darwin"]`, which npm enforces

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>57 command files]
+        CMD[commands/<br/>58 command files]
         AGT[agents/<br/>8 agent personas]
         RUL[rules/<br/>12 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -169,7 +169,7 @@ revisions of this diagram - Codex CLI and the two independently-shipped repos
 graph TD
     CC["Claude Code<br/>(source of truth)"]
     COP["Copilot CLI<br/>(instructions + 56 skills)"]
-    COD["Codex CLI<br/>(1 router skill + 57 refs)"]
+    COD["Codex CLI<br/>(1 router skill + 58 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(5 stack plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 57 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 58 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 5 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 115 MCP tools across 13 categories (simulator/emulator control, memory, crash diagnostics, accessibility audit, store compliance, web automation, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index, provider-backed research, video key frames) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 57 commands"]
+        PHASES["6 phases · 58 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>57 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 57 refs<br/>+ 8 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>58 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 58 refs<br/>+ 8 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -157,7 +157,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 57 slash-command skills, native | 57 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 57 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 58 slash-command skills, native | 58 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 58 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
   "generatedAt": "2026-09-21",
-  "version": "20.0.0",
+  "version": "20.2.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,12 +35,12 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 3, 4, 5]
   },
-  "commandCount": 57,
-  "skillCount": 153,
-  "skillCountAll": 213,
+  "commandCount": 58,
+  "skillCount": 158,
+  "skillCountAll": 219,
   "agentCount": 9,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 115,
+  "toolCount": 117,
   "toolCategories": {
     "ios": 40,
     "android": 31,
@@ -51,8 +51,9 @@
     "context": 3,
     "agent": 2,
     "research": 2,
+    "security": 2,
     "media": 1
   },
-  "pluginSkillCount": 239,
-  "toolkitVersion": "3.13.1"
+  "pluginSkillCount": 244,
+  "toolkitVersion": "3.14.0"
 }

package/install/_codex-agents.mjs

@@ -27,7 +27,7 @@ import { ensureDir, ensureRealDir, isDryRun, writeFile } from "./_common.mjs";
  * Claude Code.
  *
  * This table resolves a persona's DEFAULT tier, which is not the same thing as
- * a per-slot override. Phase 4 dispatches Reviewer 3 with an explicit
+ * a per-slot override. Phase 3 dispatches Reviewer 3 with an explicit
  * `gpt-5.6` @ `medium` (see `phases/phase-3-review.md`, `claude-md-template.md`
  * and `reviewer-output.schema.json`, which all state that value) even though
  * the persona's own tier is `sonnet` and resolves here to `gpt-5.4`. That is