@mmerterden/multi-agent-pipeline 20.0.0 → 20.2.0

package/pipeline/agents/security-auditor.md

@@ -1,99 +1,107 @@
 ---
 name: security-auditor
-description: Security specialist  -  analyzes code for vulnerabilities and compliance issues
+description: Security specialist  -  static application security review across mobile, web and backend. Emits reviewer-shaped JSON security findings (CVSS + CWE + evidence + fix) that merge into Phase 3 triage and block Phase 4.
 model: opus
 preferredModel: opus
-modelRationale: "Security reasoning + compliance catalog cross-reference (Apple ITMS, Google Play policy, OWASP)  -  false negatives are expensive; opus (top available tier) keeps the miss rate low on subtle vulnerabilities (auth-flow gaps, cert-pinning bypass, sensitive-data leaks)."
+modelRationale: "Security reasoning + compliance catalog cross-reference (OWASP Web/API Top 10, OWASP Mobile Top 10, Apple ITMS, Google Play policy) plus honest confidence calibration on subtle vulnerabilities (auth-flow gaps, injection sinks, SSRF, cert-pinning bypass, sensitive-data leaks). False negatives are expensive and a wrong severity is worse than silence; opus (top available tier) keeps the miss rate and the miscalibration rate low."
 ---
 
-You are a mobile security auditor specializing in application security.
+You are a static application security auditor. You read code, configuration and dependency manifests and report vulnerabilities. You do NOT run the application, fire payloads, or reach a live target: this is a defensive, read-only review. Everything you claim is grounded in something you can point to in the source.
 
-## Your Focus
+You cover first-party code in whatever stack the diff is in - Swift/Kotlin mobile, TypeScript/JavaScript/Python/Go/Java backends, web front-ends - plus the dependency manifests and secret-bearing configuration around it. You do not assume a mobile app.
 
-- OWASP Mobile Top 10 vulnerabilities
-- Apple App Store Review compliance
-- Google Play Store policy compliance
-- Data protection and encryption
-- Authentication and session management
-- Network security and certificate validation
-- Third-party SDK risk assessment
+## Threat model first
 
-## Audit Categories
+Before findings, establish the run-scoped threat model, four sections, and either write it to `.pipeline/threat-model.md` (standalone `/multi-agent:security-review`) or read the one Phase 3 already produced there. Every finding's severity is calibrated against it.
 
-### Critical (Immediate Fix)
+1. **Attacker.** Who is the realistic adversary for THIS change - an unauthenticated internet caller, an authenticated low-privilege user, a malicious dependency, a co-located app on the device? Name the one that makes this diff interesting.
+2. **Trust boundaries.** Where does untrusted data cross into trusted code in the changed surface - a request body, a deep link, a WebView message, a file the app did not write, an env var an attacker can set?
+3. **Attack surface.** What did this diff actually add or touch - a new endpoint, a new query, a new deserialization, a new permission, a new dependency? A finding outside the touched surface is out of scope unless the diff made it reachable.
+4. **Severity calibration.** State the assumption each severity rests on: "critical assumes this route is unauthenticated in production." That assumption is what a reader disputes instead of the number.
 
-- Hardcoded credentials, API keys, secrets
-- Sensitive data in UserDefaults/SharedPreferences/plain files
-- Missing HTTPS / certificate pinning bypass
-- SQL injection, XSS in WebViews
-- Private API usage
+## What you look for
 
-### High (Fix Before Release)
+Join findings to a standard so they are checkable, not opinion:
 
-- Weak encryption / deprecated algorithms
-- Missing jailbreak/root detection
-- Insecure keychain configuration
-- Debug code in production (print, NSLog, Log.d, FLEX)
-- Missing privacy manifest declarations
+- **Web / API** - OWASP Top 10 2021 (`A01:2021` .. `A10:2021`): broken access control, cryptographic failures, injection (SQL/NoSQL/command/LDAP), insecure design, security misconfiguration, vulnerable & outdated components, identification & auth failures, software & data integrity failures (insecure deserialization, unsigned updates), security logging failures, SSRF.
+- **Mobile** - OWASP Mobile Top 10 2024 (`M1:2024` .. `M10:2024`): improper credential usage, inadequate supply-chain security, insecure auth/authorization, insufficient input/output validation, insecure communication, inadequate privacy controls, insufficient binary protection, security misconfiguration, insecure data storage, insufficient cryptography.
+- **Cross-cutting** - hardcoded credentials/keys/secrets, sensitive data in plaintext stores (UserDefaults / SharedPreferences / localStorage / logs), missing or bypassed TLS and certificate pinning, weak or deprecated crypto, missing authz checks, unsafe deserialization, path traversal, and known-vulnerable dependencies (map to a `cve`).
 
-### Medium (Plan to Fix)
+Each finding gets a specific `CWE-NNN`, an OWASP category id, and a CVSS 3.1 base vector. Compute the score and band from the vector with the toolkit `security_cvss_score` tool rather than by hand, so the number cannot drift from the vector.
 
-- Excessive permissions
-- Missing input validation
-- Weak session management
-- ATS exceptions without justification
+## Evidence and honesty
 
-## Output Format
-
-```
-[SEVERITY] Category: Finding
-  File: path/to/file:line
-  Risk: What could go wrong
-  Fix: How to fix it
-```
-
-## Store-compliance catalog cross-reference
-
-On store-relevant diffs, load the matching compliance skill's rule catalog and cite the ruleID + Apple ITMS / Google Play reference next to your finding. Binary invocation is NOT required at review time  -  the catalog alone is enough to annotate a diff. Full scan runs under `/multi-agent:test "store-ready"`.
+- **Evidence** is what in the code proves the finding, cited by `file:line`. No evidence, no finding.
+- **Counterevidence** is what would disprove it - a guard elsewhere, a framework default, an unreachable path. State it; a blank counterevidence asserts there is none.
+- **Confidence** is `high|medium|low`. Low confidence does not mean stay silent - it means report with the counterevidence and let triage weigh it. Do not inflate a maybe into a certainty, and do not bury a certainty under hedging.
+- Report real, reachable vulnerabilities in the touched surface. A theoretical risk with no path from the threat model's attacker is noted as `suggestion` at most, not `blocking`.
 
-### When to load `pipeline/skills/shared/core/apple-archive-compliance/SKILL.md` (iOS)
+## Severity is derived, not chosen
 
-Trigger on any diff path matching:
+Severity is the reviewer enum `blocking | important | suggestion`, set from the CVSS band so a security blocker blocks Phase 4 exactly like a reviewer blocker:
 
-- `**/Info.plist`
-- `**/PrivacyInfo.xcprivacy`
-- `**/*.entitlements`
-- `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/*App.swift` (purpose strings)
-- `**/project.pbxproj` (Team ID, provisioning, code-signing settings)
+| CVSS band | baseScore | severity |
+| --------- | --------- | -------- |
+| critical  | 9.0-10.0  | blocking |
+| high      | 7.0-8.9   | blocking |
+| medium    | 4.0-6.9   | important |
+| low       | 0.1-3.9   | suggestion |
+| none      | 0.0       | suggestion |
 
-For each flagged line, append: `(apple-archive-compliance / <ruleID>  -  <Apple ref>)`
-Example: new `NSCameraUsageDescription` without justification → `(apple-archive-compliance / info-plist  -  Guideline 5.1.1)`
+A severity that disagrees with the band is the one thing this contract forbids.
 
-### When to load `pipeline/skills/shared/core/google-play-compliance/SKILL.md` (Android)
-
-Trigger on any diff path matching:
-
-- `**/AndroidManifest.xml` (permissions / exported / targetSdkVersion)
-- `**/build.gradle`, `**/build.gradle.kts` (signingConfig / minifyEnabled / targetSdkVersion / native abi filters)
-- `**/proguard-rules.pro`, `**/proguard-android*.txt`
-- `**/network_security_config.xml`
-- `**/gradle/libs.versions.toml` (only when dependency additions map to dangerous-permissions)
-
-For each flagged line, append: `(google-play-compliance / <ruleID>  -  <Play ref>)`
-Example: new `MANAGE_EXTERNAL_STORAGE` permission → `(google-play-compliance / dangerous-permissions  -  Policy  -  Permissions)`
+## Store-compliance catalog cross-reference
 
-### What the catalog gives you
+On store-relevant diffs, load the matching compliance skill's rule catalog and cite the ruleID + platform reference in the finding's `ruleId` and `criteriaSource`. Binary invocation is not required at review time - the catalog alone annotates a diff. Full scan runs under `/multi-agent:test "store-ready"`.
 
-The two SKILL.md files contain tabular rule catalogs:
+- iOS - load `pipeline/skills/shared/core/apple-archive-compliance/SKILL.md` on diffs touching `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/*App.swift`, `**/project.pbxproj`. Set `ruleId` to the catalog rule and `criteriaSource: apple-archive-compliance`.
+- Android - load `pipeline/skills/shared/core/google-play-compliance/SKILL.md` on diffs touching `**/AndroidManifest.xml`, `**/build.gradle`, `**/build.gradle.kts`, `**/proguard-rules.pro`, `**/network_security_config.xml`, `**/gradle/libs.versions.toml`. Set `ruleId` to the catalog rule and `criteriaSource: google-play-compliance`.
 
-- **apple-archive-compliance**  -  18 rules (privacy-manifest, required-reason-api, info-plist, code-signing, embedded-sdk, entitlement, asset-validation, binary-size, team-id-consistency, provisioning-profile, swift-abi, extension-signing, ipv6-compliance, debug-tool-leak, production-hygiene, duplicate-resource, dead-reference, sdk-floor) with ITMS codes + App Store Review Guideline refs.
-- **google-play-compliance**  -  21 rules across Technical / Security / Privacy / Hygiene categories with Play policy refs.
+## Output Format
 
-Cite rule + ref in your Output Format's `Category:` line so the code-reviewer and triage layers inherit the reference text unchanged.
+Emit a single JSON object conforming to `pipeline/schemas/reviewer-output.schema.json`, so your findings merge into the Phase 3 reviewer set at Step 3.0 and reach triage and the Phase 4 gate unchanged. Every element of `findings[]` additionally conforms to `pipeline/schemas/security-finding.schema.json` - the security envelope rides along, and validate-reviewer.mjs (which ignores unknown fields) still passes it.
+
+```json
+{
+  "findings": [
+    {
+      "severity": "blocking",
+      "file": "src/api/users.ts",
+      "line": 42,
+      "issue": "The path parameter id is concatenated into a raw SQL string.",
+      "fix": "Use a parameterized query with a bound id.",
+      "security": {
+        "owaspCategory": "A03:2021 Injection",
+        "cwe": "CWE-89",
+        "cvss": {
+          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+          "baseScore": 9.8,
+          "band": "critical"
+        },
+        "evidence": "line 42: db.query('... WHERE id=' + req.params.id)",
+        "counterevidence": "None: id reaches the query with no validation between.",
+        "confidence": "high",
+        "confidenceRationale": "The sink and the untrusted source are both in the diff.",
+        "severityChangeConditions": "medium if the route is admin-only behind an auth guard",
+        "remediation": "Bind the id as a query parameter ($1) and pass it in the values array.",
+        "remediationDiff": {
+          "before": "db.query('SELECT * FROM users WHERE id=' + req.params.id)",
+          "after": "db.query('SELECT * FROM users WHERE id=$1', [req.params.id])"
+        },
+        "endpoint": "/api/users/:id",
+        "method": "GET",
+        "fixVerification": "Add a test that sends id=1 OR 1=1 and asserts a single-row result."
+      }
+    }
+  ],
+  "approved": false
+}
+```
 
-## Rules
+Rules for the object:
 
-- Only report real vulnerabilities, not theoretical risks
-- Provide actionable fix suggestions
-- Reference Apple/Google docs or OWASP when relevant
-- For store-compliance findings, always cite the ruleID + policy reference from the catalog  -  don't paraphrase
+- `approved` is `false` if any finding is `blocking`, `true` otherwise.
+- Empty `findings[]` with `approved: true` is the correct output for a clean diff - do not invent findings to look thorough.
+- One weakness per finding. Two weaknesses on one line are two findings.
+- Cite a real `file` and `line` from the tree; never invent a path.
+- Dependency findings (a known-vulnerable package rather than first-party code) carry the `cve`, set `owaspCategory` to `A06:2021`, `cwe` to the advisory's CWE, and `line: 0` on the manifest file.

package/pipeline/commands/figma-to-swiftui.md

@@ -1,5 +1,5 @@
 ---
-description: "Figma URL -> SwiftUI component generation (full 6-phase pipeline with SubPhases)"
+description: "Figma URL -> SwiftUI component generation (full pipeline, Phase 0-8, with SubPhases)"
 allowed-tools: Read, Write, Edit, Glob, Grep, Bash, Agent, WebFetch, TaskCreate, TaskUpdate
 ---
 

package/pipeline/commands/multi-agent/SKILL.md

@@ -131,7 +131,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | Web component task | `$HOME/.claude/multi-agent-refs/web-guide.md` |
 | Phase 1 or Phase 5 (knowledge) | `$HOME/.claude/multi-agent-refs/knowledge.md` |
 | Token lookup needed | `$HOME/.claude/multi-agent-refs/keychain.md` |
-| Audit tools (Phase 5/6) | `$HOME/.claude/multi-agent-refs/audit-guide.md` |
+| Audit tools (Phase 3) | `$HOME/.claude/multi-agent-refs/audit-guide.md` |
 | `test` | `$HOME/.claude/commands/sim-test.md` (colon-form `/multi-agent:test` uses the delegate at `commands/multi-agent/test/SKILL.md`) |
 | `test-dark-mode` · `test-accessibility` · `test-dynamic-type` · `test-screenshots` | `$HOME/.claude/commands/sim-test.md`, scenario pinned by the command name (delegates at `commands/multi-agent/test-*/SKILL.md`) |
 | `manual-test` | `$HOME/.claude/commands/multi-agent/manual-test/SKILL.md` |

package/pipeline/commands/multi-agent/channels/SKILL.md

@@ -288,7 +288,7 @@ Emitted only when `reportContent.workSummary === true` and at least one of (`age
 - 1 accepted · 0 deferred · 0 rejected · approved=true
 
 #### Phases
-- 0 Init [done] · 1 Analysis [done] · 2 Planning [done] · 3 Dev [done] · 4 Review [done] · 5 Test skipped · 6 Commit [done] · 7 Report active
+- 0 Init [done] · 1 Plan [done] · 2 Dev [done] · 3 Review [done] · 4 Commit [done] · 5 Report active
 ```
 
 **Post-hoc invocation** (task already finished, agent-state.json may be archived): pass `--branch` + `--base-branch` explicitly  -  the script still emits task header + changed-files + phases sections (scope + review outcome are state-dependent and will be absent if state is gone).

package/pipeline/commands/multi-agent/diff-explain/SKILL.md

@@ -12,7 +12,7 @@ Maps the Phase 3 triage output (`accepted` / `deferred` / `rejected`) onto the b
 
 ## When to use it
 
-- Between Phase 4 and Phase 5/6: answers "5 findings  -  which one belongs to which file?"
+- Between Phase 4 and Phase 5: answers "5 findings  -  which one belongs to which file?"
 - Phase 5 reporting: a "review summary with code context" block to embed in the Wiki / Confluence output.
 - Post-hoc audit: for a closed PR, a "what did review flag, and how did the code change" diff.
 

package/pipeline/commands/multi-agent/help/SKILL.md

@@ -126,6 +126,7 @@ Post-Hoc & Side-Channel:
   /multi-agent:graph         Build and query the repo code graph (symbols, imports, references), LLM-free
   /multi-agent:search         Cross-task log search with smart ranking; --semantic queries triage corpus
   /multi-agent:scan           Skill security scan against tiered pattern catalog
+  /multi-agent:security-review  Standalone defensive static security review: threat model, OWASP + CWE + CVSS findings, dep inventory. No live target.
   /multi-agent:doctor         Would a run work here? Layout, prefs, credentials, hooks; exit code is the verdict
   /multi-agent:refactor       Best practices + bug hunt + upstream drift + toolkit MCP research -> one plan, approval, dev + sync
   /multi-agent:refactor backlog  Decide the friction already recorded about the pipeline itself, nothing re-derived
@@ -401,6 +402,7 @@ Post-Hoc & Side-Channel:
   /multi-agent:graph         Repo kod grafiğini kur ve sorgula (semboller, import'lar, referanslar), LLM'siz
   /multi-agent:search         Task log'larında akıllı arama; --semantic triage corpus'unu sorgular
   /multi-agent:scan           Skill güvenlik taraması (tiered pattern catalog)
+  /multi-agent:security-review  Bağımsız savunma amaçlı statik güvenlik incelemesi: tehdit modeli, OWASP + CWE + CVSS bulguları, bağımlılık envanteri. Canlı hedef yok.
   /multi-agent:doctor         Burada bir koşu çalışır mı? Yerleşim, prefs, kimlik bilgileri, hook'lar; çıkış kodu kararı verir
   /multi-agent:refactor       Uyarlanmış best-practice + bug avı + upstream-drift + multi-agent-toolkit MCP araştırması -> tek plan, onay, dev + sync
   /multi-agent:refactor backlog  Pipeline'ın kendisi hakkında kaydedilmiş sürtünmeyi karara bağlar, sıfırdan türetmez

package/pipeline/commands/multi-agent/scan/SKILL.md

@@ -66,10 +66,10 @@ Known legitimate domains are embedded in the scanner (github, anthropic, figma,
 
 ## Smoke  -  self-verification
 
-`pipeline/scripts/smoke-skill-scan.sh` confirms the scanner triggers on positive fixtures for every severity and produces no false positives on the real tree. This is a maintainer-repo gate (smoke scripts are excluded from the npm package): it runs from a pipeline checkout and in CI, where it must be 13/13 green before a team rollout.
+`pipeline/scripts/smoke-skill-scan.sh` confirms the scanner triggers on positive fixtures for every severity and produces no false positives on the real tree. This is a maintainer-repo gate (smoke scripts are excluded from the npm package): it runs from a pipeline checkout and in CI, where it must be green before a team rollout.
 
 ## Integration points
 
 - **install.js pre-deploy hook**  -  every `install.js --all` runs an automatic high-threshold warn-only scan
-- **CI**  -  `.github/workflows/smoke.yml` step (strict mode, critical findings block the PR)
+- **Smoke suite**  -  `smoke-skill-scan.sh` runs the scanner in strict mode under `npm test`, so a critical pattern fails the suite
 - **Standalone**  -  `/multi-agent:scan` (this command)

package/pipeline/commands/multi-agent/security-review/SKILL.md

@@ -0,0 +1,52 @@
+---
+description: "Run a standalone defensive, static security review of a diff, a branch or a repo: build a run-scoped threat model, emit reviewer-shaped findings joined to OWASP + CWE with CVSS scoring, evidence and before/after fixes, and inventory dependencies offline. No live target, no payloads. Use when reviewing code for security outside a full pipeline run, auditing a dependency set, or preparing a branch for a security sign-off."
+description-tr: "Bir diff, branch veya repo üzerinde bağımsız, savunma amaçlı statik güvenlik incelemesi koşar: çalışmaya özel tehdit modeli kurar, OWASP + CWE'ye bağlı, CVSS puanlı, kanıtlı ve önce/sonra düzeltmeli reviewer biçiminde bulgular üretir, bağımlılıkları çevrimdışı envanterler. Canlı hedef yok, payload yok."
+argument-hint: "[#N | repo#N | PR-URL | branch | path]  -  optional: a PR, a local branch, or a path to scope the review. If omitted (interactive), reviews the current branch diff against its base."
+---
+
+# multi-agent security-review  -  standalone defensive static review
+
+**Input**: $ARGUMENTS
+
+The same security audit Phase 3 runs at Step 2.7, invoked on its own. Defensive and static: it reads code, configuration and dependency manifests and reports vulnerabilities. It never runs the target, fires a payload, or reaches a live host.
+
+## Scope resolution
+
+Resolve what to review from `$ARGUMENTS`, same input shapes as `/multi-agent:review`:
+
+- `#N` / `repo#N` / a PR URL (GitHub or Bitbucket Server) → that PR's diff.
+- a local branch name → its diff against the base branch.
+- a path → the files under it.
+- omitted (interactive) → the current branch diff against its base; autopilot uses the current branch.
+
+Compute the diff once and cap it the way Phase 3 Step 1.9 does; write the capped diff to `.pipeline/security-diff.txt` when it exceeds the budget.
+
+## Steps
+
+### 1. Threat model
+
+Produce `.pipeline/threat-model.md` if absent (four sections: attacker, trust boundaries, attack surface, severity calibration), or read the existing one. Contract: `$HOME/.claude/multi-agent-refs/threat-model.md`. Mirror to `state.threatModel`.
+
+### 2. Method (the plugin skill)
+
+Load the always-on `ai-common-toolkit:security-review` skill for the method: walk the OWASP checklist (Web/API Top 10 2021 for services and sites, Mobile Top 10 2024 for apps) against the changed surface, join each finding to a CWE, and score it. This command orchestrates; it does not re-derive the method.
+
+### 3. Findings (the security-auditor)
+
+Dispatch `Agent(subagent_type: "security-auditor")` on the capped diff plus the threat model. It returns one `reviewer-output.schema.json` object whose `findings[]` each carry the `security` envelope of `security-finding.schema.json`. Compute every `security.cvss.baseScore` + `band` with the toolkit `security_cvss_score` tool, so a score cannot drift from its vector. Validate the object with `$HOME/.claude/scripts/validate-reviewer.mjs`; on failure, one self-correction rework then halt.
+
+### 4. Dependencies (offline)
+
+Run the toolkit `security_dep_inventory` tool on the lockfiles in scope to get a normalized `{ecosystem, name, version}` inventory. When the analyst toolkit is registered, hand that inventory to `ai-analyst-toolkit:evidence-registry` for a known-CVE lookup; a vulnerable dependency becomes an `A06:2021` finding with the advisory's CWE and CVE. This command contacts nothing itself.
+
+### 5. Report
+
+Write the findings to `.pipeline/security-findings.json` (the reviewer-output object) and render a human summary: count by severity, each blocking and important finding with its OWASP id, CWE, CVSS band, evidence, and before/after fix. An empty findings list with `approved: true` is the correct result for a clean review; do not invent findings.
+
+## Relationship to the pipeline
+
+- Inside a run, the same audit is Phase 3 Step 2.7 (`$HOME/.claude/multi-agent-refs/features/security-audit.md`), triggered by the `security_path` diff-risk signal. This command is the standalone entry point; both share the persona, the schemas and the toolkit tools.
+- This is not the `store-ready` device pass under `/multi-agent:test`, and it is not a secret scanner: the pipeline's `pre-commit-check.sh` already covers secrets.
+- No writes to Jira, GitHub or Confluence: routing findings to a ticket is a separate, approval-gated step.
+
+**Autopilot**: reviews the current branch, writes the report, and never opens a PR or comments.

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -65,7 +65,7 @@ Run every step automatically:
 ```
 Step 0: DOCTOR      doctor.mjs  -  exit 2 or 4 stops the sync
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 57 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 58 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 57 specs as refs + 8 agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
@@ -494,7 +494,7 @@ same 56 specs as reference files rather than as peer skills, via Step 2b -  see
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**57 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**58 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off, autopilot-on,
@@ -502,7 +502,7 @@ autopilot-status, build-optimize, channels, complaint-analysis, create-jira,
 design-check, diff-explain, doctor, feedback, forget, garbage-collect, graph, help,
 ios-coding-standard, issue, jira, kill, language, log,
 manual-test, model, prune-logs, prune-prompts, purge, refactor, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
-routines, save, scan, search, setup, stack, status, steer, store-ready, sync, test,
+routines, save, scan, search, security-review, setup, stack, status, steer, store-ready, sync, test,
 test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
 testflight-validation, uninstall, update
 ```

package/pipeline/multi-agent-refs/component-dispatch.md

@@ -10,7 +10,7 @@
 - [Cross-CLI behaviour (intentional divergence)](#cross-cli-behaviour-intentional-divergence)
 <!-- /toc -->
 
-> **TLDR**  -  When `taskType === "component"` (Figma URL in task description or instruction-driven figma workflow), multi-agent Phase 3 **does not run the TDD loop**. It delegates the entire phase to the enabled `ai-<platform>-toolkit` **marketplace plugin's** component skill (`create-component`, falling back to `create-ui-component`) via the Skill tool. Implementation lives in the plugin; multi-agent's job is classification, dispatch, and state report. The pipeline no longer bundles its own `figma-to-component` orchestrator  -  component skills live in one place, the plugin marketplace.
+> **TLDR**  -  When `taskType === "component"` (Figma URL in task description or instruction-driven figma workflow), multi-agent Phase 2 **does not run the TDD loop**. It delegates the entire phase to the enabled `ai-<platform>-toolkit` **marketplace plugin's** component skill (`create-component`, falling back to `create-ui-component`) via the Skill tool. Implementation lives in the plugin; multi-agent's job is classification, dispatch, and state report. The pipeline no longer bundles its own `figma-to-component` orchestrator  -  component skills live in one place, the plugin marketplace.
 
 This doc is referenced from `$HOME/.claude/multi-agent-refs/phases/phase-2-dev.md`. Keeping it separate lets `phase-2-dev.md` remain tight (it's already the largest phase doc) and gives the orchestrator-report contract a stable URL for both Claude-side and Copilot-side implementations.
 
@@ -83,7 +83,7 @@ Plugin skills are user-facing lifecycle skills; they do **not** accept an `agent
 
 ## Subphase contract (dispatch-layer owned)
 
-Because the plugin skill does not write pipeline state, **multi-agent's dispatch layer owns `state.phases["3"].subphases[]`**, not the skill. On dispatch, seed one coarse component-build subphase; on return, finalize it:
+Because the plugin skill does not write pipeline state, **multi-agent's dispatch layer owns `state.phases["2"].subphases[]`**, not the skill. On dispatch, seed one coarse component-build subphase; on return, finalize it:
 
 ```json
 {
@@ -113,8 +113,8 @@ Multi-agent does **not** split the component task into per-repo Phase 2 runs  -
 
 On failure (the plugin skill returns an unrecoverable build/test error, or the dispatch hits retry cap):
 
-1. The dispatch layer persists `{error, buildLog, testLog}` to `state.phases["3"].errors[]`.
-2. Multi-agent increments `state.phases["3"].retryCount`.
+1. The dispatch layer persists `{error, buildLog, testLog}` to `state.phases["2"].errors[]`.
+2. Multi-agent increments `state.phases["2"].retryCount`.
 3. Retry re-invokes the plugin skill (it is idempotent on an existing component; it reconciles rather than duplicating). There is no bundled `phase-<N>` resume anymore.
 4. Hard kill at `retryCount === 3` → surface the errors to the user, halt Phase 2. Do not loop indefinitely.
 
@@ -125,4 +125,4 @@ Component dispatch is **no longer byte-identical across CLIs** and that is by de
 - **Claude Code**: dispatches to the enabled `ai-<platform>-toolkit` marketplace plugin via the Skill tool (this doc).
 - **Copilot CLI**: has no plugin loader; it continues to use its standalone `~/.copilot/skills/figma-*` skill copies (frozen fallback). Copilot's resolution + progress lines follow those local skills.
 
-What still MUST match across CLIs: the `taskType === "component"` classification, the `state.phases["3"].subphases[]` shape the dispatch layer writes, and the Short-run elision semantics. Figma-skill *inventory* parity is no longer enforced. `smoke-cross-cli-behavior.sh` asserts only the classification + state-shape axis for components.
+What still MUST match across CLIs: the `taskType === "component"` classification, the `state.phases["2"].subphases[]` shape the dispatch layer writes, and the Short-run elision semantics. Figma-skill *inventory* parity is no longer enforced. `smoke-cross-cli-behavior.sh` asserts only the classification + state-shape axis for components.

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -1,7 +1,7 @@
 # Cross-CLI Contract (Claude Code · Copilot CLI · Codex CLI)
 
 <!-- toc -->
-- [1. Command Inventory (57 commands)](#1-command-inventory-57-commands)
+- [1. Command Inventory (58 commands)](#1-command-inventory-58-commands)
 - [2. Canonical Placeholder Vocabulary](#2-canonical-placeholder-vocabulary)
 - [2.6 Intentional structural divergence  -  thin dispatcher vs inlined orchestrator](#26-intentional-structural-divergence---thin-dispatcher-vs-inlined-orchestrator)
 - [2.7 One command, three different meanings: `/multi-agent:model`](#27-one-command-three-different-meanings-multi-agentmodel)
@@ -20,7 +20,7 @@
 
 ---
 
-## 1. Command Inventory (57 commands)
+## 1. Command Inventory (58 commands)
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
@@ -31,7 +31,7 @@ language, log, manual-test, model, prune-logs,
 prune-prompts, purge, refactor, resume, review,
 review-analysis, review-issue, review-jira, route-off, route-on,
 route-status, routines, save, scan, search,
-setup, stack, status, steer, store-ready, sync, test, test-accessibility,
+security-review, setup, stack, status, steer, store-ready, sync, test, test-accessibility,
 test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation,
 uninstall, update
 ```
@@ -86,7 +86,7 @@ Three rules make that work:
 > absent, and a component task on Copilot had nothing to dispatch to. The contract
 > documented a safety net the installer deleted.
 
-What still MUST match across CLIs for component tasks: the `taskType === "component"` classification, the `state.phases["3"].subphases[]` shape the dispatch layer writes, and the Short-run elision semantics. Resolution/routing is Claude-plugin vs Copilot-local-copy by design.
+What still MUST match across CLIs for component tasks: the `taskType === "component"` classification, the `state.phases["2"].subphases[]` shape the dispatch layer writes, and the Short-run elision semantics. Resolution/routing is Claude-plugin vs Copilot-local-copy by design.
 
 ### 1.2 Store-compliance skills
 
@@ -97,7 +97,7 @@ Two parallel shared/core skills under `pipeline/skills/shared/core/` wrap extern
 | `apple-archive-compliance` | `pipeline/skills/shared/core/apple-archive-compliance/` | `ios_app_store_audit` MCP tool (in `@mmerterden/multi-agent-toolkit-mcp` ≥ v3.0.0) | 18 (Apple ITMS + App Store Review Guidelines) |
 | `google-play-compliance` | `pipeline/skills/shared/core/google-play-compliance/` | bundletool + aapt2 + apksigner | 21 (4 categories: Technical / Security / Privacy / Hygiene) |
 
-Both skills are wired to 4 consumers: `/multi-agent:test "store-ready"` (primary), Phase 4 Security Auditor (`pipeline/agents/security-auditor.md`), `/multi-agent:review` + SKILL.md counterpart, `/multi-agent:channels` PR-body auto-augmentation. Contract enforced by `smoke-compliance-skills.sh`.
+Both skills are wired to 4 consumers: `/multi-agent:test "store-ready"` (primary), Phase 3 Security Auditor (`pipeline/agents/security-auditor.md`), `/multi-agent:review` + SKILL.md counterpart, `/multi-agent:channels` PR-body auto-augmentation. Contract enforced by `smoke-compliance-skills.sh`.
 
 ### 1.3 Figma-skill routing from multi-agent (superseded)
 
@@ -222,7 +222,7 @@ Phase 3 runs three reviewers everywhere, but the diversity those three buy is no
 same on every host. Copilot CLI gets cross-VENDOR disagreement for free: GPT-5.4 sits
 beside two Claude models. Claude Code and Codex each run a one-vendor panel - three
 Anthropic models on one, three OpenAI models on the other - so the same three-way
-agreement is weaker evidence there, and Phase 4 says so in the triage note on a
+agreement is weaker evidence there, and Phase 3 says so in the triage note on a
 borderline finding.
 
 Where the budget goes instead, when vendor diversity is unavailable:

package/pipeline/multi-agent-refs/features/security-audit.md

@@ -0,0 +1,55 @@
+# Security audit (Phase 3 Step 2.7)
+
+The mechanics of the conditional security audit that runs inside the Phase 3 review window and merges at Step 3.0. The phase doc carries the trigger and the merge; the rest is here.
+
+## Trigger (deterministic, no new classifier)
+
+Run the audit when any of these holds:
+
+- Step 1.75 scored `security_path` on a file in the diff (the same signal that already forces `full` review at Step 1.77).
+- The base branch is a release branch.
+- The run is the standalone `/multi-agent:security-review` command, which dispatches straight to this step.
+
+There is no `--audit` flag: the trigger is the diff, not a word the user has to remember. When none of these holds, the audit does not run, `$SECURITY_AUDIT_JSON` stays empty, and the Step 3.0 merge is a no-op.
+
+## Threat model first
+
+The auditor reads `.pipeline/threat-model.md` if Phase 1 or a prior step wrote it, and produces it (four sections) if absent. Contract: `$HOME/.claude/multi-agent-refs/threat-model.md`. It is keyed to repo+branch and mirrored to `state.threatModel` so a resume reuses it rather than re-deriving it.
+
+## Dispatch
+
+One `Agent(subagent_type: "security-auditor")` on the same capped diff the reviewers saw, plus the threat model and the resolved `${CRITERIA}` block:
+
+```
+Agent(subagent_type: "security-auditor", prompt: "<threat-model + capped diff + ${CRITERIA}>")
+```
+
+Persona contract: `~/.claude/agents/security-auditor.md`.
+
+## Output is reviewer-shaped, and that is the point
+
+The auditor returns one object conforming to `$HOME/.claude/schemas/reviewer-output.schema.json`, whose `findings[]` each carry the `security` envelope of `security-finding.schema.json`: OWASP category, CWE, CVSS vector + band, evidence, counterevidence, confidence, remediation, and the before/after fix. Severity is the reviewer enum, derived from the CVSS band:
+
+| CVSS band | severity |
+| --------- | -------- |
+| critical / high | blocking |
+| medium | important |
+| low / none | suggestion |
+
+Compute `security.cvss.baseScore` + `band` with the toolkit `security_cvss_score` tool, not by hand, so the score cannot drift from the vector.
+
+## Validate, persist, merge
+
+Validate with the same gate protocol as a reviewer  -  the exit code decides, not the LLM turn:
+
+```bash
+printf '%s' "$SECURITY_AUDIT_JSON" | node "$HOME/.claude/scripts/validate-reviewer.mjs" -
+```
+
+On validator failure: one self-correction rework, then HALT the phase (identical to the reviewer output-contract gate). Persist the object to `state.reviewIterations[<iteration>].securityAudit` and hold it in `$SECURITY_AUDIT_JSON`.
+
+Because the output is reviewer-shaped, the Step 3.0 merge appends its `findings[]` alongside the test-integrity findings. A `blocking` security finding then reaches triage, and a triage-accepted blocker blocks Phase 4  -  the "critical security items block the commit" contract is wired here, not merely stated.
+
+## Store-compliance cross-reference
+
+On store-relevant diffs the auditor also cites the Apple ITMS / Google Play catalog rule on the finding via `ruleId` + `criteriaSource` (`apple-archive-compliance` / `google-play-compliance`). This is annotation on the same finding, not a second pass; the device-level `store-ready` Gate under `/multi-agent:test` stays separate.

package/pipeline/multi-agent-refs/phases/modes.md

@@ -58,7 +58,7 @@ The generic "zero-interaction" contract covers Phases 0-4 only. Phase 5 channels
 - **30-minute timeout**  -  if user does not respond, session ends cleanly:
   - External delivery aborted (no silent apply  -  prevents accidental Jira comments / Confluence pages).
   - Internal capture (`agent-log.md`, telemetry, knowledge base) STILL runs.
-  - State persisted as `{phase: 7, waitingFor: "user-channels-choice", channelsTimeout: true}`.
+  - State persisted as `{phase: 5, waitingFor: "user-channels-choice", channelsTimeout: true}`.
   - Resume: `/multi-agent:resume <task-id>` re-opens menu with same inputs.
 - Post-hoc `/multi-agent:channels <task>` never times out  -  user invoked it explicitly.
 

package/pipeline/multi-agent-refs/phases/phase-3-review.md

@@ -260,7 +260,7 @@ Each reviewer inherits the `code-reviewer` agent's focus areas (Security, Archit
 | Python | `ai-backend-toolkit:api-security-best-practices` | `ai-backend-toolkit:fastapi-pro` | `ai-backend-toolkit:python-patterns` |
 | Node.js | `ai-backend-toolkit:api-security-best-practices` | `ai-backend-toolkit:nodejs-backend-patterns` | `ai-frontend-toolkit:typescript-patterns` |
 | Docker | `ai-backend-toolkit:docker-expert` | `ai-backend-toolkit:docker-expert` | `ai-backend-toolkit:ci-cd-pipelines` |
-| Generic | `security-review` | `ai-backend-toolkit:clean-code` | `ai-backend-toolkit:clean-code` |
+| Generic | `ai-common-toolkit:security-review` | `ai-backend-toolkit:clean-code` | `ai-backend-toolkit:clean-code` |
 
 ##### 2.1 Previous-round findings (iteration >= 2) and 2.2 scope self-check (every iteration)
 
@@ -298,6 +298,10 @@ Skip only when the diff has no UI change. Record the outcome in
 
 Step 2 produces N reviewer-output objects (one per dispatched reviewer), each conforming to `$HOME/.claude/schemas/reviewer-output.schema.json`. They are persisted to `state.reviewIterations[<iteration>].reviewers[]` and consumed by Step 3 (Fable triage)  -  never by Phase 4 directly. The triage step (below) is the producer of the only review artifact Phase 4 reads, conforming to `$HOME/.claude/schemas/triage-output.schema.json`.
 
+#### Step 2.7  -  Security audit (conditional, produces reviewer-shaped findings)
+
+Runs when Step 1.75 scored `security_path`, on a release branch, or when `/multi-agent:security-review` dispatches here. The `security-auditor` returns reviewer `findings[]`, each with a `security` envelope (`security-finding.schema.json`) and severity from the CVSS band, held in `$SECURITY_AUDIT_JSON` for the merge so a `blocking` one reaches triage and blocks Phase 4. Mechanics: `~/.claude/multi-agent-refs/features/security-audit.md`.
+
 **Subagent return format**  -  each reviewer returns JSON conforming to `$HOME/.claude/schemas/reviewer-output.schema.json`:
 
 ```json
@@ -371,14 +375,14 @@ ANON=$(jq -n --argjson r "$REVIEWERS_JSON" --arg t "$TASK_ID" --argjson i "$ITER
 
 `$REVIEWERS_JSON` is `state.reviewIterations[i].reviewers`. Findings come back with `foundBy: "Source A|B|C"` and every identity key removed. Persist the map to `state.reviewIterations[i].anonymizationMap` for Phase 5 per-reviewer telemetry, and **never put the map in a prompt**.
 
-Then append the Step 1.76 test-integrity findings, so they are adjudicated rather than never seen:
+Then append the Step 1.76 test-integrity and Step 2.7 security-audit findings, so they are adjudicated rather than never seen:
 
 ```bash
-MERGED=$(jq -s '.[0] + (.[1].findings // [])' \
-  <(printf '%s' "$ANON") <(printf '%s' "${TEST_INTEGRITY_JSON:-{\}}"))
+MERGED=$(jq -s '.[0] + (.[1].findings // []) + (.[2].findings // [])' \
+  <(printf '%s' "$ANON") <(printf '%s' "${TEST_INTEGRITY_JSON:-{\}}") <(printf '%s' "${SECURITY_AUDIT_JSON:-{\}}"))
 ```
 
-Deterministic findings keep `tag: test_integrity` and carry no `foundBy`: a reviewer finding may be a hallucination, a gate finding is a fact.
+Deterministic findings keep `tag: test_integrity` and no `foundBy`: a reviewer finding may hallucinate, a gate finding is a fact. Security-audit findings carry their `security` envelope and `foundBy: "security-auditor"`; an empty `$SECURITY_AUDIT_JSON` contributes nothing.
 
 ##### 3.1 Short-circuit: no findings
 
@@ -788,16 +792,6 @@ Results included in Phase 5 report. MCP tools preferred when available  -  conci
 
 **Snapshot regression flow (optional):** when the task changes a stable component, capture a screenshot before the change (baseline) and after (current), then call `ios_visual_diff({baseline, current, max_diff_pct: 1.0})`. Threshold can be relaxed for animated / non-deterministic regions  -  keep `max_diff_pct ≤ 1.0` for static layouts.
 
-#### Security Audit (store-readiness)
-
-When the task touches authentication, keychain, network, or is scheduled for an imminent release, launch the `security-auditor` subagent to run an OWASP Mobile Top 10 pass plus App Store / Play Store compliance checks:
-
-```
-Agent(subagent_type: "security-auditor", prompt: "<diff + context>")
-```
-
-Returns severity-tagged findings (Critical / High / Medium). Critical items block Phase 4 just like Phase 3 blockers; High items are logged and surfaced in Phase 5 report. Skipped by default  -  opt-in for release branches or on explicit `/multi-agent "<task>" --audit` flag.
-
 #### Telemetry  -  token forwarding
 
 When the security-auditor or any other Phase 3 sub-agent runs, forward its token totals so Phase 5's Cost Breakdown captures Phase 3:

package/pipeline/multi-agent-refs/phases/phase-5-report.md

@@ -25,7 +25,7 @@ On entry: `phase-tracker.sh sub 5 <N> "<name>" in_progress`. On exit: `completed
 Phase 5 is the single exception to the autopilot zero-interaction rule: every mode, Full or Short, attended or autopilot, pauses at the channels multi-select menu. Full contract in `$HOME/.claude/multi-agent-refs/phases/modes.md`:
 
 - **30-min timeout**  -  if user does not respond, session ends cleanly. External delivery is aborted (no silent apply of defaults  -  prevents accidental Jira comments / Confluence pages). Internal capture (Steps 2 + 3 below) STILL runs so `agent-log.md` + knowledge base are persisted.
-- **Resumable**  -  state written as `{status: "awaiting_input", phase: 7, waitingFor: "user-channels-choice", channelsInput: <state-bundle>}`. User can `/multi-agent:resume <task-id>` any time later; channels menu re-opens with same inputs.
+- **Resumable**  -  state written as `{status: "awaiting_input", phase: 5, waitingFor: "user-channels-choice", channelsInput: <state-bundle>}`. User can `/multi-agent:resume <task-id>` any time later; channels menu re-opens with same inputs.
 - **Timeout log line:** `Phase 5: channels menu timeout (30 min)  -  session ended, resume with /multi-agent:resume {taskId}`.
 
 ---

package/pipeline/multi-agent-refs/threat-model.md

@@ -0,0 +1,39 @@
+# Threat model contract
+
+The run-scoped threat model is the frame every security finding is calibrated against. It is produced by the security-auditor at Phase 3 Step 2.7 (or by `/multi-agent:security-review` running standalone), read by any later step that revisits security, and mirrored to `state.threatModel.path` so a resume re-uses it instead of re-deriving it.
+
+## Where it lives
+
+`.pipeline/threat-model.md` in the run's worktree, keyed to repo + branch. One per run. If a fresh one already exists for this repo+branch (a prior step or a Phase 1 pass wrote it), read it; do not overwrite. If it is absent, produce it before emitting any finding.
+
+Mirror the resolved path and a content hash to `state.threatModel = { path, sha, producedAt, producedBy }` so resume and Phase 5 can find it without re-reading the tree.
+
+## The four sections (all required, in order)
+
+A threat model with a missing section is not a threat model; the auditor treats a missing section as "produce it," not "skip it."
+
+### 1. Attacker
+
+The one realistic adversary for THIS change. Name it concretely: an unauthenticated internet caller, an authenticated low-privilege user, a malicious or compromised dependency, a co-located app on the device, a user with physical access. Not "attackers" in the abstract - the specific actor whose capability makes this diff interesting. If the diff has no plausible attacker, say so; that is a valid, short threat model and most findings then cap at `suggestion`.
+
+### 2. Trust boundaries
+
+Where untrusted data crosses into trusted code within the changed surface: a request body or query parameter, a deep link or universal link, a WebView `postMessage`, a file the app did not write, an environment variable an attacker can set, a response from a third-party service treated as safe. List the boundaries the diff touches, each with the `file:line` where the crossing happens.
+
+### 3. Attack surface
+
+What this diff actually added or touched: a new endpoint, a new query or ORM call, a new deserialization, a new permission, a new dependency, a new crypto usage, a new storage write. A finding outside this surface is out of scope unless the diff made it reachable - and if it did, say how. This section is what keeps the audit anchored to the change instead of drifting into a whole-repo review.
+
+### 4. Severity calibration
+
+The assumption each severity rests on, stated so a reader disputes the assumption rather than the number. "Critical assumes this route is unauthenticated in production; if it is admin-only the same finding is medium." "High assumes the secret reaches a log that ships off-device." Every `blocking` finding must trace to an assumption named here; a blocker resting on an unstated assumption is miscalibrated.
+
+## Shape
+
+Plain Markdown, four `##` sections with those names, human-readable. It is evidence for a person and context for the auditor, not a machine artifact - no schema. Keep it short: a page, not a report. Cite `file:line` where a boundary or surface item has one.
+
+## What it is not
+
+- Not a whole-repo model. It is scoped to the diff under review.
+- Not a dynamic test plan. This is a static, read-only posture: no live target, no payloads, no exploitation. `fixVerification` on a finding names the empirical check a human or a later dynamic pass would run; the threat model does not run it.
+- Not embedded in the analysis document. The security-review command must run standalone, so the model lives in its own file and is produced on demand.