@mmerterden/multi-agent-pipeline 20.12.0 → 20.15.0

package/CHANGELOG.md

@@ -16,6 +16,103 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.15.0] - 2026-10-02
+
+### Added
+
+- `phase-tracker.sh task <phase> <taskId> <status> [--subject S] [--active-form A]` records one entry of the host's native task list under the phase it belongs to (pending, in_progress, completed), so a reader that is not the host sees the same list. The tracker contract asks for one `task` call per `TaskCreate` / `TaskUpdate`, `update_plan` step or card row, on every host.
+
+- `runs-index.mjs` 1.2.0: each run carries `runType`, `title`, `progress` and `currentTask`, and each phase `progress` and `tasks[]`, so a client shows how far a run is and what it is doing without reading tracker files. The index reads the unattended log root (`~/.multi-agent-unattended/logs`) beside `LOGS_ROOT`, one record per task id, so a run launched in the background is listed. Each run also carries `processAlive`, from `claude agents --json` through `lib/claude-sessions.mjs`, which the autopilot runner, `run-kill.mjs` and the index now share. Phase 0 records the fetched issue title as `agent-state.json` `title`.
+
+- Launch request `mode: background` with `kind: development | analysis`: an unattended run of `/multi-agent` (without autopilot) or `/multi-agent:analysis`, in the same background shape as autopilot (`launch.json` `hosts.claude.background`). A picker the request did not answer parks the run on a `pendingQuestion` (`picker-contract.md`, Background) instead of being defaulted, and a background run never takes `workspace: local`. `launch.json` `hosts.claude.resume` and `launch-request.mjs` `planResume` give the background shape of `/multi-agent:resume <taskId>`.
+- `gate-ledger.mjs park --waiting-for question --question-file <path>` parks a run on a question from the command line; the question is held to the shape a client answers before anything is written.
+
+- `run-kill.mjs preview|apply <taskId>`: what a kill touches (worktree, branch, size, uncommitted files, commits on no remote, whether the session is alive), and the kill itself: `claude stop` for a live session, `git worktree remove --force` for a linked worktree inside its repository, the local branch deleted unless it is the base, the main checkout's branch or main / master / develop, and the run marked `abandoned` with `abandonedBy: "kill"`. `/multi-agent:kill` runs it.
+
+- `gc-tmp.sh`, `gc-refs.sh` and `gc-worktrees.sh` take `--report <file>` (one JSON line per candidate, as `gc-abandoned.sh` writes) and `--only <file>` (only the listed paths), through `lib/gc-report.sh`. `gc-plan.mjs preview` runs all four collectors as dry runs and lists every candidate as `{kind, path, sizeKb, reason}`; `gc-plan.mjs apply` runs each with `--yes --only` over exactly those paths, so nothing the preview did not show is removed.
+
+- `autopilot-control.mjs status | off [--now]`: continuous mode's status document with its contract version, and the off switch `/multi-agent:autopilot-off` describes (schedule and awake agent removed, a stale sleep lock released, the selection kept; with `--now` the in-flight item's session stopped and its run marked `abandoned` with `abandonedBy: "autopilot-off"`, its worktree stashed when it holds work and removed when clean).
+
+- Contract server routes (contract 1.3.0): `GET /v1/repos` (`launch-request.mjs repos`: the configured and registered repositories a launch may name), `GET /v1/runs/{id}/log`, `POST /v1/runs/{id}/resume`, `POST /v1/runs/{id}/kill`, `POST /v1/gc`, `GET /v1/autopilot` and `POST /v1/autopilot/off`, each a call into the script the CLI runs. Kill and gc take a preview request and a confirming one; the confirm token is random, single use, valid for 120 seconds, bound to the route and run, and held only in the server's memory. New error codes: `run-active`, `not-resumable`, `confirm-expired`, `confirm-mismatch`.
+
+### Changed
+
+- `/multi-agent:kill` keeps the remote branch and the run's logs, and no longer offers to delete the remote branch. A remote branch is deleted on the host, by hand, when that is wanted.
+- `/multi-agent:analysis` states the background rule: a run launched in the background never asks or defaults a picker, it parks on the question (`picker-contract.md`, Background).
+- `/multi-agent:autopilot-off` runs `autopilot-control.mjs off [--now]`, the script `POST /v1/autopilot/off` runs, instead of its own launchctl, awake-agent and indicator steps.
+- The plan's steps attach to Dev (phase 2), the phase that executes them: Phase 1 calls `phase-tracker.sh plan 2`, and Phase 2 moves each step with `sub 2 <task_id>` as it starts and finishes it. `smoke-phase-contract.sh` holds both calls to the Dev id in `phases.json`.
+
+### Fixed
+
+- Every background launch passes its prompt as claude's positional argument instead of `-p`, because `claude --bg` refuses `--print`; this covers the autopilot runner's launch, research and resume children and every plan from `launch.json`. The research child's `--disallowedTools` list now sits before another flag, so its variadic value cannot take the prompt.
+- `POST /v1/launch` and `POST /v1/runs/{id}/resume` answer `409 unattended-profile-missing`, with a `remedy` naming the install command, when `~/.claude/multi-agent-unattended.settings.json` is absent, instead of returning a plan whose session stops at its first tool call. They answer `409 workspace-not-trusted` when Claude Code's config (`~/.claude.json` `projects[<repo root>].hasTrustDialogAccepted`) records the repository as not trusted, read through `lib/workspace-trust.mjs`, which never writes it; a config that cannot be read lets the launch proceed.
+- `runs-index.mjs` reads a phase's `now` from `meta.Now`, where `phase-tracker.sh now` writes it, so the live line reaches the index and every client.
+
+## [20.14.0] - 2026-10-02
+
+### Added
+
+- `/multi-agent:scenario-audit <scenarios.csv>` checks test scenarios against the code: `scenario-audit.mjs` reads the CSV (comma or semicolon, quoted cells, matched by header), searches HEAD for the code-level terms proposed per scenario, and holds each verdict to its evidence. PRESENT and PARTIAL need a `file:line` that resolves at HEAD and ABSENT needs the searched terms; anything else becomes UNCLEAR with the reason. Read-only; Turkish labels VAR / KISMEN / YOK / BELİRSİZ.
+- `/multi-agent:analysis check <doc>` and `refresh <doc>`. `analysis-sources.mjs fingerprint` records each source's version and a hash of the part the document uses (the Figma node, the page body, the operations of the cited endpoints) and writes `<doc>.sources.json` beside the document; `check` compares and gives each source `unchanged`, `no-effect`, `update-doc`, `retest` or `unchecked`, and resolves the document's citations at HEAD. `refresh` redrafts from the stale sources into a new draft with a changelog row; replacing the document is a separate approval.
+- Section 21 shows the Figma file version and date beside the node id. `analysisSpec.sourceVersions`, Figma `version` / `lastModified` and Confluence `version` are part of the schema.
+- `pipeline/lib/credential-resolve.mjs`: one token resolution (credential store, then an environment variable) for Node scripts; `confluence-readback.mjs` uses it.
+- `profile: custom` (Locked 37): an analysis laid out in a team's own outline (`outline: <path>`, copied beside the document). Its headings are the required sections; the universal validator checks still run and every template-specific check reports `skipped: custom profile`. Intake offers it as a third profile; `prefs.global.analysisProfiles` accepts `custom`.
+- `/multi-agent:analysis conform <doc>` maps an existing document onto a template without changing what it says; unmapped content goes to an appendix and uncovered sections become Section 20 rows. `analysis-conform-coverage.mjs` checks that every source sentence of three words or more is still in the draft, whatever markup it moved into.
+- `/multi-agent:estimate <doc|text>` gives an effort range from similar closed Jira work: `estimate.mjs` reads the finished issues a `statusCategory = Done` query names, their role sub-tasks and logged time, and reports P25-P75, the median and the issues behind each row. No number below three samples; story points come from the field the site names "Story Points".
+
+### Changed
+
+- `/multi-agent:help` reads one catalog, `multi-agent-refs/help/en.md` or `help/tr.md`, for the user's language instead of carrying both; the command file drops from about 8,500 tokens to about 300.
+- `sync` moves its Codex, stack-plugin and dev-toolkit steps to `multi-agent-refs/sync/`, read when that step runs (about 7,500 to 3,800 tokens). `setup` moves the Token Save Flow with its host prompt, credential discovery, identity routing and Figma MCP setup to `multi-agent-refs/setup/` (about 11,400 to 6,500). `channels` moves the Board adapter and the multi-repo dispatch table to `multi-agent-refs/channels/` (about 9,500 to 8,400). The token ceilings in `lint-skills.mjs` move down with them.
+- `channels`, `design-check`, `setup`, `store-ready` and `sync` carry a `## Gotchas` section near the top.
+- `status` and `diff-explain` run as a forked read-only Explore context (`context: fork`), so their reads stay out of the calling conversation.
+- `design-check` (about 8,000 to 5,000 tokens), `store-ready` (6,000 to 4,400), `refactor` (5,750 to 4,300) and `analysis` (5,600 to 4,400) move their long procedures into `multi-agent-refs/{design-check,store-ready,refactor,analysis}/`, read at the step that needs them; every binding rule stays in the command. The Copilot orchestrator skill drops from 713 lines and about 9,150 tokens to 313 lines and 4,850, with its operations, skill loading and per-project phase blocks in `multi-agent-refs/orchestrator/`. The grace entries for `design-check` and the orchestrator are gone.
+- The Copilot `multi-agent-setup` skill carries every step of the Claude command and points at the same `setup/` refs.
+- `smoke-context-budget.sh` counts the analysis command file together with the refs it names, so moving text from the command into one of its refs leaves the per-run total unchanged.
+
+### Fixed
+
+- Copilot skills name `$HOME/.claude/multi-agent-refs/...`, where the refs are installed, instead of `~/.copilot/multi-agent-refs/`, which no install creates (`review`, `review-jira`, `review-issue`, `review-analysis`, `design-check`, `store-ready`). `test/copilot-ref-paths.test.mjs` holds the rule.
+- The Copilot `design-check` skill offers the snapshot lane before halting on a module without mock mode, as the command does.
+- The Copilot orchestrator's kill keeps the task logs and reads the task counter from the shared log root, as `phases/operations.md` specifies; an autopilot blocking finding returns to Phase 2.
+- `estimate` cites the picker contract.
+
+## [20.13.0] - 2026-10-01
+
+### Added
+
+- Every destructive command (`kill`, `forget`, `garbage-collect`, `prune-logs`, `prune-prompts`, `autopilot-off`, alongside `purge` and `uninstall`) carries `disable-model-invocation: true`, so it runs only when the user types it. Confirm-only commands such as `sync` stay model-invocable. `test/command-contract.test.mjs` holds the rule, and `cross-cli-contract.md` records it with the decision to keep command-only frontmatter keys at the top level.
+- `lint-skills.mjs` requires a routing clause ("use when ...") in every command description, as it already did for skills, and warns when a command on its Gotchas list has no `## Gotchas` section.
+- `## Gotchas` sections near the top of `analysis`, `analysis-jira`, `autopilot`, `doctor`, `review` and `review-analysis`, mirrored into their Copilot skills.
+- `validate-analysis-doc.mjs` warns on vague wording (`fast`, `appropriately`, `etc.`, `gerektiğinde`, `vb.` and similar) in id-bearing requirement rows (`BR-`, `IG-`, `FG-`); `--strict` turns it into a failure. Code spans and summary prose are not read.
+- `smoke-personal-data.sh` also reads a machine-local pattern list (`~/.claude/personal-data-patterns.txt`, or `MA_PERSONAL_DATA_PATTERNS`), so names that must never ship are guarded without being written into the shipped tree.
+- `pipeline/lib/analysis-sections.mjs` holds the section and table-row readers the validator uses, plus the per-profile location of the redesign artefacts.
+- `argument-hint` on the root `/multi-agent` command and on the Copilot `multi-agent-setup` skill.
+- `/multi-agent:analysis-jira` writes a full story description built from the document: the user story, up to 8 acceptance criteria (the G/W/T column or the rule; functional requirements plus alternative and exception flows on the corporate profile), redesign rows for the story's section, and links to the analysis page, the design and the API spec. Missing parts become body warnings and are never filled in. The preview shows every body in full; `--brief` keeps the one-line view.
+- `escapeJiraWiki()` and `wikiLink()` in `jira-wiki-escape.mjs`: document text is escaped before it reaches wiki markup, and links accept http and https only.
+- `--epic KEY` links the stories to an existing epic: `parent` on Cloud, the discovered Epic Link field on Server and Data Center (`issueTree.epicLinkMode`, `issueTree.epicLinkFieldId`). With no field found, the stories are created unlinked and the writer warns.
+- `issueTree.cloneByChannel` creates one linked clone per channel in `channelComponents`, with its own label and component; `cloneLinkType` names the link.
+- `analysis-tickets-writeback.mjs` writes a `## Tickets` table (story, key, sources, channel) into the analysis document between markers, idempotently; updating the Confluence page is a separate approval.
+- `analysis-story-tree.mjs --page-url URL` links the published analysis page from every story.
+- `validate-analysis-doc.mjs` gains six document-quality checks, in `pipeline/lib/analysis-quality.mjs`: `exception-flow` (a corporate use case with a main flow states its exception flow; missing warns on a draft and fails a final document, `Yok: <reason>` is an accepted answer), `scope-overlap` (an item both goal and non-goal fails), `cited-undefined` (a `BR`/`CB`/`IG`/`UC`/`FG` id the text cites but no table row or heading defines fails), `design-frame-unmapped` (a Figma frame outside every corporate use case warns), `business-layer-technical` (a file path or endpoint in global Part A warns; `<details>` blocks and redesign evidence tables are not read) and `missing-inputs` (a final document with a non-empty missing-inputs panel warns).
+- `build-references.mjs --missing-panel` prints the sources the run could not read as the panel at the top of the document; the render places it above Section 1.
+- `confluence-readback.mjs` reads a published page back and reports each document heading missing from the page and each embedded image that is not attached. The analysis render runs it after every publish and reports a mismatch without republishing.
+- Draft pages carry `[TASLAK]` / `[DRAFT]` in their title until the document is final; the corporate `titleFormat` accepts a `{status}` placeholder.
+- The corporate use-case table has an `İstisna Akışı / Exception Flow` row, the traceability matrix gains `Ekran` and `Test` columns, and Section 20 gains `Kategori` and `Karar` columns with one row per question. Multi-service use cases also get a sequence diagram.
+- Synthesis proposes edge-case candidates from the evidence (`state.analysisSpec.edgeCandidates[]`); only accepted ones enter the document. The global API request body shows types instead of sample values and names each field's source, and the document head carries an "at a glance" line of counts.
+- The analysis review verdict ends with `Publish ready`, an ordered `Fix first` list and a `Verified OK` line.
+
+### Fixed
+
+- The corporate profile has a layout for redesign documents: `2.1.1` current behaviour, `2.3.1` difference list and `5.(N+4).1` endpoint mapping, and the validator looks the artefacts up by profile. A corporate document with `redesign: true` previously had no sections the validator would accept.
+- The analysis refs agree with each other: 36 Locked decisions everywhere (the command and `resolve.md` said 35 and 31); section numbers are canonical and keep gaps everywhere (the command and `render.md` said numbering re-flows); the `review.md` verdict example uses the rubric's own class names. `test/analysis-refs-consistency.test.mjs` keeps them aligned.
+- The global Section 20 table carries an `ID` column with `AS-NN` values, which the closure gate pairs on.
+- `feedback` and `review-analysis` descriptions say when to use them.
+- The analysis-jira writer searches for clone labels before creating, so a re-run with `cloneByChannel` no longer creates the clones again. A node found on the site is recorded in the ledger as `exists`.
+- Codex receives stack-plugin skills with their `$HOME/.claude/...` paths retargeted, like the pipeline's own skills.
+- The analysis render resolves `CONFLUENCE_BASE_URL` from `prefs.global.hosts.confluence` before publishing.
+- No analysis file says section numbers re-flow: the global template's omission rule, `synthesis.md`, `analysis-resolve` and the validator all state canonical numbers with gaps, and the consistency test also matches "re-flowed".
+
 ## [20.12.0] - 2026-10-01
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ Runs natively on Claude Code, Copilot CLI and Codex CLI. macOS only. Zero runtim
 ### Prerequisites
 
 - **Node.js >= 20.11** - required; the pipeline's own tooling runs on it.
-- **`jq`** - required for nine paths, optional for the rest. 89 shell files call it. The nine that publish or decide - the autopilot queue, Jira comments, PR reviews, issue updates, the plan file, both Figma fetchers, log search and Jira auth - refuse with exit 3 rather than run, because a missing `jq` renders as empty DATA and the work carries on with it. Everywhere else it still degrades. The install prints a note when it is missing.
+- **`jq`** - required for nine paths, optional for the rest. 91 shell files call it. The nine that publish or decide - the autopilot queue, Jira comments, PR reviews, issue updates, the plan file, both Figma fetchers, log search and Jira auth - refuse with exit 3 rather than run, because a missing `jq` renders as empty DATA and the work carries on with it. Everywhere else it still degrades. The install prints a note when it is missing.
 - **`gh`** - for GitHub issue and PR work. Its built-in `--jq` is independent of the `jq` binary.
 
 ## Quick Start
@@ -158,7 +158,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 61 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 63 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -191,6 +191,8 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 | `/multi-agent:review-issue`        | Same grading for a GitHub issue                                                             |
 | `/multi-agent:review-analysis`     | Review a written analysis document; findings cite the Locked rule they break                |
 | `/multi-agent:diff-explain`        | Map a Phase 3 triage finding back to the diff lines that caused it                          |
+| `/multi-agent:estimate`            | Effort range from similar closed work: P25-P75 per role, with the tickets behind it         |
+| `/multi-agent:scenario-audit`      | Check test scenarios against the code; each PRESENT on a resolving file:line                |
 | `/multi-agent:refactor`            | Best-practice extraction + bug hunt + derived-skill drift + toolkit MCP research → one plan |
 | `/multi-agent:scan`                | Skill security scan of local skill directories against a tiered pattern catalog             |
 | `/multi-agent:prune-prompts`       | Zero-base review of the always-on instruction footprint; keep / trial / delete per rule     |
@@ -392,17 +394,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 61 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 63 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + three `PreToolUse` hooks (secret scan, agent-guard, read-size gate) |
-| Copilot CLI | `--copilot`          | instructions + 61 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 61 specs as refs + 10 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 63 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 63 specs as refs + 10 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 61.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 63.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single

package/README.tr.md

@@ -17,7 +17,7 @@ Claude Code, Copilot CLI ve Codex CLI üzerinde native çalışır. Yalnızca ma
 ### Önkoşullar
 
 - **Node.js >= 20.11** - zorunlu; pipeline'ın kendi araçları bunun üzerinde koşuyor.
-- **`jq`** - dokuz yol için zorunlu, geri kalanı için opsiyonel. 89 kabuk dosyası ona başvuruyor. Yayınlayan ya da karar veren dokuzu - autopilot kuyruğu, Jira yorumları, PR review'ları, issue güncellemeleri, plan dosyası, iki Figma fetcher'ı, log araması ve Jira auth - `jq` yokken çalışmak yerine exit 3 ile reddediyor, çünkü eksik bir `jq` boş VERİ olarak görünür ve iş onunla devam eder. Diğer yerlerde `jq` olmadan da çalışıyor, yalnızca daha az şey yapıyor. Kurulum, eksikse bir not basıyor.
+- **`jq`** - dokuz yol için zorunlu, geri kalanı için opsiyonel. 90 kabuk dosyası ona başvuruyor. Yayınlayan ya da karar veren dokuzu - autopilot kuyruğu, Jira yorumları, PR review'ları, issue güncellemeleri, plan dosyası, iki Figma fetcher'ı, log araması ve Jira auth - `jq` yokken çalışmak yerine exit 3 ile reddediyor, çünkü eksik bir `jq` boş VERİ olarak görünür ve iş onunla devam eder. Diğer yerlerde `jq` olmadan da çalışıyor, yalnızca daha az şey yapıyor. Kurulum, eksikse bir not basıyor.
 - **`gh`** - GitHub issue ve PR işleri için. Kendi dahili `--jq`'su, `jq` ikilisinden bağımsız.
 
 ## Hızlı Başlangıç
@@ -157,7 +157,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 61 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 63 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -190,6 +190,8 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 | `/multi-agent:review-issue`        | Aynı puanlama, GitHub issue'su için                                                              |
 | `/multi-agent:review-analysis`     | Yazılmış analiz dokümanını review eder; bulgular ihlal edilen Locked kuralını gösterir           |
 | `/multi-agent:diff-explain`        | Faz 4 triyaj bulgusunu onu doğuran diff satırlarına eşler                                        |
+| `/multi-agent:estimate`            | Benzer kapanmış işlerden efor aralığı: rol başına P25-P75, dayandığı ticket'larla               |
+| `/multi-agent:scenario-audit`      | Test senaryolarını koda karşı denetler; her VAR çözülen bir dosya:satıra dayanır                 |
 | `/multi-agent:refactor`            | Best-practice çıkarımı + bug avı + türetilmiş skill drift'i + toolkit MCP araştırması → tek plan |
 | `/multi-agent:scan`                | Yerel skill dizinlerini kademeli desen kataloğuna göre güvenlik taraması                         |
 | `/multi-agent:prune-prompts`       | Sürekli yüklü talimat yükünün sıfır-tabanlı incelemesi; kural başına tut / dene / sil            |
@@ -391,17 +393,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 61 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 63 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 61 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 61 spec + 10 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 63 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 63 spec + 10 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 61 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 63 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/docs/architecture.md

@@ -113,7 +113,7 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>61 command files]
+        CMD[commands/<br/>63 command files]
         AGT[agents/<br/>10 agent personas]
         RUL[rules/<br/>13 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
@@ -204,8 +204,8 @@ repo and the website, plus the two independently shipped repos
 ```mermaid
 graph TD
     CC["Claude Code<br/>(source of truth)"]
-    COP["Copilot CLI<br/>(instructions + 61 sub-command skills)"]
-    COD["Codex CLI<br/>(1 router skill + 61 refs)"]
+    COP["Copilot CLI<br/>(instructions + 63 sub-command skills)"]
+    COD["Codex CLI<br/>(1 router skill + 63 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(6 plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 61 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 63 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 6 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 118 MCP tools across 14 categories (simulator/emulator control, memory, crash diagnostics, accessibility audit, store compliance, web automation, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index, provider-backed research, video key frames, offline security scoring) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 61 commands"]
+        PHASES["6 phases · 63 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>61 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 61 refs<br/>+ 10 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>63 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 63 refs<br/>+ 10 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -161,7 +161,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 61 slash-command skills, native | 61 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 61 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 63 slash-command skills, native | 63 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 63 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-01",
-  "version": "20.12.0",
+  "generatedAt": "2026-10-02",
+  "version": "20.15.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,9 +35,9 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 3, 4, 5]
   },
-  "commandCount": 61,
+  "commandCount": 63,
   "skillCount": 154,
-  "skillCountAll": 218,
+  "skillCountAll": 220,
   "agentCount": 10,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
   "toolCount": 154,

package/install/_common.mjs

@@ -591,7 +591,7 @@ export function removePipelineAgentFiles(destDir, agentsSrc) {
  * @param {string} rel  path relative to the copy root, posix-separated
  * @returns {boolean}
  */
-function isCopyJunk(rel) {
+export function isCopyJunk(rel) {
   return (
     rel === ".DS_Store" ||
     rel.endsWith("/.DS_Store") ||

package/install/_plugin-skills.mjs

@@ -182,10 +182,18 @@ export function pluginsToDeliver(home, platformFlag) {
  * @param {"ios"|"android"|"all"} opts.platformFlag
  * @param {string} opts.label - host label for log lines
  * @param {Set<string>} [opts.skipNames] - PIPELINE-owned skill names; a plugin skill matching one is delivered plugin-prefixed rather than dropped
+ * @param {(from: string, to: string) => void} [opts.copy] - copies one skill directory; a host whose paths differ from Claude Code's passes a rewriting copy
  * @returns {{copied: number, renamed: string[], collided: number, plugins: string[], missing: string[]}}
  */
 export function installAuthoredPluginSkills(opts) {
-  const { home, dest, platformFlag, label, skipNames = new Set() } = opts;
+  const {
+    home,
+    dest,
+    platformFlag,
+    label,
+    skipNames = new Set(),
+    copy = (from, to) => copyDir(from, to, {}),
+  } = opts;
   const { names: wanted, source: selectionSource } = pluginsToDeliver(home, platformFlag);
 
   let copied = 0;
@@ -257,7 +265,7 @@ export function installAuthoredPluginSkills(opts) {
         // Wipe before copy: `copyDir` only adds, so a file the plugin dropped upstream
         // would linger in the installed skill and keep being read as current.
         wipeDir(to);
-        copyDir(from, to, {});
+        copy(from, to);
         copied += countFiles(from);
         perPlugin++;
       }
@@ -315,13 +323,9 @@ export function installAuthoredPluginSkills(opts) {
 /**
  * Skill names the PIPELINE owns, derived from its source tree.
  *
- * This is what `skipNames` should be. Callers used to pass a snapshot of
- * whatever was already installed (a now-deleted `existingSkillNames(dest)`) - which
- * did protect pipeline skills from being shadowed by a plugin, but also meant a
- * plugin skill was copied exactly once and then frozen: on the second install its
- * own name was "already there", so it was skipped, forever. A stale plugin skill
- * then outlives every upstream fix in it, which is how a reference to a path the
- * plugin no longer names survived in an installed tree.
+ * This is what `skipNames` should be. A snapshot of the destination would also
+ * match plugin skills from a previous install, so each would be copied once and
+ * then skipped on every later install, frozen against upstream fixes.
  *
  * Deriving from the source keeps the shadowing protection (a plugin still cannot
  * overwrite a pipeline skill) while letting plugin skills refresh on every install.