@mmerterden/multi-agent-pipeline 20.16.0 → 20.17.0

package/pipeline/scripts/valven-gate.mjs

@@ -8,6 +8,7 @@
  *   valven-gate.mjs --mode dev|commit|review
  *                   [--repo <dir>] [--base <ref>] [--head <ref> | --worktree] [--branch <name>]
  *                   [--diff-file <patch>] [--commits-file <path>] [--pr-body-file <path>]
+ *                   [--pr-meta-file <json>]
  *                   [--rules <rules.yml>] [--prefs <prefs.json>] [--now <ISO date>]
  *                   [--out <file>]
  *
@@ -20,6 +21,12 @@
  *     (one subject per line), --branch and --pr-body-file when known. The rework
  *     ratio needs history, so it is reported `not-measured`.
  *
+ * --pr-meta-file adds the pull request's timing (`gh pr view --json
+ * author,closedAt,createdAt,isDraft,mergedAt,reviewRequests,reviews`, or the normalized
+ * shape normalizePrMeta() documents). Without it the pickup and review durations
+ * are `not-measured`; coding time is measured up to now in commit mode, where the
+ * pull request is about to open.
+ *
  * A rule that cannot be measured is `not-measured` with the reason, never a pass.
  * Generated output, lockfiles and snapshots are removed with the same pattern
  * list the reviewers use (review-file-filter.mjs), so no budget counts them.
@@ -40,10 +47,12 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { homedir } from "node:os";
 import { loadPatterns, partition } from "./review-file-filter.mjs";
 import { unquotePathIfNeeded } from "./git-path.mjs";
 import { runMain } from "../lib/fatal.mjs";
 import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import { pluginSkillRootCandidates } from "../lib/plugin-skill-roots.mjs";
 import { messages, outputLanguage, prefsPath } from "../lib/user-facing.mjs";
 
 export const CRITERIA_SOURCE = "valven-rules";
@@ -56,16 +65,29 @@ const SPLIT_RULES = new Set(["VLV-SIZE-01", "VLV-SIZE-02", "VLV-SCOPE-01"]);
 const DEFAULT_PATTERNS = join(import.meta.dirname, "..", "schemas", "review-file-exclusions.json");
 
 /**
- * Candidate locations of rules.yml relative to this script, installed layouts
- * first: Claude Code and Copilot (`<root>/skills`), Codex
- * (`<root>/multi-agent-refs/skills`), then the source checkout.
+ * Candidate locations of rules.yml. The gate reads the registry that was
+ * installed with it, so its evaluators and its rules come from one release: on
+ * Claude Code `<root>/multi-agent-refs/registries/valven-rules` (the installer
+ * lays it down there because Claude Code loads the skill itself from the
+ * ai-common-toolkit plugin), on Copilot `<root>/skills`, on Codex
+ * `<root>/multi-agent-refs/skills`, and in a checkout the source. Searching the
+ * registries dir before `<root>/skills` also keeps a `~/.claude/skills/valven-rules`
+ * left by an older install from being read. The plugin copies come last, for a
+ * layout that has none of these.
+ *
+ * @param {string} [dir]  directory of this script
+ * @param {string} [home]
  */
-export function rulesCandidates(dir = import.meta.dirname) {
+export function rulesCandidates(dir = import.meta.dirname, home = homedir()) {
   const rel = ["valven-rules", "references", "rules.yml"];
   return [
+    join(dir, "..", "multi-agent-refs", "registries", ...rel),
     join(dir, "..", "skills", ...rel),
     join(dir, "..", "multi-agent-refs", "skills", ...rel),
-    join(dir, "..", "skills", "shared", "core", ...rel),
+    join(dir, "..", "skills", "shared", "external", ...rel),
+    ...pluginSkillRootCandidates(home, ["ai-common-toolkit"]).map((root) =>
+      join(root, "knowledge", ...rel),
+    ),
   ];
 }
 
@@ -246,6 +268,102 @@ export function anchorFile(human) {
   return [...pool].sort((a, b) => b.added + b.deleted - (a.added + a.deleted))[0].path;
 }
 
+/**
+ * The Valven score band of a duration: 100 under `full_under_minutes`, 75 under
+ * `three_quarter_under_minutes`, 50 under `half_under_minutes`, otherwise 0.
+ * Each bound is exclusive, as in Valven's table ("under 30 min", "30 min - 2.5 hours").
+ *
+ * @param {number} minutes
+ * @param {{full_under_minutes:number, three_quarter_under_minutes:number, half_under_minutes:number}} rule
+ */
+export function bandOf(minutes, rule) {
+  if (minutes < rule.full_under_minutes) return 100;
+  if (minutes < rule.three_quarter_under_minutes) return 75;
+  if (minutes < rule.half_under_minutes) return 50;
+  return 0;
+}
+
+const isoOrNull = (v) => {
+  if (!v) return null;
+  const d = new Date(v);
+  return Number.isNaN(d.getTime()) ? null : d.toISOString();
+};
+
+/** The earliest valid date that is not before `floor`, or null. */
+const earliest = (dates, floor) => {
+  const valid = dates
+    .map(isoOrNull)
+    .filter((d) => d && d >= floor)
+    .sort();
+  return valid[0] ?? null;
+};
+
+/**
+ * Pull request timing in one shape. Accepts `gh pr view --json
+ * author,closedAt,createdAt,isDraft,mergedAt,reviewRequests,reviews` as is, or the
+ * normalized form a Bitbucket caller writes: `{createdAt, readyAt, isDraft,
+ * reviewerCount, firstReviewAt, approvedAt, mergedAt, closedAt}`. Reviews by the pull
+ * request's own author, bots and pending reviews never count, and a review left
+ * before the pull request was ready for review (or before it opened) is not the
+ * first review: pickup and review time start at ready. A reviewer count the input does not carry
+ * stays null, so it reads as unknown rather than as "no reviewer". Returns null
+ * without a valid `createdAt`, because every duration here is anchored to it.
+ *
+ * @param {object|null} raw
+ */
+export function normalizePrMeta(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const createdAt = isoOrNull(raw.createdAt);
+  if (!createdAt) return null;
+  const base = {
+    createdAt,
+    readyAt: isoOrNull(raw.readyAt),
+    isDraft: raw.isDraft === true,
+    mergedAt: isoOrNull(raw.mergedAt),
+    closedAt: isoOrNull(raw.closedAt),
+  };
+  const floor = base.readyAt ?? createdAt;
+  if (Array.isArray(raw.reviews) || Array.isArray(raw.reviewRequests)) {
+    const author = raw.author?.login ?? null;
+    const isBot = (who) => who?.is_bot === true || /\[bot\]$/.test(who?.login ?? "");
+    const reviews = (raw.reviews ?? []).filter(
+      (r) => r?.author?.login !== author && r?.state !== "PENDING" && !isBot(r?.author),
+    );
+    const people = new Set([
+      ...(raw.reviewRequests ?? []).map((r) => r?.login ?? r?.name ?? r?.slug).filter(Boolean),
+      ...reviews.map((r) => r.author?.login).filter(Boolean),
+    ]);
+    return {
+      ...base,
+      reviewerCount: people.size,
+      firstReviewAt: earliest(
+        reviews.map((r) => r.submittedAt),
+        floor,
+      ),
+      approvedAt: earliest(
+        reviews.filter((r) => r.state === "APPROVED").map((r) => r.submittedAt),
+        floor,
+      ),
+    };
+  }
+  return {
+    ...base,
+    reviewerCount: Number.isFinite(raw.reviewerCount) ? raw.reviewerCount : null,
+    firstReviewAt: earliest([raw.firstReviewAt], floor),
+    approvedAt: earliest([raw.approvedAt], floor),
+  };
+}
+
+const minutesBetween = (from, to) =>
+  Math.max(0, Math.floor((new Date(to).getTime() - new Date(from).getTime()) / 60000));
+
+function duration(minutes, lang) {
+  const tr = lang === "tr";
+  if (minutes < 60) return tr ? `${minutes} dakika` : `${minutes} min`;
+  const hours = Math.round((minutes / 60) * 10) / 10;
+  return tr ? `${String(hours).replace(".", ",")} saat` : `${hours} h`;
+}
+
 const TEXT = {
   en: {
     size: (n, max) =>
@@ -270,6 +388,20 @@ const TEXT = {
       `The branch is ${n} commits behind its base and its merge-base is ${d} days old. Carry the change onto a fresh branch with valven-port.`,
     foreign: (s, key) =>
       `Commit "${s}" belongs to another issue (branch key ${key}). Move it to its own PR.`,
+    coding: (d, band) =>
+      `Coding took ${d} from the first commit to opening the pull request (Valven score ${band}%). Open the pull request as soon as the first slice works, and keep slices small.`,
+    pickup: (d, band, waiting) =>
+      waiting
+        ? `The pull request has waited ${d} for its first review (Valven score ${band}%). Remind the reviewers or ask the team for one.`
+        : `The first review came ${d} after the pull request was ready (Valven score ${band}%).`,
+    review: (d, band, open) =>
+      open
+        ? `The pull request has been in review for ${d} without an approval (Valven score ${band}%). Answer every comment in one round and push the fixes together.`
+        : `Review took ${d} from the first review to approval (Valven score ${band}%). Answer every comment in one round and push the fixes together.`,
+    noReviewer:
+      "The pull request has no reviewer, so nobody is asked to review it. Assign the default reviewers.",
+    draft: (d) =>
+      `The pull request has been a draft for ${d}. Mark it ready for review once its gates pass, or close it.`,
   },
   tr: {
     size: (n, max) =>
@@ -294,6 +426,19 @@ const TEXT = {
       `Branch base'in ${n} commit gerisinde ve merge-base'i ${d} günlük. Değişikliği valven-port ile güncel base'den açılan yeni bir branch'e taşı.`,
     foreign: (s, key) =>
       `"${s}" commit'i başka bir işe ait (branch ID'si ${key}). Onu ayrı bir PR'a taşı.`,
+    coding: (d, band) =>
+      `İlk commit'ten PR'ın açılmasına kadar ${d} geçmiş (Valven puanı %${band}). İlk dilim çalışır hale gelince PR'ı hemen aç, dilimleri küçük tut.`,
+    pickup: (d, band, waiting) =>
+      waiting
+        ? `PR ${d} süredir ilk review'u bekliyor (Valven puanı %${band}). Reviewer'lara hatırlat ya da takımdan birini iste.`
+        : `İlk review, PR hazır olduktan ${d} sonra geldi (Valven puanı %${band}).`,
+    review: (d, band, open) =>
+      open
+        ? `PR ${d} süredir review'da ve onay almadı (Valven puanı %${band}). Bütün yorumları tek turda yanıtla, düzeltmeleri birlikte push'la.`
+        : `İlk review'dan onaya kadar ${d} geçmiş (Valven puanı %${band}). Bütün yorumları tek turda yanıtla, düzeltmeleri birlikte push'la.`,
+    noReviewer: "PR'da reviewer yok, kimseden review istenmiyor. Varsayılan reviewer'ları ekle.",
+    draft: (d) =>
+      `PR ${d} süredir draft. Gate'leri geçtiyse review'a hazır olarak işaretle ya da kapat.`,
   },
 };
 
@@ -308,7 +453,9 @@ const TEXT = {
  * @param {string[]|null} input.commits  subjects, null when unknown
  * @param {string|null} input.prBody     null when unknown
  * @param {{ratio:number, recent:number, removed:number}|{reason:string}|null} input.rework
- * @param {{oldestDays:number|null, behind:number|null, baseDays:number|null}|null} [input.history]
+ * @param {{oldestDays:number|null, oldestCommitAt?:Date|null, behind:number|null, baseDays:number|null}|null} [input.history]
+ * @param {ReturnType<typeof normalizePrMeta>} [input.prMeta]  null when no pull request is known
+ * @param {Date} [input.now]
  * @param {string} [input.lang]
  */
 export function evaluate({
@@ -320,6 +467,8 @@ export function evaluate({
   prBody,
   rework,
   history = null,
+  prMeta = null,
+  now = new Date(),
   lang = "en",
 }) {
   const t = messages(TEXT, lang);
@@ -337,7 +486,19 @@ export function evaluate({
       criteriaSource: CRITERIA_SOURCE,
       tag: TAG,
     });
-  const record = (rule, status, detail) => results.push({ ruleId: rule.id, status, detail });
+  const record = (rule, status, detail, score) =>
+    results.push(
+      score === undefined
+        ? { ruleId: rule.id, status, detail }
+        : { ruleId: rule.id, status, detail, score },
+    );
+  const scoreDuration = (rule, minutes, issue, detail) => {
+    const band = bandOf(minutes, rule);
+    if (band <= 50) {
+      add(rule, rule.severity, issue(duration(minutes, lang), band));
+      record(rule, "violated", detail, band);
+    } else record(rule, "pass", detail, band);
+  };
 
   for (const rule of rules) {
     const modes = Array.isArray(rule.modes) ? rule.modes : [];
@@ -425,8 +586,14 @@ export function evaluate({
           record(rule, "not-measured", rework?.reason ?? "no history");
           break;
         }
+        const score = Math.round((1 - rework.ratio) * 100);
         if (rework.removed < rule.min_removed_lines) {
-          record(rule, "pass", `${rework.removed} removed lines, below ${rule.min_removed_lines}`);
+          record(
+            rule,
+            "pass",
+            `${rework.removed} removed lines, below ${rule.min_removed_lines}`,
+            score,
+          );
         } else if (rework.ratio > rule.ratio_over) {
           const pct = Math.round(rework.ratio * 100);
           add(
@@ -434,8 +601,8 @@ export function evaluate({
             rule.severity,
             t.rework(pct, Math.round(rule.ratio_over * 100), rule.window_days),
           );
-          record(rule, "violated", `${rework.recent}/${rework.removed}`);
-        } else record(rule, "pass", `${rework.recent}/${rework.removed}`);
+          record(rule, "violated", `${rework.recent}/${rework.removed}`, score);
+        } else record(rule, "pass", `${rework.recent}/${rework.removed}`, score);
         break;
       }
       case "VLV-PRDESC-01": {
@@ -503,6 +670,97 @@ export function evaluate({
         } else record(rule, "pass", `${n} <= ${rule.important_over}`);
         break;
       }
+      case "VLV-CYCLE-01": {
+        const start = history?.oldestCommitAt ?? null;
+        const end = prMeta ? prMeta.createdAt : mode === "commit" ? now : null;
+        if (!start) {
+          record(rule, "not-measured", "commit dates unknown");
+          break;
+        }
+        if (!end) {
+          record(rule, "not-measured", "no pull request opening time (branch input)");
+          break;
+        }
+        const m = minutesBetween(start, end);
+        scoreDuration(rule, m, t.coding, `${m} min to open`);
+        break;
+      }
+      case "VLV-CYCLE-02": {
+        if (!prMeta) {
+          record(rule, "not-measured", "no pull request metadata");
+          break;
+        }
+        const ready = prMeta.readyAt ?? (prMeta.isDraft ? null : prMeta.createdAt);
+        if (!ready) {
+          record(rule, "not-measured", "still a draft; the pickup clock has not started");
+          break;
+        }
+        if (!prMeta.firstReviewAt && (prMeta.mergedAt || prMeta.closedAt)) {
+          record(
+            rule,
+            "not-measured",
+            prMeta.mergedAt ? "merged without a review" : "closed without a review",
+          );
+          break;
+        }
+        const waiting = !prMeta.firstReviewAt;
+        const m = minutesBetween(ready, prMeta.firstReviewAt ?? now);
+        scoreDuration(
+          rule,
+          m,
+          (d, band) => t.pickup(d, band, waiting),
+          waiting ? `${m} min, still waiting` : `${m} min to first review`,
+        );
+        break;
+      }
+      case "VLV-CYCLE-03": {
+        if (!prMeta?.firstReviewAt) {
+          record(rule, "not-measured", prMeta ? "no review yet" : "no pull request metadata");
+          break;
+        }
+        const done = prMeta.approvedAt ?? prMeta.mergedAt ?? prMeta.closedAt;
+        const m = minutesBetween(prMeta.firstReviewAt, done ?? now);
+        scoreDuration(
+          rule,
+          m,
+          (d, band) => t.review(d, band, !done),
+          done ? `${m} min to approval` : `${m} min, still in review`,
+        );
+        break;
+      }
+      case "VLV-PICKUP-01": {
+        if (!prMeta) {
+          record(rule, "not-measured", "no pull request metadata");
+          break;
+        }
+        if (prMeta.mergedAt || prMeta.closedAt) {
+          record(rule, "not-applicable", prMeta.mergedAt ? "already merged" : "closed");
+          break;
+        }
+        const problems = [];
+        const reviewerUnknown =
+          prMeta.reviewerCount === null && !prMeta.firstReviewAt && !prMeta.isDraft;
+        if (prMeta.reviewerCount === 0 && !prMeta.firstReviewAt && !prMeta.isDraft) {
+          add(rule, rule.severity, t.noReviewer);
+          problems.push("no reviewer");
+        }
+        const draftFor = minutesBetween(prMeta.createdAt, now);
+        if (prMeta.isDraft && draftFor > rule.draft_minutes_over) {
+          add(rule, rule.draft_severity ?? rule.severity, t.draft(duration(draftFor, lang)));
+          problems.push(`draft for ${draftFor} min`);
+        }
+        if (problems.length) record(rule, "violated", problems.join(", "));
+        else if (reviewerUnknown) record(rule, "not-measured", "reviewer count unknown");
+        else
+          record(
+            rule,
+            "pass",
+            prMeta.reviewerCount === null
+              ? "already reviewed"
+              : `${prMeta.reviewerCount} reviewer(s)`,
+          );
+        break;
+      }
       default:
         record(rule, "not-measured", "rule has no evaluator in this version of the gate");
     }
@@ -510,7 +768,10 @@ export function evaluate({
 
   const splitRequired = results.some((r) => SPLIT_RULES.has(r.ruleId) && r.status === "violated");
   const failing = findings.some((f) => f.severity === "blocking" || f.severity === "important");
-  return { results, findings, splitRequired, failing };
+  const scores = Object.fromEntries(
+    results.filter((r) => r.score !== undefined).map((r) => [r.ruleId, r.score]),
+  );
+  return { results, findings, splitRequired, failing, scores };
 }
 
 // ---------------------------------------------------------------------------
@@ -745,7 +1006,23 @@ async function main() {
   }
   const oldest = commitDates.length ? Math.min(...commitDates.map((d) => d.getTime())) : null;
   history.oldestDays = oldest === null ? null : daysBetween(new Date(oldest), now);
+  history.oldestCommitAt = oldest === null ? null : new Date(oldest);
   const prBody = args["pr-body-file"] ? readFileSync(args["pr-body-file"], "utf-8") : null;
+  let prMeta = null;
+  if (args["pr-meta-file"]) {
+    let problem = null;
+    try {
+      prMeta = normalizePrMeta(JSON.parse(readFileSync(args["pr-meta-file"], "utf-8")));
+      if (!prMeta) problem = "no valid createdAt";
+    } catch (err) {
+      problem = err.message;
+    }
+    if (problem) {
+      process.stderr.write(
+        `valven-gate: --pr-meta-file ${args["pr-meta-file"]}: ${problem}; the timeline rules report not-measured\n`,
+      );
+    }
+  }
 
   const metrics = measure(files, patterns);
   const verdict = evaluate({
@@ -757,6 +1034,8 @@ async function main() {
     prBody,
     rework,
     history,
+    prMeta,
+    now,
     lang: args.lang ?? outputLanguage(prefsFile),
   });
 
@@ -775,6 +1054,8 @@ async function main() {
       excludedFiles: metrics.excluded.length,
       rework: "reason" in rework ? null : rework,
     },
+    prMeta,
+    scores: verdict.scores,
     results: verdict.results,
     findings: verdict.findings,
     splitRequired: verdict.splitRequired,

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-02T10:19:25Z",
-  "skillCount": 221,
+  "generatedAt": "2026-10-07T15:02:16Z",
+  "skillCount": 223,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -39,6 +39,10 @@
       "path": "shared/core/multi-agent-autopilot/SKILL.md",
       "sha256": "a9731771fbc1f45260f214f069b976eff16e7b25e2f1375b0d9a213575271bc6"
     },
+    {
+      "path": "shared/core/multi-agent-bug-bash/SKILL.md",
+      "sha256": "a44ad2520ef24444b68d9040519f82498abda3ebb6467890bb6b5e1460299400"
+    },
     {
       "path": "shared/core/multi-agent-build-optimize/SKILL.md",
       "sha256": "8534891d1198597a0893d131e6b944d15443f62b24cb5584c486a235845fd281"
@@ -161,7 +165,7 @@
     },
     {
       "path": "shared/core/multi-agent-review/SKILL.md",
-      "sha256": "cd500e32efdf6c8f36da5bb2e43d2558d096e33cd3274aead5118dd2c14f118a"
+      "sha256": "2b6934d6086a467bdf145b326061ab4b83d5479bfb1a2fb36420ff8012a02e5d"
     },
     {
       "path": "shared/core/multi-agent-route-off/SKILL.md",
@@ -209,7 +213,7 @@
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
-      "sha256": "775ade509ec312055205d28f187f6c67f0cfd89cdd341a412101770526057291"
+      "sha256": "28c00a0a32b5d636240ced308983b4aaee919016693a686a18ccb0e1e9103ec3"
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
@@ -229,7 +233,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "d0db9f860bbc9765d25a961866fa9307bd7343d862bf71dcfbc73730837afbde"
+      "sha256": "b34c0e3bd9160552b9222d448e54be14504761597ceea875f0447a227df90772"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -261,16 +265,12 @@
     },
     {
       "path": "shared/core/multi-agent-update/SKILL.md",
-      "sha256": "d96e18b70bab0a601057f75f212dd4fb563db0cb250607c770ce1c7a1df4b1d0"
+      "sha256": "37f5950dca1a09b1ca0c2e2b1b2d20de418f6398a8aed37b062917cf6d95b4a5"
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
       "sha256": "3dd44ccc00e41c09e59ad223900a391f80158bd3f69e45d67c684285bc42418d"
     },
-    {
-      "path": "shared/core/valven-rules/SKILL.md",
-      "sha256": "274299b75e36991941b8402ae025967ce553878100c1a3878a955d27f5b7db9e"
-    },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",
       "sha256": "0508b6e832b43d54c6ed5f57d42c292925b81e4df1c132ba1786860385ea2838"
@@ -455,6 +455,10 @@
       "path": "shared/external/docker-expert/SKILL.md",
       "sha256": "b3db936caa89a2c249ae64896cfb4c0a72ac45064cc081d6f99c78efe6a1f9e9"
     },
+    {
+      "path": "shared/external/e2e-testing/SKILL.md",
+      "sha256": "e76dac61b973a5c509a9902a15a7c18ed226d838406fd0f8b513f24b45ea4025"
+    },
     {
       "path": "shared/external/energykit/SKILL.md",
       "sha256": "a557acc6e324f4b841f411cfb0d9040094c8d2934aefe5cb4eecd5a2a6b0e402"
@@ -839,6 +843,10 @@
       "path": "shared/external/typescript-patterns/SKILL.md",
       "sha256": "784d294aa6ba09ff29bc7ec0f106eb512a006e79c96a01ec92d1699bfa122077"
     },
+    {
+      "path": "shared/external/valven-rules/SKILL.md",
+      "sha256": "4dcb5f937310523e13250780ed381b5a2677bc4a4f44b974fba2b89fe8b60173"
+    },
     {
       "path": "shared/external/vision-framework/SKILL.md",
       "sha256": "370fdf6eaf71833dff0e8f2d3989a849b5c42ff3198605aa818c2fd0c12c7ef7"

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 221,
+  "skillCount": 223,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -519,6 +519,17 @@
       "triggerPaths": [],
       "relativePath": "shared/external/docker-expert/SKILL.md"
     },
+    {
+      "name": "e2e-testing",
+      "description": "End-to-end testing of a running web or mobile app through the multi-agent-toolkit MCP server: element locators instead of coordinates, expect steps that return passed / failed / blocked verdicts with codes, secrets by secret_ref, failure traces, saved and replayed step sequences, parallel web sessio",
+      "platform": null,
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:e2e-testing",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/external/e2e-testing/SKILL.md"
+    },
     {
       "name": "energykit",
       "description": "EnergyKit on iOS 26: grid electricity forecasts via ElectricityGuidance, EnergyVenue, EV and HVAC load events, ElectricityInsightService history. Use when building smart home, EV charging, HVAC scheduling or energy dashboard features that shift home power use to cleaner or cheaper grid periods.",
@@ -1025,6 +1036,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-autopilot-status/SKILL.md"
     },
+    {
+      "name": "multi-agent-bug-bash",
+      "description": "Bug bash: parallel exploratory sessions by charter and persona, each with a budget; a finding is reported only when a repro test fails for its reason. Use when an app or branch needs broad bug hunting.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-bug-bash",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-bug-bash/SKILL.md"
+    },
     {
       "name": "multi-agent-build-optimize",
       "description": "Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analyzers, produces a recommend-first optimization plan in .build-benchmark/, and re-benchmarks after the developer approves changes. Fails fast on non-iOS stacks. U",
@@ -2292,14 +2314,14 @@
     },
     {
       "name": "valven-rules",
-      "description": "Delivery-flow rules from the metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, rework, PR body, small hotfixes. Use when developing, committing or reviewing a change held to these rules, or splitting a branch into stacked PRs.",
+      "description": "Delivery-flow rules from metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, churn, PR body, and coding, pickup and review time on Valven's bands. Use when developing, opening or reviewing a pull request held to these rules, or splitting a branch into ",
       "platform": null,
-      "group": "core",
-      "plugin": null,
-      "invokeAs": "valven-rules",
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:valven-rules",
       "triggerKeywords": [],
       "triggerPaths": [],
-      "relativePath": "shared/core/valven-rules/SKILL.md"
+      "relativePath": "shared/external/valven-rules/SKILL.md"
     },
     {
       "name": "vision-framework",

package/pipeline/skills/shared/README.md

@@ -2,12 +2,12 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 221 skills (67 core + 154 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 223 skills (67 core + 156 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
 - **`core/`**  -  67 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
-- **`external/`**  -  154 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
+- **`external/`**  -  156 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
 Source layout is logical grouping only  -  skill discovery at runtime is unchanged.
@@ -19,7 +19,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
 - [Backend / API](#backend-api)  -  11
-- [Cross-cutting](#cross-cutting)  -  28
+- [Cross-cutting](#cross-cutting)  -  30
 
 ## Pipeline Orchestration
 
@@ -35,6 +35,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-autopilot-off`](./core/multi-agent-autopilot-off/) | `core` | Turn off continuous mode on this machine: the schedule is removed, work already running finishes, the repo selection is kept. Use when the m |
 | [`multi-agent-autopilot-on`](./core/multi-agent-autopilot-on/) | `core` | Turn on continuous mode on THIS machine: pick the repos it watches; labelled GitHub issues and assigned+labelled Jira items then run in a wo |
 | [`multi-agent-autopilot-status`](./core/multi-agent-autopilot-status/) | `core` | Show what continuous mode is doing here: what runs at which phase, what is queued, what waits for an answer, what PRs it opened today. Use w |
+| [`multi-agent-bug-bash`](./core/multi-agent-bug-bash/) | `core` | Bug bash: parallel exploratory sessions by charter and persona, each with a budget; a finding is reported only when a repro test fails for i |
 | [`multi-agent-build-optimize`](./core/multi-agent-build-optimize/) | `core` | Wrapper that dispatches to xcode-build-orchestrator on iOS repos. Benchmarks the current Xcode build, runs compilation / project / SPM analy |
 | [`multi-agent-channels`](./core/multi-agent-channels/) | `core` | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | [`multi-agent-complaint-analysis`](./core/multi-agent-complaint-analysis/) | `core` | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
@@ -91,7 +92,6 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-testflight-validation`](./core/multi-agent-testflight-validation/) | `core` | iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never upl |
 | [`multi-agent-uninstall`](./core/multi-agent-uninstall/) | `core` | Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline set |
 | [`multi-agent-update`](./core/multi-agent-update/) | `core` | Update the pipeline to the latest version: git pull, install, migrate. Use when the installed pipeline is behind and should be brought to th |
-| [`valven-rules`](./core/valven-rules/) | `core` | Delivery-flow rules from the metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, rework, PR  |
 
 ## iOS / Apple Ecosystem
 
@@ -255,6 +255,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`cryptokit`](./external/cryptokit/) | `external` | CryptoKit in Swift: SHA-2, SHA-3, HMAC, AES-GCM, ChaChaPoly, P256, P384, P521, Curve25519 and ML-DSA signatures, ECDH with HKDF, HPKE, ML-KE |
 | [`debugging-instruments`](./external/debugging-instruments/) | `external` | Xcode debugging and profiling: LLDB, Memory Graph Debugger, Instruments, crashes, leaks and retain cycles, main-thread hangs, slow rendering |
 | [`debugging-strategies`](./external/debugging-strategies/) | `external` | Language-neutral debugging method: reproduce, minimise, falsifiable hypotheses, git bisect, instrumentation, production traces, concurrency  |
+| [`e2e-testing`](./external/e2e-testing/) | `external` | \| |
 | [`evidence-github`](./external/evidence-github/) | `external` | Search GitHub for facts an analysis can cite - a known issue in a dependency, the PR that fixed it, what a release actually changed, prior a |
 | [`evidence-registry`](./external/evidence-registry/) | `external` | Check a package's real version, deprecation status and release notes on npm, PyPI, Maven Central or Swift Package Index. Use when a spec or  |
 | [`github-actions-templates`](./external/github-actions-templates/) | `external` | Authoring GitHub Actions workflows: triggers, matrices, caching, concurrency, least-privilege permissions, SHA pinning, OIDC, reusable workf |
@@ -266,6 +267,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`signal-community`](./external/signal-community/) | `external` | Check whether other people hit the same problem, via Stack Overflow and Hacker News (keyless) plus opt-in Reddit and X. Use when a bug repor |
 | [`skill-creator`](./external/skill-creator/) | `external` | House guide for authoring plugin skills: creating a new skill, trimming or splitting a bloated one, writing or sharpening a description, and |
 | [`spm-build-analysis`](./external/spm-build-analysis/) | `external` | Analyze Swift Package Manager dependencies, package plugins, module variants, and CI-oriented build overhead that slow Xcode builds. Use whe |
+| [`valven-rules`](./external/valven-rules/) | `external` | Delivery-flow rules from metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, churn, PR body, |
 | [`xcode-build-benchmark`](./external/xcode-build-benchmark/) | `external` | Benchmark Xcode clean and incremental builds with repeatable inputs, timing summaries, and timestamped `.build-benchmark/` artifacts. Use wh |
 | [`xcode-build-fixer`](./external/xcode-build-fixer/) | `external` | Apply approved Xcode build optimization changes following best practices, then re-benchmark to verify improvement. Use when a developer has  |
 | [`xcode-build-orchestrator`](./external/xcode-build-orchestrator/) | `external` | Orchestrate Xcode build optimization by benchmarking first, running the specialist analysis skills, prioritizing findings, requesting explic |