@mmerterden/multi-agent-pipeline 20.18.0 → 20.20.0

package/manifest.json

@@ -1,15 +1,15 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.18.0",
-  "commit": "896371483bce326d6cb68a1f9609ebb99e7575d6",
-  "generatedAt": "2026-10-09T05:37:30.195Z",
+  "version": "20.20.0",
+  "commit": "3eaded72b1509c7426dcba713df56fd72a0a2698",
+  "generatedAt": "2026-10-11T23:40:41.943Z",
   "algorithm": "sha256",
-  "fileCount": 1356,
+  "fileCount": 1357,
   "files": {
-    "CHANGELOG.md": "76773c616fec7b75d1db838ce716c2f25caebb605762c786c89381dc5aeb6141",
+    "CHANGELOG.md": "cf8a8131da43152e49483d7b7a9890a70f23e4df07c8c3e99f768ec632840e55",
     "LICENSE": "8d8c51aaf1e1538b180c69965fa038db71be86798cc3e26a143bebfefe16a43e",
-    "README.md": "1336cf131fdc0dbab1dd8b90fcd5614bd19d27b92b4f91ab99c3108d61cb51e1",
-    "README.tr.md": "7979b32e6c72aedc3a6affe85f33b2840e72f056a836e8546566d259b236ff29",
+    "README.md": "a73f80dafda9ee106db1613bb359d56b02f53f9c3e16fb5691fef06719d2c2e9",
+    "README.tr.md": "7338743b34baa2128236775f8e11b7e7df486294e15f63268755e62d12e4fe4d",
     "SECURITY.md": "0eb89553ddcfc56bfe9712315b55a6630ee2f579631aaeccd6ad24f8ac769a0b",
     "docs/FIGMA_PIPELINE.md": "ea01f3ea5fef1a9cb316040a2d416fcf87dd4f2a14b5497aa00994a0b5dc7e6a",
     "docs/adr/0001-three-model-triage.md": "79a6f1025469f607a5859add21854052d7433bc213f4aceee2e159b613eeb6a1",
@@ -31,10 +31,10 @@
     "docs/adr/README.md": "6ff58bc97dde4f1d94df60e4e221396a46906682b429ef275fd813cd288956e1",
     "docs/architecture.md": "04fe9630d51646962bc5b660b4c82a8a8199984dc14d993aaf5c147c4c8f6968",
     "docs/best-practices.md": "f8b75b0d38b5896a6a852bb30a1edddeb24dab8b5b7b1d9313290e1241c72024",
-    "docs/ecosystem.md": "d504124f421748744599f6974ec71d52664affc47740665651cca5ddc17d0c71",
+    "docs/ecosystem.md": "a1aa8134339f915749652814f4ee7291a37a926467fbb097109d5821f97aeeb8",
     "docs/engineering.md": "550528cd47c7d2c921729c68d0782a00ac8e77a4bdfec479f6749f9c3235d188",
-    "docs/facts.json": "fd737a1eef03c1cdda33d9d4173556998b39c7bc2d3cfca06c3bcb887a18ce20",
-    "docs/features.md": "87ae163280fe05b36ff9f664b1bf9d98b697cc498731d47298751b439fa7a35c",
+    "docs/facts.json": "3a12532eb8aab78df188985a05e593251ba248de79201ea6e5bba1ab696fbe8b",
+    "docs/features.md": "703435e309d1e37668c24bde3c2c0a7e4689a05d95449dcd394406fda1a19858",
     "docs/performance.md": "bbf2f3922c25dcba0c1a9e69ef420e3871a729af5b35009a49b48a5d3c5cd151",
     "docs/recovery-guide.md": "59a8f1b66b34cb9ff5507b3d54dac3b9915e184aa044d9c758d18cac818d510e",
     "docs/server-readiness.md": "ea21eee6a08c6fc0f2d1da8058acd5a50c556cea486d3acfe48fc0b23f4581fc",
@@ -52,7 +52,7 @@
     "install/_telemetry.mjs": "5433d753f909beed2c8789272bba05e245482c472f83d3444f58000c4c9a634b",
     "install/_unattended-profile.mjs": "e1ed82bde35d19105ee12c2a551eb778912b0e5c93ab227fd15c993098d98de0",
     "install/_xcode-skills.mjs": "1a7e20f1e6743324b941c5d3ecac9f94c65fff1534ffd9c63b39cbea4f8d101a",
-    "install/catalog-history.json": "0d6a9cb4eb8d228e4bb5133910fa7b7a0a3d223195dfb6643a42f7d75afcd201",
+    "install/catalog-history.json": "9f8bd5ce3b6d5d49faec993a50111b4942be2a9402c4a5c38ba7ff6bdfde3e48",
     "install/claude.mjs": "106ce353ebc19c8319d057ce342e1f989519510465c798399076b5f3d8727904",
     "install/codex.mjs": "08925fe9f3ecdf509b37f01105652c847475d20fcde2db0d679b9a7d663ca145",
     "install/copilot.mjs": "41dc394b8a3ae77cfd194ce0ca9bbcafce9bdce349f1f72eeb86569f993e15fe",
@@ -63,7 +63,7 @@
     "install/templates/multi-agent-autopilot-awake.plist.template": "ddd25c76c56fcbb38a89de8e35637372d70ace993d6bc487a88ca9cfb702fe1f",
     "install/templates/multi-agent-autopilot.plist.template": "122c8a61cd927edd99375d6e3da40f1d42bcceed5b6641785c8b28bb930bc77e",
     "install/unattended-profile-legacy.json": "f52e86b998956f09ad306b1735a6c10b58580d7082d8a55665a4c6bb15c3aa1f",
-    "package.json": "ea701923f2dbd97b1c712d609729f9cea25b3ccbf18eb447d9a604e22fc20e9b",
+    "package.json": "6f50165ff1e18ae3f084464e171f7e710d106f37a96d77927b525509b5981de0",
     "pipeline/agents/android-architect.md": "11fb74543cb0ebcf9525ca6654fe95d53da7229e0bf4a1149b31fd9005abc453",
     "pipeline/agents/backend-architect.md": "b02a606c301e4714131aed70ae6d16eeb77fbc819a001e2752cff2488d4246de",
     "pipeline/agents/bulk-reader.md": "6597052cd7d205bac2b1c7633f5232fe1a40730664a913b8eb77efd5a786dc25",
@@ -142,7 +142,7 @@
     "pipeline/commands/multi-agent/test/SKILL.md": "5a67be2b1ec0321e79f8b7f35be53676e349e55a4f8ca09a07f0de89dadac8c4",
     "pipeline/commands/multi-agent/testflight-validation/SKILL.md": "38fa8d3d3c8340d025e100c53a70183cbad22665b7ddccbb6102c05986cce489",
     "pipeline/commands/multi-agent/uninstall/SKILL.md": "b2124820a6e10cdd72be71df2183aad4f8bd8988ec90248c88599c1514f7d9ab",
-    "pipeline/commands/multi-agent/update/SKILL.md": "b87d2b9b284860eb14f5973f640b09de2993493cc1e3676bf14bb877927966ed",
+    "pipeline/commands/multi-agent/update/SKILL.md": "4b9ca40382eb2bd06f8b1a483d6232d1e9941d6e6288a21e83fa977482a1bae7",
     "pipeline/commands/sim-test.md": "b09038b9511108c77fae5e0c11f8515b5c64eb8b63a77fe8c2ff5907ddd0313a",
     "pipeline/contract/CHANGELOG.md": "0813f5737219bafad3eb4daf809b9754937fae8533e07caf3850e30b2685662b",
     "pipeline/contract/README.md": "6239eb0877d70e70d63db74bae3499599b0425c80c71eceb6bb0a981523eaa89",
@@ -271,7 +271,7 @@
     "pipeline/multi-agent-refs/component-dispatch.md": "2ab9094aa716397e4840cd48f736c3f4fc3e7c4f9ccc5c7c7c52f9e8b0a28fb5",
     "pipeline/multi-agent-refs/component-generation.md": "04fdb3fd0f1c129e1df8243184a3225cebd9c4f63511d6015eb356a92eda8891",
     "pipeline/multi-agent-refs/conventions-defaults.md": "608a05ec6332fc19ee12c0418fbf25165f80e6c06cfee9efed7f27fab185d97d",
-    "pipeline/multi-agent-refs/cross-cli-contract.md": "401599612e561c4dedbeec4535e8b6aaa675e3d3c4f8b8c99c48e5f5f26381e6",
+    "pipeline/multi-agent-refs/cross-cli-contract.md": "d7f6dc9e0d589077150c807ca2def54f78f5aa717d266941f70458e6480069b2",
     "pipeline/multi-agent-refs/design-check/build-launch.md": "0ac64d07ef7389e22f7443f79c70a0a4f8bb87dcff6dbc94c63e034febe194ea",
     "pipeline/multi-agent-refs/design-check/compare.md": "2a0a89542a8bfefcfeaf1068dd91edb6947392f911f23e8b4857e4ace8fd15d7",
     "pipeline/multi-agent-refs/design-check/drive-capture.md": "dee4cd6230a401bc9e9dc82fc08109803dd2630c872c5b77a43cf17db062b05f",
@@ -293,8 +293,8 @@
     "pipeline/multi-agent-refs/features/design-conformance.md": "a88ca595827cafa0c87c2facfcf9190dac69485e0596e5c198c6fc1613880452",
     "pipeline/multi-agent-refs/features/dev-critic.md": "08e01edef04b5ac216f8f43332126966d33da7b95625e47a8a6cd8ac105b263f",
     "pipeline/multi-agent-refs/features/doctor.md": "62ff75a085095b11818ffabb97bd76e62e58de6affd24f4eaf3d9f89f2fe1d66",
-    "pipeline/multi-agent-refs/features/exploratory-testing.md": "3ee81dc5d42068b09b6e31c7649ee57ff73e30480237c8c4a0571c78d996928d",
-    "pipeline/multi-agent-refs/features/external-context-injection.md": "fe0373f27c3e9aae660a55a3ba9a8163df329b4d95c727d6023b6b3afaf71d66",
+    "pipeline/multi-agent-refs/features/exploratory-testing.md": "ac534fdb9e056b1a3782f9b9e38f0b8823f85e03cb85924513079179e318c45d",
+    "pipeline/multi-agent-refs/features/external-context-injection.md": "be9a0e904efd52535fa18a254567c9d0c3fc2ed12fcbc7a116f7879048303df6",
     "pipeline/multi-agent-refs/features/jira-context.md": "7d14802ed9ad1747e1a06dec26f22ff9e8959e03c47d7a018af45b8274aea47c",
     "pipeline/multi-agent-refs/features/maturity-followup.md": "e663e5bcf0b3b4d4d2a67f4516dbb9fb12520dfbdedb47a9c5f57c13a9a0633e",
     "pipeline/multi-agent-refs/features/model-fallback.md": "e6b9635124f3557013dfbfa71d414a9d9abe9ddc89f2228a5496086c8e3b0c72",
@@ -318,7 +318,7 @@
     "pipeline/multi-agent-refs/features/stack-adapters.md": "71e23385da872ceed35263f4838f154800aa2da55bb6688ccca74726b70a3ef5",
     "pipeline/multi-agent-refs/features/stack-skill-routing.md": "1989f7f64be6c5ee0a42d8e9962aead7cd7472d795915ab953d89d9382f317e6",
     "pipeline/multi-agent-refs/features/unattended-gates.md": "46b516cac81a4eacf5d58bc3b1613e2266c26f1559be8dac060d1dc6b7d7ca01",
-    "pipeline/multi-agent-refs/features/unattended-security.md": "18da3d51c175a42ab6312051a50b9d0339524dad2cc34e0350de62fbf0cece91",
+    "pipeline/multi-agent-refs/features/unattended-security.md": "24235b0479342e4a9f0edb88d387619dd5f222ea82769b99acbc703392769005",
     "pipeline/multi-agent-refs/features/url-enrichment.md": "72e01a799d9fa54b56c762ba404a9f9236adbbf98320e395a96f6b0f5917e76b",
     "pipeline/multi-agent-refs/features/usage-reporting.md": "bd8643e804a70d86679e431368e2fff7a8fbe7b121837340e745b1dd221a428d",
     "pipeline/multi-agent-refs/features/valven.md": "13b1fb8a3815330f6f970181506ac117e0d1c42761e5a83454edbd0b383ee1a7",
@@ -358,7 +358,7 @@
     "pipeline/multi-agent-refs/refactor/drift.md": "4fd4144785c60fef18e0532035c33343eb01da884e36f89ef42bf89ed69171d3",
     "pipeline/multi-agent-refs/refactor/observations.md": "7a63a7043bf1c42a78296ab082b1cace67fbcdf0078fec736fffd9af3147b6ce",
     "pipeline/multi-agent-refs/refactor/run-errors.md": "4afc33fb591fabb2ec2bcbb74f0e5bae3645c6d507d756cf552ea45a4332bcd3",
-    "pipeline/multi-agent-refs/refactor/toolkit-research.md": "1ef7f36345c5a7d2f6bb8529ef39e9e00865c6ca851aec942891bc2f8a57ea2b",
+    "pipeline/multi-agent-refs/refactor/toolkit-research.md": "94e52343111fd113b0464a3d390861aa7f44d45879e06bdd9e83591d9dfe0d12",
     "pipeline/multi-agent-refs/research/engine.md": "6e812c2637f563a6fa53ade6690dcc69fa819450a74405eb138883dd19cef0b2",
     "pipeline/multi-agent-refs/rules.md": "0b272d9ee2ba4a2fde28313f3084b8caa3d26f10e78d6099547a800e6c33534a",
     "pipeline/multi-agent-refs/setup/app-store-connect.md": "6230406b14615f7a412f95542c3c10ea8f4d2681d9a39f7910c9f5f8592184bd",
@@ -480,10 +480,10 @@
     "pipeline/schemas/triage-output.schema.json": "60e329a22cea0f0ed9fa1e8e78f9b512ef283277346b08a194ad491e0bad0995",
     "pipeline/schemas/unattended-policy.json": "64ca8d36c29766af2f9e94435f017650799ee62a8ad04c5d5cf802b75550073b",
     "pipeline/schemas/unattended-policy.schema.json": "d1aab1b49541ca77c3ca5ee69158878b61ea47a5bfdfe06cd548c3315ffd09c4",
-    "pipeline/schemas/unattended-profile.json": "05bc095b6328ff77b7bee8b008becf9aa20f1dabeab3b0fc174b97cad421e23b",
+    "pipeline/schemas/unattended-profile.json": "25ca36388640a22b47b08f01f515b192ee4210eb820c85fd3d0485e0247afd8c",
     "pipeline/schemas/unattended-profile.schema.json": "a9c0979f0d0742826e410fdbfe1ae1c4a56b05b4e638eec42d4c276d6f48f701",
     "pipeline/schemas/worktrees.schema.json": "4e15c413c00811814eee734d86734ad9e1d34a37737f7df641b389ce5d8d134b",
-    "pipeline/scripts/README.md": "937adf6f34ce18fc07d91d6556abcdd39debf2df7819c3f16e009430dc0549a7",
+    "pipeline/scripts/README.md": "4cdf7054cddbe5cdcb08460f68782f2347a26c8c343d8ef8418714464672b36c",
     "pipeline/scripts/_autopilot-config.mjs": "0f42d2791f1d71c4aad5a0735ca56fef1ed27d275b72f99d8ca8f95fcb8aa83a",
     "pipeline/scripts/_autopilot-ops.mjs": "5e84d628482434c8f09dc69601c73ab70e928af15c2f068d998d2f61bd692d1a",
     "pipeline/scripts/_autopilot-outcomes.mjs": "5b2423814d979ed5c657473290083b296f7245d40507c866e7931b2771001236",
@@ -617,6 +617,7 @@
     "pipeline/scripts/prune-logs.sh": "c5587b33104c7253e07be8cce8249b50014c52dfdf232de637811ffdd88e95e4",
     "pipeline/scripts/purge.sh": "95c60b272ae47209893dba9b17528538592bb5636da47940a02734cd9b4f0ce5",
     "pipeline/scripts/record-phase.mjs": "041dc262e54f38b66299f45c44db7918812e599a773f5a3dc78cfd09ab5e155e",
+    "pipeline/scripts/release-notes.mjs": "05430926cf679534978bcc79c160a6787aaf04831b8b8489d8bbc9fa343a14af",
     "pipeline/scripts/render-agent-log-cost.sh": "6c58c1f5754ff5754485a0c1b66f4cd713575d2e8ebb1630aedf2f87fe34ef4d",
     "pipeline/scripts/render-cost-summary.sh": "ce9647332ab9a3e518af98f52a6fc70baab9fd3c09ec5f9e85bae2d67078a5e3",
     "pipeline/scripts/render-work-summary.sh": "ee4db04ebc145cc2fc7fa9a533d42b7da4da191710ef67c883502ca83b2aa67c",
@@ -661,7 +662,7 @@
     "pipeline/scripts/token-budget-report.mjs": "508bbc659df478c535c0ecdd3f8611372af8fef0b0932c7b19a247af2b2b9265",
     "pipeline/scripts/triage-memory.mjs": "2d8541145f1749593ae5728fb4c9eb3001484edb5e4d37be473aeec34d1dbe7c",
     "pipeline/scripts/ui-tree-dumper.swift": "a09e42ef069eafa08c05afd8333e05b754ef6a7d8b9687712039b0f2c9801273",
-    "pipeline/scripts/unattended_policy.py": "f1df6470c798bd7d4bc9f8338eaabf98bdcfab00198d98b7e2e654aab84b709c",
+    "pipeline/scripts/unattended_policy.py": "e2ac82b4a969fdd230e3c3f390cb31cde1e2178c4caa57574ad63a3d786f8379",
     "pipeline/scripts/uninstall.mjs": "ba11803733cf3bfcc966f0d4aa2cc5fbed000cb37a251005f067ce0289306233",
     "pipeline/scripts/update-check.sh": "9c00647e7ca4249414b2e5af08f61705ab5bd2106b6f66ae8ebce8aa143dc957",
     "pipeline/scripts/update-issue-progress.sh": "ccfef87743e91272e009e396ac07461d2784b2fa84a06c802a582526eeeb9ed9",
@@ -690,7 +691,7 @@
     "pipeline/scripts/worktrees.mjs": "90dfd09b70fffe9b56c331a4ae2692cc248f4898f4ee6aee4239ef0b20888a90",
     "pipeline/scripts/write-state.mjs": "e1198bf970eace07d3eff22b394808a526e473df65d3d58aa2d5a12cfdac8b49",
     "pipeline/scripts/write-store-config.mjs": "b994a061f6febb2ca3d396074d8b51d2c1c1f991d3072d321703380da3639a56",
-    "pipeline/skills/.skill-manifest.json": "48f84aac9947e30a91e65ca97ff41b327b43af8b3643883f2a19e0169bfc89b9",
+    "pipeline/skills/.skill-manifest.json": "93cf5b7a3d7011a6be1e1c7601892039775051ff34ad80dc172ea4c44c82fc20",
     "pipeline/skills/.skills-index.json": "b2917fa44e273b939549f1c3ab3dd81c26ba8168772bc7644c9fa076116d8a4c",
     "pipeline/skills/shared/README.md": "928fe4292be729c3b7d7d0898cade8be0dfa868f208e0c6d1fe7b2c6bd6223c5",
     "pipeline/skills/shared/core/apple-archive-compliance/SKILL.md": "7239fef717ea45b79276bfcc2c3903acd57950b6e00dd6a2a66399c4b09cbd51",
@@ -883,7 +884,7 @@
     "pipeline/skills/shared/external/device-integrity/references/device-integrity-patterns.md": "84b0d44b6a11daaae8383c7662e71dd2cd56d92bf52bde7537385beb66eb418c",
     "pipeline/skills/shared/external/docker-expert/SKILL.md": "b3db936caa89a2c249ae64896cfb4c0a72ac45064cc081d6f99c78efe6a1f9e9",
     "pipeline/skills/shared/external/docker-expert/references/patterns.md": "1d2052123d6c1c0379f4ebf5d153d649ca22807b7c9c70b88b0dba9c249eecc6",
-    "pipeline/skills/shared/external/e2e-testing/SKILL.md": "e76dac61b973a5c509a9902a15a7c18ed226d838406fd0f8b513f24b45ea4025",
+    "pipeline/skills/shared/external/e2e-testing/SKILL.md": "6d5fa81328d8b4c8ccc8e273487b7f27e6100f7192b2b3bdd2387b333a119659",
     "pipeline/skills/shared/external/e2e-testing/references/document-fixtures.md": "0a6939374affdf5f0ed40ed91ea28c66f23bac027a4431ac956baeb9de850c89",
     "pipeline/skills/shared/external/energykit/SKILL.md": "a557acc6e324f4b841f411cfb0d9040094c8d2934aefe5cb4eecd5a2a6b0e402",
     "pipeline/skills/shared/external/energykit/evals/evals.json": "e2adae145af422785b57c96dc5a0789d5d99fdba9b767d2a79397d67334ccefc",
@@ -1093,7 +1094,7 @@
     "pipeline/skills/shared/external/shareplay-activities/SKILL.md": "63205693c5fbc9ec3b06e04a823deaa34c69e4fa01c0a1eb3419c2d1388c3e29",
     "pipeline/skills/shared/external/shareplay-activities/evals/evals.json": "3305323af4c7b60ece654487aeb568772d9e7a7b3372ed145da4d65eb561d59a",
     "pipeline/skills/shared/external/shareplay-activities/references/shareplay-patterns.md": "8f0ead5b253d0e79ad543718a56b15749848b6949684334f22203e3afbfb7ff3",
-    "pipeline/skills/shared/external/signal-community/SKILL.md": "0660107c2bf0e65847e72708a196b672ae7b9469bd98ec70793c988351024298",
+    "pipeline/skills/shared/external/signal-community/SKILL.md": "66b584551428d9078c88ef5d1164c77a1985accaebdc373eb4bfcdd5e65ed0f1",
     "pipeline/skills/shared/external/skill-creator/SKILL.md": "f80c5f74dc285240d0213a4e6e0c178a9f38142f0eb7d6956d7c89c061009b71",
     "pipeline/skills/shared/external/skill-creator/audit.md": "65499fe230f872deff1611a1d54fd0ecc4a57dcb59a04fb59cce729155afd167",
     "pipeline/skills/shared/external/skill-creator/checklist.md": "de558dc9b08ab8480e19a7eb1c3b3f880dcf08ba727ed20d782ea443f8fd403e",
@@ -1330,7 +1331,7 @@
     "pipeline/skills/shared/external/weatherkit/references/weatherkit-patterns.md": "81a54949c6abde31019100f85876c69488e5bf80deb77ddbc8504955a87a82a3",
     "pipeline/skills/shared/external/web-accessibility/SKILL.md": "a1cd782292982a3c37fd8d1eedaae85f860886f492b2666b73735c6261025594",
     "pipeline/skills/shared/external/web-performance/SKILL.md": "b9983bb39f9a65daad5aca4fb97c88ecbd7c0639b39023dc5c7c6784c4c1c868",
-    "pipeline/skills/shared/external/web-testing/SKILL.md": "3120db537a687adfbf396e500f4e146880e4b1a00ab339f85ab526853c947447",
+    "pipeline/skills/shared/external/web-testing/SKILL.md": "28a088947d4c9ab216ae92131c42a700966d8b531047fa5a0af5bfa870376e11",
     "pipeline/skills/shared/external/widgetkit/SKILL.md": "d4bce1c362e57616b252304414cfd01354586c7ed0be6c22f61efcc0980e26b0",
     "pipeline/skills/shared/external/widgetkit/references/widgetkit-advanced.md": "b04ca376ecc86ab17a9a6e86c081b6c7720cb6c614c091ec0ef1d41ba2d30a16",
     "pipeline/skills/shared/external/xcode-build-benchmark/SKILL.md": "3554d7b310fadfb1afd48793d01f08d91e47a596af0001bd575b61e21e29c19f",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.18.0",
+  "version": "20.20.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -100,9 +100,13 @@ and every later block that needs them starts by sourcing it.
 
 4b. **Update the stack plugins** (catalog refresh, then every installed plugin in its own scope):
    ```bash
-   bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner}
+   REFRESH_LOG="${TMPDIR:-/tmp}/multi-agent-plugin-refresh.log"
+   bash "$HOME/.claude/scripts/plugin-refresh.sh" {owner} > "$REFRESH_LOG" 2>&1
+   rc=$?
+   cat "$REFRESH_LOG"
+   echo "plugin-refresh exit: $rc"
    ```
-   A non-zero exit means a step failed and the CLI's own error is already on screen. Report it to the user; do not retry silently.
+   A non-zero exit means a step failed and the CLI's own error is already on screen. Report it to the user; do not retry silently. The log feeds step 6, which tells the user what each updated plugin brought.
 
 4c. **Prune retired adapter files** (Cursor / Antigravity / Copilot Chat were removed in v10.7.0 - the pipeline targets Claude Code, Copilot CLI and Codex CLI):
    ```bash
@@ -139,19 +143,41 @@ and every later block that needs them starts by sourcing it.
    or an SSH key on the personal account (the "Personal account" step in
    `$HOME/.claude/multi-agent-refs/features/usage-reporting.md`).
 
-6. **Show the new version and its changes** (from the packaged CHANGELOG - there is no git history on this channel):
+6. **Tell the user what the update brought.** Read the notes, then write the summary yourself:
    ```bash
    . "${TMPDIR:-/tmp}/multi-agent-update.env" || { echo "Run step 1 first."; exit 1; }
    NEW=$(tr -d '[:space:]' < "$HOME/.claude/.pipeline-version" 2>/dev/null)
-   echo ""
-   echo "✓ Updated: v$CUR → v$NEW"
-   echo ""
-   echo "Changes:"
-   awk -v new="## [$NEW]" -v cur="## [$CUR]" \
-     'index($0,new){on=1} on&&index($0,cur){exit} on' \
-     "$UPD_DIR/package/CHANGELOG.md" | head -40
+   NOTES="$UPD_DIR/package/pipeline/scripts/release-notes.mjs"
+   [ -f "$NOTES" ] || NOTES="$HOME/.claude/scripts/release-notes.mjs"
+   LOG="$UPD_DIR/package/CHANGELOG.md"
+   [ -f "$LOG" ] || LOG=/nonexistent
+   node "$NOTES" --changelog "$LOG" --from "$CUR" --to "$NEW" \
+     --plugins-dir "$HOME/.claude/plugins/marketplaces/multi-agent-plugins/plugins" \
+     --plugin-refresh-log "${TMPDIR:-/tmp}/multi-agent-plugin-refresh.log"
    ```
 
+   The JSON holds every release between the old and the new version (not only
+   the last one) and, for each plugin the refresh moved, that plugin's releases.
+   Turn it into a short note in `outputLanguage`, written for the person using
+   the pipeline, not for its maintainers:
+
+   - First line: `✓ Updated: v<CUR> → v<NEW>`, then one line per updated plugin
+     (`ai-ios-toolkit 0.20.0 → 0.21.0`).
+   - Then up to four groups, each only when it has entries: **New** (added),
+     **Fixed**, **Changed**, **Removed** (Turkish: Yeni, Düzeltilen, Değişen,
+     Kaldırılan). Put security entries first under Fixed.
+   - One plain sentence per item about what the user notices or can now do.
+     Merge items that say the same thing; leave out internal-only entries
+     (smoke tests, CI, refactors, budgets, docs) unless they change what a user
+     sees. At most about eight items per group; when more were dropped, say how
+     many and that the full list is in the CHANGELOG.
+   - Use only what the JSON says. Never invent a feature or a fix, and never
+     guess why something changed.
+   - Last line, when anything needs action: what to do (restart Claude Code for
+     plugin changes, run a command a release asks for).
+
+   With empty notes and no plugin updates, print only the version line.
+
 7. **Smoke test (optional)** - the release tarball ships exactly two smokes for this purpose:
    ```bash
    . "${TMPDIR:-/tmp}/multi-agent-update.env" || { echo "Run step 1 first."; exit 1; }
@@ -165,18 +191,19 @@ and every later block that needs them starts by sourcing it.
 ## Output
 
 ```
-Current: v15.6.0   Latest: v15.6.1
-  -> npm pack @{npm-scope}/multi-agent-pipeline@15.6.1
+Current: v15.6.0   Latest: v15.7.0
+  -> npm pack @{npm-scope}/multi-agent-pipeline@15.7.0
   -> node install.js --installed (Claude Code; no Copilot CLI or Codex CLI stamp, not installed)
   -> migrate-prefs.mjs (0 changes  -  already v2.6.0)
 
-✓ Updated: v15.6.0 → v15.6.1
+✓ Updated: v15.6.0 → v15.7.0
+  ai-ios-toolkit 0.19.0 → 0.20.0
 
-Changes:
-  ## [15.6.1] - 2026-08-19
-  ### Fixed
-  - Usage report reads the tracker as it is actually written
-  ...
+New
+  - iOS design review: critiques a screen against the HIG from screenshots.
+Fixed
+  - The usage report reads the tracker as it is written.
+Restart Claude Code to load the updated plugins.
 
 Verification:
   schema-validation: 27/27 pass

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -111,6 +111,10 @@ it does not. Contracts: `features/exploratory-testing.md`,
 | Secrets by reference | `secret_ref` on the type tools | ≥ v3.19.0 |
 | Parallel web sessions, replay | `session` on the web tools; `save_as` / `replay` | ≥ v3.19.0 |
 | Travel document fixtures | `document_generate`, `document_mrz_build` | ≥ v3.19.0 |
+| ARIA assertions | `expect_aria` step, `web_assert_aria` | ≥ v3.20.0 |
+| Web states and locators | `web_route`, `web_network_state`, `web_clock`, `web_dialog`, `web_upload`, `web_drag`, `web_hover`, `web_fill_form`, `web_find`, `web_generate_locator`, `web_trace`; `request_id` on `web_network`; `locator` on `web_click` / `web_type` | ≥ v3.20.0 |
+| Document fetch and crawl | `web_scrape` (formats, cache, `change_tracking`), `url` / `sitemap` / `include_paths` / `llms_txt` on `web_crawl` and `web_map` | ≥ v3.20.0 |
+| Research modes and threads | `mode`, `recency`, `domains`, `sources`, `thread_id` on `research_ask`; `arxiv` and `fetch_content` on `research_search` | ≥ v3.20.0 |
 
 ---
 

package/pipeline/multi-agent-refs/features/exploratory-testing.md

@@ -123,6 +123,13 @@ taps as before and say so in the report:
   value; the value never enters the transcript, the run file or a finding.
 - **Traces.** A failed `agent_run_steps` writes a `trace.md`; put its path in
   the step's `trace` and in the finding's `evidence` as `kind: "trace"`.
+- **States the happy path skips (web, ≥ v3.20.0).** Reach error, empty, slow
+  and offline states on purpose: `web_route` fulfills an endpoint with an error
+  status or an empty body, aborts it or delays it; `web_network_state` goes
+  offline; `web_clock` moves time for expiry and countdowns; `web_dialog`
+  answers a confirm before the click that opens it. Clear the routes when the
+  state is done. `expect_aria` checks a screen's structure against a template
+  without a judge.
 - **Replay.** `save_as` stores a step sequence that reached a finding, and
   `replay` runs it again. `REPLAY_DIVERGED` means the app no longer follows the
   recorded path: an automation block, and a hint that the screen changed.

package/pipeline/multi-agent-refs/features/external-context-injection.md

@@ -35,7 +35,7 @@ One fetcher per type. Each fetcher emits a normalized JSON view that the analysi
 | `swagger` | `~/.claude/lib/fetch-swagger.sh <url>` → endpoints[], request/response examples | `state.fetchedContext.swagger[]` |
 | `confluence` | `~/.claude/lib/fetch-confluence.sh <url>` → page body, code blocks, extracted API contracts | `state.fetchedContext.confluence[]` |
 | `figma` | no standalone fetcher - resolve via the Figma 3-tier chain (Tier 1 MCP tools, Tier 2 `~/.claude/lib/figma-screenshot.sh` + REST) when the task is a component; otherwise advisory only | `state.fetchedContext.figma[]` |
-| `generic-doc` | no automatic fetcher  -  surfaced as advisory; the agent uses WebFetch on demand when the URL turns out to be load-bearing | n/a |
+| `generic-doc` | no automatic fetcher  -  surfaced as advisory. When the URL turns out to be load-bearing, the agent reads it with the toolkit's `web_scrape` (`formats: ["markdown"]`; ≥ v3.20.0) when the server is registered, else with WebFetch. `web_scrape` returns main content as Markdown fenced as untrusted with prompt-injection flags, and serves a repeat from its cache | n/a (read into the prompt, not stored) |
 
 ## Exit code handling
 

package/pipeline/multi-agent-refs/features/unattended-security.md

@@ -231,9 +231,10 @@ allowed host is allowed; `corpDomain` is not used, because it is an email domain
 and would allow every host under it. The host is parsed with
 `urllib.parse.urlsplit`, so `http://evil.com#@github.com/` resolves to `evil.com`
 and is refused. The same allowlist governs `WebFetch`, the toolkit's
-`web_goto` / `web_crawl` (any URL argument), each step of `agent_run_steps`,
+`web_goto` / `web_crawl` / `web_map` / `web_scrape` (any URL argument), each step of `agent_run_steps`,
 and a web URL given to `ios_open_url` / `android_open_url`; `web_eval` is
-refused outright because inline JavaScript can reach any host. Reads only: a request body or
+refused outright because inline JavaScript can reach any host. Every entry of a
+`paths` list (`web_upload`) is held to the same path rules as a single path argument. Reads only: a request body or
 upload - `-d`/`--data*`, `-F`/`--form`, `-T`/`--upload-file`, and their attached
 and clustered short forms (`-d@file`, `-sd`, `-Tfile`) - is **refused outright**,
 whatever the host, rather than allowed to an allowlisted one; a run has nothing

package/pipeline/multi-agent-refs/refactor/toolkit-research.md

@@ -28,10 +28,12 @@ Loaded on demand by `/multi-agent:refactor` Step 0c. The SKILL.md carries the st
 |---|------|---------------|-----------------|
 | 1 | MCP protocol | spec revisions + `@modelcontextprotocol/sdk` releases | protocol features released since the pinned SDK range that the server does not use yet: tool annotations (`readOnlyHint` / `destructiveHint` / `idempotentHint` / `openWorldHint`), `outputSchema` + structured content, resource links in results, progress + cancellation, `tools/list_changed`, pagination, elicitation |
 | 2 | Host clients | Claude Code / Copilot CLI / Cursor / Antigravity docs + release notes | per-tool description budget, tool-count ceilings, naming conventions, image and output size limits, permission / allowlist ergonomics |
-| 3 | Peer servers | GitHub search on the same domain terms + `stars:>50` | tool surfaces we lack, conventions peers converged on, and what to discard as out of scope |
+| 3 | Peer servers | GitHub search on the same domain terms + `stars:>50`; standing watchlist: `microsoft/playwright-mcp` (browser tool surface, capability groups), `firecrawl/firecrawl-mcp-server` (scrape / crawl / map / extract formats). Check each peer's license before reading code: AGPL or unlicensed means the idea only | tool surfaces we lack, conventions peers converged on, and what to discard as out of scope |
 | 4 | Wrapped tooling | `xcrun simctl help`, `idb`, `adb`, `xcodebuild`, Playwright release notes, Apple ITMS + App Store Review Guidelines | deprecated flags still in use, new capabilities worth a tool, audit rules that changed |
 | 5 | Field practice | X / Twitter, Reddit, MCP community threads | what server authors actually changed recently (transport choice, output-token diets, sandboxing, error shape) |
 
+When the toolkit itself is registered, run the axes through it: `research_ask` with `mode: "pro"` (or `"deep"` for a whole axis) and `recency: "month"` for release-note questions, `research_search` with `provider: "arxiv"` for papers, `web_scrape` with `change_tracking` on a release-notes page to see what moved since the last refactor. WebSearch / WebFetch stay the fallback.
+
 **Audit the toolkit against the findings**  -  run the checks, do not assume:
 
 ```bash

package/pipeline/schemas/unattended-profile.json

@@ -144,7 +144,7 @@
     [
       "MCP_TOOLKIT_URL_POLICY",
       "strict",
-      "web_goto and web_crawl refuse loopback, link-local and metadata addresses"
+      "web_goto, web_crawl, web_map and web_scrape refuse loopback, link-local and metadata addresses"
     ],
     [
       "MCP_TOOLKIT_INDEX_DENY",

package/pipeline/scripts/README.md

@@ -85,6 +85,7 @@ Shell scripts invoked during pipeline execution.
 - `github-ssh-setup.sh`  -  first-run SSH key setup helper
 - `update-check.sh`  -  cached registry read (`dist-tags.latest` + `dist-tags.required`); always exit 0
 - `require-supported-version.sh`  -  turns the `force` signal into exit 3; fails open offline
+- `release-notes.mjs`  -  every release between the installed and the new version, grouped by kind, plus each plugin the refresh moved; feeds the update summary
 - `sync-parity-check.sh`  -  manual parity verification helper
 
 ## Node.js helpers (74 `.mjs` files)

package/pipeline/scripts/release-notes.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * release-notes.mjs  -  what an update brought, grouped so the user can be told.
+ *
+ * `/multi-agent:update` runs this from the release it just unpacked, against that
+ * release's CHANGELOG: every version after the one that was installed, up to the
+ * one now installed, with its bullets grouped by kind (added, changed, fixed,
+ * removed, ...). A jump across many releases is reported whole, not cut at a line
+ * count. The same is done for each stack plugin the plugin refresh moved, read
+ * from that plugin's CHANGELOG in the marketplace checkout.
+ *
+ * The output is data for the update step, which summarizes it for the user in
+ * their language. It never fails an update: a missing or unreadable CHANGELOG is
+ * empty notes and exit 0.
+ *
+ * Usage:
+ *   release-notes.mjs --changelog <CHANGELOG.md> --from <old> --to <new>
+ *                     [--plugins-dir <marketplace>/plugins --plugin-refresh-log <file>]
+ *
+ * stdout: JSON `{ pipeline: Notes, plugins: [{ name, from, to, notes: Notes }] }`
+ * where Notes is `{ from, to, versions: [{ version, date, sections }], counts }`.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { runMain } from "../lib/fatal.mjs";
+
+const RELEASE_RE = /^## \[(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\](?:\s*-\s*(.+))?\s*$/;
+const SECTION_RE = /^### (.+?)\s*$/;
+
+function cmp(a, b) {
+  const [pa, qa = ""] = a.split("-");
+  const [pb, qb = ""] = b.split("-");
+  const x = pa.split(".").map(Number);
+  const y = pb.split(".").map(Number);
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] - y[i];
+  if (qa === qb) return 0;
+  if (!qa) return 1;
+  if (!qb) return -1;
+  return qa < qb ? -1 : 1;
+}
+
+/**
+ * Released versions in a Keep a Changelog file, newest first as written.
+ * `## [Unreleased]` is skipped; a bullet's wrapped lines are joined.
+ *
+ * @param {string} text
+ * @returns {{version: string, date: string|null, sections: Record<string, string[]>}[]}
+ */
+export function parseChangelog(text) {
+  const releases = [];
+  let release = null;
+  let section = null;
+  let bullet = null;
+  const flush = () => {
+    if (bullet !== null && release && section) release.sections[section].push(bullet.trim());
+    bullet = null;
+  };
+  for (const line of String(text || "").split("\n")) {
+    if (line.startsWith("## ")) {
+      flush();
+      const m = RELEASE_RE.exec(line);
+      release = m ? { version: m[1], date: m[2]?.trim() || null, sections: {} } : null;
+      if (release) releases.push(release);
+      section = null;
+      continue;
+    }
+    if (!release) continue;
+    const s = SECTION_RE.exec(line);
+    if (s) {
+      flush();
+      section = s[1].toLowerCase();
+      release.sections[section] ||= [];
+      continue;
+    }
+    if (!section) continue;
+    if (/^[-*] /.test(line)) {
+      flush();
+      bullet = line.slice(2);
+    } else if (bullet !== null && /^\s+\S/.test(line)) {
+      bullet += " " + line.trim();
+    } else if (!line.trim()) {
+      flush();
+    }
+  }
+  flush();
+  return releases;
+}
+
+/**
+ * Releases after `from` up to and including `to`, newest first, with a count of
+ * bullets per section across all of them.
+ *
+ * @param {string} text
+ * @param {{from: string, to: string}} range
+ */
+export function releaseNotes(text, { from, to }) {
+  const versions = parseChangelog(text)
+    .filter((r) => cmp(r.version, from) > 0 && cmp(r.version, to) <= 0)
+    .sort((a, b) => cmp(b.version, a.version));
+  const counts = {};
+  for (const v of versions) {
+    for (const [k, items] of Object.entries(v.sections))
+      counts[k] = (counts[k] || 0) + items.length;
+  }
+  return { from, to, versions, counts };
+}
+
+/**
+ * Plugins the refresh moved, from the CLI's own lines
+ * (`Plugin "<name>" updated from <a> to <b> for scope ...`). A plugin updated in
+ * several scopes is reported once, from the oldest version any of them had.
+ *
+ * @param {string} output
+ * @returns {{name: string, from: string, to: string}[]}
+ */
+export function pluginUpdates(output) {
+  const byName = new Map();
+  const re = /Plugin "([^"]+)" updated from (\S+) to (\S+)/g;
+  for (const m of String(output || "").matchAll(re)) {
+    const [, name, from, to] = m;
+    const seen = byName.get(name);
+    if (!seen) byName.set(name, { name, from, to });
+    else {
+      if (cmp(from, seen.from) < 0) seen.from = from;
+      if (cmp(to, seen.to) > 0) seen.to = to;
+    }
+  }
+  return [...byName.values()];
+}
+
+function read(path) {
+  try {
+    return existsSync(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+
+function arg(argv, name) {
+  const i = argv.indexOf(name);
+  return i >= 0 ? argv[i + 1] : undefined;
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const from = arg(argv, "--from") || "0.0.0";
+  const to = arg(argv, "--to") || from;
+  const pipeline = releaseNotes(read(arg(argv, "--changelog") || ""), { from, to });
+
+  const pluginsDir = arg(argv, "--plugins-dir");
+  const refreshLog = arg(argv, "--plugin-refresh-log");
+  const plugins = [];
+  if (pluginsDir && refreshLog) {
+    for (const u of pluginUpdates(read(refreshLog))) {
+      const notes = releaseNotes(read(join(pluginsDir, u.name, "CHANGELOG.md")), u);
+      plugins.push({ ...u, notes });
+    }
+  }
+  process.stdout.write(JSON.stringify({ pipeline, plugins }, null, 2) + "\n");
+  return 0;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || "").href) {
+  runMain("release-notes", () => main());
+}

package/pipeline/scripts/unattended_policy.py

@@ -2627,6 +2627,14 @@ TOOLKIT_PATH_KEYS = ("path", "filename", "out_dir", "output", "output_path", "ou
 
 def _toolkit_path_refusal(name, ti, policy, env, cwd):
     for key, value in ti.items():
+        if isinstance(value, list) and (key == "paths" or key.endswith("_paths")):
+            for item in value:
+                if not isinstance(item, str):
+                    return f"{name} {key}: an entry that is not a string cannot be checked"
+                r = check_path(item, cwd, policy, env)
+                if r:
+                    return f"{name} {key}: {r}"
+            continue
         if not isinstance(value, str) or not value:
             continue
         if key in TOOLKIT_PATH_KEYS or key.endswith("_path"):

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-09T05:08:19Z",
+  "generatedAt": "2026-10-11T20:10:05Z",
   "skillCount": 228,
   "entries": [
     {
@@ -457,7 +457,7 @@
     },
     {
       "path": "shared/external/e2e-testing/SKILL.md",
-      "sha256": "e76dac61b973a5c509a9902a15a7c18ed226d838406fd0f8b513f24b45ea4025"
+      "sha256": "6d5fa81328d8b4c8ccc8e273487b7f27e6100f7192b2b3bdd2387b333a119659"
     },
     {
       "path": "shared/external/energykit/SKILL.md",
@@ -713,7 +713,7 @@
     },
     {
       "path": "shared/external/signal-community/SKILL.md",
-      "sha256": "0660107c2bf0e65847e72708a196b672ae7b9469bd98ec70793c988351024298"
+      "sha256": "66b584551428d9078c88ef5d1164c77a1985accaebdc373eb4bfcdd5e65ed0f1"
     },
     {
       "path": "shared/external/skill-creator/SKILL.md",
@@ -889,7 +889,7 @@
     },
     {
       "path": "shared/external/web-testing/SKILL.md",
-      "sha256": "3120db537a687adfbf396e500f4e146880e4b1a00ab339f85ab526853c947447"
+      "sha256": "28a088947d4c9ab216ae92131c42a700966d8b531047fa5a0af5bfa870376e11"
     },
     {
       "path": "shared/external/widgetkit/SKILL.md",