@mmerterden/multi-agent-pipeline 20.2.0 → 20.3.0

package/CHANGELOG.md

@@ -14,6 +14,928 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [Unreleased]
+
+## [20.3.0] - 2026-09-25
+
+### Added
+
+- **The client contract, over the CLI and localhost HTTP.** `contract-server.mjs`
+  serves runs, commands, run questions, issues, worktrees and the launch shape,
+  plans a launch and answers a pending question on `127.0.0.1`, byte for byte
+  what the CLI prints: a per-start bearer token in a 0600 file, Host and Origin
+  checks, schema-validated bodies up to 64 KiB, `?redact=1` (forced for a
+  browser origin), `?v=` major selection and idle shutdown. It never starts a
+  host CLI. `/multi-agent:serve` starts it on demand. `pipeline/contract/`
+  ships the client kit: a manifest pointing at `pipeline/schemas`, generated
+  TypeScript declarations and fixtures (`build.mjs`, run at prepack), the
+  frozen fields of the current client and a contract changelog of its own.
+- **Commands, run questions and the launch shape as data.** Every command
+  declares `parameters`, `gui`, `destructive` and `confirm` in its frontmatter,
+  held to `argument-hint` by `lint-skills`, and `commands.mjs --json` prints
+  the catalog. `run-questions.json` lists the Phase 0 pickers;
+  `MA_LAUNCH_REQUEST` names a request whose answers pre-fill them, validated by
+  `launch-request.mjs` (unset, Phase 0 is unchanged). `launch.json` declares
+  the unattended launch shape. `answer-question.mjs` records only an option id
+  the pending question offered, and `resume --answer` goes through it.
+  `issues.mjs`, `worktrees.mjs` and `runs-index.mjs --json` carry
+  `contractVersion`, schemas with `x-sensitivity`, and `--redact`.
+- **Per-stack evidence.** `stack-adapters.json` gives each stack (ios, android,
+  web, backend-node, python, go, rust, jvm, unknown) its detection, commands,
+  success markers, parsers, test-file patterns and truth-source globs.
+  `evidence-gate --stack` fails a test claim that executed nothing or counted
+  a failure, `test-summary.mjs` reads the counts from the runner's own output
+  and reports unread counts as unparsed, and `test-strength.mjs` reverts the
+  production side of a diff in a temporary worktree and requires the changed
+  tests to go red.
+- **Quality gates for autopilot runs.** With `MULTI_AGENT_UNATTENDED=1` or a run
+  in autopilot mode, `symbol-existence-gate` checks added references against
+  the stack's truth sources, `open-questions-gate` parks a run with open
+  analysis questions on `waitingFor: question` before Phase 2,
+  `verify-citations` matches quotes to lines and checks pre-existing claims
+  against the base commit, and `gate-ledger.mjs` is the one locked writer of
+  `state.gates[]`; with the variable set the commit hook requires every
+  mandatory gate to pass for HEAD. With neither, every gate is a no-op.
+- **Terminal output in the reader's language.** `user-facing.{mjs,sh}` resolve
+  `outputLanguage` and the host's command spelling (`/multi-agent:<sub>` or
+  `/multi-agent-<sub>`) once; the GUI, the autopilot menu bar and the terminal
+  panels use them, and `smoke-terminal-language.sh` fails a frozen string or a
+  hardcoded spelling in a user-facing surface. `promptLanguage` stays English.
+- `design-check-config` `inventory.targetsFile` names a JSON target catalog
+  that both design-check skills pass to `design_scenario_inventory`, for a repo
+  whose state drivers no source signal reveals.
+
+- `check-derived-drift.mjs`: a `git-paths` upstream type for sources that ship no manifest. The recorded version is the commit the port was taken from, and drift is any later commit on `upstreamRef` that touches `upstreamPaths`, so unrelated commits in an app repo do not count.
+- **Android knowledge: same-frame input intents, deferred state reads and
+  custom architecture rules.** `android-mvi-viewmodel` gains a per-intent
+  immediate-dispatch flag so text, toggle and selection intents write state on
+  `Dispatchers.Main.immediate` instead of a `Dispatchers.Default` hop, and shows
+  how a context parameter confines use-case invocation to the ViewModel
+  executor. `android-performance` gains a deferred-state-reads section (the
+  composition / layout / draw phase table, `offset { }`, `graphicsLayer { }`,
+  `drawBehind { }`) and a stability row for classes from modules the Compose
+  compiler does not see. `android-build-quality-gates` gains a custom detekt
+  rule set section for architecture rules a single file can show. `android-architecture`
+  adds the data-source-only repository rule, the shared request helper, feature-local
+  UI models and `internal`-by-default visibility. `compose-testing` fixes the
+  test-tag hierarchy and uniqueness rule. `compose-navigation` requires the
+  typed argument helper even for primitive-only routes, and its type-map
+  example uses a neutral search filter.
+
+- **Phone API on the contract server** (`features/phone-api.md`). Four routes
+  under `/v1/phone/` - runs and one run (always redacted), answer a parked
+  question, and launch - served by the existing handlers behind an Ed25519
+  device signature instead of the bearer token. The signed text covers method,
+  target, body digest, device id, timestamp and nonce; a request that is
+  unsigned, from an unknown or revoked device, more than 60 seconds behind or
+  5 seconds ahead of this machine's clock or older than the server's start,
+  replayed (seen nonces persist on disk, so a restart does not reopen them), or
+  for an unknown verb is refused. Requests whose signature verified go to a
+  0600 audit log with five generations; refusals decided before that go to a
+  separate, rate-limited refusals log, so an unsigned flood cannot rotate the
+  audit log. Neither holds the signature, nonce or body. Devices are enrolled locally with the new `phone-devices.mjs add|list|revoke|launch`,
+  which stores public keys only under the autopilot root with a per-device
+  scope (`read`, `answer`, `launch`), refuses to change the registry under
+  `MULTI_AGENT_UNATTENDED=1`, and is blocked by name in the unattended guard.
+  Launch from a phone is off until `phone-devices.mjs launch on`. An answer is
+  still only an offered option id, and the maturity and open-questions gates
+  re-run on resume. Pause, resume, stop and steer are not offered: their
+  existing backends start a session, run `launchctl`, delete a worktree or
+  queue free text. The bearer path for the desktop client is unchanged. Client
+  contract 1.2.0: `manifest.json` `phone`, `phone-signed-request.schema.json`,
+  `phone-devices.schema.json`, new `contract-error` codes. The phone app is a
+  separate project.
+
+- **Autopilot keeps the Mac awake while it is on.** `autopilot-on` installs a
+  second launchd agent, `com.multi-agent.autopilot-awake`, that runs
+  `/usr/bin/caffeinate -s -i` until `autopilot-off` removes it, because
+  launchd's `StartInterval` does not wake a sleeping Mac and a machine that
+  sleeps between ticks stops taking work. `-s` holds system sleep off on AC,
+  `-i` idle sleep on battery too. `autopilot-on` asks whether the display stays
+  on as well (`-d`, `awake.display`, default no: builds, simctl screenshots and
+  headless browsers work with the display asleep, and display sleep does not
+  lock the keychain). New `autopilot-awake.mjs render|install|remove|status`,
+  `templates/multi-agent-autopilot-awake.plist.template`, config `awake`
+  (`{enabled: true, display: false}`), and `awake: {held, display}` in
+  `autopilot-status --json`. The in-flight lock is unchanged.
+
+- **Autopilot operations around a run** (`features/autopilot-operations.md`).
+  A tick holds a sleep inhibitor from the launch to its end - `caffeinate -s -w
+<runner pid>`, honoured on AC only - and kills the process group it spawned on
+  every exit path. `autopilot-arming.mjs probe` checks every credential the configured
+  repos need before `autopilot-on` offers the schedule (`gh auth status`, and the
+  new no-value `credential-store.sh probe <key>`: `readable`, `missing` or
+  `locked`), and every tick re-probes the item's source through `check --probe`,
+  so a keychain that locked on sleep refuses with the key and the fix instead of
+  failing the run. `maxParallelAgents` caps runner-launched sessions working at
+  once, counting parked runs that are busy again; unset, the one-at-a-time claim
+  is unchanged, and the claim is now an exclusive create of `runner.pid`. Once
+  per local day the runner writes `gc-report-<date>.json` / `.md`, a
+  `gc-abandoned.sh` dry run over only the worktrees it created
+  (`worktrees.jsonl`; new `--only` and `--report` flags), with removal opt-in
+  through `gc.autoDelete`, and, when `digest.enabled`, a digest of items,
+  outcome classes, PRs, parked items and cost, sent through `reportChannels`
+  after the outbound gate (`reportDigest`, posted to `digest.jiraIssue`).
+  `autopilot-status --json` adds `inhibitorHeld`, `lastGcReport`, `lastDigest`
+  and `maxParallelAgents`.
+- **The autopilot runner is the single outward writer.** After an unattended
+  session ends at the Phase 4 hand-off, `autopilot-publish.mjs` verifies the PR
+  request the run left and only then pushes and opens the PR. The repository
+  comes from the runner's config, never the request; the worktree must belong
+  to it and sit on an unprotected branch that is ahead of the base fetched from
+  the configured remote; worktree git config that rewrites URLs or runs a
+  command is refused. The gate ledger, the named test log, the commit hook's
+  secret detectors over the commit range and the outbound gate are re-run
+  outside the run. The push URL is the config's `pushUrl` or `gh repo view`,
+  never `.git/config`; the push is never forced and runs with hooks off, and
+  `gh pr create --draft` takes the body from a file. Every spawn runs with
+  `MULTI_AGENT_UNATTENDED` unset. Bitbucket pushes the branch and writes a
+  summary, outcome `pushed-awaiting-pr` (terminal); an unknown host and every
+  failed check are `verification-failed`, with the verdict in
+  `pr-requests/<session>.verdict.json`.
+- The runner refuses to launch (`blocked-guard-missing`) unless `agent-guard.sh`
+  is registered on both the `Bash` and `Edit|Write|NotebookEdit` PreToolUse
+  matchers, prepares `pr-requests/` at 0700 before every launch, and passes
+  `MCP_TOOLKIT_URL_POLICY=strict` and `MCP_TOOLKIT_INDEX_DENY` to the child
+  (`launch.json` contract 1.1.0 carries both).
+- Post-PR reports move to the runner, off by default: `reportChannels` with a
+  configured `jira` target posts one Jira comment, and the new
+  `reportIssueUpdates` runs `update-issue-progress.sh` and a PR-link Jira
+  comment. Both run once, after the PR opened, through the outbound gate.
+- `pre-commit-check.sh --scan-range <base>..<head>` runs the secret detectors
+  over the lines a commit range added. `test-summary.mjs` records the log it
+  read in its ledger entry (`detail.source`). New autopilot config keys
+  `repos[].host`, `repos[].pushUrl`, `repos[].baseBranch`, `reportIssueUpdates`;
+  new state key `publish`.
+- **Plan critic, one round.** With the quality gates active, Phase 1 ends with
+  one adversarial critic (`agents/plan-critic.md`, dispatched through
+  `model-dispatch.sh --persona plan-critic --default fable`, so it follows the
+  fable switch like review) asking why the plan will fail under four lenses:
+  scope, feasibility, security and a cheaper alternative. Each objection carries
+  an id, lens, claim and evidence anchors (`file:line` resolved like
+  `verify-citations.mjs`, a plan task, an analysis id or heading, or
+  `inference`), in `.pipeline/plan-critique.json`
+  (`plan-critique.schema.json`). The planner answers each objection once:
+  accept and revise the plan, or rebut with evidence. `plan-critique-gate.mjs`
+  judges with no model call: a missing, duplicate or orphan reply, `round`
+  other than 1, or a second critique of a run already judged fails; an
+  objection citing a binding constitution rule blocks unless its reply
+  resolves it with an anchor that holds; everything else is advisory and kept
+  in `state.planCritique.advisory` for the plan render and the PR summary.
+  Gates active it records `plan-critique` in the gate ledger and parks a
+  failing run as `verification-failed` (exit 0 pass, 1 fail, 2 not-applicable,
+  3 unreadable); attended no critic runs and the gate, if invoked, is advisory,
+  exit 0, nothing written. One round, because further rounds of debate move
+  agents toward each other rather than toward the right answer. It is not in
+  `MANDATORY_AT_COMMIT`: the resume tail commits under the gates with no Plan
+  phase. Feature: `features/plan-critic.md`.
+- **Review decision rule for autopilot.** `review-decision-gate.mjs` runs on
+  the triage output after Step 3.7 in every round, the empty Step 3.1 result
+  included. With the quality gates active an accepted `blocking` finding keeps
+  its severity only when two independent reviewer outputs carry the same
+  finding (same file, and the same fingerprint or cited lines at most three
+  apart, never across different `ruleId`s or CWEs), when a `confirmed`
+  verify-by-test log inside the checkout shows a failing test and no pass, or
+  when test-integrity-gate.mjs produced it. Anything else is lowered to
+  `important` in place, never dropped, with its fingerprint and reason in the
+  report and the ledger entry; `approved` is recomputed. The Step 2.5 rebuttal
+  round does not run under the gates (`--rebuttal-allowed` exits 1), and a
+  reviewer entry with `roundCount` above 1 fails the gate. `review-decision`
+  joins `MANDATORY_AT_COMMIT`: every mode carries Review and the gate records
+  `pass` on a run with no blocker, so no clean commit is refused. Attended
+  review is unchanged: advisory output, exit 0, nothing written. The reviewer
+  panel on Claude Code is one model family, so the rule leans on executable
+  evidence rather than on more same-family agreement
+  (`features/review-decision.md`). `state.reviewIterations[].reviewDecision`
+  is declared.
+- **`/multi-agent:scaffold` and the scaffold contract.** The command resolves
+  `ai-<stack>-toolkit:scaffold`, dispatches it through the Skill tool and then
+  only verifies: `scaffold-gate.mjs --phase skeleton` requires a valid
+  `.scaffold.json` (`scaffold-manifest.schema.json`), no commit and no remote
+  yet, and the stack adapter's build, test and lint commands to pass, build and
+  test judged by `evidence-gate.mjs --stack` with test counts. The first commit
+  follows exit 0; creating the hosted repository is a separate question asked
+  after it and is refused unattended by agent-guard. For a scaffolded repo
+  Phase 2 runs `scaffold-gate.mjs --phase story` at entry and exit: build, test,
+  lint and the manifest's demo command must pass, or the next story does not
+  start (`features/scaffold.md`). The stack adapters gain an optional `lint`
+  command kind, declared for ios, android, web and backend-node.
+
+- **Project constitution and the spec-consistency gate.** `/multi-agent:analysis`
+  writes the project's invariant rules (security, accessibility, architecture,
+  licensing) to `~/.claude/knowledge/<project>/constitution.md` and its
+  machine-readable twin `constitution.json` (`constitution.schema.json`). Each
+  rule cites one labelled source: `repo` (a file and line in the repository),
+  `evidence` (a standards document or tracker item) or `inference`, which is
+  always `proposed` and never binding. A run with no repository keys the file on
+  the analysis name and cites no repo. `constitution.mjs` resolves the path
+  (worktree-safe), lists the repository files a rule may cite (license,
+  instruction files, lint configs, the stack manifest) and checks a
+  constitution, including that every repo ref resolves.
+  `spec-consistency-gate.mjs` checks by id, with no model call, that every
+  requirement (`BR-<slug>-NN` or `FG-NN`) has a task and a Test Plan row or test
+  task, that every task cites a defined requirement, and that no requirement
+  row or task waives a binding constitution rule. With the quality gates active
+  it records `spec-consistency` in the gate ledger and exits 0 pass, 1 gap, 2
+  not-applicable, 3 unreadable; attended it prints an advisory report, exits 0
+  and writes nothing. `/multi-agent:analysis-jira` runs it after planning: gates
+  active, a gap is the existing exit 4 and no issue is created; attended, the
+  preview gains an advisory `consistency:` line. Pipeline Phase 1 Step 12 runs
+  it before Phase 2. It is not in `MANDATORY_AT_COMMIT`, since a run whose
+  item carries no requirement id has nothing for it to check. Planning tasks
+  gain an optional `requirements[]` field, checked by `validate-planning.mjs`. Feature: `features/constitution.md`.
+- **Research before asking.** A run the autopilot runner finds parked on a
+  maturity blocker or on open analysis questions gets a research pass before it
+  is left for a person: `/multi-agent:research <id> --autonomous` reads the
+  tracker thread, issue links, similar closed items, linked documents and the
+  repository, and `research-gate.mjs` decides what closed. `inference` alone
+  never closes a gap, `evidence` must be quoted from a source in the fetched
+  context, `repo` must resolve at `file:line` or in a commit, and acceptance
+  criteria and business rules only ever yield candidates. The maturity check or
+  the open-questions gate re-runs on the result and decides; `proceed` resumes
+  the run, anything else parks it with the gaps left and the candidates found.
+  `maxAskRounds` now bounds these rounds per item. The research session runs
+  without the `research_*` MCP tools and web search. Engine:
+  `multi-agent-refs/research/engine.md`; feature: `features/research.md`.
+- `lib/issue-fetcher.sh` carries Jira comments and issue links and GitHub issue
+  comments on the request that fetches the item, bounded by count, per-comment
+  length and total bytes, and lists every tracker-written field in
+  `untrustedFields`. The maturity score is unchanged. `--rescore` re-scores a
+  descriptor on stdin with the same formula.
+- New state key `research` and schema `research-output.schema.json`;
+  `prefs.projects.<slug>.research.providers` (graylog, crashlytics,
+  counterpart).
+- `lint-skills` fails a skill under `shared/external` whose frontmatter has a
+  top-level key no host reads. The allowed set is skill-creator's packaging keys
+  plus Claude Code's documented skill fields; repo bookkeeping goes under
+  `metadata:`.
+
+- **Attribution check for vendored skills** (`_notices.mjs`). Every
+  `NOTICE-*.md` under `shared/external` lists the skills it covers in a
+  `## Skills (N)` section, and every vendored skill carries
+  `metadata.source: "<upstream> (<license>)"`. `lint-skills` fails when the two
+  disagree: a vendored skill no NOTICE lists (so deleting a NOTICE fails), a
+  listed skill without that source, a NOTICE whose upstream differs from the
+  skill's, a wrong count, or a skill listed twice. `build-stack-plugins.mjs`
+  runs the same check before writing anything and exits 1 on a problem, ships a
+  NOTICE only beside the skills its section lists, and gains `--check-notices`.
+  `lint-skills` also warns on a `metadata.source` that names no licensed
+  upstream (27 skills marked `community`).
+- `NOTICE-vibeship-spawner-skills.md` attributes `firebase` to
+  vibeforge1111/vibeship-spawner-skills under Apache 2.0, with the license terms
+  and the changes made to the upstream work.
+- `launch-request.mjs plan --channel desktop|phone` (default `desktop`) applies
+  that channel's input rule, so `plan --channel phone --redact` prints what
+  `POST /v1/phone/launch` returns for the same request file; the manifest's
+  phone-launch invocation passes it.
+- `CREDENTIAL_STORE_KEYCHAIN` scopes `credential-store.sh` and `keychain.py` to
+  one keychain file instead of the user's search list.
+- Schemas for `phases.json`, `token-budget.json`, `unattended-policy.json`,
+  `unattended-profile.json`, `secret-patterns.json` and
+  `review-file-exclusions.json`.
+
+### Security
+
+- `usage-register.mjs` sends the GitHub login proof only over https to the default reporting host or a host listed in `usageLog.trustedHosts`, and reads the server's answer by code: a login mismatch, a login without collaborator access and a decline each get their own status. `usage-report.mjs` no longer follows a redirect with the ingest token.
+- **The OS sandbox is the primary boundary for unattended runs.**
+  `install --unattended` always writes an OS sandbox block into the unattended
+  profile: enabled and required at startup, no unsandboxed retry, no excluded
+  commands, auto-allow off, writes confined to the worktree, host configuration
+  and credential stores denied, and network limited by a strict allowlist to the
+  package registries the stack adapters need. The autopilot runner refuses to
+  launch (`blocked-sandbox-unavailable`) unless the profile file's content still
+  holds the sandbox, and re-checks before every research pass and resume, so a
+  run that rewrote the profile cannot widen the next one. An unattended run
+  writes its logs and PR request under `~/.multi-agent-unattended` (the one
+  place outside the worktree the sandbox permits), and `Edit`/`Read` deny rules
+  cover the file and MCP tools the sandbox does not. Behaviour verified against
+  Claude Code 2.1.282 and recorded in `features/unattended-security.md`.
+- **The publish step verifies a clean checkout and refuses host changes.**
+  Independent verification builds and tests a detached checkout of the run's
+  commit, so an untracked file (a `.npmrc`, a `conftest.py`) cannot change what
+  runs; a build or test that rewrites a tracked file, or that changes
+  `~/.claude/{scripts,lib}`, the settings files, the profile or
+  `~/Library/LaunchAgents`, is refused before anything is pushed. The push range
+  is scanned through repository `.gitattributes` and binary blobs, so a path
+  marked `-diff`/binary cannot hide an added secret.
+- **The unattended command guard closes the round-3 one-liner bypasses** as a
+  second layer behind the sandbox: `/dev/*` and non-regular files as programs;
+  debuggers, job runners and tracers; `node -r`/`sort --compress-program`/
+  `rg --pre` helper values; git `send-pack`/`http-push`/`lfs push`/`svn`/`p4`,
+  credential helpers, `maintenance start`, browser/server subcommands and the
+  `--git-dir`/`--work-tree`/`--exec-path`/`--namespace` global flags; host
+  checks on git and `gh` URLs and `--hostname`; `ssh`/`scp`/`nc`/`dig` and
+  rsync-to-remote; `gh` alias normalization, `config set`, `config get` of a
+  token; git `mv`/`checkout`/`worktree add`/`clone`/`init`/`checkout-index`/
+  `apply --directory` write targets, `mkdir`, copy destination-plus-basename and
+  `mv`/`rm` sources; `cd -` as an unresolved directory; the whole host roots and
+  `$HOME`'s ancestors; the proxy and toolchain-redirect environment variables;
+  `patch` and `git apply`/`am`; and every path-typed MCP argument, including
+  inside `agent_run_steps`. A program file counts as trusted only when unchanged
+  at the run's base commit and inside the run's own worktree.
+- `fetch-confluence.sh` sends the token only to `prefs.global.hosts.confluence`
+  or a subdomain of it, or to Atlassian Cloud when no host is configured, and
+  refuses any other link host with exit 6 before the token is read. The setup
+  flows write secrets through the stdin sentinel (`set <key> -`);
+  `credential-store.sh` delegates writes to `keychain.py`, and its shell
+  fallback writes `-X` hex and decodes the `0x` marker, so a multi-line value
+  such as a service-account JSON round-trips byte-exact.
+- `context-link-extractor.sh` matches hosts by domain rather than suffix, so a
+  look-alike such as `evil-figma.com` is not classified as Figma, and a Graylog
+  label must end at a word boundary.
+- `agent-guard` blocks force-push bypasses (`HEAD`, any remote, push options,
+  `git -C`, `cd`) in every mode. Under `MULTI_AGENT_UNATTENDED=1` it also
+  blocks pushes, PR and issue writes, publisher scripts, Keychain reads,
+  fetches outside the host allowlist, package installs, manifest edits and
+  writes into protected paths, and fails closed. Phase 4 writes
+  `pr-request.json` through `pr-request.mjs` instead of pushing, channels posts
+  nothing unattended, and fetched text goes into `<untrusted-data>` blocks.
+- `pre-commit-check.sh --scan-range` scans every commit in the range on its own, reading content from the commit objects, so a secret added and later removed inside a branch is refused before it is pushed.
+- The publish step resolves its build and test commands from the base commit's manifests and refuses a range that changes those commands, their package scripts and hooks, the declared package manager, or the executable a command starts with (`publish/verify-scripts`).
+- The publish step snapshots git credential settings before running the build and tests, pushes with that snapshot, and refuses to push when `~/.gitconfig`, the XDG git config or the credential settings changed meanwhile (`publish/verify-credentials`). Processes started by verification are killed by process group and by a per-run environment marker.
+- With no `baseBranch` configured, a PR must target the remote's default branch; other bases need the new `allowedBases` repo option. Branch and base names that start with `-` or contain `..` are refused.
+- `readRegularFile` refuses a file whose path no longer names the opened descriptor (dev/ino compared after the no-follow open).
+- Redacted free text also replaces IPv4 addresses, host names under known TLDs and any `host:port`; file names, versions and code paths are left intact.
+- Prefs writes from usage identity, usage registration and the prefs migrator share one locked, atomic writer and keep the file at `0600`.
+
+- **The unattended Bash guard is fail-closed on anything it cannot parse into
+  simple commands** (`scripts/unattended_policy.py`, `agent-guard.py`). Under
+  `MULTI_AGENT_UNATTENDED=1` a command is judged only when it reduces to simple
+  commands joined by `;`, `&&`, `||` and plain pipes between non-interpreter
+  commands. A subshell, brace group, command or process substitution, heredoc,
+  background job, shell keyword, interpreter reading its program from stdin, `-c` cluster on a
+  shell, runtime-built command name, `sudo`/`doas`, `find -exec`, or a line above
+  50 segments is refused unparsed. `$(...)` is analysed instead of refused: each inner command must pass the same parser and policy checks, a substitution may not name a command, subcommand or write target, and nesting, backticks, `<(`/`>(` and arithmetic stay refused. Quoted-delimiter heredocs and here-strings are literal data; segments and redirections are split quote-aware; in-command variables and `$HOME` are expanded and an unresolvable write target or `cd` is refused. Wrappers are stripped with their option values
+  (`env -u`, `nice -n`, `timeout -s`); command basenames are casefolded and
+  absolute paths reduced to their basename; git aliases and `git -c
+core.hooksPath=` are refused. Path checks casefold on darwin, resolve through
+  `cd`/`pushd`, parse `--opt=value` and attached short options, cover `curl -o`,
+  `tar -C`, `unzip -d`, `ln`, `git checkout -- `/`git restore`, `patch`, and a
+  directory that is an ancestor of a protected path. New protected paths:
+  `~/.gitconfig`, `~/.config/git/`, the shell rc files, `~/Library/LaunchAgents/`,
+  `~/.claude/CLAUDE.md`, `~/.claude/plugins/`, `~/.claude/multi-agent-preferences.json`.
+  `gh` gains `alias`/`ssh-key`/`gpg-key`/`extension`/`codespace`/`secret`/`variable`
+  and `auth` (except `auth status`) to the write list, skips `-R/--repo` inside a
+  group, treats attached `-f*`/`-F*` as POST fields, and refuses graphql `@file`
+  fields. `curl`/`wget` parse the host with `urllib.parse.urlsplit`, refuse
+  `-x`/`--proxy`/`--connect-to`/`--resolve`/`-K`/`--unix-socket`/`--doh-url`, and
+  refuse any request body or upload outright. `keychain.py get/set/delete` and
+  `gate-ledger.mjs append/park` are blocked from Bash. `WebFetch` and the
+  toolkit's `web_*` tools are gated on the network allowlist (`web_eval`
+  refused), registered as a third PreToolUse matcher; the installer requires the
+  `Bash` tool-name matcher for the Bash guard and migrates a stale `Bash(...)`
+  guard entry. `agent-guard.py` arms a 5 s internal deadline (hook timeout 10 s)
+  and memoizes git reads. Attended verdicts are unchanged in the allow direction.
+- **The unattended guard judges what a command runs, not only its name**
+  (`scripts/unattended_policy.py`). `xcrun`, `arch` and `sandbox-exec` are
+  wrappers like `env`, so `xcrun git push` is judged as `git push`; `script`,
+  `watch`, `env -S` and `env -C` are refused because the guard does not model
+  the command line they run. An interpreter may run only a file the run did
+  not write: an installed pipeline script, a file the user cannot write, a
+  `node_modules/.bin` binary, or a file tracked and unmodified at HEAD. The same
+  holds for a command named by path (`./x.sh`, behind `nohup` too), a module
+  `python3 -m` finds in the cwd, `awk -f` / `sed -f` program files and the
+  Makefile `make` reads. Inline programs are refused on every interpreter
+  (`node -e/-p`, `perl -e/-E`, `ruby -e`, `osascript -e`, `php -r`, `lua -e`,
+  `Rscript -e`, `swift -e`, `bun -e`, `deno eval`), as are awk programs with
+  `system`, a pipe, `getline` or a `print >` redirect, sed programs with a `w`
+  or `e` command, and `make --eval` or a `VAR=value` operand.
+- **Configuration and environment that make git or a shell run a program are
+  refused wherever they are set.** One key list covers `git -c`,
+  `git --config-env`, `git clone -c` and `git config` (`diff.external`,
+  `core.pager`, `core.editor`, `core.sshCommand`, `core.fsmonitor`,
+  `core.hooksPath`, `gpg.program`, `url.*.insteadOf`, `alias.*`, `filter.*`,
+  `credential.*` and the rest); `git config --global/--system` writes and
+  `git config --edit` are refused. Every `GIT_*` variable other than commit
+  identity, date and prompt control is refused, as are `BASH_ENV`, `ENV`,
+  `PROMPT_COMMAND`, `CDPATH`, `HOME`, `NODE_OPTIONS`, `PYTHONPATH`, `LD_*`,
+  `DYLD_*` and a non-trivial `EDITOR` / `PAGER`, including after `env` and in
+  `arch -e`. `rebase --exec`, `bisect run`, `submodule foreach`,
+  `difftool --extcmd`, `filter-branch`, `grep -O`, `--upload-pack`,
+  `--template` and `ext::` / `fd::` transports are refused.
+- **Write targets the shell expands, and writers the guard did not read.** A
+  write target or `cd` with an unquoted glob is refused, since the shell picks
+  the path at run time; an inherited `CDPATH` leaves a bare relative `cd`
+  unresolved. `sed` `w` commands, `sort -o`, `find -fprint/-fprintf/-fls` and
+  `find -delete`, `git diff --output`, `git format-patch -o` and `ditto` are
+  read as writers. `crontab`, `launchctl` and `defaults` writes, `altool` and
+  `notarytool` are refused. New protected home paths: `~/.zshenv`, `~/.zlogin`,
+  `~/.zlogout`, `~/.bash_login`, `~/.ssh/`, `~/.gnupg/`, `~/.config/gh/`,
+  `~/.npmrc`, `~/.netrc`, `~/.git-credentials`, and the new
+  `~/.claude/multi-agent-unattended.settings.json`.
+- **Packages fetched by a runner command are refused.** `npx`, `npm exec` and
+  `npm x` pass only for a binary already in `node_modules/.bin`, because with
+  no TTY npm installs a missing package without asking; `--call` is refused.
+  `pnpm dlx`, `pnpx`, `yarn dlx`, `bunx`, `bun x`, `uvx`, `uv tool run/install`,
+  `pipx run/install`, `yarn global` and `npm install-test <pkg>` are refused.
+  `security` is judged by its subcommand after leading flags
+  (`security -q find-generic-password`).
+- **Every multi-agent-toolkit tool goes through the guard.** The installer
+  registers `agent-guard.sh` on `WebFetch|mcp__multi-agent-toolkit__.*` and
+  migrates the older web-tools-only matcher in place. Each step of
+  `agent_run_steps` is judged as if called directly, a web URL given to
+  `ios_open_url` / `android_open_url`, `xcrun simctl openurl` or `open` is held
+  to the host allowlist (an app's own deep-link scheme passes), and the
+  `research_*` tools are refused.
+- **The attended force-push rule covers deletes and hidden pushes**
+  (`agent-guard.py`). `git push origin :main`, `--mirror`, and `--prune` with a
+  glob refspec are blocked like a force-push to a protected branch; the rule
+  reads through subshells, brace groups, `sh -c` / `bash -c` payloads and
+  `eval`; and after a `cd` it cannot read, a relative `cd` keeps the directory
+  unknown, so a bare force-push there is blocked.
+- **`install --unattended` no longer changes attended sessions.** The profile
+  (`dontAsk`, the narrow allow list, the push deny, the toolkit env, the
+  optional sandbox) is written to `~/.claude/multi-agent-unattended.settings.json`
+  and the autopilot runner passes it to every child with `claude --settings`
+  (`launchArgv`, `researchArgv`, `resumeArgv`, and `{settingsFile}` in
+  `schemas/launch.json`). `~/.claude/settings.json` keeps its own posture; a
+  whole-Bash allow there is reported by the installer and doctor, not removed.
+  A profile an earlier install wrote into `settings.json` is moved out on the
+  next `install --unattended`, printed first. The allow list names `xcrun`
+  subcommands (`simctl`, `xcresulttool`, `xctrace`, `--find`) instead of all of
+  `xcrun`.
+- **The runner's guard precondition accepts only the installer's hook.** A hook
+  command counts only when it is exactly
+  `bash $HOME/.claude/scripts/agent-guard.sh` (or that path with `$HOME`
+  expanded), only user or managed settings count, the web entry has to cover
+  `agent_run_steps` and both `open_url` tools, and the launch is refused while
+  the permission profile file is missing.
+- `untrusted.mjs` defuses a forged closing tag written with whitespace, a tab
+  or a newline before the slash, which could end an `<untrusted-data>` block
+  early.
+- The Copilot setup skill and the token-rotation step in `recovery-guide.md`
+  stream the token over stdin instead of passing it to
+  `security add-generic-password -w`. `smoke-secret-off-argv.sh` also catches a
+  variable or backtick value on a store `set` and a `security` call carrying
+  `-w`/`-X` on argv, in scripts and lib as well as docs.
+
+### Changed
+
+- **First-party knowledge skills in place of skills of unknown license.** 23
+  knowledge skills are rewritten as original content and marked
+  `metadata.source: multi-agent-pipeline`, keeping their names so routing and
+  plugin indexes are unchanged: the nine `hig-*` skills (written against
+  Apple's public Human Interface Guidelines, which they cite),
+  `android-jetpack-compose-expert`, `kotlin-coroutines-expert`, `api-patterns`,
+  `api-security-best-practices`, `nodejs-backend-patterns`, `fastapi-pro`,
+  `docker-expert`, `github-actions-templates`, `observability-engineer`,
+  `monorepo-architect`, `architecture`, `debugging-strategies`,
+  `context-compression` and `accessibility-compliance-accessibility-audit`.
+  `agentflow`, `closed-loop-delivery`, `ios-developer` and
+  `android-ui-verification` are removed: the pipeline's own orchestration,
+  `multi-agent:test`, and the Swift, SwiftUI and Compose skills already cover
+  them. `NOTICE-provenance-unconfirmed.md` is gone with them, and `lint-skills`
+  and `build-stack-plugins` now reject any skill whose `metadata.source` is
+  `community`, whether or not a NOTICE lists it.
+- Knowledge-skill examples use neutral domains (orders, products, notes)
+  instead of travel wording.
+
+- The autopilot runner, intake and circuit breaker share one outcome contract
+  (`_autopilot-outcomes.mjs`: terminal, retryable, parked, blocked). Every
+  retryable outcome counts toward `maxAttempts` once per run, with new
+  `awaiting-answer`, `rate-limited` (its own backoff) and `verification-failed`
+  outcomes. The runner finds its run by the session id it passes as
+  `MULTI_AGENT_SESSION_ID`, which Phase 0 records as `sessionId`; a parked run
+  holds its repo, not a slot; only a linked worktree matched by session is
+  removed; spend is priced from tracker tokens and null when unknown, and
+  arming refuses on unknown spend.
+- The model router resolves a `fable` default to `opus` on every path while
+  `modelFallback.fableEnabled` is off, and `/multi-agent:review`,
+  `review-analysis` and the untracked-branch tail of `resume` ask it for their
+  reviewer and triage slots.
+- Every shipped surface uses the six-phase numbering in `phases.json`;
+  `smoke-phase-labels.sh` fails a `Phase N (Name)` that disagrees with it or a
+  phase above 5. Lite analysis mode and the removed `:local` commands are gone
+  from the refs, schema and Copilot skill.
+- Usage registration proves ownership of the GitHub login: it sends the verified account's `gh auth token --user <login>` as `Authorization: Bearer`, over https only (plain http only to loopback), without following redirects, and reports 401/403 with the login that could not be confirmed.
+- Android, Compose, localization, clean-code and command examples in the shipped skills use a neutral orders/payments domain. The iOS coding standard names its data classes `identity-document` and `order-reference`. Technical guidance is unchanged.
+- `unattended-security.md` and the publish step's docs state what the run's code can still reach when it runs as the runner's user (Keychain items readable without a prompt, `gh auth token`, the user's files) and recommend a separate macOS user for the runner.
+- Core skill frontmatter (`skills/shared/core/multi-agent-*`,
+  `apple-archive-compliance`, `google-play-compliance`) carries only keys a host
+  reads. `language`, `not-for` and `standards-registry` sit under `metadata:`,
+  and `lint-skills.mjs` reads `not-for` from either place and enforces the host
+  key set on `shared/core` as well as `shared/external`.
+- `lint-skills.mjs` rejects an angle bracket in any `description` or
+  `description-tr`, not only in `shared/external`; the `save` and
+  `test-screenshots` descriptions write placeholders as `{name}`.
+- The line-grace ceilings for `setup` and `sync` drop to their current lengths
+  (826, 528).
+- The autopilot indicator fixture and the menu bar comments use the six-phase
+  shape (`2/5 Dev`) with no pipeline-depth field, which the runner does not
+  write.
+
+- `NOTICE-swift-ios-skills.md` stays, with a `## Skills (67)` list and the
+  PolyForm Perimeter 1.0.0 URL; the license requires its terms and the
+  `Required Notice:` line to accompany every copy of the 67 skills.
+- 79 vendored skills carry `metadata.source` naming their upstream and license:
+  67 from swift-ios-skills, six Xcode build skills, `swiftui-expert-skill`, the
+  four Paul Hudson skills and `firebase`. `swift-security` records PolyForm
+  Perimeter 1.0.0 there instead of the upstream `license: MIT` line, which
+  contradicts the repository license. Twelve of these files drop one or two
+  blank lines to stay within 500 lines.
+- `clean-code` is written in this project's own words and marked
+  `metadata.source: multi-agent-pipeline`. It credits no upstream: the
+  repository it cited has no license, so nothing from it can be redistributed.
+  The skill stays in `shared/external`, the single source for knowledge skills
+  that the stack-plugin builder publishes and the Copilot and Codex installs copy.
+- Operational reporting is sent under the logged-in GitHub account that can
+  read the pipeline repository (`usageLog.accessRepo`), not the account `gh`
+  has active. New `usage-identity.mjs` checks each account `gh auth status`
+  lists with that account's token in the child's `GH_TOKEN`, caches the
+  answer in `usageLog.login` (7 days; 1 day when none qualifies), and
+  re-checks on `--refresh`. With no such account nothing is registered or
+  sent, and one line says why. `usage-register.mjs` replaces a stored token
+  issued for a different login (`usageLog.registeredAs`) and no longer falls
+  back to the OS user.
+- Each run record now says what happened: `ev` (`phase`, `completed`,
+  `halted`, `parked`), a run status derived from it, the current phase taken
+  from the tracker, task type, a halt or park reason code, and, opt-in through
+  `usageLog.includeTitle` / `usageLog.includePrUrl`, a cleaned one-line title
+  and the PR URL. `phase-tracker.sh` reports every non-pending transition as
+  `--event phase`; Phase 5 writes `status: complete` and `finishedAt` before
+  sending `--event completed`; halts send `--event halted` and parked runs
+  `--event parked`. A completed run is no longer reported with its Phase 0
+  status and phase.
+- The reported mode is one of `schemas/phases.json`'s modes or `unknown`, and
+  the command is one that still ships, so a state written by an older version
+  cannot report a removed mode. The analysis render writes `mode: analysis`
+  and an explicit `complete` / `failed` status.
+
+- The always-on description ceiling in `smoke-context-budget.sh` is 90500 (was 90000) for the new command and its shared/core counterpart.
+- Overlapping iOS knowledge skills state their boundary in the description, so a
+  host choosing between them has a clause to decide on: `swift-testing-pro` and
+  `swiftdata-pro`, the three concurrency skills, the four SwiftUI review and
+  pattern skills, and the two SwiftUI performance skills. Third-party
+  descriptions keep their upstream text and gain one appended clause, recorded
+  under "Local modifications" in their NOTICE. `backlog`, `localization-reuse-map`
+  and `swift-language` descriptions are shorter, so the always-on description
+  surface still shrinks with the boundaries in (90252 to 90237 bytes).
+- Tables of contents in `android-build-quality-gates/references/patterns.md` and
+  `ios-coding-standard/references/STANDARD.md`; `macos-spm-app-packaging` links
+  its `references/scaffold.md`.
+- Frontmatter of 65 external skills moves repo bookkeeping under `metadata:`:
+  `source` (42), `risk` (42), `date_added` (41), `version` (21), `tags` (15),
+  `standards-registry` (2) and `category` (1). `skill-conformance.mjs` reads
+  `metadata.standards-registry` and still accepts the top-level spelling.
+- `hig-components-content` and `hig-components-layout` descriptions each gain a
+  clause naming what they cover and which of the two handles the rest.
+- `NOTICE-xcode-build-skills.md` records that the six Xcode build skills link one
+  another by relative path. `NOTICE-paul-hudson-skills.md` records a table of
+  contents added to `swift-testing-pro/references/new-features.md`.
+  `NOTICE-dimillian-skills.md` names the `metadata:` keys.
+
+- Open questions: `open-questions-gate.mjs` runs as the last step of Phase 1
+  whatever `analysis.docStatus` says, and the resume tail runs it at Phase 0, so
+  every gated path leaves the entry `MANDATORY_AT_COMMIT` asks for (a list never
+  recorded is not-applicable). On re-entry the gate applies `state.lastAnswer`:
+  `assume` moves the rows to `analysis.assumptions[]` and records pass,
+  `ask-now` re-parks under `MULTI_AGENT_UNATTENDED=1`, `abort` stops the run as
+  verification-failed. Exit 3 halts Phase 1 too.
+- With the quality gates active, Phase 1 always writes plan todos, and
+  `plan-coverage-gate.mjs` reads a run that had a Plan phase but left no todos
+  and no Section 14 `Add new` row as a gap (exit 1); only a run with no Plan
+  phase is not-applicable. Phase 4 branches on exit code and `--json` verdict.
+- Review decision: Step 1.76 writes `.pipeline/test-integrity.json` and Step 2.7
+  `.pipeline/security-audit-<n>.json`; the gate reads both as files
+  (`--integrity`, `--source`), treats a missing or empty file as no findings or
+  no audit, and refuses an empty `reviewers: []` like a missing record (exit 3).
+  The phase doc writes `reviewIterations[-1].reviewDecision` and parks with an
+  explicit `gate-ledger.mjs park`.
+- The attended path of `verify-citations.mjs`, `plan-coverage-gate.mjs` and
+  `evidence-gate.mjs` returns the verdicts and exit codes of its base contract:
+  quote checks, nested deferred findings and the plan-coverage exit codes 1 and
+  3 apply only with the gates active. `test/attended-parity.test.mjs` runs a
+  corpus against the base scripts and lists the four intended differences, each
+  a false failure at the base.
+- `autopilot-config.schema.json` marks `askOnLowMaturity`, `reportStatus` and
+  `sendItemKeys` reserved: nothing reads them, and `autopilot-on` no longer
+  writes a default for them.
+- `smoke-removed-modes-absent.sh` scans `.github/` and rejects a fast mode or a
+  Short answer.
+- `smoke-no-mcp-in-dev-phases.sh` is described as what it is, a maintainer
+  regression check over a state file: the phase docs, `rules.md` and the
+  schema no longer say it fails a run. It has no default state file, and a
+  Figma entry recorded without an integer phase exits 2 instead of reading as
+  phase 0.
+- `write-state.mjs` names on stderr any top-level key a write introduces that
+  `agent-state.schema.json` does not declare. The write still lands: failing
+  it would stop a run over a documentation gap, and the runtime package ships
+  no validator.
+- The smoke runner gives each suite its own temporary `HOME`
+  (`SMOKE_SHARED_HOME=1` keeps the real one). The live keychain smokes run
+  against a throwaway keychain, `smoke-cross-cli-behavior.sh` installs a git
+  checkout into a temporary home and checks that, `gen-facts --check` leaves
+  out and names the numbers it cannot read without the sibling repos, and the
+  npm registry probe runs only with `SMOKE_NETWORK=1`.
+- `validate-schemas.mjs` compiles every schema with ajv under the draft it
+  names and validates each data file in `pipeline/schemas` against its sibling
+  schema; a data file without one fails. The contract test harness holds every
+  non-2xx body to `contract-error.schema.json`.
+- Complaint intake redacts reservation and order reference codes as `[REDACTED:reference]`, recognises more reference-code labels, and `validate-complaint-doc` warns on a code after any of them, in any case.
+- `guardRegistration` takes the managed settings path as an option; unit tests cover `allowManagedHooksOnly`, project-level `disableAllHooks` and `CLAUDE_CONFIG_DIR`.
+- `json-file-lock.mjs` has direct tests: contention between two processes, stale and dead-holder reclaim, timeout, atomic replace and exact file mode.
+
+### Docs
+
+- README (EN and TR) describes current behaviour only: the release-labelled
+  sections become feature sections, version history stays in this file and in
+  ADR-0014. The command tables list `analysis-jira`, `graph`, `security-review`
+  and `doctor`, and the Turkish `jq` prerequisite matches the English one.
+- `autopilot-status`: a waiting item is parked until `resume <id> --answer` or a
+  client answers it; a comment is posted only when `autopilotCommentsOnIssue` is
+  on. The `--subjects` example shows `Phase 2/5`.
+- `help` (EN and TR) lists the pipeline entries without a count and with no
+  depth question; the Turkish block matches the English one.
+- `sync` names the Codex transform without hardcoded spec and persona counts;
+  `docs/architecture.md` and `docs/ecosystem.md` count six sync targets.
+- Removed references to pipeline depth: `analysisPhase.mode` in Phase 1,
+  short-run elision in the cross-CLI and component-dispatch contracts, `:local`
+  in the tracker registration rule, and the Lite paragraph in `analysis`.
+- `unattended-gates.md` places plan critique before the open-questions gate
+  that closes Phase 1; `autopilot-circuit-breaker.md` excludes `died` and
+  `rate-limited` from the failure count; `autopilot-off` names the
+  `autopilot/abandoned/<task-id>` stash entry.
+- ADR-0007 and ADR-0008 carry the ADR-0012 macOS-only amendment.
+- `docs/features.md` opens with a table of contents.
+- Schema descriptions (`phases.json`, `token-budget.json`, `prefs.schema.json`,
+  `agent-state.schema.json`, `triage-output.schema.json`) state what each field
+  is and who reads it. The token-budget ceiling history moved from
+  `docs/token-budget-history.md` to the end of `CHANGELOG-archive.md`.
+- Removed `docs/internal/STABILITY-FIX-PLAN.md` and
+  `docs/internal/GENERICITY-REVIEW.md`.
+- `features/maturity-followup.md` states that a parked autopilot item is not
+  queued again by a later scan; it moves on `resume <id> --answer` or a client
+  answer, and the resumed run re-enters the maturity step.
+- `picker-contract.md` says `agent-guard.sh` blocks on an internal error when
+  unattended, instead of calling all three hooks fail-open.
+- The naming defaults, the Phase 2 conventions handoff, the task-sequence rule
+  and the repo-discovery sample use neutral order and storefront names.
+- The status command's group table lists `waitingFor` as a reason for the
+  waiting group.
+
+### Removed
+
+- `NOTICE-swift-ios-skills.md`, and the `license` line in `swift-security`.
+- **The Linux and Windows code paths** (ADR-0012). `credential-store.sh` keeps
+  only the Keychain backend: platform detection answers `macos` or `unknown`,
+  and on anything else every subcommand but `platform` exits 2 with `macOS only,
+see ADR-0012`; the `secret-tool` and PowerShell Credential Manager arms of
+  `get`, `set`, `delete`, `probe`, `list` and `doctor`, `ps_run`, and the
+  `linux` case in `delegate_to_python` are gone. `keychain.py` drops its
+  `secret-tool` branches and reports non-macOS hosts as unsupported. The
+  runner's in-flight sleep lock drops its `systemd-inhibit` branch. Also gone:
+  the `USERPROFILE` fallbacks, the Windows path conversion in the installer's
+  `relOf`, the `xclip` branch in `github-ssh-setup.sh`, the Linux cron example
+  in `audit-log-rotate.sh`, the Linux branch of `smoke-keychain.sh`, the
+  `secret-tool` stub in `smoke-bitbucket-contract.sh`, and the Linux and
+  Windows wording in the setup, uninstall, review, channels and
+  complaint-analysis SKILLs, `keychain.md`, `tracker-contract.md`,
+  `url-enrichment.md`, `recovery-guide.md` and the workflow comments. The seven
+  constructs ADR-0012 lists as load-bearing on macOS stay.
+  `smoke-macos-only.sh` now scans shipped code and docs for another platform's
+  backend or branch, proved on a planted `systemd-inhibit` line first.
+
+### Fixed
+
+- The commit hook scans the repository the commit runs in: a `cd <dir>` or `git -C <dir>` earlier on the line moves the scan to that checkout, and text inside a quoted heredoc is no longer read as a commit.
+- `_autopilot-config` honours `minLength`/`maxLength`, so an empty string in a
+  repo's `allowedBases` is refused at load. `attended-parity` fails, rather than
+  silently skips, when the base commit is missing unless
+  `MA_ATTENDED_PARITY_SKIP=1` is set. `feedback-send` accepts the bracketed IPv6
+  loopback (`[::1]`) that `URL.hostname` returns. `markedPids` in the publish
+  step is macOS-only (`ps -E`), dropping a dead Linux `/proc` branch.
+- A session at its plan limit that prints only the "You've hit your weekly
+  limit" notice is recognised, so the runner backs off instead of recording a
+  retryable failure.
+- `diff-explain` reads triage from the newest `reviewIterations` entry;
+  `issue-fetcher` strips a URL fragment and re-validates the key before
+  re-dispatching and times out Jira requests at 30 s; `evidence-gate`
+  recognises Gradle `BUILD SUCCESSFUL`, pytest `PASSED` and `N passed` and
+  reads `failed=0` as a zero summary; `plan-coverage-gate` writes its verdict
+  synchronously, so a pipe keeps all of it.
+- Autopilot checks `config.json` against `autopilot-config.schema.json` whenever arming, intake or the runner load it. A value the schema refuses, such as a non-numeric ceiling, slot count or attempt limit, blocks the queue with the field named (`blocked-config`).
+- The cleanup report lists a runner worktree only while the newest run state naming it carries the ledger row's session. A refused `git worktree remove` is reported as `remove-failed`.
+- The runner's circuit breaker counts each run once per window and, like the rate-limit backoff, reads a trailing time window. `ticks.jsonl` is size-capped and `attempted.jsonl` is compacted, with the full log kept in `attempted.jsonl.1`.
+- Autopilot identifies GitHub items by `owner/repo#N`; rows recorded under the short id still count. A Jira issue matched by more than one repo is queued once, and the other matches are listed in `queue.json.dropped`.
+- A run already waiting on a question at its first poll is parked from its own state instead of holding the queue.
+- When retiring a run with uncommitted work, the runner records the stash reference only when `git stash push` succeeded.
+- `gc-abandoned.sh` removes only paths git reports as worktree top levels, and only through `git worktree remove`.
+- `autopilot-status.sh --write` keeps the previous `status.json` and exits 3 when the status envelope cannot be built; `--json` prints an error object with exit 3.
+- `build-lock.sh` writes its owner atomically, takes a lock over only when the holder's process is gone, the owner file is stale, or the owner file is missing past a grace window, and `release <task-id>` frees only the caller's own lock.
+- `worktree-prepare.sh` recognises a registered worktree named through a symlinked path and re-enters an existing task branch.
+- Scripts that fall back to the installed copy of a helper keep running under `set -e` on bash 3.2 when the first location is missing.
+- `answer-question` and `runs-index` read run state as a bounded regular file, so a FIFO or oversized file is reported unreadable instead of blocking the contract server.
+- `gate-ledger.mjs check --repo` checks the named repository's HEAD.
+- A state update that changes nothing no longer rewrites the file or bumps `rev`.
+- `launch-request register-repo` holds the file's lock across read-modify-write, so concurrent registrations all land.
+- `usageLog.optOut` is honoured before any credential read.
+- `agent-state.schema.json` declares `review` and `complaintSpec`, and the state-keys check covers command docs too. design-check persists its platform under `designCheck`.
+- The channels report example records `invokedFrom: phase-5`.
+
+- The guard's internal deadline verdict reaches the hook wrapper: it is flushed
+  before the process exits, so an unattended guard that runs out of time refuses
+  with its reason. `MA_GUARD_DEADLINE_SECONDS` can lower the 5 s deadline, never
+  raise it.
+- `install/templates/claude-hooks.json` registers the same hooks the installer
+  writes: tool-name matchers (`Bash`, `Edit|Write|NotebookEdit`,
+  `WebFetch|mcp__multi-agent-toolkit__.*`, `Read|Bash`) and a readme that states
+  which gates fail open and that `agent-guard.sh` fails closed unattended.
+- Guard tests and the agent-guard and red-team smokes count an exit 2 as a
+  refusal only when stderr carries a rule's reason, so a crash, a timeout or a
+  missing decision in the policy code fails them.
+- `state.currentPhase` moves forward on every completed phase, so resume re-enters after the last finished phase instead of after Phase 0. `phase-tracker.sh update <n> completed` calls the new `record-phase.mjs`, which writes through the locked state writer and never moves the value back.
+- **An unattended run can execute its own documented steps.** Every command in
+  the phase docs now passes the fail-closed unattended guard as written, once
+  its placeholders are filled. Shell control flow moved into installed scripts,
+  each called as one command: the new `worktree-prepare.sh` (heal a stale lock
+  and dead admin entries, residue guard, add or re-enter, identity; JSON out)
+  and `build-lock.sh acquire|release`; `probe-evidence-capability.sh --platform
+auto --stack-root` picks the platform from `stack-detect.sh` and records a
+  backend repo as `other` with a `skippedReason`; `repo-hygiene.sh
+ensure|release|gitignore|prune <root>` runs without sourcing;
+  `triage-memory.mjs prior-art` answers every finding in one call;
+  `memory-save.sh --from-json` saves a synthesis array, bodies with spaces and
+  newlines included; `test-integrity-gate.mjs --out`, `plan-coverage-gate.mjs
+--analysis-from-state --json-out`, `test-gap-scan.mjs --stack-from <state>` and
+  `render-agent-log-cost.sh --append <log>` replace the redirects, arrays and
+  `case` blocks around them. Write targets in the docs are spelled
+  `{worktreePath}/...`, LLM-written JSON goes through the Write tool, and
+  `stack-detect.sh --json` replaces the `eval`. The steps a run does not take
+  (credential read, evidence push, `gh pr create`, issue comment and progress
+  sync, release PR edit) carry a `# unattended: skipped` comment, and
+  `test/unattended-doc-lines.test.mjs` fails on any other refusal; its doc
+  scanner judges a template line with its placeholders filled.
+- `gate-ledger.mjs park` is allowed from Bash again under
+  `MULTI_AGENT_UNATTENDED=1`, as `unattended-gates.md` instructs: parking only
+  stops the run. `append` stays refused.
+- The autopilot runner's guard-registration check also requires `agent-guard.sh`
+  on the `WebFetch|mcp__multi-agent-toolkit__web_.*` matcher that the installer
+  registers.
+- Desktop launch free text is refused only when its first word is an op or mode
+  word, the one position that can route; "Add unit test for X" is accepted.
+  Newlines, control characters, a leading `-`, quotes, backticks and URLs are
+  still refused, and the phone route still takes structured input only.
+- The Codex and Copilot installs copy every vendored skill's `NOTICE-*.md` next
+  to the installed skills, so the attribution ships with them.
+
+- Phase 3 no longer passes JSON through a `${X:-{}}` default, which bash 3.2
+  (the stock macOS `/bin/bash`) expands to `{\}`: the review decision gate read
+  that as unreadable input and every gated commit was refused, and the Step 3.0
+  merge came out empty. `smoke-shell-portability.sh` runs the documented blocks
+  under `/bin/bash` and rejects a brace default in any doc.
+- `plan-critique-gate.mjs`: an `analysis` anchor resolves only on a requirement
+  id or a whole heading, and a rebuttal clears a binding objection with a file
+  anchor only as `path:line` plus a quote.
+- Pre-existing claims (`_pre-existing.mjs`) need a cited line that the diff from
+  the base does not add or change, the same text elsewhere in the base file no
+  longer counts, a blank or punctuation-only line never qualifies, and a
+  failing-test log must sit in the checkout or the run's state directory, name
+  the test and show a failure marker.
+- `spec-consistency-gate.mjs` matches `CON-` ids in any case and reads passive
+  and gerund waivers (`is waived`, `waiving`, `waived for`, `does not apply`).
+- `symbol-existence-gate.mjs` resolves JSON keys by their full nested path: an
+  invented dotted key built from segments that exist elsewhere, or a bare leaf
+  that exists only nested, is reported missing.
+- `evidence-gate.mjs`: with the gates active a test claim needs a positive
+  executed count, from the log or from the new `--junit` / `--xcresult` /
+  `--xcresult-json`; adapters gain `skipped` markers, and a Gradle log whose
+  every test task is `SKIPPED` or `NO-SOURCE` or a Maven `Tests are skipped.`
+  counts as zero. The `failed: 0` zero form is read only as a summary-list item,
+  so `Assertion failed: 0 == expected` stays a failure. The web and Node
+  adapters fail on vitest's `Errors N error` and yarn's `error Command failed`.
+- `test-strength.mjs` reports a test that goes red only by failing to compile or
+  load without the change as `unjudged`, never red (adapter `loadError`
+  markers); red plus unjudged is a pass in the ledger, unjudged alone
+  not-applicable.
+- `verify-citations.mjs` needs a quote of at least 8 non-space characters or
+  the whole line, and records not-applicable when there is nothing to check.
+- `scaffold-gate.mjs`: a manifest `vars` entry cannot replace the per-run
+  `resultBundle`. The phase docs handle scaffold exit 3 as a halt and exit 2 as
+  a call error.
+- Doc counts: 10 agent personas and Codex TOML files, 13 rules, 61 Copilot
+  sub-command skills, 158 external skills, the stack plugins' skill counts and
+  versions, and the toolkit's tool count.
+- Product voice in `stack-adapters.md`, `sync/SKILL.md`,
+  `unattended-contract.md`, `phase-0-init.md`, `gen-facts.mjs` and the
+  `waitingFor` schema description; removed-mode leftovers in `help/SKILL.md`,
+  `payload-contracts.md` and the bug report template.
+- **A launch request's input is a reference, not a prompt.** The run starts
+  with `--permission-prompts none`, so `launch-request.mjs` accepts a Jira key,
+  a GitHub issue URL, `repo#N`, `#N` or a Jira URL on the configured host, and
+  on the desktop channel free text that the plan passes as one quoted
+  argument. A newline, a control or format character, a leading `-`, a
+  flag-like token, and any token naming a pipeline op or mode keyword (read
+  from the command tree, the dispatcher's routing table, `phases.json`,
+  `launch.json` and the workspace options) is refused on every channel; the
+  phone route takes structured references only. `repo` must be a configured
+  autopilot repo or one registered with the new
+  `launch-request.mjs register-repo <path>` (refused under
+  `MULTI_AGENT_UNATTENDED=1`); any other directory is `403 repo-not-allowed`.
+- `fetch-confluence.sh` refuses a host that is not a bare `host[:port]` before
+  the allowlist check and before any token is read (`host-malformed`, exit 6),
+  so `--host attacker.example/.confluence.example.com` and the same with `#`,
+  `?`, `@` or `\` no longer pass the suffix match; the check compares the string
+  curl receives. `issue-fetcher.sh` holds a Jira URL to the same shape and to
+  the configured Jira host (Atlassian Cloud only when none is configured)
+  before it re-dispatches with that host, instead of sending the Jira token to
+  whatever host the link named.
+- `scrub` (the redacted contract views and every phone response) replaces
+  `host.tld/path` links written without a scheme, absolute paths under
+  `/Volumes`, `/private`, `/var`, `/opt` and `/tmp`, and any user's home
+  directory; the redacted runs view scrubs phase names too.
+- `/multi-agent:autopilot-off` is declared `destructive: true` with
+  `confirm: required`, because `--now` abandons the item in flight, and it
+  names that item and asks before stopping it.
+- Docs: the phone API's question-id pattern and audit outcomes
+  (`registry-unreadable`), the attended exit of `plan-critique-gate.mjs` and
+  `spec-consistency-gate.mjs` (3 on a usage error) and
+  `review-decision-gate.mjs` (2), the `scaffold-gate.mjs` row in the
+  unattended contract, and the picker contract's path.
+- `lint-skills` rejects an unquoted frontmatter value YAML would not parse (a
+  `: ` inside it, or text after a flow collection), and an angle bracket in the
+  description of a skill that ships into the stack plugins. `signal-community`
+  had such a header; it now parses, and four external skill descriptions drop
+  angle brackets.
+- `NOTICE-paul-hudson-skills.md` and `NOTICE-avdlee-swiftui-agent-skill.md`
+  attribute `swiftui-pro`, `swift-concurrency-pro`, `swiftdata-pro`,
+  `swift-testing-pro` and `swiftui-expert-skill` to their MIT upstreams, which
+  had no notice; the stack-plugin builder ships them with those skills.
+- The evals of eleven renamed knowledge skills name the skill as it ships
+  (`callkit-voip`, not `callkit`), so a skill-creator run matches them to the
+  right skill.
+- `build-stack-plugins.mjs` removes a plugin's `NOTICE-*.md` once its source
+  file is deleted, and bumps the version. It only removed a notice whose source
+  still existed but no longer named one of the plugin's skills.
+- The autopilot publish step no longer takes the run's gate ledger as evidence.
+  It re-runs the stack adapter's build and test commands in the worktree, with
+  token-shaped variables, the ssh agent socket and askpass helpers removed and
+  a bounded timeout (`verify.timeoutSec`), and judges the output with
+  `evidence-gate.mjs --stack` and `test-summary.mjs`; a failure, zero tests, or a
+  stack with no commands refuses (`publish/verify-*`) unless
+  `verify.allowUnverifiedStack` is set. A ledger that names no test log is
+  refused as `publish/test-log`.
+- The publish step pushes from a fresh bare staging repository with no system
+  config and a global config holding only the operator's `credential.*`
+  settings, instead of from the worktree behind a key denylist. `url.*`,
+  `http.proxy`, `http.curloptResolve`, `http.sslVerify`, `http.extraHeader`,
+  `credential.*`, `core.sshCommand` and includes in the worktree's config no
+  longer reach the push, the base fetch or the remote-branch check.
+- The pushed branch must be the `branch` the run recorded in its state, and a
+  branch already on the remote is refused unless this session pushed it and its
+  tip is an ancestor of the run's HEAD (`publish/remote-branch`). A worktree
+  with uncommitted changes to tracked files is refused, since the tree tested
+  would not be the tree pushed.
+- Agent-writable files are read as bounded regular files
+  (`lib/regular-file.mjs`): the PR request (read once and validated in process
+  with `validatePrRequest`), the run state, the test log (inside the worktree or
+  the run's directory), run states and trackers in the runner, `_run-paths.mjs`
+  and `gate-ledger.mjs`. A FIFO under any of those names blocked the tick.
+- `gc-abandoned.sh` keeps a run parked with `verificationFailed` or `waitingFor`,
+  which gate-ledger's park writes with `status: failed` and pass 2 removed as
+  finished. The daily cleanup report also drops a worktree whose item's newest
+  attempt is parked, since a parked run leaves the queue when its session ends.
+- The tick's credential probe also checks the credential the item's repo
+  publishes with (`gh auth status` for a GitHub host, `check --repo`), and
+  `verification-failed` rows refused at `publish/remote`, `publish/push` or
+  `publish/pr-create` count toward the circuit breaker; the runner now records
+  the refusing gate as `publishGate`.
+- Spend in the arming check and the daily digest counts each run once, at the
+  largest cumulative `usd` any of its rows recorded, instead of adding every row
+  (`_cost.mjs` `attemptSpend`).
+- `maxAskRounds` counts research rounds over the whole attempt log rather than
+  its last 50 rows.
+- `runner.pid` is claimed by writing a temp file and hard-linking it into place,
+  the runner's other files are replaced by temp file and rename, and an
+  unparseable `runner.pid` younger than a minute is left for the tick writing
+  it. A run retired as died is marked `abandoned` through the locked state
+  writer with a `rev` bump; `status: abandoned` and `abandonedBy` are declared
+  in `agent-state.schema.json`.
+- The Phase 0 state template in `phase-0-init.md` is a valid
+  `agent-state.schema.json` document (`schemaVersion`, an integer `shortId`,
+  phase keys 0-5), and a unit test holds it there. The schema declares the keys
+  the phases read (`inputType`, `offlineOnly`, `figmaUrl`, `instructionFiles`,
+  `contextLinks`, `crashContext`, `fortifyFinding`, `graylogContext`), and
+  `remoteType` accepts `generic-git` and `local`, which Phase 0 writes.
+- `runs-index` groups a run with `waitingFor` set as `waiting` at any phase. A
+  run paused on a question at phase 0 was grouped `question`, whose offered
+  action is garbage-collecting an abandoned intake.
+- `autopilot-status --subjects` no longer prints a `Full` pipeline-depth label
+  the runner never writes, and the menu bar drops the matching field.
+- The contract manifest's `launch-spec` surface carries `launch.json`'s version
+  (1.1.0), and `phone-signed-request.schema.json` states the timestamp bounds
+  the server applies: 60 seconds behind, 5 ahead.
+
+## [20.2.1] - 2026-09-22
+
+### Fixed
+
+- **Usage reporting could attribute a run to a work identity.** On a machine with
+  more than one identity, the reporting login came from `identities[0]` (or the
+  active `gh` account inside a work repo), so a run could land on the panel under
+  a corporate account rather than the personal login that owns the ingest token.
+  A new `usageLog.reportAs` pins the reporting login and is resolved before
+  `identities[0]`, `gh api user` and the OS user.
+
 ## [20.2.0] - 2026-09-21
 
 ### Added
@@ -1780,7 +2702,7 @@ A review of the three repositories together (pipeline, toolkit MCP, plugin marke
 - **Sourced from zsh, `credential-store-resolver.sh` printed the store path to stdout** and `figma-token.sh` asked for a single key named `figma figma_pat`.
 - **`validate-analysis-doc.mjs` crashed on a document without front matter,** failed the gate on a check it called a warning, listed the correct Turkish word `Onay` as a typo, and cited "Locked 37" in a list of 36.
 - **`multi-repo-pipeline.sh` committed `git add -A`** while its header said staged changes, and ignored `state.identity`. `plan-todos.sh` returned 0 for an unknown id. `update-issue-progress.sh` failed on macOS `mktemp` on the second call.
-- **Smoke hygiene.** Thirty-six smokes: five asserted against the installed `~/.claude` copy instead of the repo, one passed when `sha256sum` was missing (`"" = ""`), eleven used predictable `/tmp` paths, five wrote probe files into the repo tree, five wrote into the real `$HOME`, four turned errexit on halfway through, four had assertions that could not fail, and the `THY` personal-data pattern matched `thyme` under `grep -i`.
+- **Smoke hygiene.** Thirty-six smokes: five asserted against the installed `~/.claude` copy instead of the repo, one passed when `sha256sum` was missing (`"" = ""`), eleven used predictable `/tmp` paths, five wrote probe files into the repo tree, five wrote into the real `$HOME`, four turned errexit on halfway through, four had assertions that could not fail, and a short personal-data pattern matched `thyme` under `grep -i`.
 - **Smaller ones.** `build-skills-index.mjs` recorded `|` and `>-` as descriptions for five skills, so `match-skills` could never score them; `learning-curve` and `aggregate-metrics` computed "cache ratio" with different formulas; `graph-build` omitted Go; `repo-map --include` matched substrings while documented as globs; `eval-mine-corpus` read the corpus from a path the writer never used inside a worktree; `gen-mode-dispatch` defaulted to a mode removed in 16.0.0; `scorecard` claimed no network and ran `npm audit`; `_dev-only-files` misgrouped its regex; `render-cost-summary` selected 0/0 phases; `gc-refs` matched `pr-body-final.md`; `credential-inventory` reported every key missing with rc 0 when no backend existed; `repo-cache` and `issue-fetcher` split scan roots on whitespace; `md2confluence-v3.py` detected every document as Turkish and its residual-character warning could never fire; `github-ssh-setup.sh` wrote `UseKeychain` on Linux; dead functions and stale headers in `cost-lib`, `extract-conventions`, `shadow-git`, `fetch-document`, `benchmark-phase-0`, `sync-parity-check`, `_mcp-register`, `_plugin-skills`, `cost-budget-check`, `triage-memory`, `migrate-prefs`, `eval-golden-tasks`; dangling references to `figma-navigation`, `/multi-agent:fix-bug`, `ask_choice.sh`, `refs/frontend-guide.md` and a `-v610` anchor.
 - **Vendored knowledge skills point at files that exist.** Twenty-six external skills linked 184 files that were never vendored; 58 were fetched from their upstream (Dimillian/Skills, MIT, provenance recorded), the rest de-linked. `help-skills` (Turkish, install-path catalog) is retired; `ios-module-structure` resolves its scripts relative to the skill; `ios-coding-standard` examples use a neutral domain.