@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.0

package/pipeline/commands/multi-agent/serve/SKILL.md

@@ -0,0 +1,62 @@
+---
+description: "Start the local contract server a client (the macOS toolbox, a web page) reads runs, commands, questions, issues and worktrees from, on 127.0.0.1 behind a per-start token. It stops by itself after 15 idle minutes. Use when a client asks for the HTTP carrier instead of the CLI."
+description-tr: "Bir istemcinin (macOS toolbox, bir web sayfası) run, komut, soru, issue ve worktree okuduğu yerel sözleşme sunucusunu 127.0.0.1 üzerinde, her başlatmada yeni bir token ile başlatır. 15 dakika boşta kalınca kendiliğinden durur."
+allowed-tools: Bash, Read
+argument-hint: "[--port <n>] [--idle-minutes <n>] [--allow-origin <origin>] [--print-token]  -  all optional, --allow-origin may repeat; binds 127.0.0.1 only"
+parameters: [{"name":"--port","kind":"text"},{"name":"--idle-minutes","kind":"text"},{"name":"--allow-origin","kind":"text","repeat":true},{"name":"--print-token","kind":"flag"}]
+gui: hidden
+destructive: false
+confirm: none
+not-for: status, autopilot-on
+---
+
+# multi-agent serve  -  the contract over HTTP, on demand
+
+**Input**: $ARGUMENTS
+
+Starts `contract-server.mjs`: the same JSON the CLI prints (`runs-index.mjs`,
+`commands.mjs`, `issues.mjs`, `worktrees.mjs`, `launch-request.mjs`,
+`answer-question.mjs`), served over HTTP on `127.0.0.1` for a client that would
+rather hold a socket than spawn a process per read. Routes, schemas and the
+versioning rule are in the package's `pipeline/contract/README.md` and
+`manifest.json`.
+
+It is never a service. It runs until 15 minutes pass without a request
+(`--idle-minutes`) or it gets SIGTERM, and removes its token file either way.
+
+## Start it
+
+Run it in the background (it keeps running), then read its first stdout line:
+
+```bash
+node "$HOME/.claude/scripts/contract-server.mjs" $ARGUMENTS
+```
+
+The ready line is one JSON object: `url`, `port`, `pid`, `tokenFile`,
+`idleMinutes`. Report `url`, `pid` and `tokenFile` in `outputLanguage`.
+
+- **Never print the token**, and do not pass `--print-token` yourself: it puts
+  the token on stdout, which lands in this transcript. It exists for a client
+  that spawns the server as its own child. The token is in `tokenFile` (0600).
+- `--host` accepts only `127.0.0.1`; anything else (0.0.0.0, ::, a LAN address)
+  exits 2. Say so rather than retrying another address.
+- `--allow-origin` is for a browser page the user named; without it no Origin
+  is accepted. A request that carries an Origin is always served redacted.
+
+## Stop it
+
+Send SIGTERM to the `pid` from the ready line, and only that pid:
+
+```bash
+kill -TERM <pid>
+```
+
+Or leave it: it exits on its own when idle.
+
+## What it will not do
+
+There is no route that merges, marks ready, runs a command or starts a host.
+`POST /v1/launch` validates a launch request, writes it (0600) and returns the
+argv and environment `launch.json` declares; the client starts the process.
+`POST /v1/runs/{id}/answer` accepts only an option the run's pending question
+offered.

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -1,6 +1,11 @@
 ---
 description: "First-run setup wizard: keychain token discovery, Git Identity onboarding, and pipeline preparation. Use when the pipeline is being set up for the first time, or tokens and git identity need onboarding."
 description-tr: "İlk kurulum sihirbazı: keychain token keşfi, Git Identity kaydı ve pipeline hazırlığı."
+argument-hint: "[jira-keys | hosts | accounts]  -  optional; no argument runs the whole onboarding"
+parameters: [{"name":"section","kind":"enum","enum":["jira-keys","hosts","accounts"]}]
+gui: form
+destructive: false
+confirm: none
 allowed-tools: Bash, Read, Write, AskUserQuestion, WebFetch
 ---
 
@@ -10,26 +15,15 @@ allowed-tools: Bash, Read, Write, AskUserQuestion, WebFetch
 node "$HOME/.claude/scripts/doctor.mjs"
 ```
 
-Run it before the first question and again at the end. The first run turns setup
-from a fixed script into a targeted one: there is no point asking for a token
-that is already mapped and answering. The second run is the only honest way to
-end - "setup complete" is a claim, and the doctor's exit code is the evidence for
-or against it. Report both in `outputLanguage`, and if the second run still shows
-a BLOCK, say so plainly rather than closing on the word "complete".
+Run it before the first question and again at the end. The first run turns setup from a fixed script into a targeted one: there is no point asking for a token that is already mapped and answering. The second run is the only honest way to end - "setup complete" is a claim, and the doctor's exit code is the evidence for or against it. Report both in `outputLanguage`, and if the second run still shows a BLOCK, say so plainly rather than closing on the word "complete".
 
 ## Setup (Credential Store + Git Identity Onboarding)
 
-Cross-platform setup  -  uses `$HOME/.claude/lib/credential-store.sh` to read/write secrets in the platform-native credential store:
+Uses `$HOME/.claude/lib/credential-store.sh` to read/write secrets in the macOS Keychain (`security`, built in). The pipeline is macOS only (ADR-0012).
 
-| Platform | Backend | Built-in? |
-|----------|---------|-----------|
-| macOS    | Keychain (`security`) | Yes |
-| Windows  | Credential Manager (PowerShell `CredentialManager` module) | Module install required |
-| Linux    | libsecret (`secret-tool`) | Distro package required |
+Run `~/.claude/lib/credential-store.sh doctor` first  -  it prints the platform and whether the backend is usable.
 
-Run `~/.claude/lib/credential-store.sh doctor` first  -  it prints platform + missing dependencies with the exact install command.
-
-On macOS and Linux the shell driver auto-delegates `get`/`set`/`delete` to the deterministic Python helper at `$HOME/.claude/scripts/keychain.py` (Python 3 stdlib only, no external deps). The Python path writes both `-l` (label) and `-s` (service) attributes so items are findable regardless of how callers look them up. Set `KEYCHAIN_DELEGATE=0` to force the raw shell path.
+The shell driver auto-delegates `get`/`set`/`delete` to the deterministic Python helper at `$HOME/.claude/scripts/keychain.py` (Python 3 stdlib only, no external deps). The Python path writes both `-l` (label) and `-s` (service) attributes so items are findable regardless of how callers look them up. Set `KEYCHAIN_DELEGATE=0` to force the raw shell path.
 
 ### Step 0  -  Language Selection
 
@@ -85,10 +79,8 @@ command -v pdftotext >/dev/null 2>&1 || echo "pdftotext: MISSING"
 | Output | Action |
 |--------|--------|
 | `Backend: ✓` | Continue to Step 1 |
-| Linux: `secret-tool ✗ MISSING` | Prompt: `sudo apt install libsecret-tools` (Debian/Ubuntu) or `sudo dnf install libsecret` (Fedora). Re-run setup after install. |
-| Windows: `CredentialManager ✗ MISSING` | Prompt: `Install-Module CredentialManager -Scope CurrentUser -Force` in an elevated PowerShell. Re-run setup. |
-| Platform `unknown` | Halt  -  credential storage cannot proceed. |
-| `pdftotext: MISSING` | Advisory. Print `brew install poppler` (or distro equivalent), continue. `.docx` needs nothing. |
+| Platform `unknown` or `ERR: macOS only` | Halt  -  the pipeline runs on macOS only (ADR-0012). |
+| `pdftotext: MISSING` | Advisory. Print `brew install poppler`, continue. `.docx` needs nothing. |
 
 ### Credential Key Naming Rule
 
@@ -97,7 +89,7 @@ command -v pdftotext >/dev/null 2>&1 || echo "pdftotext: MISSING"
 
 ### Step 1  -  Dynamic Credential Discovery
 
-Instead of checking only hardcoded key names, discover ALL user keys and intelligently map them to services. Uses cross-platform `credential-store.sh list`:
+Instead of checking only hardcoded key names, discover ALL user keys and intelligently map them to services. Uses `credential-store.sh list`:
 
 **1a. Discover all keys:**
 ```bash
@@ -223,7 +215,8 @@ git or any synced tree - under the standard per-user name, so it is revocable on
 its own:
 
 ```bash
-~/.claude/lib/credential-store.sh set "${USER}_Usage_Ingest_Token" "<pasted-token>"
+pbpaste | ~/.claude/lib/credential-store.sh set "${USER}_Usage_Ingest_Token" -
+pbcopy < /dev/null
 ```
 
 Then, **whether they pasted or skipped**, run:
@@ -347,11 +340,11 @@ For PAT / API key / username:
 
 Pipeline runs silently  -  value is piped via stdin (`-` sentinel) so it never lands on argv / shell history:
 ```bash
-pbpaste | ~/.claude/lib/credential-store.sh set "<KEY_NAME>" "$(cat)"
+pbpaste | ~/.claude/lib/credential-store.sh set "<KEY_NAME>" -
 pbcopy < /dev/null
 ```
 
-(The shell driver auto-delegates to `~/.claude/scripts/keychain.py` on macOS / Linux, which writes both `-l` (label) and `-s` (service) attributes so callers using either convention find the same entry.)
+(The shell driver auto-delegates to `~/.claude/scripts/keychain.py`, which writes both `-l` (label) and `-s` (service) attributes so callers using either convention find the same entry.)
 
 For JSON file (Firebase)  -  same clipboard flow, JSON content never lands in argv or shell history:
 ```
@@ -364,12 +357,10 @@ For JSON file (Firebase)  -  same clipboard flow, JSON content never lands in ar
 
 Pipeline runs silently:
 ```bash
-pbpaste | ~/.claude/lib/credential-store.sh set "<KEY_NAME>" "$(cat)"
+pbpaste | ~/.claude/lib/credential-store.sh set "<KEY_NAME>" -
 pbcopy < /dev/null   # clear clipboard
 ```
 
-Linux substitutes: `xclip -selection clipboard -o` or `wl-paste` for `pbpaste`; matching clear command for `pbcopy < /dev/null`. The shell driver detects platform and routes accordingly (see `~/.claude/lib/credential-store.sh`).
-
 **Firebase repeats per project.** Teams own several Firebase projects (legacy plus redesign, staging plus prod), each with its own key, and a crash URL from the second one used to fail the `project_id` check as if it were misconfigured. After each saved key, read `project_id` from the stored JSON (never ask) and offer another round: `Saved: <project_id>. Add another Firebase project? [y/N]`.
 
 - Every key appends `{projectId, keychainKey, label?}` to `prefs.global.firebase.accounts`; the first one also fills `keychainMapping.firebase`, so a one-project setup is unchanged.
@@ -598,10 +589,10 @@ Auto-skipped if Step 5 was skipped or fewer than 2 repos were selected.
 **Prompt:**
 ```
 Step 6  -  Remember as a multi-repo group (optional)
-You picked 2 repos: Booking, UIComponents.
+You picked 2 repos: Checkout, UIComponents.
 
 Save this combo for one-tap selection in Phase 0?
-  Group name (Enter for auto): [Booking + UIComponents]
+  Group name (Enter for auto): [Checkout + UIComponents]
   Skip with 'n'.
 ```
 
@@ -619,8 +610,8 @@ Repo identifiers in the label are the human label from `recentProjects` (basenam
   "global": {
     "recentGroups": [
       {
-        "label": "Booking + UIComponents",
-        "repos": ["~/dev/Booking", "~/dev/UIComponents"],
+        "label": "Checkout + UIComponents",
+        "repos": ["~/dev/Checkout", "~/dev/UIComponents"],
         "count": 1,
         "lastUsed": "2026-04-15T21:08:00Z"
       }
@@ -702,7 +693,7 @@ Glob matching semantics (Phase 0 implementation):
 
 ### Cross-Platform Notes (Step 1-9)
 
-Every read and write goes through `~/.claude/lib/credential-store.sh`, which dispatches to the right backend per platform; stay on the helper rather than the native commands. The backend table, the Linux clipboard substitutes for `pbpaste` / `pbcopy`, and what happens when no backend exists: `$HOME/.claude/multi-agent-refs/keychain.md` "Cross-platform mechanics".
+Every read and write goes through `~/.claude/lib/credential-store.sh`, which wraps the macOS Keychain; stay on the helper rather than calling `security` directly. The clipboard handling and what happens when no backend exists: `$HOME/.claude/multi-agent-refs/keychain.md` "Credential store mechanics".
 
 ### Token -> Source Mapping
 
@@ -710,22 +701,22 @@ Standard key names are a convention for NEW tokens; discovery may find existing
 
 ### Inline Token Save Pattern
 
-All tokens go through `~/.claude/lib/credential-store.sh`, which auto-delegates to the deterministic Python helper (`~/.claude/scripts/keychain.py`) on macOS / Linux and to the PowerShell `CredentialManager` module on Windows. The Python path writes both `-l` (label) and `-s` (service) attributes so existing manually-added entries with either convention remain findable.
+All tokens go through `~/.claude/lib/credential-store.sh`, which auto-delegates to the deterministic Python helper (`~/.claude/scripts/keychain.py`). The Python path writes both `-l` (label) and `-s` (service) attributes so existing manually-added entries with either convention remain findable.
 
 ```bash
 # PAT / API Key (from clipboard)
-pbpaste | ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "$(cat)"
+pbpaste | ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" -
 pbcopy < /dev/null  # clear clipboard
 
-# Plain text (direct value)
+# Non-secret value typed inline (a secret on argv is visible to ps and lands in shell history)
 ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "<VALUE>"
 
 # JSON file from clipboard (preferred  -  no file path leaks into history)
-pbpaste | ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "$(cat)"
+pbpaste | ~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" -
 pbcopy < /dev/null
 
 # JSON file from disk (fallback when clipboard backend unavailable)
-~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" "$(cat /path/to/file.json)"
+~/.claude/lib/credential-store.sh set "<SERVICE_NAME>" - < /path/to/file.json
 
 # Read  -  a JSON value comes back exactly as it was stored, newlines included
 ~/.claude/lib/credential-store.sh get "<SERVICE_NAME>"

package/pipeline/commands/multi-agent/stack/SKILL.md

@@ -2,6 +2,10 @@
 description: "Select the active stack(s) for this repo by enabling the matching marketplace plugin(s) in .claude/settings.json. Multi-select: pass several stacks (ios backend) or pick them in the native picker. Use when a repo's stack changed or the wrong plugins are enabled for it."
 description-tr: "Bu repo için aktif stack'leri seçer: eşleşen marketplace plugin'lerini .claude/settings.json'da etkinleştirir. Çoklu seçim: birden fazla stack yazılabilir (ios backend) ya da native picker'dan seçilir."
 argument-hint: "[ios|android|web|frontend|backend|mobile|fullstack|all ...]"
+parameters: [{"name":"stacks","kind":"enum","repeat":true,"enum":["ios","android","web","frontend","backend","mobile","fullstack","all"]}]
+gui: form
+destructive: false
+confirm: none
 allowed-tools: Bash, Read, Edit, Write, AskUserQuestion
 ---
 

package/pipeline/commands/multi-agent/status/SKILL.md

@@ -1,6 +1,10 @@
 ---
 description: "Show every multi-agent task's ID, phase, branch, and status. Use when asked what is running, or for an overview of every task."
 description-tr: "Tüm multi-agent görevlerinin ID, faz, branch ve durumunu gösterir."
+parameters: []
+gui: button
+destructive: false
+confirm: none
 ---
 
 # multi-agent status  -  Task Status Dashboard
@@ -21,11 +25,9 @@ Show every active and completed task as a table.
    so it sees both directory layouts (`<project>/<id>/` and the flat `<id>/`),
    the salvaged `artifacts/` copy Phase 4 leaves behind, and every spelling of a
    task id - and it counts a run that exists in both layouts once. Do NOT
-   re-scan the tree by hand: the earlier instruction here listed three
-   hard-coded `.worktrees/` paths and a single `find` depth, and on a real
-   install that combination missed a quarter of the runs and double-counted
-   others. It also scanned worktrees for `agent-state.json`, which Phase 0 has
-   never written there ("never inside the worktree", `phases/phase-0-init.md`).
+   re-scan the tree by hand: fixed `.worktrees/` paths and a single `find`
+   depth miss runs and double-count others, and `agent-state.json` never lives
+   inside a worktree (`phases/phase-0-init.md`).
 
    The JSON and the table are rendered from the same records, so a dashboard and
    this command cannot disagree.
@@ -37,14 +39,13 @@ Show every active and completed task as a table.
 
 3. **Groups are computed, not judged.** `runs-index.mjs` assigns `group` by the
    table below; report what it returns rather than re-deriving it. `in_progress`
-   alone cannot tell a run that is waiting for you from one that died, and on
-   this machine that difference covered 21 runs.
+   alone cannot tell a run that is waiting for you from one that died.
 
    | Group | Test | Action offered |
    |---|---|---|
-   | `waiting` - Waiting on you | `status == "awaiting_input"`, or a `pr.url`, or phase >= 4 | `resume #N` - the work landed, it needs your answer |
+   | `waiting` - Waiting on you | `status == "awaiting_input"`, or `waitingFor` set, or a `pr.url`, or phase >= 4 | `resume #N` - the work landed, it needs your answer |
    | `stopped` - Stopped mid-development | anything else past phase 0 | `resume #N` or `kill #N` |
-   | `question` - Left at a question | phase 0 | `garbage-collect --abandoned` - nothing was built |
+   | `question` - Left at a question | phase 0, nothing pending | `garbage-collect --abandoned` - nothing was built |
    | `unknown` - Status not recorded | no `status` field | say so; offer nothing |
 
    A run with no `status` is **not** placed in an actionable group. Unknown is

package/pipeline/commands/multi-agent/steer/SKILL.md

@@ -1,7 +1,11 @@
 ---
 description: "Queue an instruction for a task that is already running. It is applied at the next phase boundary, not mid-phase. Use when a run is going the wrong way and killing it would throw away good work."
 description-tr: "Zaten koşmakta olan bir göreve talimat bırakır. Talimat faz ortasında değil, bir sonraki faz sınırında uygulanır. Koşu yanlış yöne gidiyorsa ve kill etmek iyi işi de çöpe atacaksa kullanılır."
-argument-hint: "#id \"<instruction>\"  -  e.g. #3 \"the field is called web, not frontend\". With no instruction, you are asked for it."
+argument-hint: "#id [\"<instruction>\"]  -  e.g. #3 \"the field is called web, not frontend\". With no instruction, you are asked for it."
+parameters: [{"name":"task","kind":"run-id","required":true},{"name":"instruction","kind":"text"}]
+gui: form
+destructive: false
+confirm: none
 ---
 
 # multi-agent steer  -  correct a run without stopping it

package/pipeline/commands/multi-agent/store-ready/SKILL.md

@@ -2,6 +2,10 @@
 description: "Pre-submission store readiness for a built package, iOS and Android, local-only. Three symmetric gates per platform: a static package audit, the store's own authoritative validation, and a policy review against repo source. Separate verdict per gate, a skipped gate never counted as a pass. Validates only, never uploads. Use when a build is about to go to TestFlight or a Play track, or when a submission was rejected and the reason is not obvious."
 description-tr: "Üretilmiş paketin yükleme öncesi store hazırlığı, iOS + Android, yalnızca lokal. Platform başına üç simetrik kapı: statik paket denetimi, store'un kendi doğrulayıcısı, ve kaynağa karşı politika incelemesi. Kapı başına ayrı verdict, atlanan kapı asla pass sayılmaz. Sadece doğrular, asla yüklemez."
 argument-hint: "[repo]  -  empty = pick; repo name or path; --ipa= | --archive= | --aab= | --apk=; --skip-sweep; --resume"
+parameters: [{"name":"repo","kind":"text"},{"name":"--ipa","kind":"path"},{"name":"--archive","kind":"path"},{"name":"--aab","kind":"path"},{"name":"--apk","kind":"path"},{"name":"--skip-sweep","kind":"flag"},{"name":"--resume","kind":"flag"}]
+gui: form
+destructive: false
+confirm: none
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, AskUserQuestion, Skill, mcp__multi-agent-toolkit__ios_app_store_audit, mcp__multi-agent-toolkit__ios_export_ipa, mcp__multi-agent-toolkit__ios_testflight_validate, mcp__multi-agent-toolkit__ios_xcodebuild, mcp__multi-agent-toolkit__ios_xcresult, mcp__multi-agent-toolkit__android_apk_audit, mcp__multi-agent-toolkit__ios_screenshot, mcp__multi-agent-toolkit__ios_get_ui_tree, mcp__multi-agent-toolkit__ios_set_appearance, mcp__multi-agent-toolkit__ios_set_content_size, mcp__multi-agent-toolkit__android_screenshot, mcp__multi-agent-toolkit__android_get_ui_tree, mcp__multi-agent-toolkit__android_set_dark_mode, mcp__multi-agent-toolkit__android_set_font_scale
 ---
 

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -2,6 +2,10 @@
 description: "One-shot sync of the entire multi-agent ecosystem: Claude Code, Copilot CLI, pipeline repo, website, and the multi-agent-toolkit MCP server. Use when work is finished and should be propagated across Claude Code, Copilot CLI, the repos, the website and the multi-agent-toolkit server."
 description-tr: "Tüm multi-agent ekosisteminin tek atımlık senkronu: Claude Code, Copilot CLI, pipeline repo, website ve multi-agent-toolkit MCP sunucusu."
 argument-hint: "[release] [multi-agent-toolkit]"
+parameters: [{"name":"release","kind":"flag"},{"name":"multi-agent-toolkit","kind":"flag"}]
+gui: hidden
+destructive: false
+confirm: required
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, WebFetch
 ---
 
@@ -33,10 +37,7 @@ When invoked, it synchronizes all targets in order. It detects what changed, upd
 
 ## Platform Support (macOS only)
 
-v17.0.0 removed Linux and Windows (ADR-0012). `package.json` declares
-`os: ["darwin"]`, which npm enforces on the root package, so this tree cannot be
-installed elsewhere - a detection table for hosts that cannot run the installer
-would be a table the agent executes against a case that no longer exists.
+Only macOS is supported (ADR-0012). `package.json` declares `os: ["darwin"]`, which npm enforces on the root package, so this tree cannot be installed elsewhere, and a detection table for other hosts would describe a case that cannot occur.
 
 **Contract for synced shell scripts.** The runtime is BSD userland and bash 3.2,
 and that is a stricter constraint than "cross-platform", not a looser one:
@@ -65,8 +66,8 @@ Run every step automatically:
 ```
 Step 0: DOCTOR      doctor.mjs  -  exit 2 or 4 stops the sync
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 58 sub-command skills)
-Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + 57 specs as refs + 8 agent TOML)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 61 sub-command skills)
+Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
@@ -94,7 +95,6 @@ Step 0 gate rules and why: `features/doctor.md`.
    - Project detection (URL-based + cwd-based)
    - Figma pipeline flow
    - Git conventions (author, branch, commit format)
-   - Short-run model info (Opus)
    - Keychain management (registry, naming convention, multi-agent pattern)
 4. **Do not duplicate**  -  summary in Copilot, full spec in Claude. Keep this distinction.
 5. **Report**  -  show a short diff summary after sync
@@ -172,11 +172,11 @@ Step 0 gate rules and why: `features/doctor.md`.
 Unlike the Copilot step, this one does **not** hand-copy files. The Codex tree is a
 *transform* of the Claude tree, not a mirror of it, and the transform is real work:
 
-- the 56 sub-command specs become reference files, because Codex silently truncates
+- the sub-command specs become reference files, because Codex silently truncates
   its skills block (see `cross-cli-contract.md` 2.6 for the measurement)
 - every `$HOME/.claude/...` reference to a CLI-owned tree is retargeted, with
   `agents/<persona>.md` becoming `.toml` and the dispatcher becoming the router skill
-- the 8 personas are regenerated as TOML with a model + reasoning-effort mapping
+- the personas under `agents/` are regenerated as TOML with a model + reasoning-effort mapping
 - shared state (`logs/`, prefs, `knowledge/`) is deliberately NOT retargeted
 
 That logic lives in `install/codex.mjs` and is gate-locked by
@@ -487,22 +487,22 @@ When invoked with the `release` argument:
 ## Sub-Command Sync (Claude Code <-> Copilot CLI Skills)
 
 This runs on the Claude <-> Copilot axis. Codex is NOT synced here: it receives the
-same 56 specs as reference files rather than as peer skills, via Step 2b -  see
+same specs as reference files rather than as peer skills, via Step 2b -  see
 `cross-cli-contract.md` 2.6 for why the parity axis differs per host.
 
 | Claude Code | Copilot CLI |
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**58 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**61 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off, autopilot-on,
 autopilot-status, build-optimize, channels, complaint-analysis, create-jira,
 design-check, diff-explain, doctor, feedback, forget, garbage-collect, graph, help,
 ios-coding-standard, issue, jira, kill, language, log,
-manual-test, model, prune-logs, prune-prompts, purge, refactor, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
-routines, save, scan, search, security-review, setup, stack, status, steer, store-ready, sync, test,
+manual-test, model, prune-logs, prune-prompts, purge, refactor, research, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
+routines, save, scaffold, scan, search, security-review, serve, setup, stack, status, steer, store-ready, sync, test,
 test-accessibility, test-dark-mode, test-dynamic-type, test-screenshots,
 testflight-validation, uninstall, update
 ```

package/pipeline/commands/multi-agent/test/SKILL.md

@@ -2,6 +2,10 @@
 description: "UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb). Auto-detects platform. Screenshot + tap + analyze on the booted device. The Phase 5 Manual Test flow lives at /multi-agent:manual-test. Use when a running app should be driven on a simulator or emulator to hunt UI bugs."
 description-tr: "UI Bug Hunter - iOS Simulator (simctl) + Android Emulator (adb). Platformu otomatik algılar. Açık cihazda screenshot + tap + analiz. Faz 3 Manuel Test akışı /multi-agent:manual-test'te."
 argument-hint: '[scenario]  -  e.g. "dark mode" | "accessibility" | "dynamic type" | "screenshot tr" | "store-ready" | (empty = full sweep)'
+parameters: [{"name":"scenario","kind":"text"}]
+gui: form
+destructive: false
+confirm: none
 ---
 
 # /multi-agent:test  -  UI Bug Hunter

package/pipeline/commands/multi-agent/test-accessibility/SKILL.md

@@ -2,6 +2,10 @@
 description: "Accessibility audit on a booted simulator / emulator: VoiceOver labels, sub-44pt tap targets, contrast, traits. Alias pinning the accessibility scenario. Use when auditing a screen for assistive-technology support."
 description-tr: "Booted simulator / emulator üzerinde erişilebilirlik denetimi: VoiceOver label'ları, 44x44pt altı tap target'lar, kontrast oranları ve trait'ler; her ekranda canlı UI tree'ye karşı denetlenir. /multi-agent:test \"accessibility\" için sabit-senaryo alias'ı."
 argument-hint: "(argümansız  -  senaryo sabit)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
 ---
 
 # /multi-agent:test-accessibility  -  Accessibility audit

package/pipeline/commands/multi-agent/test-dark-mode/SKILL.md

@@ -2,6 +2,10 @@
 description: "Dark mode UI test on a booted simulator / emulator: walk every screen light then dark, report contrast + colour bugs. Alias pinning the dark-mode scenario. Use when a dark-mode rendering bug is suspected."
 description-tr: "Booted simulator / emulator üzerinde dark mode UI testi. Her ekranı light'ta gezer, görünümü değiştirir, tekrar gezer; farktan kontrast + renk + sabit-palet buglarını raporlar. /multi-agent:test \"dark mode\" için sabit-senaryo alias'ı."
 argument-hint: "(argümansız  -  senaryo sabit)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
 ---
 
 # /multi-agent:test-dark-mode  -  Dark mode UI test

package/pipeline/commands/multi-agent/test-dynamic-type/SKILL.md

@@ -2,6 +2,10 @@
 description: "Dynamic Type layout test on a booted simulator / emulator: re-walk every screen at XL through accessibility-extra-large, report truncation and clipping. Alias pinning the dynamic-type scenario. Use when checking a layout survives large text."
 description-tr: "Booted simulator / emulator üzerinde Dynamic Type layout testi. Her ekranı XL'den accessibility-extra-large'a kadar yeniden gezer; kırpılma, taşma, üst üste binme ve ölçeklenmeyi bırakan sabit yükseklikli container'ları raporlar. /multi-agent:test \"dynamic type\" için sabit-senaryo alias'ı."
 argument-hint: "(argümansız  -  senaryo sabit)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
 ---
 
 # /multi-agent:test-dynamic-type  -  Dynamic Type layout test

package/pipeline/commands/multi-agent/test-screenshots/SKILL.md

@@ -1,7 +1,11 @@
 ---
 description: "App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the screenshot scenario. Use when generating store screenshots or checking a localised build renders."
-description-tr: "Booted simulator / emulator'dan belirtilen dilde App Store screenshot seti: temiz status bar, her ekran gezilip yakalanır. Dili isim içine gömmek yerine argüman olarak alır (default tr). /multi-agent:test \"screenshot <lang>\" için sabit-senaryo alias'ı."
+description-tr: "Booted simulator / emulator'dan belirtilen dilde App Store screenshot seti: temiz status bar, her ekran gezilip yakalanır. Dili isim içine gömmek yerine argüman olarak alır (default tr). /multi-agent:test \"screenshot {lang}\" için sabit-senaryo alias'ı."
 argument-hint: "[locale]  -  boş = tr; örn. tr | en | de | ar"
+parameters: [{"name":"locale","kind":"text"}]
+gui: form
+destructive: false
+confirm: none
 ---
 
 # /multi-agent:test-screenshots  -  Locale screenshot set

package/pipeline/commands/multi-agent/testflight-validation/SKILL.md

@@ -2,6 +2,10 @@
 description: "iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never uploads. Use when an iOS build is about to go to TestFlight, or a submission was rejected and you need why."
 description-tr: "store-ready komutunun iOS'a sabitlenmiş alias'ı: iOS build'inde aynı üç kapı, tek implementasyon. TestFlight / App Store paketini doğrular, asla yüklemez."
 argument-hint: "[repo]  -  empty = pick from prefs; repo name or path; --ipa=<path>; --archive=<path>; --resume"
+parameters: [{"name":"repo","kind":"text"},{"name":"--ipa","kind":"path"},{"name":"--archive","kind":"path"},{"name":"--resume","kind":"flag"}]
+gui: form
+destructive: false
+confirm: none
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, AskUserQuestion, Skill, mcp__multi-agent-toolkit__ios_app_store_audit, mcp__multi-agent-toolkit__ios_export_ipa, mcp__multi-agent-toolkit__ios_testflight_validate, mcp__multi-agent-toolkit__ios_xcodebuild, mcp__multi-agent-toolkit__ios_xcresult
 ---
 

package/pipeline/commands/multi-agent/uninstall/SKILL.md

@@ -3,6 +3,10 @@ description: "Uninstall the pipeline from Claude Code + Copilot CLI. Keychain ac
 disable-model-invocation: true
 description-tr: "Pipeline'ı Claude Code + Copilot CLI'dan kaldırır. Keychain erişim token'larına asla dokunulmaz; --all-data ayrıca pipeline ayarlarını, loglarını, repo bazlı hafızayı ve bilgi tabanını da siler. Çift onay ister."
 argument-hint: "[--dry-run] [--all-data] [--claude] [--copilot] [--target=<path>]"
+parameters: [{"name":"--dry-run","kind":"flag"},{"name":"--all-data","kind":"flag"},{"name":"--claude","kind":"flag"},{"name":"--copilot","kind":"flag"},{"name":"--target","kind":"path"}]
+gui: button
+destructive: true
+confirm: required
 ---
 
 # multi-agent uninstall  -  Token-Preserving Uninstall
@@ -27,7 +31,7 @@ Tokens in the OS credential store are NEVER removed by either mode.
 
 ## Never deleted (either mode)
 
-- **Keychain / Credential Manager / libsecret** personal access tokens (GitHub, Jira, Bitbucket, Confluence, Telegram, Vercel, Firebase, etc.)
+- **Keychain** personal access tokens (GitHub, Jira, Bitbucket, Confluence, Telegram, Vercel, Firebase, etc.)
 - `~/.claude/lib/credential-store.sh` - the only way to READ those tokens. Deleting it while keeping the secrets preserves a locked box and throws away the key, and the closing message below used to advise a command uninstall had just removed.
 - `global.keychainMapping` inside `multi-agent-preferences.json`, even under `--all-data`. It carries no secret, only logical-name -> credential-store key; without it the preserved tokens sit under names the user never chose and no longer has a record of. Everything else in that file is removed.
 - The **`multi-agent-toolkit` MCP registration**. Its device, accessibility and store-audit tools work with no pipeline at all - the same reason the tokens stay. The retired `dev-toolkit` name IS deregistered: it points at a registration nothing maintains, so leaving it is litter, not preservation.

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -2,6 +2,10 @@
 description: "Update the pipeline to the latest published npm release: registry check, npm pack, install, migrate. Use when the installed pipeline is behind and should be brought to the latest version."
 description-tr: "Pipeline'ı npm'deki son yayına günceller: registry kontrolü, npm pack, install, migrate."
 allowed-tools: Bash, Read, Write, AskUserQuestion
+parameters: []
+gui: button
+destructive: false
+confirm: none
 ---
 
 ## After the install, check it

package/pipeline/contract/CHANGELOG.md

@@ -0,0 +1,74 @@
+# Client contract changelog
+
+Versions of the client contract (`manifest.json` `contractVersion`), separate
+from the package version. See `README.md` for what counts as minor and major.
+
+## 1.2.0
+
+Added, plus one narrowing of the launch input, which no released pipeline
+version served before this one.
+
+- Phone routes under `/v1/phone/`: `GET /v1/phone/runs`, `GET /v1/phone/runs/{id}`,
+  `POST /v1/phone/runs/{id}/answer` and `POST /v1/phone/launch`. Each request
+  is signed with an enrolled device's Ed25519 key (`phone-signed-request.schema.json`);
+  the bearer token does not open them and a signature opens no desktop route.
+  Responses are always redacted, and launch is refused until it is enabled
+  locally. `manifest.json` `phone` names the headers, the signed fields, the
+  window and the scopes, so a client hardcodes none of them.
+- `phone-devices.schema.json`: the device registry `phone-devices.mjs` writes.
+- `contract-error.schema.json`: `unsigned`, `unknown-device`, `revoked-device`,
+  `bad-signature`, `stale-request`, `replayed`, `replay-store-full`,
+  `unknown-verb`, `forbidden-scope` and `launch-disabled`. A desktop request
+  never receives one of them. `repo-not-allowed` (403) answers a launch on
+  either route whose `repo` is neither a configured autopilot repo nor one
+  registered with `launch-request.mjs register-repo`.
+- `manifest.json` `phone.signature.futureSkewSeconds` (5): how far ahead of
+  the server's clock a timestamp may be. `windowSeconds` (60) is how far
+  behind.
+- Launch input. `input` is a structured reference (Jira key, GitHub issue URL,
+  `repo#N`, `#N`, Jira URL on the configured host) or, on the desktop channel
+  only, free text that the plan renders as one quoted argument. A newline, a
+  control or format character, a leading `-`, a flag-like token or a first
+  token that is a pipeline op or mode keyword rejects the request
+  (`400 invalid-request`); free text may use those words after its first
+  token. A client that sent free text to `/v1/phone/launch`, or an input
+  carrying one of those, now sends a structured reference instead.
+- `launch-request.mjs plan --channel desktop|phone` (default `desktop`) applies
+  that channel's input rule, so `plan --channel phone --redact` prints what
+  `POST /v1/phone/launch` returns for the same request file.
+- `manifest.json`: the `launch-spec` surface carries `launch.json`'s own
+  version, 1.1.0.
+- `runs-index` `group`: a run with `waitingFor` set is `waiting` at any phase.
+  A run paused on a question at phase 0 is no longer grouped `question`, the
+  group whose action is garbage-collecting an abandoned intake.
+
+## 1.1.0
+
+Added; nothing a 1.0 client decodes changed.
+
+- HTTP carrier: `contract-server.mjs` serves every surface on `127.0.0.1`
+  behind a per-start bearer token, byte-for-byte what the CLI prints.
+- `runs-index` 1.1.0: each run carries `sessionId`, `waitingFor` and
+  `pendingQuestion`, so a client can find the run it launched and answer the
+  question it stopped on without reading `agent-state.json`.
+- `runs-index`: `schemaVersion` is always a string or null (agent-state.schema.json
+  already declares a string) and token counts are always integers. The
+  producer now coerces both and the schema says so; the toolbox decodes exactly
+  these types.
+- `launch-request.mjs plan` and `POST /v1/launch`: the launch plan
+  (`launch-plan.schema.json`). `launch-request.mjs questions` and `spec` print
+  `run-questions.json` and `launch.json`.
+- `answer-question.mjs --question <id>` and `POST /v1/runs/{id}/answer`
+  (`answer-request.schema.json`): an answer names the question it answers.
+- `credential-inventory.sh --json` carries `probed` in every envelope,
+  including `empty` and `no-backend`.
+- `contract-error.schema.json` for every non-2xx HTTP body.
+- The kit itself: `manifest.json`, generated `types/index.d.ts`, fixtures and
+  the frozen toolbox fields.
+
+## 1.0.0
+
+The first declared contract: `commands.mjs --json`, `run-questions.json`,
+launch requests (`launch-request.mjs validate|resolve`), `answer-question.mjs`,
+`issues.mjs --json`, `worktrees.mjs --json`, `runs-index.mjs --json` with
+`--redact`, and `launch.json`.