@mmerterden/multi-agent-pipeline 20.23.2 → 20.25.0

package/pipeline/scripts/uninstall.mjs

@@ -60,6 +60,7 @@ import {
   XCODE_SKILLS_MANIFEST,
 } from "../lib/xcode-plugin.mjs";
 import { createInterface } from "readline";
+import { removeHooks, templateCommands } from "./host-hooks.mjs";
 
 const HOME = process.env.HOME;
 
@@ -104,6 +105,7 @@ export const PIPELINE_RETIRED_SKILL_DIRS = ["valven-rules"];
  */
 export const PIPELINE_TEMPLATE_FILES = [
   "claude-hooks.json",
+  "codex-hooks.json",
   "codex-instructions.md",
   "copilot-instructions.md",
   "multi-agent-autopilot-awake.plist.template",
@@ -781,11 +783,14 @@ function stripManagedBlock(filePath, { hostFile = false } = {}) {
 }
 
 /**
- * Remove the pipeline-added hooks + env from settings.json. Other hooks the
- * user added stay intact.
+ * Remove the pipeline-added hooks + env from settings.json: the gates
+ * install/claude.mjs registers, and every handler whose full command is one
+ * claude-hooks.json registers (setup Step 8 merges those). Other hooks the
+ * user added stay intact, including one inside a group the pipeline uses.
  * @param {string} settingsPath
+ * @param {Set<string>|null} templateCmds  claude-hooks.json's commands
  */
-function cleanClaudeSettings(settingsPath) {
+function cleanClaudeSettings(settingsPath, templateCmds) {
   if (!existsSync(settingsPath)) return;
   let settings;
   try {
@@ -831,6 +836,20 @@ function cleanClaudeSettings(settingsPath) {
     if (settings.hooks && Object.keys(settings.hooks).length === 0) delete settings.hooks;
   }
 
+  if (templateCmds && settings.hooks) {
+    try {
+      const { doc, removed } = removeHooks(settings, templateCmds);
+      if (removed) {
+        settings = doc;
+        touched = true;
+      }
+    } catch {
+      console.log(
+        `    skipped the hook template pass (hooks not in the expected shape): ${settingsPath}`,
+      );
+    }
+  }
+
   if (touched) {
     if (dryRun) {
       report("would update", settingsPath);
@@ -841,6 +860,63 @@ function cleanClaudeSettings(settingsPath) {
   }
 }
 
+/**
+ * The commands a shipped hook template registers, read from the first copy
+ * found: the host's installed templates, the package this script runs from,
+ * or the templates directory beside an installed scripts/. Null when none is
+ * readable.
+ * @param {string} name   template file name
+ * @param {string[]} dirs host template directories, searched first
+ */
+export function shippedHookCommands(name, dirs = []) {
+  const here = import.meta.dirname;
+  const candidates = [
+    ...dirs.map((d) => join(d, name)),
+    join(here, "..", "..", "install", "templates", name),
+    join(here, "..", "templates", name),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const commands = templateCommands(JSON.parse(readFileSync(path, "utf-8")), HOME);
+      if (commands.size) return commands;
+    } catch {
+      // An unreadable copy: try the next one.
+    }
+  }
+  return null;
+}
+
+/**
+ * Take the pipeline's hook handlers out of Codex's hooks.json (host-hooks.mjs
+ * merged them in), matched by the template's full commands; the user's own
+ * hooks stay. Without a template the file is left as it is.
+ * @param {string} hooksPath
+ * @param {Set<string>|null} commands
+ */
+function cleanCodexHooks(hooksPath, commands) {
+  if (!existsSync(hooksPath)) return;
+  if (!commands) {
+    console.log(`    skipped (no codex-hooks.json template to match against): ${hooksPath}`);
+    return;
+  }
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(hooksPath, "utf-8"));
+  } catch {
+    console.log(`    skipped (unparseable): ${hooksPath}`);
+    return;
+  }
+  const { doc: cleaned, removed } = removeHooks(doc, commands);
+  if (!removed) return;
+  if (dryRun) {
+    report("would update", hooksPath);
+    return;
+  }
+  atomicWrite(hooksPath, JSON.stringify(cleaned, null, 2) + "\n");
+  console.log(`    removed ${removed} pipeline hook(s) from: ${hooksPath}`);
+}
+
 async function confirm(question) {
   if (skipPrompt || dryRun) return true;
   return new Promise((resolve) => {
@@ -910,6 +986,9 @@ export async function main() {
     console.log("  [Claude Code] Removing...");
     deregisterClaudeMcpServer();
     const CLAUDE = join(HOME, ".claude");
+    const claudeHookCommands = shippedHookCommands("claude-hooks.json", [
+      join(CLAUDE, "templates"),
+    ]);
     unlinkClaudeXcodePlugin(HOME);
     rmCommandsPreservingLocalOnly(join(CLAUDE, "commands", "multi-agent"));
     rmIfExists(join(CLAUDE, "scripts"));
@@ -961,7 +1040,7 @@ export async function main() {
     // Agent definitions are FILES; remove only the pipeline-shipped names so
     // user-authored agents survive.
     rmMatchingFiles(join(CLAUDE, "agents"), (name) => PIPELINE_AGENT_FILES.includes(name));
-    cleanClaudeSettings(join(CLAUDE, "settings.json"));
+    cleanClaudeSettings(join(CLAUDE, "settings.json"), claudeHookCommands);
   }
 
   if (forCopilot && HOME) {
@@ -1071,6 +1150,13 @@ export async function main() {
     console.log("  [Codex CLI] Removing from ~/.codex...");
     const CODEX = join(HOME, ".codex");
 
+    // Codex reads hooks from $CODEX_HOME when set, so host-hooks.mjs may have
+    // registered there as well as in ~/.codex.
+    const codexHooks = shippedHookCommands("codex-hooks.json", [join(CODEX, "templates")]);
+    const hooksFiles = new Set([join(CODEX, "hooks.json")]);
+    if (process.env.CODEX_HOME) hooksFiles.add(join(process.env.CODEX_HOME, "hooks.json"));
+    for (const hooksFile of hooksFiles) cleanCodexHooks(hooksFile, codexHooks);
+
     // Wholly pipeline-owned trees.
     rmIfExists(join(CODEX, "multi-agent-refs"));
     rmIfExists(join(CODEX, "scripts"));

package/pipeline/scripts/update-issue-progress.sh

@@ -135,12 +135,10 @@ if [ "$TASK_ID" = "--rewrite" ]; then
 fi
 
 # Resolve agent-state.json. multi-repo-pipeline.sh writes it under a
-# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/)
-# - not the ~/.claude/projects/*/state/ path this used to glob, which no
-# writer in the pipeline ever populates.
-# This globbed ONLY the nested layout. phase-tracker.sh and most Phase 0 paths
-# write flat, so on a real machine the majority of runs resolved to nothing and
-# this script reported "no agent-state.json" for a run whose state existed.
+# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/),
+# while phase-tracker.sh and most Phase 0 paths write it flat; no writer uses
+# ~/.claude/projects/*/state/. ma_resolve_run_file checks both layouts, so a
+# run whose state exists is always found.
 AGENT_STATE="$(ma_resolve_run_file "$TASK_ID" agent-state.json 2>/dev/null || true)"
 
 if [ -z "$AGENT_STATE" ]; then

package/pipeline/scripts/usage-report.mjs

@@ -235,8 +235,8 @@ function invokedCalls(state, { publicPlugins, manifestPath } = {}) {
 }
 
 // The package declares `os: ["darwin"]` and every entry point refuses a
-// non-darwin host, so the branches this used to carry were unreachable. The
-// function and the field stay: the panel groups by `os` and a row with the key
+// non-darwin host, so no other platform gets a branch of its own. The
+// function and the field exist because the panel groups by `os` and a row with the key
 // missing reads as "unknown host" rather than "macOS".
 function detectOs() {
   return platform() === "darwin" ? "macos" : platform();

package/pipeline/scripts/validate-planning.mjs

@@ -13,12 +13,20 @@
 //
 // Exit codes:
 //   0  -  valid
-//   1  -  invalid structure, missing field, bad enum, or broken dependsOn edges
+//   1  -  invalid structure, missing field, bad enum, broken dependsOn edges,
+//         or two tasks that both create the same file
+//
+// Output: {ok, code, errors[], warnings[], overlaps[]}. `overlaps` holds one
+// anchored row per pair of tasks that share a file or a named symbol, and
+// `warnings` the overlaps that look wrong without being certain to be
+// (_plan-overlap.mjs). Warnings never change the exit code.
 
 import { readFileSync } from "node:fs";
+import { planOverlaps } from "./_plan-overlap.mjs";
 
 const ALLOWED_TYPES = new Set(["test", "code", "refactor", "docs", "chore"]);
 const TASK_ID_RE = /^T\d+$/;
+const NAME_LISTS = ["creates", "removes", "produces", "consumes"];
 
 function readInput() {
   const arg = process.argv[2];
@@ -114,6 +122,29 @@ async function main() {
     ) {
       errors.push(`tasks[${i}].requirements: must be an array of requirement ids if present`);
     }
+    for (const key of NAME_LISTS) {
+      if (
+        t[key] !== undefined &&
+        !(Array.isArray(t[key]) && t[key].every((n) => typeof n === "string" && n.length > 0))
+      ) {
+        errors.push(`tasks[${i}].${key}: must be an array of non-empty strings if present`);
+      }
+    }
+    if (t.complexity !== undefined) {
+      const c = t.complexity;
+      if (
+        typeof c !== "object" ||
+        c === null ||
+        !Number.isInteger(c.score) ||
+        c.score < 1 ||
+        c.score > 10 ||
+        (c.recommendSplit !== undefined && typeof c.recommendSplit !== "boolean")
+      ) {
+        errors.push(
+          `tasks[${i}].complexity: must be {score: 1-10, recommendSplit?: boolean} if present`,
+        );
+      }
+    }
   });
 
   // Validate dependsOn edges point to real ids and don't cycle
@@ -149,13 +180,24 @@ async function main() {
     }
   }
 
+  let overlaps = [];
+  let warnings = [];
+  if (errors.length === 0) {
+    const found = planOverlaps(parsed.tasks);
+    overlaps = found.rows;
+    warnings = found.warnings;
+    errors.push(...found.contradictions);
+  }
+
   if (errors.length > 0) {
-    emit({ ok: false, code: 1, errors });
-    process.exit(1);
+    emit({ ok: false, code: 1, errors, warnings, overlaps });
+    process.exitCode = 1;
+    return;
   }
 
-  emit({ ok: true, code: 0, errors: [] });
-  process.exit(0);
+  // exitCode, not exit(): the overlap rows grow with the plan, and exit()
+  // would cut them at the pipe buffer.
+  emit({ ok: true, code: 0, errors: [], warnings, overlaps });
 }
 
 /**
@@ -177,7 +219,7 @@ function hasCycle(id, graph, state) {
 }
 
 function emit(result) {
-  process.stdout.write(JSON.stringify(result) + "\n");
+  process.stdout.write(JSON.stringify({ warnings: [], overlaps: [], ...result }) + "\n");
 }
 
 main().catch((err) => {

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-13T19:19:55Z",
-  "skillCount": 228,
+  "generatedAt": "2026-10-14T08:53:17Z",
+  "skillCount": 230,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -13,7 +13,7 @@
     },
     {
       "path": "shared/core/multi-agent-analysis-jira/SKILL.md",
-      "sha256": "798061199762b141d0312b56f9e8e10af1324fb867393929565ebe4e61fcbc81"
+      "sha256": "485a44b117a5502ea54ff0830584cb69d7622a77f13e326e4684eb9e693de8a0"
     },
     {
       "path": "shared/core/multi-agent-analysis-resolve/SKILL.md",
@@ -59,6 +59,10 @@
       "path": "shared/core/multi-agent-create-jira/SKILL.md",
       "sha256": "5aad0d841e9e5b7140bb441e07819209ca64c5b6fc209d6ad586b5fbb353e377"
     },
+    {
+      "path": "shared/core/multi-agent-deps/SKILL.md",
+      "sha256": "1c583a47a1c1d66f37a581f0436861e511d1272b5014e1bd15397a4b4d6a8553"
+    },
     {
       "path": "shared/core/multi-agent-design-check/SKILL.md",
       "sha256": "8888744fa52e935f53db9a1068e1b18c636b6c9d55b084dabfc19b9ae68bf6f8"
@@ -125,7 +129,11 @@
     },
     {
       "path": "shared/core/multi-agent-model/SKILL.md",
-      "sha256": "88fe1d5676606058d505bee3273bd20a5027a874122ef5e4de21df9d27ac3c6a"
+      "sha256": "57ba710657d74176b0f19d4a97d3183df1f7b0c056eb1eef2792308914be836c"
+    },
+    {
+      "path": "shared/core/multi-agent-postmortem/SKILL.md",
+      "sha256": "41edd907cbaae1523eab1cd716390c9e9cd889574141cb88c33966e221b0987d"
     },
     {
       "path": "shared/core/multi-agent-prune-logs/SKILL.md",
@@ -165,7 +173,7 @@
     },
     {
       "path": "shared/core/multi-agent-review/SKILL.md",
-      "sha256": "1a22618e6d3d9d07b267bd61fc591bb33726e1d7ef8567285401f61bc7be0ad5"
+      "sha256": "e3a673e13b9b7a227334afe79e20e2be837c0900e16e88003b4692a1d74dea41"
     },
     {
       "path": "shared/core/multi-agent-route-off/SKILL.md",
@@ -173,7 +181,7 @@
     },
     {
       "path": "shared/core/multi-agent-route-on/SKILL.md",
-      "sha256": "97c76d711454e6bc9edfd47344bbeab7f73cf72c116cca92cffacdcda7fe96b1"
+      "sha256": "0435bb53d8c55d20cfdb1bd5ddbd0544bace68041ab45929904d1a38d2f608c6"
     },
     {
       "path": "shared/core/multi-agent-route-status/SKILL.md",
@@ -213,7 +221,7 @@
     },
     {
       "path": "shared/core/multi-agent-setup/SKILL.md",
-      "sha256": "73a1d1d8484d32b6d83107632a84aeced2f230f8581b7d47cad5e2d14e13860a"
+      "sha256": "28e80bacb521b3c41aac18859ca3921735970b0bf27f064bfc2b496db9f85016"
     },
     {
       "path": "shared/core/multi-agent-stack/SKILL.md",
@@ -233,7 +241,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "b34c0e3bd9160552b9222d448e54be14504761597ceea875f0447a227df90772"
+      "sha256": "76e713bb107d0fa14db67ca3fc67f420a8e831f3c2db85b21fd59acb327f0017"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -257,7 +265,7 @@
     },
     {
       "path": "shared/core/multi-agent-testflight-validation/SKILL.md",
-      "sha256": "6bfd1569117bfbacb485d831c0b7f262ebb3a2f9471f6177a646f5ce32c06a25"
+      "sha256": "b6c360c330ef0094cd7e7d9624e89624446b048951e43a180766bbe67d1b725c"
     },
     {
       "path": "shared/core/multi-agent-uninstall/SKILL.md",
@@ -269,7 +277,7 @@
     },
     {
       "path": "shared/core/multi-agent/SKILL.md",
-      "sha256": "a39f712426638e7955db9171c950be720f11c861621884e628c81a0b6a49de5d"
+      "sha256": "b2435de3df518efb8ddf9ac89b3089449e46bf55f29220e07a3aa95dfc8cd083"
     },
     {
       "path": "shared/external/accessibility-compliance-accessibility-audit/SKILL.md",
@@ -337,7 +345,7 @@
     },
     {
       "path": "shared/external/app-store-optimization/SKILL.md",
-      "sha256": "6015dd7b4c8661e23b677c53c391a3e39116fee2ad6b2b031b3d310eef4a3e2b"
+      "sha256": "99580fe67cbe4e42bb07a95669ab10bcece0c6ba5032acf321a25e73fee1c37d"
     },
     {
       "path": "shared/external/app-store-review/SKILL.md",
@@ -445,7 +453,7 @@
     },
     {
       "path": "shared/external/debugging-strategies/SKILL.md",
-      "sha256": "b3749d22253d55840b866a81782e3fc55589edd547fc0708d79e5fe7243dced6"
+      "sha256": "83b0a5d8a907b5704451920c488269ac88b0410aaa41ed9267946fb0e636963d"
     },
     {
       "path": "shared/external/device-integrity/SKILL.md",

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 228,
+  "skillCount": 230,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -1146,6 +1146,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-create-jira/SKILL.md"
     },
+    {
+      "name": "multi-agent-deps",
+      "description": "Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when a library needs updating.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-deps",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-deps/SKILL.md"
+    },
     {
       "name": "multi-agent-design-check",
       "description": "Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a countable target set, build Debug in a worktree, launch in mock mode, fetch Figma variants, compare each pixel + px-spacing + typography + color, and export a si",
@@ -1333,6 +1344,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-model/SKILL.md"
     },
+    {
+      "name": "multi-agent-postmortem",
+      "description": "Post-mortem of a run from its session transcripts: loops, stalls, root-cause hypotheses on file:line, fixes. Read-only, redacted. Use when a run went wrong or ran far too long.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-postmortem",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-postmortem/SKILL.md"
+    },
     {
       "name": "multi-agent-prune-logs",
       "description": "Delete per-task project logs under ~/.claude/logs/multi-agent (filter by age/project/task). Audit trail + metrics are preserved. Dry-run first; confirms before deleting. Use when task logs have built up and need trimming by age, project or task.",

package/pipeline/skills/shared/README.md

@@ -2,11 +2,11 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 228 skills (67 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 230 skills (69 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  67 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`core/`**  -  69 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
 - **`external/`**  -  161 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
@@ -14,7 +14,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  67
+- [Pipeline Orchestration](#pipeline-orchestration)  -  69
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  94
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
@@ -40,6 +40,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-channels`](./core/multi-agent-channels/) | `core` | Multi-channel reporter  -  Jira/Confluence/Wiki/PR description. Multi-select channels + content, humanizer pass, reviewer-preserving Bitbuck |
 | [`multi-agent-complaint-analysis`](./core/multi-agent-complaint-analysis/) | `core` | Customer-complaint triage. Ingests complaints (paste, csv/xlsx/txt/json file, Jira issue, Confluence URL), fetches Graylog evidence per trx/ |
 | [`multi-agent-create-jira`](./core/multi-agent-create-jira/) | `core` | Create a standards-compliant Jira issue (Task / Bug / Story): asks the type, mines project conventions, drafts from a standard template with |
+| [`multi-agent-deps`](./core/multi-agent-deps/) | `core` | Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when |
 | [`multi-agent-design-check`](./core/multi-agent-design-check/) | `core` | Mock-mode vs Figma design audit (iOS / Android, local-only). Pick repo + module, gate on mock support, enumerate every state driver into a c |
 | [`multi-agent-diff-explain`](./core/multi-agent-diff-explain/) | `core` | Map Phase 3 triage findings to branch diff lines. Read-only post-hoc command, used after review to answer 'which finding lines up with which |
 | [`multi-agent-doctor`](./core/multi-agent-doctor/) | `core` | Health check for the installed pipeline: layout, preferences, credentials, hooks and host capabilities, each with one actionable step. Exit  |
@@ -57,6 +58,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-log`](./core/multi-agent-log/) | `core` | Show the agent-log.md for the given task. With no ID, shows the most recent task. Use when asked what a task did, or to read its log. |
 | [`multi-agent-manual-test`](./core/multi-agent-manual-test/) | `core` | Switch to the active task's branch and prepare it for manual testing in Xcode. Phase 3 user-test step, standalone (the UI Bug Hunter lives a |
 | [`multi-agent-model`](./core/multi-agent-model/) | `core` | Turn the top model rung on or off and keep the cost ledger's pricing in step with it. Use when asked to enable or disable Fable, or which mo |
+| [`multi-agent-postmortem`](./core/multi-agent-postmortem/) | `core` | Post-mortem of a run from its session transcripts: loops, stalls, root-cause hypotheses on file:line, fixes. Read-only, redacted. Use when a |
 | [`multi-agent-prune-logs`](./core/multi-agent-prune-logs/) | `core` | Delete per-task project logs under ~/.claude/logs/multi-agent (filter by age/project/task). Audit trail + metrics are preserved. Dry-run fir |
 | [`multi-agent-prune-prompts`](./core/multi-agent-prune-prompts/) | `core` | Zero-base prompt review: measure the always-on instruction footprint, classify every rule block, propose keep/trial-removal/delete; applies  |
 | [`multi-agent-purge`](./core/multi-agent-purge/) | `core` | ⚠️ Wipes every worktree, branch, log, and state file. Irreversible; asks for double confirmation. Use when every worktree, branch, log and s |

package/pipeline/skills/shared/core/multi-agent/SKILL.md

@@ -206,12 +206,12 @@ Per-project input parsing (my-ios-app / my-figma-app / generic), worktree creati
 ### Phase 1: Plan
 Two halves, one phase, one approval gate.
 
-**1a  -  Analysis** (claude-sonnet-5, `explorer` persona)
+**1a  -  Analysis** (claude-sonnet-5-5, `explorer` persona)
 1. Launch **explore agents** (parallel) to scan the codebase: related files, existing patterns and conventions, potential impact areas
 2. Summarize findings
 3. Log: `📊 Phase 1: Plan (analysis)  -  {N} files identified, {summary}`
 
-**1b  -  Planning** (claude-fable-5)
+**1b  -  Planning** (claude-fable-5-1)
 1. Create task breakdown → todos with dependencies
 2. Launch **ios-architect** agent for architecture review (if structural changes)
 3. Determine development approach per todo (new file, modify, refactor)
@@ -221,7 +221,7 @@ Two halves, one phase, one approval gate.
    - **5b  -  Approval loop**: render plan → user: `onayla`/`iptal`/free-text. A free-text edit request → the planning model (Fable) revises the plan → show it again. No iteration cap; user controls exit via `onayla` or `iptal`.
    - Persist `clarificationRounds`, `clarificationQuestions`, `clarificationAnswers`, `planIterations`, `planApprovedAt`, `planEditRequests` to `state.phases["1"]`.
 
-### Phase 2: Dev (claude-sonnet-5)
+### Phase 2: Dev (claude-sonnet-5-5)
 For each todo (respecting dependency order):
 1. Update todo status: `in_progress`
 2. **TDD cycle**: write failing test → verify RED; write minimal code → verify GREEN; refactor if needed
@@ -233,9 +233,9 @@ For each todo (respecting dependency order):
 ### Phase 3: Review (parallel + triage)
 0. **Diff Risk Scoring (advisory)**  -  before reviewer dispatch run `node $HOME/.claude/scripts/diff-risk-score.mjs --base "$BASE_BRANCH" --top 5` and inject the top-N risk-ranked files as a `${PRIORITY_FILES}` block into each reviewer's prompt. Heuristic, deterministic, sub-second, never gates the pipeline. Disabled when `prefs.global.diffRiskAdvisory = false`. Signals: security paths (×3), schema migrations (×4), public API surfaces (×2), no-test-change (×2.5), complexity delta (×1.5), UI-critical paths (×1.5), loc changed (×1).
 1. Launch **code-reviewer** agents in parallel. Reviewer set depends on which CLI is hosting the pipeline:
-   - **Claude Code** (3 reviewers): `claude-fable-5` (deep security + architecture) + `claude-opus-5` (edge cases, different perspective) + `claude-sonnet-5` (quality + correctness)
-   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-5` + `claude-sonnet-5` (Fable 5 is not offered on Copilot CLI)
-   - Triage: single top-tier pass over merged findings (`claude-fable-5` on Claude Code, `claude-opus-5` on Copilot CLI)
+   - **Claude Code** (3 reviewers): `claude-fable-5-1` (deep security + architecture) + `claude-opus-5-5` (edge cases, different perspective) + `claude-sonnet-5-5` (quality + correctness)
+   - **Copilot CLI** (3 reviewers): `gpt-5.4` (edge cases, different perspective) + `claude-opus-4.7` + `claude-sonnet-4.6` (Fable is not offered on Copilot CLI)
+   - Triage: single top-tier pass over merged findings (`claude-fable-5-1` on Claude Code, `claude-opus-4.7` on Copilot CLI)
 2. Collect findings, classify:
    - 🔴 **Blocking** → must fix → back to Phase 2 (max 3 iterations)
    - 🟡 **Important** → fix and re-review

package/pipeline/skills/shared/core/multi-agent-analysis-jira/SKILL.md

@@ -25,6 +25,7 @@ Contract, severities and reasoning:
 - An open `EKLENECEK`/`TBD` marker or an open Section 20 row stops planning with exit 4. Resolve them with `/multi-agent-analysis-resolve` first.
 - The epic must already exist: stories are linked to it, never an epic created. On Server/Data Center the Epic Link field is discovered from the site; when none is found the stories are created unlinked and the writer says so.
 - Channel clones (`issueTree.cloneByChannel`) carry their own labels and are searched like stories, so a re-run never doubles them or their links.
+- A requirement row with `Depends on: <ids>` links the stories, prerequisite first, as `issueTree.dependencyLinkType` (default Blocks). A cycle, or a prerequisite no story covers, makes the plan `incomplete`; fix the document, not the links.
 - Story bodies hold only document text. A body warning (no user story, fewer than 2 criteria, no negative criterion) is a gap in the document; fix the document, not the ticket.
 
 ## Phase 1 - Plan, offline
@@ -60,6 +61,7 @@ what makes a preview meaningful:
 - the coverage verdict **on its own line**, and the consistency verdict below it
 - every field beside the pref key it came from, so a wrong setting shows here
   rather than in Jira afterwards
+- the dependency edges between stories, prerequisite first
 - the write count
 - every story's full description, as it will be written, with its body
   warnings; `--brief` gives the one-line-per-node view
@@ -102,7 +104,7 @@ A run that could not be checked is allowed. One that looks checked when it was
 not is the defect, so the approval has to name it and a plain "Approve" must not
 be reachable.
 
-`incomplete` prints its uncovered and invented ids before the question. An
+`incomplete` prints its uncovered and invented ids, and any dependency cycle or uncovered prerequisite, before the question. An
 invented id means the plan cites something the document does not define - treat
 that as a defect in the plan, not a warning to click past.
 
@@ -152,7 +154,7 @@ missing-attachment warning.
 
 ## Phase 5 - Report
 
-Keys created, keys skipped, the epic linked (or none), the coverage verdict, and the ledger path. If the
+Keys created, keys skipped, the epic linked (or none), the dependency links written, the coverage verdict, and the ledger path. If the
 verdict was `unverifiable`, say that in the report too - not only at approval
 time, because the report is what gets pasted elsewhere.
 

package/pipeline/skills/shared/core/multi-agent-deps/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: multi-agent-deps
+description: "Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when a library needs updating."
+user-invocable: true
+argument-hint: "[package[@version]] [--major]  -  no package opens a picker over the outdated candidates; --major allows a breaking bump"
+metadata:
+  language: en
+---
+
+# multi-agent deps  -  bump one dependency and fix what it broke
+
+> **Pickers follow** `$HOME/.claude/multi-agent-refs/picker-contract.md`: never a one-option call, and branch on the option selected, not on its text.
+
+**Input**: $ARGUMENTS
+
+> **Language (read FIRST)**: read `prefs.global.outputLanguage` and render every conversational line in it. `AskUserQuestion` renders `question`, option `label`s and `description`s in `outputLanguage`; only `header` stays English (<=12-char chip). Commit messages and branch names stay English. Full contract: `$HOME/.claude/multi-agent-refs/rules.md` "Language Application".
+
+The normal pipeline with a fixed task. Read `$HOME/.claude/multi-agent-refs/features/dep-bump.md` first: it is the contract for every step below (run shape, scope rule, rollback). `dep-bump.mjs` does every deterministic step; never edit a version string or a lockfile by hand.
+
+## Steps
+
+1. **Repo and settings.** Resolve the repo as `/multi-agent` does for a free-text task (`_account-picker.md`, `_repo-picker.md`). Then:
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" config            # depBump.maxFixRounds, depBump.queryRegistry
+   node "$HOME/.claude/scripts/dep-bump.mjs" detect --dir "$REPO"
+   ```
+   No ecosystem detected: say so and stop.
+
+2. **Candidates.**
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" list --dir "$REPO" [--registry]   # --registry when queryRegistry is true
+   ```
+   Show `registry.note` and every per-package `note`: an offline listing is reported as offline, never as "nothing outdated".
+   - `package@version` given: use it. `package` alone: its `latestInMajor`, else `latest`. Not in the list: stop with the manifests that were read.
+   - No package: a single-select picker over the candidates with a newer version, non-breaking first, each option `name current -> target (risk)`. Two or more options per the picker contract; one candidate is confirmed with a yes/no, none means report "nothing newer found" with the registry note.
+
+3. **Major gate.** Risk `major` or `unknown`, or a prerelease target (`prerelease: true`), needs `--major` in the input or an explicit confirmation naming the versions (`Bump anyway` / `Take {latestInMajor} instead` when one exists / `Cancel`). An autopilot run without `--major` takes `latestInMajor` or stops.
+
+4. **Run the pipeline** with `state.mode = "deps"`, `state.taskType = "chore"`, the free-text task `chore(deps): bump {name} from {current} to {target}` and the branch `chore/deps-{name}-{target}` (kebab rules from Phase 0 Step 4). Phase 0 intake, worktree and tracker run as in `/multi-agent`. Then:
+   - **Phase 1**: the fixed plan from the feature doc, with the changelog excerpt as evidence:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" notes --dir "$WORKTREE" --ecosystem E --name N --from A --to B
+     ```
+   - **Phase 2**: apply first, then the exit gate as written:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" apply --dir "$WORKTREE" --ecosystem E --name N --to B [--allow-major]
+     ```
+     Exit 1: report `error` and `lock.output` (or `dirty`: the worktree had uncommitted changes), stop with nothing to commit. Persist the output to `state.depBump`. Green: no dev agent, on to Phase 3. Red: fix rounds, at most `depBump.maxFixRounds`, each dispatched with the failing log tail, `surface` output, the changelog excerpt and the scope rule (feature doc section 4); after each round:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" scope --dir "$WORKTREE" --log "$GATE_LOG"   # the round's build/test log
+     ```
+     Only the surface recorded by `apply` is in scope. A file listed in `newImporters` with `cited: null` started importing the dependency without an error line behind it: revert it before the next round.
+   - **Cap reached and still red** (or still out of scope): `dep-bump.mjs rollback --dir "$WORKTREE"` (restores the manifest, lockfile and fix files; anything under `kept` is reported, not discarded), set `state.depBump.rolledBack = true`, and end with the report from feature doc section 5. No commit, no push, no PR.
+   - **Phase 3**: standard review. Each `outOfScope` file without a cited error line, and each `newImporters` entry with `cited: null`, is a blocking finding.
+   - **Phase 4**: commit with `commitMessage` from `apply` (plus ` [{jiraId}]` when present). PR body per the feature doc; `Ref:` or `Related:`, never `Closes`, `Fixes` or `Resolves`, and never close an issue.
+   - **Phase 5**: channels as in every mode.
+
+## Report
+
+In `outputLanguage`, at most 10 lines: the dependency, from and to, risk, lockfile command and result, rounds taken against the cap, files changed (in scope / justified), review verdict, and the PR URL or the rollback reason.

package/pipeline/skills/shared/core/multi-agent-model/SKILL.md

@@ -44,8 +44,8 @@ because it does not mean the same thing on all three:
 
 | Host | What `off` does | Why |
 |---|---|---|
-| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5 |
-| Copilot CLI | nothing | Fable 5 is not offered there; its personas never sat on this rung |
+| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5.1 |
+| Copilot CLI | nothing | Fable is not offered there; its personas never sat on this rung |
 | Codex CLI | nothing, deliberately | the `fable` rung there means `gpt-5.6 @ xhigh`, a different model on a different account - switching it from a knob named after an Anthropic model would surprise a Codex user |
 
 So on two of the three hosts this command is a **status report**, not a switch,