@mmerterden/multi-agent-pipeline 20.24.0 → 20.25.0

package/pipeline/commands/multi-agent/deps/SKILL.md

@@ -0,0 +1,61 @@
+---
+description: "Bump one dependency, fix only what the bump broke, review, open a PR; rolls back past the fix round cap. SwiftPM, Gradle, npm, pip. Use when a library needs updating."
+description-tr: "Tek bağımlılığı yükseltir, yalnızca yükseltmenin kırdığını düzeltir, review edip PR açar; düzeltme turu sınırında geri alır. SwiftPM, Gradle, npm, pip. Bir kütüphaneyi güncellemek için kullanılır."
+argument-hint: "[package[@version]] [--major]  -  no package opens a picker over the outdated candidates; --major allows a breaking bump"
+parameters: [{"name":"package","kind":"text"},{"name":"--major","kind":"flag"}]
+gui: form
+destructive: false
+confirm: none
+---
+
+# multi-agent deps  -  bump one dependency and fix what it broke
+
+> **Pickers follow** `$HOME/.claude/multi-agent-refs/picker-contract.md`: never a one-option call, and branch on the option selected, not on its text.
+
+**Input**: $ARGUMENTS
+
+> **Language (read FIRST)**: read `prefs.global.outputLanguage` and render every conversational line in it. `AskUserQuestion` renders `question`, option `label`s and `description`s in `outputLanguage`; only `header` stays English (<=12-char chip). Commit messages and branch names stay English. Full contract: `$HOME/.claude/multi-agent-refs/rules.md` "Language Application".
+
+The normal pipeline with a fixed task. Read `$HOME/.claude/multi-agent-refs/features/dep-bump.md` first: it is the contract for every step below (run shape, scope rule, rollback). `dep-bump.mjs` does every deterministic step; never edit a version string or a lockfile by hand.
+
+## Steps
+
+1. **Repo and settings.** Resolve the repo as `/multi-agent` does for a free-text task (`_account-picker.md`, `_repo-picker.md`). Then:
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" config            # depBump.maxFixRounds, depBump.queryRegistry
+   node "$HOME/.claude/scripts/dep-bump.mjs" detect --dir "$REPO"
+   ```
+   No ecosystem detected: say so and stop.
+
+2. **Candidates.**
+   ```bash
+   node "$HOME/.claude/scripts/dep-bump.mjs" list --dir "$REPO" [--registry]   # --registry when queryRegistry is true
+   ```
+   Show `registry.note` and every per-package `note`: an offline listing is reported as offline, never as "nothing outdated".
+   - `package@version` given: use it. `package` alone: its `latestInMajor`, else `latest`. Not in the list: stop with the manifests that were read.
+   - No package: a single-select picker over the candidates with a newer version, non-breaking first, each option `name current -> target (risk)`. Two or more options per the picker contract; one candidate is confirmed with a yes/no, none means report "nothing newer found" with the registry note.
+
+3. **Major gate.** Risk `major` or `unknown`, or a prerelease target (`prerelease: true`), needs `--major` in the input or an explicit confirmation naming the versions (`Bump anyway` / `Take {latestInMajor} instead` when one exists / `Cancel`). An autopilot run without `--major` takes `latestInMajor` or stops.
+
+4. **Run the pipeline** with `state.mode = "deps"`, `state.taskType = "chore"`, the free-text task `chore(deps): bump {name} from {current} to {target}` and the branch `chore/deps-{name}-{target}` (kebab rules from Phase 0 Step 4). Phase 0 intake, worktree and tracker run as in `/multi-agent`. Then:
+   - **Phase 1**: the fixed plan from the feature doc, with the changelog excerpt as evidence:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" notes --dir "$WORKTREE" --ecosystem E --name N --from A --to B
+     ```
+   - **Phase 2**: apply first, then the exit gate as written:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" apply --dir "$WORKTREE" --ecosystem E --name N --to B [--allow-major]
+     ```
+     Exit 1: report `error` and `lock.output` (or `dirty`: the worktree had uncommitted changes), stop with nothing to commit. Persist the output to `state.depBump`. Green: no dev agent, on to Phase 3. Red: fix rounds, at most `depBump.maxFixRounds`, each dispatched with the failing log tail, `surface` output, the changelog excerpt and the scope rule (feature doc section 4); after each round:
+     ```bash
+     node "$HOME/.claude/scripts/dep-bump.mjs" scope --dir "$WORKTREE" --log "$GATE_LOG"   # the round's build/test log
+     ```
+     Only the surface recorded by `apply` is in scope. A file listed in `newImporters` with `cited: null` started importing the dependency without an error line behind it: revert it before the next round.
+   - **Cap reached and still red** (or still out of scope): `dep-bump.mjs rollback --dir "$WORKTREE"` (restores the manifest, lockfile and fix files; anything under `kept` is reported, not discarded), set `state.depBump.rolledBack = true`, and end with the report from feature doc section 5. No commit, no push, no PR.
+   - **Phase 3**: standard review. Each `outOfScope` file without a cited error line, and each `newImporters` entry with `cited: null`, is a blocking finding.
+   - **Phase 4**: commit with `commitMessage` from `apply` (plus ` [{jiraId}]` when present). PR body per the feature doc; `Ref:` or `Related:`, never `Closes`, `Fixes` or `Resolves`, and never close an issue.
+   - **Phase 5**: channels as in every mode.
+
+## Report
+
+In `outputLanguage`, at most 10 lines: the dependency, from and to, risk, lockfile command and result, rounds taken against the cap, files changed (in scope / justified), review verdict, and the PR URL or the rollback reason.

package/pipeline/commands/multi-agent/model/SKILL.md

@@ -52,8 +52,8 @@ because it does not mean the same thing on all three:
 
 | Host | What `off` does | Why |
 |---|---|---|
-| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5 |
-| Copilot CLI | nothing | Fable 5 is not offered there; its personas never sat on this rung |
+| Claude Code | every `preferredModel: fable` persona (architects, reviewer 1, triage) starts on `opus` | the only host where the rung is Fable 5.1 |
+| Copilot CLI | nothing | Fable is not offered there; its personas never sat on this rung |
 | Codex CLI | nothing, deliberately | the `fable` rung there means `gpt-5.6 @ xhigh`, a different model on a different account - switching it from a knob named after an Anthropic model would surprise a Codex user |
 
 So on two of the three hosts this command is a **status report**, not a switch,

package/pipeline/commands/multi-agent/postmortem/SKILL.md

@@ -12,18 +12,30 @@ confirm: none
 
 **Input**: $ARGUMENTS
 
-Explains what a run actually did, read from the Claude Code session transcripts
-it ran in, not from what the run log says it decided. The evidence comes from a
+Explains what a run actually did, read from the session transcripts it ran in,
+not from what the run log says it decided. The evidence comes from a
 deterministic indexer; the model only interprets it.
 
+The indexer reads all three hosts and detects the format per file:
+
+| Host | Session files |
+|------|---------------|
+| Claude Code | `~/.claude/projects/<dir>/<session>.jsonl` plus its subagent files |
+| Copilot CLI | `~/.copilot/session-state/<session>/events.jsonl` (cited as `<first 8 of session>/events.jsonl`) |
+| Codex | `~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl` (cited as `rollout-<first 8 of session>.jsonl`) |
+
+Copilot CLI reports tokens per session, so its turns carry output tokens only
+and the totals come from the session's shutdown record; Codex reports them per
+request.
+
 **Read-only.** Nothing is sent anywhere: no issue comment, no PR, no channel.
 The one write is the report itself, saved under the run's log directory.
 
 ## Steps
 
 1. **Resolve the target.**
-   - A path ending in `.jsonl`: index that file (subagent files beside it are
-     included). There is no run directory, so nothing is saved unless the user
+   - A path ending in `.jsonl` (any of the three hosts): index that file
+     (Claude Code subagent files beside it are included). There is no run directory, so nothing is saved unless the user
      names one.
    - A task id or `#N`: locate the run and its transcripts:
      ```bash
@@ -31,8 +43,8 @@ The one write is the report itself, saved under the run's log directory.
      ```
      `matchedBy: "session"` means the run recorded its session id and the match
      is exact. `"time-window"` means it did not (attended runs record none), so
-     the files are the sessions that ran in the run's worktree or checkout while
-     it was active; say that this match is a heuristic. Exit 3 with a `reason`:
+     the files are the sessions, on any host, that ran in the run's worktree or
+     checkout while it was active; say that this match is a heuristic. Exit 3 with a `reason`:
      report the reason, and offer to take a transcript path instead.
    - No argument: take the most recent run from
      `node "$HOME/.claude/scripts/runs-index.mjs" --json` (latest `startedAt`)

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -247,14 +247,14 @@ off: Agent 1 is dropped, the panel is Agent 2 + Agent 3, triage runs on
 Never dispatch a Fable reviewer or a Fable triage on the model list below alone.
 
 **Claude Code (3 in parallel while the fable rung is on, 2 while it is off):**
-- Agent 1: `claude-fable-5` → security + architecture (only when `REVIEW_RUNG` is `fable`)
-- Agent 2: `claude-opus-5` → edge cases, alternate perspective
-- Agent 3: `claude-sonnet-5` → general quality
+- Agent 1: `claude-fable-5-1` → security + architecture (only when `REVIEW_RUNG` is `fable`)
+- Agent 2: `claude-opus-5-5` → edge cases, alternate perspective
+- Agent 3: `claude-sonnet-5-5` → general quality
 
 **Copilot CLI (3 in parallel):**
-- Agent 1: `claude-opus-5` → security + architecture (Fable 5 is not offered on Copilot CLI)
+- Agent 1: `claude-opus-4.7` → security + architecture (Fable is not offered on Copilot CLI)
 - Agent 2: `gpt-5.4` → edge cases, alternate perspective
-- Agent 3: `claude-sonnet-5` → general quality
+- Agent 3: `claude-sonnet-4.6` → general quality
 
 **Codex CLI (3 in parallel, single vendor):**
 - Agent 1: `gpt-5.6` @ `xhigh` → security + architecture

package/pipeline/commands/multi-agent/route-on/SKILL.md

@@ -30,7 +30,7 @@ honoured only at `bulk-read` and `delegate` and only while `--free` is on.
 
 **Rung names are the contract; model ids are not.** `opus` is a rung here and a
 model id in `cost-table.json`, and the second can change without anyone editing
-a rule. Writing `claude-opus-5` into a rule pins a decision to a string that will
+a rule. Writing `claude-opus-5-5` into a rule pins a decision to a string that will
 go stale.
 
 Set rules with:

package/pipeline/commands/multi-agent/setup/SKILL.md

@@ -429,14 +429,16 @@ To set up multi-agent on a new machine:
 
 All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
 
-### Step 8  -  Enforcement hooks (optional, Claude Code)
+### Step 8  -  Enforcement hooks (optional)
 
-Offer to merge `$HOME/.claude/templates/claude-hooks.json`: three `PreToolUse` gates that block on a non-zero exit (secret scan, agent-guard, read-size) plus four hooks that block nothing (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+On Claude Code, offer to merge `$HOME/.claude/templates/claude-hooks.json`: three blocking `PreToolUse` gates (secret scan, agent-guard, read-size) plus four non-blocking hooks (`PreCompact`, `SessionEnd`, `SessionStart`, `PostToolUse`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
 
 - Ask (picker): "Install the pipeline's hooks into `~/.claude/settings.json`?" Default Yes.
-- On Yes, deep-merge EVERY event in the template's `hooks` object, not `PreToolUse` alone - merging one event silently drops the capture hooks, and a run killed before Phase 5 then loses its findings exactly as it did before they existed. Preserve existing hooks; never duplicate a matcher already calling the same script.
-- Say what the merge does NOT cover: only the three gates need no run-specific arguments, so only they are hookable; the rest are phase-enforced.
-- Say what it does not turn on: the read-size gate is inert until `prefs.global.bulkRead.mode` is set. Recommend `observe` first. Why, and the Phase 3 exemption: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
+- On Yes, deep-merge EVERY event in the template's `hooks` object (merging `PreToolUse` alone drops the capture hooks); keep existing hooks, never duplicate a matcher calling the same script.
+- Say only the three gates are hookable (no run-specific arguments); the rest are phase-enforced.
+- Say the read-size gate stays inert until `prefs.global.bulkRead.mode` is set; recommend `observe` first (why, and the Phase 3 exemption: `picker-contract.md`).
+
+Codex: offer only the syntax gate, then run `node "$HOME/.codex/scripts/host-hooks.mjs" install --host codex`. Copilot CLI: offer no hook (it discards `postToolUse` output as of 1.0.45).
 
 ### Step 9  -  Default stack plugin enablement
 

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -73,7 +73,7 @@ Run every step automatically:
 ```
 Step 0: DOCTOR      doctor.mjs  -  exit 2 or 4 stops the sync
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 65 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 66 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
@@ -241,12 +241,12 @@ same specs as reference files rather than as peer skills, via Step 2b -  see
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**65 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**66 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off, autopilot-on,
 autopilot-status, bug-bash, build-optimize, channels, complaint-analysis, create-jira,
-design-check, diff-explain, doctor, estimate, feedback, forget, garbage-collect, graph, help,
+deps, design-check, diff-explain, doctor, estimate, feedback, forget, garbage-collect, graph, help,
 ios-coding-standard, issue, jira, kill, language, log,
 manual-test, model, postmortem, prune-logs, prune-prompts, purge, refactor, research, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
 routines, save, scaffold, scan, scenario-audit, search, security-review, serve, setup, stack, status, steer, store-ready, sync, test,

package/pipeline/commands/multi-agent/testflight-validation/SKILL.md

@@ -11,10 +11,9 @@ allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdat
 
 # /multi-agent:testflight-validation  -  iOS alias for store-ready
 
-This command is an alias. The implementation it used to carry was merged into
+This command is an alias. The implementation lives in
 `/multi-agent:store-ready`, which runs the same three gates on iOS and adds the
-Android side, so there is one flow to maintain instead of two that had already
-started to drift.
+Android side, so there is one flow to maintain instead of two that drift.
 
 The name is kept because it is the one people reach for when the target is
 TestFlight, and removing a command is a breaking change to the slash-command

package/pipeline/contract/fixtures/runs-failed.json

@@ -85,7 +85,7 @@
         "out": 1020,
         "cached": 2700
       },
-      "estUsd": 0.0449,
+      "estUsd": 0.0353,
       "unlockedWrites": 0,
       "runType": "development",
       "title": null,

package/pipeline/contract/fixtures/runs-old-schema.json

@@ -63,7 +63,7 @@
         "out": 680,
         "cached": 1800
       },
-      "estUsd": 0.0299,
+      "estUsd": 0.0236,
       "unlockedWrites": 0
     }
   ]

package/pipeline/contract/fixtures/runs-pr-opened-redacted.json

@@ -106,7 +106,7 @@
         "out": 2040,
         "cached": 5400
       },
-      "estUsd": 0.0897,
+      "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
       "title": null,

package/pipeline/contract/fixtures/runs-pr-opened.json

@@ -111,7 +111,7 @@
         "out": 2040,
         "cached": 5400
       },
-      "estUsd": 0.0897,
+      "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
       "title": null,

package/pipeline/contract/fixtures/runs-running.json

@@ -96,7 +96,7 @@
         "out": 680,
         "cached": 1800
       },
-      "estUsd": 0.0299,
+      "estUsd": 0.0236,
       "unlockedWrites": 0,
       "runType": "autopilot",
       "title": "Fix the crash on the login screen",

package/pipeline/lib/credential-inventory.sh

@@ -3,11 +3,11 @@
 #
 # WHY THIS EXISTS
 #
-# A run asked the user to paste a Crashlytics stack trace by hand while a Firebase
-# service-account JSON sat in the Keychain, mapped as `firebase`, fully valid. Nothing
-# was broken - the pipeline simply never asked itself "do I already hold a credential
-# that answers this?" before asking the user. From the user's side that is worse than a
-# failure: they had supplied the key precisely so this would not happen.
+# A run that asks the user to paste a Crashlytics stack trace by hand while a valid
+# Firebase service-account JSON sits in the Keychain, mapped as `firebase`, has failed
+# even though nothing is broken. From the user's side that is worse than a failure: they
+# supplied the key precisely so this would not happen. So the pipeline asks itself "do I
+# already hold a credential that answers this?" before it asks the user.
 #
 # One command, so there is no excuse for asking blind. Run it before any question that
 # requests data an external system holds, and let the answer shape the question:

package/pipeline/lib/fetch-crashlytics.sh

@@ -214,15 +214,13 @@ if [ -z "$SA_JSON_RAW" ]; then
 fi
 
 # The credential store returns the JSON as stored - encoding is its internal
-# business, not this script's. The base64 attempt that used to live here was
-# guesswork that never fired: what actually broke the fetcher was the store
-# returning bare hex for any multi-line value, which is neither base64-of-JSON
-# nor JSON, so both branches failed and the failure surfaced three layers later
-# as a token-exchange error.
+# business, not this script's, so nothing here guesses at a decoding. A guess
+# that misfires (bare hex read as base64, say) fails three layers later as a
+# token-exchange error instead of here.
 #
-# With no decode step there is nothing to stage on disk, so the temp file and its
-# cleanup traps went with it: the service-account JSON now only ever exists in a
-# shell variable, which is one fewer place a GCP private key can be left behind.
+# With no decode step there is nothing to stage on disk, so there is no temp file
+# and no cleanup trap: the service-account JSON only ever exists in a shell
+# variable, which is one fewer place a GCP private key can be left behind.
 SA_JSON="$SA_JSON_RAW"
 
 # Verify project_id from SA JSON matches the URL  -  protects against pasting a

package/pipeline/lib/model-rung.sh

@@ -69,7 +69,7 @@ host_note() {
       echo "Claude Code: the fable rung is Fable 5. This switch is live here."
       ;;
     copilot)
-      echo "Copilot CLI: Fable 5 is not offered; its personas never sat on this rung."
+      echo "Copilot CLI: Fable is not offered; its personas never sat on this rung."
       echo "This setting is recorded but changes nothing on this host."
       ;;
     codex)

package/pipeline/lib/plan-todos.sh

@@ -13,6 +13,7 @@
 # Subcommands:
 #   init      <task-id> [title]            Initialize with empty todos[] (Phase 2 usually pipes the JSON instead)
 #   set       <task-id> <plan-json>        Replace the whole plan from a JSON blob on stdin or arg
+#                                          (exit 2 when a dep names no todo id exactly)
 #   start     <task-id> <todo-id>          Mark in_progress, set startedAt; refuses if deps unsatisfied
 #                                          or the todo awaits re-plan confirmation
 #   complete  <task-id> <todo-id> [notes] [--no-tests <reason>]
@@ -84,10 +85,9 @@ resolve_state() {
   local task_id="$1"
   local found=""
   # multi-repo-pipeline.sh writes agent-state.json under a per-project
-  # directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/) - not the
-  # ~/.claude/projects/*/state/ path this used to glob, which no writer in
-  # the pipeline ever populates.
-  # This globbed ONLY the nested layout; flat-layout runs resolved to nothing.
+  # directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/), other
+  # writers write it flat; no writer uses ~/.claude/projects/*/state/.
+  # ma_resolve_run_file checks both layouts.
   found="$(ma_resolve_run_file "$task_id" agent-state.json 2>/dev/null || true)"
   if [ -z "$found" ]; then
     echo "plan-todos: agent-state.json not found for task=$task_id" >&2
@@ -155,6 +155,23 @@ do_set() {
     echo "plan-todos: every todo must be an object with string .id and .task fields" >&2
     exit 2
   fi
+  # Every dependency must name a todo exactly. Ids are compared as written, so
+  # `t1` against a todo `T1` would leave the dependent blocked for good; the
+  # error names the id that differs only by case.
+  local bad_deps
+  bad_deps=$(jq -r '
+    [.todos[].id] as $ids
+    | [.todos[] | .id as $owner | (.deps // [])[]
+        | select((type != "string") or (. as $d | $ids | index($d) | not))
+        | . as $d
+        | ($ids | map(select(($d | type) == "string" and ascii_downcase == ($d | ascii_downcase)))) as $near
+        | "\($owner) depends on \($d | tojson), which is no todo id"
+          + (if ($near | length) > 0 then " (did you mean \($near | map(tojson) | join(", "))?)" else "" end)]
+    | .[]' <<<"$plan_blob" 2>/dev/null)
+  if [ -n "$bad_deps" ]; then
+    printf 'plan-todos: %s\n' "$bad_deps" >&2
+    exit 2
+  fi
   local state_path; state_path=$(resolve_state "$task_id")
   local now; now=$(iso_now)
   local new

package/pipeline/lib/post-pr-review.sh

@@ -107,12 +107,10 @@ if [ -z "$TASK_ID" ]; then
 fi
 
 # Resolve agent-state.json. multi-repo-pipeline.sh writes it under a
-# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/)
-# - not the ~/.claude/projects/*/state/ path this used to glob, which no
-# writer in the pipeline ever populates.
-# This globbed ONLY the nested layout. phase-tracker.sh and most Phase 0 paths
-# write flat, so on a real machine the majority of runs resolved to nothing and
-# this script reported "no agent-state.json" for a run whose state existed.
+# per-project directory ($HOME/.claude/logs/multi-agent/{project}/{taskId}/),
+# while phase-tracker.sh and most Phase 0 paths write it flat; no writer uses
+# ~/.claude/projects/*/state/. ma_resolve_run_file checks both layouts, so a
+# run whose state exists is always found.
 AGENT_STATE="$(ma_resolve_run_file "$TASK_ID" agent-state.json 2>/dev/null || true)"
 
 if [ -z "$AGENT_STATE" ]; then

package/pipeline/lib/route-state.sh

@@ -77,7 +77,7 @@ free_savings() {
   since=$(( $(date +%s) - 7 * 86400 ))
   jq -rs --argjson since "$since" --slurpfile ct "$COST_TABLE" '
       map(select((.ts | sub("\\.[0-9]+Z$"; "Z") | fromdateiso8601? // 0) >= $since))
-    | ($ct[0].prices.haiku // {inPerMtok: 1, outPerMtok: 5}) as $h
+    | ($ct[0].prices.haiku // {inPerMtok: 0.5, outPerMtok: 2.5}) as $h
     | {
         n: length,
         ok: (map(select(.ok and (.cached | not))) | length),

package/pipeline/lib/shadow-git.sh

@@ -227,11 +227,10 @@ do_prune() {
     printf 'shadow-git: pruned shadow repo for %s\n' "$task_id" >&2
   else
     [ ! -d "$sd/.git" ] && { err "no shadow for $task_id"; exit 1; }
-    # Retention never touches a real work-tree: this used to run
-    # `reset --hard` with --work-tree=$(pwd), silently rewriting whatever
-    # directory prune happened to be invoked from, and it kept the OLDEST
-    # commit inside the window while discarding every newer one - backwards
-    # for a "keep the last N days" policy. Every git call below is
+    # Retention never touches a real work-tree: a `reset --hard` with
+    # --work-tree=$(pwd) would silently rewrite whatever directory prune is
+    # invoked from. It keeps every commit inside the window and drops the
+    # older ones, as a "keep the last N days" policy requires. Every git call below is
     # git-dir-only plumbing (log/rev-parse/commit-tree/update-ref/gc - no
     # checkout, no reset, no clean); the one --work-tree `sg` still wants
     # points at $sd itself, which prune already owns.

package/pipeline/multi-agent-refs/cross-cli-contract.md

@@ -1,7 +1,7 @@
 # Cross-CLI Contract (Claude Code · Copilot CLI · Codex CLI)
 
 <!-- toc -->
-- [1. Command Inventory (65 commands)](#1-command-inventory-65-commands)
+- [1. Command Inventory (66 commands)](#1-command-inventory-66-commands)
 - [2. Canonical Placeholder Vocabulary](#2-canonical-placeholder-vocabulary)
 - [2.6 Intentional structural divergence  -  thin dispatcher vs inlined orchestrator](#26-intentional-structural-divergence---thin-dispatcher-vs-inlined-orchestrator)
 - [2.7 One command, three different meanings: `/multi-agent:model`](#27-one-command-three-different-meanings-multi-agentmodel)
@@ -20,12 +20,12 @@
 
 ---
 
-## 1. Command Inventory (65 commands)
+## 1. Command Inventory (66 commands)
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
 autopilot-on, autopilot-status, bug-bash, build-optimize, channels, complaint-analysis,
-create-jira, design-check, diff-explain, doctor, estimate, feedback, forget,
+create-jira, deps, design-check, diff-explain, doctor, estimate, feedback, forget,
 garbage-collect, graph, help, ios-coding-standard, issue, jira, kill,
 language, log, manual-test, model, postmortem, prune-logs,
 prune-prompts, purge, refactor, research, resume, review,
@@ -40,7 +40,7 @@ Categories:
 
 - **Interactive pickers** (single-purpose, not modes): `jira`, `issue`
 - **Issue generator** (one-shot, no worktree, asks type Task/Bug/Story, hard approval gate before create): `create-jira`
-- **Pipeline entries**: `autopilot` (plus the bare `/multi-agent` in the dispatcher). The phase set is a property of the command, and every mode runs its whole set.
+- **Pipeline entries**: `autopilot`, `deps` (plus the bare `/multi-agent` in the dispatcher). The phase set is a property of the command, and every mode runs its whole set.
 - **Tail path** (the pipeline tail over work already on a branch, no run behind it): `resume`
 - **Ops commands** (one-shot, no worktree): `status`, `log`, `kill`, `steer`, `purge`, `uninstall`, `resume`, `review`, `review-jira`, `review-issue`, `analysis`, `analysis-resolve`, `research`, `scaffold`, `complaint-analysis`, `bug-bash`, `build-optimize`, `channels`, `scan`, `search`, `diff-explain`, `garbage-collect`, `graph`, `postmortem`, `prune-logs`, `prune-prompts`, `serve`
 - **Local audits** (worktree only to build; no commit, push, PR or channels): `design-check`, `testflight-validation`, `ios-coding-standard`. `testflight-validation` additionally never invokes `altool --upload-app`  -  a validation run must not be able to ship a build by accident.
@@ -262,8 +262,8 @@ that quietly no-ops is worse than one that says it cannot act.
 
 | Host | What `model on|off` does | Why |
 |---|---|---|
-| Claude Code | live switch: flips `modelFallback.fableEnabled` and realigns `costBudget.pricingModel` | the only host where the `fable` rung is Fable 5 |
-| Copilot CLI | writes the preference, changes no dispatch | Fable 5 is not offered there; its personas never sat on this rung |
+| Claude Code | live switch: flips `modelFallback.fableEnabled` and realigns `costBudget.pricingModel` | the only host where the `fable` rung is Fable 5.1 |
+| Copilot CLI | writes the preference, changes no dispatch | Fable is not offered there; its personas never sat on this rung |
 | Codex CLI | writes the preference, changes no dispatch, **deliberately** | the `fable` rung on Codex means `gpt-5.6 @ xhigh` - a different model on a different account. A knob named after an Anthropic model must not silently retune a Codex run |
 
 `model-rung.sh` prints which of the three it is on every invocation. The rule it
@@ -440,9 +440,8 @@ what keeps a secret off argv and what writes the audit entry.
   something that is not a timestamp.
 - `sed -E`, never `-r`; `sed -i ''` when editing in place.
 
-Clipboard callers may use `pbpaste` / `pbcopy` directly; the three-way
-`command -v` guard they used to carry was for hosts this package no longer
-installs on.
+Clipboard callers may use `pbpaste` / `pbcopy` directly; a `command -v` guard
+for other clipboard tools would serve hosts this package does not install on.
 
 ---
 

package/pipeline/multi-agent-refs/features/cost-analysis.md

@@ -46,6 +46,10 @@ discovered later:
 - A host with no such transcripts (Copilot, Codex) reports `UNMEASURED`, never
   zero. Zero would read as "you spent nothing" when it means "I could not see".
 
+A record is priced by its exact wire ID: a rung's `modelId`, a Copilot CLI
+`copilotModelId` at its own model's rate from the table's `models` map, or a
+previous-generation ID in the table's `legacy` map at that ID's own rate. A
+dated snapshot (`<id>-<date>`) prices as the longest known ID it extends.
 Records whose model is not in `cost-table.json` are COUNTED as unpriced and left
 out of the total. Folding them in at zero would make an unknown model look free,
 which is the direction that hurts.