@mmerterden/multi-agent-pipeline 20.27.1 → 20.28.0

package/CHANGELOG.md

@@ -16,6 +16,44 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.28.0] - 2026-10-24
+
+### Added
+
+- A registration that fails for a reason the person did not choose reports it: `usage-register.mjs` starts `usage-register-beacon.mjs` detached, which sends `{ u, v, reason, os }` to `<register URL>/failure` once per reason and version a day, with no token and no failure text, and never for an opted-out machine or one with no login. `/multi-agent:doctor` gains the `usage-register` check, which shows the last registration outcome and whether the failure report reached the site.
+- Four test-planning knowledge skills join the common toolkit: `scenario-gap-analysis` (covered, wrongly covered and missing scenarios, with a could-not-measure section), `test-result-triage` (product-bug, stale-test, valid or ambiguous per test, ambiguous unless evidence says otherwise), `handle-request` (added, already present or could not add, per platform) and `fix-review-verdicts` (test-gaming, scope and root-cause verdicts computed from findings). They are routed to `ai-common-toolkit` through `COMMON_SKILLS`.
+- `pipeline/scripts/permission-baseline.mjs` freezes the tool grants the pipeline ships in `pipeline/contract/frozen/permission-baseline.json`: each command, skill and agent's `allowed-tools` / `tools` (an agent with no or an empty `tools` inherits everything and is recorded as `*`) and `disallowedTools`, the host-read frontmatter keys that change what a file may do (`permissionMode`, `mcpServers`, `hooks`, `context`, `agent`, `shell`), the unattended profile (allow and deny lists, wideAllows, sandbox lists and values, `defaultMode`, `env`), `RESEARCH_DENIED_TOOLS`, the grant every saved routine is written with (`ROUTINE_ALLOWED_TOOLS`), and the permission flags in the spawn argv of `pipeline/scripts` and `pipeline/lib` with every literal value they take (comment lines are skipped). `check` fails when an entry joins an allow list, leaves a deny list or a value changes, and when a grant cannot be read (a block scalar, a multi-line flow list, a folded continuation, a quoted or duplicated grant key, a flow-mapping or indented frontmatter, a missing code-level declaration); `accept` records an intended grant, so every widening lands as a reviewed line in the baseline diff. Narrowing passes on its own, a deleted file is reported as removed and a file is reported as moved only when its tools, deny list and frontmatter keys all match the old path. Enforced by `test/permission-baseline.test.mjs` in `npm test`; the script and its baseline are maintainer tooling and are not published.
+- `/multi-agent:test-gen` writes the tests an app lacks, as seven subagent stages each gated on its own artefact: inventory (`inventory.json`, then a priority pick; autopilot takes the top three), discovery (`discovery.json`) and gaps (`gaps.json`, with `dataNeeds[]` that name test data and never hold it), handles (`handles.md`), the tests (`written.json`), repeated runs and per-test classification (`results.json`). Discovery and gaps run on the new read-only `test-gen-analyst` persona, whose tool grant is an allowlist of Read, Grep, Glob and read-only toolkit tools. `scripts/test-gen-gate.mjs` checks the artefacts against the new `test-gen-inventory`, `test-gen-gaps` and `test-gen-results` schemas without a dependency, snapshots the working tree (untracked files included) before each stage that may edit the repository and judges the stage by its own delta: the handle stage must add a handle line (or say `HANDLES: none-needed` with `file:line` evidence, inside the repository, of handles that exist), and the write stage may change test files only, inside the repository and changed by the stage, with no test gaming in its diff, a run command one of the discovered runners owns, and more than zero tests run. It also checks `discovery.json` (new `test-gen-discovery` schema) and writes the three-state `results.json`. Toolkit tools `test_results_classify`, `coverage_gap` and `ui_locator_codegen` need `@mmerterden/multi-agent-toolkit-mcp` ≥ v3.25.0, recorded in `cross-cli-contract.md`; each has a named fallback on an older server. `smoke-test-gen-contract.sh` holds the schemas, the stage artefact paths and the read-only agent type.
+- `scripts/handle-diff-audit.mjs` checks that a diff only adds automation handles (iOS `accessibilityIdentifier`, Compose `testTag` / semantics, web `data-testid`). The removed lines and the added lines with their handle constructs stripped are compared as ordered code tokens, operators and punctuation included and whitespace ignored, so re-wrapping a tag passes while a flipped comparison, a dropped `!` or swapped arguments fail as lost, extra or reordered tokens; a new file passes only when it holds handle constants and nothing else. With `--baseline` (or `--since <tree>`) it reads only what changed after the stage-start snapshot, so the person's uncommitted work is never read as the stage's change; refs are verified and an option-shaped value is refused. Each file is judged by its own platform's pattern, so a Flutter `Key` or a selector string in a test file is not a handle. Exit 0 handles only, 2 violation, 3 unreadable input; `smoke-handle-diff-audit.sh` holds the codes on fixed fixtures.
+- `evidence-gate.mjs --stage-start <time>` holds a stage to its own output: the evidence must have been written during the stage (mtime no earlier than the start less 2s) and be whole: a `.json` file must parse, any other file under 400 bytes or ending in a letter or digit with no trailing newline is partial. The new `--claim artefact` checks only that, for stage outputs that are not logs.
+- Per-test classification at the Phase 2 exit gate (`features/test-classification.md`). The toolkit's `test_results_classify` (`@mmerterden/multi-agent-toolkit-mcp` ≥ v3.25.0) reads the Gate 3 report, the repeat runs as confirmation and the Phase 0 report as the base; `scripts/test-classify.mjs merge` applies the pipeline's rules on top: `unstable` is never green, `not_measured` stays red with its reason, the Phase 0 baseline joins the preexisting set (and a test it lists that the toolkit calls a regression becomes `unstable`), a tripped breaker is not green. On an older toolkit `test-classify.mjs fallback` classifies from the repeat runs' JUnit XML alone; a test that failed and passed inside one run (a retry, per-device reports) is `unstable`, and both attribute quote styles are read. Exit 4 marks a crash, apart from a red verdict. `run-ui-tests.sh run` now names a per-test report next to its log (`UI_TEST_RESULT`, `UI_TEST_RESULT_FORMAT`: the xcresult bundle on iOS, Playwright's JUnit report, the module's connected test results on Android).
+- `scripts/test-gen-state.mjs` keeps the project-level state of test generation. `base-record` writes the commit a run finished at with a reason that must name the run; `base-scan` diffs base..HEAD into changed files and `graph-affected.mjs` dependents, and a scan that cannot be made still writes a `measured: false` row with the reason. `revise` counts stale-test revisions per run and per calendar day against the new `prefs.global.testGen.revisionCap` (default 20), so many small runs cannot slip under the cap; at the cap autopilot parks, and a `product-bug` verdict is never applied in autopilot. The state file is read and replaced under a lock; a state or prefs file that does not parse parks autopilot instead of counting from zero, and a cap outside 0..500 falls back to the default.
+- Test gaming check: `test-integrity-gate.mjs --diff <unified.diff>` (or `--diff-base <ref>`) reports added lines that make a suite green without fixing the code, as `test_integrity` findings with `signal: "test_gaming"` and the line. Product code that branches on the test environment (`navigator.webdriver`, `process.env.CI`, ProcessInfo and XCTest, `isRunningTests`, a test-harness check) is blocking; a swallowed error (an empty catch, `.catch(() => {})`, `except: pass`, a statement-level Swift `try?`, a Kotlin `runCatching` nobody reads; one finding per occurrence), a timeout raised to twice the nearest removed one or a new wait of 30s or more in a test is important. Units follow the language (JavaScript and Kotlin milliseconds, Swift and Python seconds). Only source files are read and comment lines are skipped; configuration (`*.config.*`, CI workflows), YAML and documentation are out of scope. `--diff-base` reads the working tree, untracked files included, against the merge base with the base branch; a ref is verified, a missing or option-shaped value is a setup error, and an unreadable diff is reported as `gaming.scanned: false`, never as clean. Phase 3 Step 1.76 passes the run's diff, and the code reviewer persona gains a test-gaming lens that defers to the `fix-review-verdicts` skill when it is enabled.
+
+### Fixed
+
+- A finished, halted or parked run now reports its end: Phase 5 and the halt and park blocks send `usage-report.mjs --task-id`, and resolve the state file with the new `--print-state` instead of a `$STATE_FILE` that an earlier shell never handed over. An empty `--state` is recorded in `usage-last-send.json` as `empty-state-path` instead of returning silently. `test/usage-report-callers.test.mjs` fails any `--state "$VAR"` whose variable is not set in the same fenced block.
+- Usage registration and reporting work behind a corporate proxy or a TLS-inspecting gateway: `_http-post.mjs` retries a connection-level failure of Node's fetch through curl, which honours the proxy variables and the system trust store, with secret headers read from a 0600 file and never placed on argv. A failure keeps both causes (`fetch SELF_SIGNED_CERT_IN_CHAIN, curl curl-exit-7`), and every registration attempt is recorded in `usage-last-register.json`.
+- Lint and format skip `.claude/worktrees/`, where agent worktrees of other branches live.
+
+### Removed
+
+- The opt-in anonymous install ping (`MULTI_AGENT_TELEMETRY=1`, `install/_telemetry.mjs`). Install and update are already reported by `usage-report.mjs --lifecycle` under the machine's registered token, and the endpoint the ping used no longer accepts unauthenticated posts.
+
+### Security
+
+- `fast-uri` updated within its semver range to clear four moderate advisories (GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp).
+
+## [20.27.2] - 2026-10-20
+
+### Changed
+
+- App Store compliance follows the App Review Guidelines of 16.10.2026 and the September 2026 upload requirements. `rules/app-store-guidelines.md` adds the upload floors (iOS 13 deployment target, iOS 26 SDK, iOS 27 SDK from April 2027), 1.2 for AI content creation apps and nonconsensual intimate imagery, 2.3.1(a) Notes for Review, 2.3.14 creative assets, 2.5.19 hidden features, the 3.1.1(a) External Purchase Link or, where permitted, Music Streaming Services entitlement, 4.3 saturated categories, 4.5.3 notification and Live Activity spam, the 5.1.1(v) citation, and the age rating and medical device declarations; 4.8 asks for an equivalent privacy-focused login rather than Sign in with Apple only.
+- `store-ready` Gate 3 (iOS) gathers evidence for 1.2, 2.5.19, the upload floor and the App Store Connect declarations, and its IAP and login rows follow 3.1.1(a) and 4.8.
+- `apple-archive-compliance`: `info-plist` covers `MinimumOSVersion` ≥ 13 for iOS and iPadOS builds, `sdk-floor` names the announced iOS 27 floor, `required-reason-api` cites ITMS-91053, and `info-plist` and `embedded-sdk` carry the guideline and ITMS codes their scanner emits. The new behaviour needs `@mmerterden/multi-agent-toolkit-mcp` ≥ 3.23.2.
+- `app-store-review` covers the new guidelines, the upload floors and the App Store Connect declarations, with a new eval.
+- `smoke-compliance-skills.sh` checks that the Apple catalog table and `references/rules.yml` agree on every rule's ITMS codes and SDK floor.
+
 ## [20.27.1] - 2026-10-19
 
 ### Fixed

package/README.md

@@ -158,7 +158,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 
 ## Commands
 
-`/multi-agent` plus 65 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
+`/multi-agent` plus 66 sub-commands. `/multi-agent:help` renders the same catalog in your terminal, in your `outputLanguage`.
 
 ### Pipeline entries
 
@@ -221,6 +221,7 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 | `/multi-agent:test-dynamic-type`         | Re-walk every screen at XL through accessibility-XL, report truncation    |
 | `/multi-agent:test-screenshots [locale]` | App Store screenshot set in a locale (defaults to `tr`)                   |
 | `/multi-agent:bug-bash`                  | Parallel exploratory sessions by charter; only findings a failing repro test proves are reported |
+| `/multi-agent:test-gen`                  | Writes the tests an app lacks, stage by stage: inventory, read-only gap analysis, handles, tests, repeated runs, per-test classification |
 | `/multi-agent:manual-test`               | Phase 3 standalone: check out the task branch and prepare it for Xcode    |
 
 ### Design, build and store
@@ -407,17 +408,17 @@ This enables the matching plugin (+ the shared `ai-common` plugin) in the repo's
 
 ## Tool support
 
-The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 65 commands.
+The pipeline runs natively on **Claude Code**, **Copilot CLI** and **Codex CLI** - all three install from the same `pipeline/` source and get the same 66 commands.
 
 | Tool        | Flag                 | What it installs                                                                                       |
 | ----------- | -------------------- | ------------------------------------------------------------------------------------------------------ |
 | Claude Code | `--claude` (default) | slash commands + skills + agents + three `PreToolUse` hooks (secret scan, agent-guard, read-size gate) |
-| Copilot CLI | `--copilot`          | instructions + 65 sub-command skills + scripts                                                         |
-| Codex CLI   | `--codex`            | one router skill + 65 specs as refs + 10 agent TOML + `AGENTS.md` block + `codex mcp add`               |
+| Copilot CLI | `--copilot`          | instructions + 66 sub-command skills + scripts                                                         |
+| Codex CLI   | `--codex`            | one router skill + 66 specs as refs + 11 agent TOML + `AGENTS.md` block + `codex mcp add`               |
 
 Filter skills by stack with `--platform=ios\|android\|all`.
 
-**Why Codex gets one skill and not 65.** Codex assembles every discovered skill's name
+**Why Codex gets one skill and not 66.** Codex assembles every discovered skill's name
 and description into a single prompt block and drops entries when it overflows, with no
 error. Measured on 0.145: installing one plugin that declares 142 skills surfaced only
 75 of them and evicted an unrelated user skill. So on Codex the pipeline ships a single

package/README.tr.md

@@ -157,7 +157,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 
 ## Komutlar
 
-`/multi-agent` ve 65 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
+`/multi-agent` ve 66 alt komut. `/multi-agent:help` aynı katalogu terminalde, `outputLanguage` ayarına göre gösterir.
 
 ### Pipeline girişleri
 
@@ -220,6 +220,7 @@ Koşunun kendisinde ayarlanabilen tek şey autopilot; geri kalan her şey kendi
 | `/multi-agent:test-dynamic-type`      | Her ekranı XL'den accessibility-XL'e kadar yeniden gezer, kırpılmaları raporlar |
 | `/multi-agent:test-screenshots [dil]` | Bir dilde App Store screenshot seti (varsayılan `tr`)                           |
 | `/multi-agent:bug-bash`               | Charter başına paralel keşif oturumları; yalnız fail eden bir repro testinin kanıtladığı bulgular raporlanır |
+| `/multi-agent:test-gen`               | Uygulamada eksik testleri aşama aşama yazar: envanter, salt-okunur eksik analizi, tutamaklar, testler, tekrarlı koşum, test başına sınıflama |
 | `/multi-agent:manual-test`            | Faz 5'in bağımsız hali: görev branch'ine geçer, Xcode için hazırlar             |
 
 ### Tasarım, build ve store
@@ -406,17 +407,17 @@ Bu, ilgili plugin'i (+ ortak `ai-common` plugin'ini) repo'nun `.claude/settings.
 
 ## Araç desteği
 
-Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 65 komutu alır.
+Pipeline **Claude Code**, **Copilot CLI** ve **Codex CLI** üzerinde native çalışır - üçü de aynı `pipeline/` kaynağından kurulur ve aynı 66 komutu alır.
 
 | Araç        | Bayrak                  | Ne kurar                                                                                                         |
 | ----------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Claude Code | `--claude` (varsayılan) | slash komutları + skill'ler + agent'lar + üç `PreToolUse` hook'u (secret scan, agent-guard, okuma-boyutu geçidi) |
-| Copilot CLI | `--copilot`             | talimatlar + 65 alt-komut skill'i + script'ler                                                                   |
-| Codex CLI   | `--codex`               | bir router skill + ref olarak 65 spec + 10 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
+| Copilot CLI | `--copilot`             | talimatlar + 66 alt-komut skill'i + script'ler                                                                   |
+| Codex CLI   | `--codex`               | bir router skill + ref olarak 66 spec + 11 agent TOML + `AGENTS.md` bloğu + `codex mcp add`                       |
 
 Skill'leri stack'e göre filtrele: `--platform=ios\|android\|all`.
 
-**Codex neden 65 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
+**Codex neden 66 değil de tek bir skill alıyor.** Codex, keşfettiği her skill'in adını
 ve açıklamasını tek bir prompt bloğuna toplar ve blok taştığında girdileri hatasızca
 düşürür. 0.145 üzerinde ölçüldü: 142 skill deklare eden bir plugin kurulduğunda sadece
 75'i yüzeye çıktı ve alakasız bir kullanıcı skill'i tahliye edildi. Bu yüzden Codex'te

package/docs/adr/0008-installer-modularization-and-secret-leak-defense.md

@@ -37,7 +37,6 @@ install/
   _adapters.mjs              - third-party adapter dispatch
   _common.mjs                - shared FS helpers (copyDir, ensureDir, ...)
   _platform-filter.mjs       - --platform=ios|android filter
-  _telemetry.mjs             - opt-in install telemetry
   _copilot-instructions.mjs  - generator for ~/.copilot/copilot-instructions.md
   _dev-only-files.mjs        - single source of truth for excluded files
 ```

package/docs/architecture.md

@@ -113,8 +113,8 @@ graph TB
     end
 
     subgraph "Pipeline Specs"
-        CMD[commands/<br/>65 command files]
-        AGT[agents/<br/>10 agent personas]
+        CMD[commands/<br/>66 command files]
+        AGT[agents/<br/>11 agent personas]
         RUL[rules/<br/>13 domain rules]
         PHS[multi-agent-refs/phases/<br/>phase specs + contracts]
         CMP[skills/shared/core/<br/>orchestration skills<br/>incl. compliance]
@@ -204,8 +204,8 @@ repo and the website, plus the two independently shipped repos
 ```mermaid
 graph TD
     CC["Claude Code<br/>(source of truth)"]
-    COP["Copilot CLI<br/>(instructions + 65 sub-command skills)"]
-    COD["Codex CLI<br/>(1 router skill + 65 refs)"]
+    COP["Copilot CLI<br/>(instructions + 66 sub-command skills)"]
+    COD["Codex CLI<br/>(1 router skill + 66 refs)"]
     REPO["Pipeline Repo<br/>(npm package)"]
     WEB["Website"]
     PLUGREPO["multi-agent-plugins<br/>(6 plugins, own repo)"]

package/docs/ecosystem.md

@@ -5,7 +5,7 @@ separately, wired together at install time and at run time:
 
 | Repo | What it owns | Ships as |
 |---|---|---|
-| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 65 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
+| **`multi-agent-pipeline`** (this repo) | Orchestration: the 6-phase flow, the 66 slash commands, quality gates, review/triage, cross-CLI parity | npm package (`@mmerterden/multi-agent-pipeline`), installs itself onto Claude Code / Copilot CLI / Codex CLI |
 | **`multi-agent-plugins`** | Stack knowledge: per-platform component/lifecycle skills (iOS, Android, Frontend, Backend) + shared knowledge | Claude Code marketplace, 6 independently-versioned plugins |
 | **`multi-agent-toolkit-mcp`** | The pipeline's hands on devices and browsers: 197 MCP tools across 21 categories (simulator/emulator control, end-to-end locators and assertions, memory, crash diagnostics, accessibility audit, store compliance, web automation and scraping, Figma-vs-mock design audit, code intelligence, wallet passes, an agent-DSL batch runner, a full-text context index with text-to-image rendering, provider-backed research, verified hand-off of simple text tasks to free models, video key frames, offline security scoring, read-only access to related repositories at their latest branch, travel document fixtures, a voice channel, App Store Connect and Play Console APIs, virtual iPhones) | npm package, registered as a standard stdio MCP server on every host |
 
@@ -18,7 +18,7 @@ Either can be swapped or removed without touching the other two's source.
 graph LR
     subgraph PIPE ["multi-agent-pipeline (orchestrator)"]
         direction TB
-        PHASES["6 phases · 65 commands"]
+        PHASES["6 phases · 66 commands"]
         GATES["deterministic gates + review triage"]
     end
 
@@ -68,8 +68,8 @@ only those:
 graph TD
     CC["Claude Code<br/>~/.claude/commands/multi-agent/<br/>(source of truth)"]
 
-    CC -->|"Step 2: copy + reformat<br/>65 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
-    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 65 refs<br/>+ 10 agent TOML"]
+    CC -->|"Step 2: copy + reformat<br/>66 sub-command skills"| COP["Copilot CLI<br/>~/.copilot/skills/"]
+    CC -->|"Step 2b: transform<br/>(install.js --codex)"| COD["Codex CLI<br/>1 router skill + 66 refs<br/>+ 11 agent TOML"]
     CC -->|"Step 3: genericize<br/>(strip personal data)"| REPO["multi-agent-pipeline repo<br/>pipeline/"]
     CC -->|"Step 4: version + feature sync"| WEB["Website<br/>projects.ts / i18n.tsx"]
 
@@ -161,7 +161,7 @@ measurements behind this table):
 
 | | Claude Code | Copilot CLI | Codex CLI |
 |---|---|---|---|
-| **Pipeline commands** | 65 slash-command skills, native | 65 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 65 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
+| **Pipeline commands** | 66 slash-command skills, native | 66 sub-command skills, `multi-agent-{cmd}` naming, copied in | 1 router skill (`multi-agent`) + 66 command specs as reference files - Codex silently truncates its skills block past a few dozen entries, so sub-commands are not peer skills here |
 | **Stack plugins** | Marketplace plugin, loaded natively, resolved by `.claude/settings.json` enabled-list | Enabled plugin's authored skills copied flat into `~/.copilot/skills/`; `knowledge/` **not** re-copied (already delivered via `shared/external`) | Copied as reference files under `~/.codex/multi-agent-refs/skills/`, plugin-prefixed on name clash (e.g. `architecture` → `ai-ios-toolkit-architecture`) |
 | **Component dispatch (Phase 3)** | Marketplace plugin's `create-component`/`create-screen` skill via the Skill tool | No plugin loader - the enabled stack plugin's authored skills (incl. `create-component`) are copied flat into `~/.copilot/skills/` at install time (the old frozen `figma-*` copies are pruned, they were never a fallback) | Not part of the enforced parity axis; classification + state-shape must match, skill *inventory* does not |
 | **multi-agent-toolkit-mcp** | `claude mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `copilot mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` | `codex mcp add multi-agent-toolkit -- npx -y @mmerterden/multi-agent-toolkit-mcp` (skipped with a warning if `codex` isn't on `PATH`) |

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-19",
-  "version": "20.27.1",
+  "generatedAt": "2026-10-24",
+  "version": "20.28.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -35,15 +35,15 @@
     "autopilot": [0, 1, 2, 3, 4, 5],
     "analysis": [0, 1, 3, 4, 5]
   },
-  "commandCount": 65,
-  "skillCount": 161,
-  "skillCountAll": 229,
-  "agentCount": 10,
+  "commandCount": 66,
+  "skillCount": 165,
+  "skillCountAll": 234,
+  "agentCount": 11,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 198,
+  "toolCount": 204,
   "toolCategories": {
     "ios": 42,
-    "web": 36,
+    "web": 38,
     "android": 33,
     "store": 30,
     "vphone": 10,
@@ -53,14 +53,16 @@
     "voice": 6,
     "context": 4,
     "pass": 4,
+    "document": 3,
     "agent": 2,
-    "document": 2,
     "llm": 2,
     "research": 2,
     "security": 2,
+    "ui": 2,
+    "coverage": 1,
     "media": 1,
-    "ui": 1
+    "test": 1
   },
-  "pluginSkillCount": 253,
-  "toolkitVersion": "3.23.0"
+  "pluginSkillCount": 261,
+  "toolkitVersion": "3.25.0"
 }

package/docs/features.md

@@ -392,6 +392,8 @@ A visual or semantic assertion is decided by a fresh judge subagent that receive
 
 `/multi-agent:bug-bash` fans out 5-10 charters, each with a persona and its own budget, merges the findings, triages them against the source, and proves every candidate with a reproducing test. `bug-bash.mjs report` confirms a finding only when its repro failed with `ASSERTION_FAILED` on the assertion that encodes it; everything else is listed as rejected with the reason (artifact, environment, design, fixture, did-not-reproduce, unproven, unverified). The `e2e-testing` knowledge skill in ai-common-toolkit carries the toolkit side: locators, expect verdicts, traces, replay, parallel web sessions and synthetic MRZ document fixtures.
 
+`/multi-agent:test-gen` writes the tests an app lacks as a chain of subagents, each gated on its own artefact: inventory (`inventory.json`, then a priority pick, the top three in autopilot), discovery and gaps (`discovery.json`, `gaps.json` with `dataNeeds[]`) on the read-only `test-gen-analyst` persona, whose tool grant is an allowlist of Read, Grep, Glob and read-only toolkit tools, handles (`handles.md`; judged against a stage-start snapshot of the working tree, the stage must add a handle line and `handle-diff-audit.mjs` must find nothing but handles in its delta, compared as ordered code tokens), the tests (`written.json`; test files only, no test gaming in the stage's diff, more than zero tests run), repeated runs, and per-test classification (`results.json`: pass, fail or not_measured, each non-pass with its reason). The run ends by recording its commit as the next run's change base, and autopilot parks at the stale-test revision cap or on any product-bug verdict. Detail: [`stages.md`](../pipeline/multi-agent-refs/test-gen/stages.md).
+
 ### Token Budget Enforcement
 
 Per-phase token budgets prevent runaway sessions. If a phase exceeds its budget, the pipeline pauses and offers: continue (extend budget), skip phase, or abort. Budgets are configurable in `prefs.global.tokenBudgets`.

package/install/_dev-only-files.mjs

@@ -70,6 +70,7 @@ const DEV_ONLY_TOOLING = Object.freeze([
   "gen-catalog-history.mjs", // reads the repo's git history; an install has none
   "gen-ref-toc.mjs", // regenerates the repo's own reference tree; an install has no pipeline/
   "validate-schemas.mjs", // validates the repo's own schema files, needs ajv
+  "permission-baseline.mjs", // reads the repo's own command, skill and agent tree; an install has none
   "sync-parity-check.sh",
   "benchmark-phase-0.sh",
   // Publish-time only: `prepack` runs it from the repo root to write