@mmerterden/multi-agent-pipeline 20.27.1 → 20.28.0

package/pipeline/skills/shared/README.md

@@ -2,24 +2,24 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 229 skills (68 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 234 skills (69 core + 165 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  68 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
-- **`external/`**  -  161 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
+- **`core/`**  -  69 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`external/`**  -  165 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
 Source layout is logical grouping only  -  skill discovery at runtime is unchanged.
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  68
+- [Pipeline Orchestration](#pipeline-orchestration)  -  69
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  94
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
 - [Backend / API](#backend-api)  -  11
-- [Cross-cutting](#cross-cutting)  -  30
+- [Cross-cutting](#cross-cutting)  -  34
 
 ## Pipeline Orchestration
 
@@ -89,6 +89,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-test-accessibility`](./core/multi-agent-test-accessibility/) | `core` | Accessibility audit on a booted simulator / emulator: VoiceOver labels, sub-44pt tap targets, contrast, traits. Alias pinning the accessibil |
 | [`multi-agent-test-dark-mode`](./core/multi-agent-test-dark-mode/) | `core` | Dark mode UI test on a booted simulator / emulator: walk every screen light then dark, report contrast + colour bugs. Alias pinning the dark |
 | [`multi-agent-test-dynamic-type`](./core/multi-agent-test-dynamic-type/) | `core` | Dynamic Type layout test on a booted simulator / emulator: re-walk every screen at XL through accessibility-extra-large, report truncation a |
+| [`multi-agent-test-gen`](./core/multi-agent-test-gen/) | `core` | Write the tests an app lacks, stage by stage, each gated on its artefact: inventory, read-only gap analysis, handles, tests, runs, per-test  |
 | [`multi-agent-test-screenshots`](./core/multi-agent-test-screenshots/) | `core` | App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the  |
 | [`multi-agent-testflight-validation`](./core/multi-agent-testflight-validation/) | `core` | iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never upl |
 | [`multi-agent-uninstall`](./core/multi-agent-uninstall/) | `core` | Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline set |
@@ -104,7 +105,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`app-intents`](./external/app-intents/) | `external` | App Intents for Siri, Shortcuts, Spotlight, widgets, Control Center and Apple Intelligence: AppIntent actions, AppEntity and EntityQuery, Ap |
 | [`app-store-changelog`](./external/app-store-changelog/) | `external` | Generate user-facing App Store release notes from git history since the last tag. Use when release notes have to be written from the commits |
 | [`app-store-optimization`](./external/app-store-optimization/) | `external` | App Store Optimization (ASO) for ranking and conversion: keyword research; app name, subtitle and 100-byte keyword field; description and pr |
-| [`app-store-review`](./external/app-store-review/) | `external` | App Store submission readiness and rejection prevention: Review Guidelines 2.1, 2.3, 2.5.1, 3.1.1, 4.2 and 5.1.2, PrivacyInfo.xcprivacy mani |
+| [`app-store-review`](./external/app-store-review/) | `external` | App Store submission readiness and rejection prevention: Review Guidelines 1.2, 2.1, 2.3, 2.3.14, 2.5.1, 2.5.19, 3.1.1, 4.2 and 5.1.2, uploa |
 | [`apple-on-device-ai`](./external/apple-on-device-ai/) | `external` | On-device AI on Apple hardware: Foundation Models (SystemLanguageModel, LanguageModelSession, @Generable and @Guide structured output, tool  |
 | [`authentication`](./external/authentication/) | `external` | iOS sign-in with AuthenticationServices and LocalAuthentication: Sign in with Apple, passkey (WebAuthn) sign-up and login via ASAuthorizatio |
 | [`background-processing`](./external/background-processing/) | `external` | iOS background work with BGTaskScheduler: BGAppRefreshTask short fetches, BGProcessingTask long maintenance, BGContinuedProcessingTask (iOS  |
@@ -264,15 +265,19 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`e2e-testing`](./external/e2e-testing/) | `external` | \| |
 | [`evidence-github`](./external/evidence-github/) | `external` | Search GitHub for facts an analysis can cite - a known issue in a dependency, the PR that fixed it, what a release actually changed, prior a |
 | [`evidence-registry`](./external/evidence-registry/) | `external` | Check a package's real version, deprecation status and release notes on npm, PyPI, Maven Central or Swift Package Index. Use when a spec or  |
+| [`fix-review-verdicts`](./external/fix-review-verdicts/) | `external` | Independent fix review with three verdicts, test-gaming, scope and root-cause, each backed by file:line findings; the result is computed fro |
 | [`github-actions-templates`](./external/github-actions-templates/) | `external` | Authoring GitHub Actions workflows: triggers, matrices, caching, concurrency, least-privilege permissions, SHA pinning, OIDC, reusable workf |
+| [`handle-request`](./external/handle-request/) | `external` | Add the test handles a scenario needs and answer each request with ADDED, ALREADY or COULD NOT ADD plus file:line or reason. Identity values |
 | [`humanizer`](./external/humanizer/) | `external` | \| |
 | [`localization-reuse-map`](./external/localization-reuse-map/) | `external` | Localization reuse map for one redesigned screen on iOS, Android and web: new keys set against each platform's legacy key, legacy values and |
 | [`pdfkit`](./external/pdfkit/) | `external` | PDFKit on iOS: PDFView display and SwiftUI wrapping, creating and editing PDFDocument and PDFPage, highlight, note, signature and form annot |
+| [`scenario-gap-analysis`](./external/scenario-gap-analysis/) | `external` | Set an inventory against existing tests, sort each behaviour into COVERED, WRONGLY COVERED or MISSING, and write gaps as measurable, priorit |
 | [`search-first`](./external/search-first/) | `external` | \| |
 | [`security-review`](./external/security-review/) | `external` | Run a defensive, static security review of a diff or a repo: build a run-scoped threat model, find vulnerabilities joined to OWASP + CWE wit |
 | [`signal-community`](./external/signal-community/) | `external` | Check whether other people hit the same problem, via Stack Overflow and Hacker News (keyless) plus opt-in Reddit and X. Use when a bug repor |
 | [`skill-creator`](./external/skill-creator/) | `external` | House guide for authoring plugin skills: creating a new skill, trimming or splitting a bloated one, writing or sharpening a description, and |
 | [`spm-build-analysis`](./external/spm-build-analysis/) | `external` | Analyze Swift Package Manager dependencies, package plugins, module variants, and CI-oriented build overhead that slow Xcode builds. Use whe |
+| [`test-result-triage`](./external/test-result-triage/) | `external` | Judge each test result on changed code as product-bug, stale-test, valid or ambiguous (the default), and list behaviour no test covers. stal |
 | [`valven-rules`](./external/valven-rules/) | `external` | Delivery-flow rules from metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, churn, PR body, |
 | [`xcode-build-benchmark`](./external/xcode-build-benchmark/) | `external` | Benchmark Xcode clean and incremental builds with repeatable inputs, timing summaries, and timestamped `.build-benchmark/` artifacts. Use wh |
 | [`xcode-build-fixer`](./external/xcode-build-fixer/) | `external` | Apply approved Xcode build optimization changes following best practices, then re-benchmark to verify improvement. Use when a developer has  |

package/pipeline/skills/shared/core/apple-archive-compliance/SKILL.md

@@ -116,10 +116,10 @@ Apple App Store Review Guidelines + ITMS upload error codes that the underlying
 | # | ruleID | Apple ref | What it checks | Default severity |
 |---|---|---|---|---|
 | 1 | `privacy-manifest` | Guideline 5.1.1 | `PrivacyInfo.xcprivacy` exists + well-formed + declares all required `NSPrivacyCollectedDataTypes` | error |
-| 2 | `required-reason-api` | 5.1.1 + ITMS-91065 | Binary-scanned API usage (UserDefaults, stat, Disk, URL schemes, etc.) cross-referenced with privacy manifest reasons | error |
-| 3 | `info-plist` |  -  | Purpose strings (`NS*UsageDescription`) for every declared permission, ATS configured, CFBundleDisplayName ≤ 30 chars | error/warning |
+| 2 | `required-reason-api` | 5.1.1 + ITMS-91053 | Binary-scanned API usage (UserDefaults, file timestamps, disk space, boot time, active keyboards) cross-referenced with privacy manifest reasons; reason codes must be on Apple's published list | error |
+| 3 | `info-plist` | 2.1 / 2.3.7 / 5.1.1 | Purpose strings (`NS*UsageDescription`) for every declared permission, ATS configured, CFBundleDisplayName ≤ 30 chars, `MinimumOSVersion` ≥ 13 for iOS and iPadOS builds (upload requirement since 2026-09-09) | error/warning |
 | 4 | `code-signing` | ITMS-90035 / 90034 / 90046 / 90717 | Debug entitlements absent in release, correct APS environment (`aps-environment=production`), signature present | error |
-| 5 | `embedded-sdk` |  -  | Third-party SDKs on [Apple's 86 SDK list](https://developer.apple.com/support/third-party-SDK-requirements/) signed + have PrivacyInfo | error |
+| 5 | `embedded-sdk` | ITMS-91061 / 91065 / 90174 | Third-party SDKs on [Apple's commonly used SDK list](https://developer.apple.com/support/third-party-SDK-requirements/) signed + have PrivacyInfo | error |
 | 6 | `entitlement` |  -  | Entitlement ↔ Info.plist mappings (background modes, associated domains, app groups) consistent | warning |
 | 7 | `asset-validation` |  -  | App icon set present + all required sizes, launch storyboard configured | error |
 | 8 | `binary-size` |  -  | `.app` bundle size + estimated post-thinning download size (warns if > 200MB) | info |
@@ -132,7 +132,7 @@ Apple App Store Review Guidelines + ITMS upload error codes that the underlying
 | 15 | `production-hygiene` |  -  | `print()` / `NSLog()` / `debugPrint()` symbol presence + mock/test JSON files shipped in bundle | warning |
 | 16 | `duplicate-resource` |  -  | Same asset under multiple paths (bloats bundle) | info |
 | 17 | `dead-reference` |  -  | Files referenced in Xcode proj but absent from archive | warning |
-| 18 | `sdk-floor` | ITMS-90725 | `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28) | error |
+| 18 | `sdk-floor` | ITMS-90725 | `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28); a build below the announced iOS 27 / Xcode 27 floor (uploads from April 2027) gets an info entry | error |
 
 ## Severity mapping for consumers
 
@@ -317,3 +317,4 @@ The appended section is structured:
 - **v6.0.0**  -  `language: en` frontmatter tag; 4-consumer Examples section expanded.
 - **v8.4.0**  -  Migrated off the standalone ArchiveGuard Swift binary. Backend is now the `ios_app_store_audit` tool inside `@mmerterden/multi-agent-toolkit-mcp` ≥ v2.4 (full Node port of the 17 rules). All four consumer surfaces unchanged; rule IDs and JSON output shape preserved for backward compatibility. Rule catalog now points to `multi-agent-toolkit-mcp/tools/ios-app-store-audit/rules/`. ArchiveGuard repo deprecated.
 - **Unreleased**  -  Catalog grows to 18 rules: adds `sdk-floor` (ITMS-90725, iOS 26 / Xcode 26 build floor in force since 2026-04-28), which nothing previously checked. `embedded-sdk`'s missing-framework-privacy-manifest finding moves from a `5.1.1` WARNING to `ITMS-91061` ERROR, an enforced rejection since 2025-02-12  -  archives that used to pass with a warning now fail. Requires `@mmerterden/multi-agent-toolkit-mcp` ≥ v3.0.0.
+- **v20.27.2**  -  October 2026 guidelines: `info-plist` errors on an iOS or iPadOS `MinimumOSVersion` below 13 (App Store Connect upload requirement since 2026-09-09); `sdk-floor` names the announced iOS 27 / Xcode 27 floor as info; `required-reason-api` cites ITMS-91053 and validates against Apple's published reason-code list. Needs `@mmerterden/multi-agent-toolkit-mcp` ≥ v3.23.2; older servers keep the previous severities.

package/pipeline/skills/shared/core/apple-archive-compliance/references/rules.yml

@@ -1,5 +1,5 @@
 version: 1.0.0
-updated: 2026-07-29
+updated: 2026-10-20
 owner: iOS platform
 description: >
   App Store review + ITMS upload rules, as a machine-readable registry. IDs are the
@@ -47,18 +47,18 @@ rules:
     rationale: app-store-compliance
   - id: required-reason-api
     title: >
-      Binary-scanned API usage (UserDefaults, stat, Disk, URL schemes, etc.) cross-referenced with privacy manifest reasons
+      Binary-scanned API usage (UserDefaults, file timestamps, disk space, boot time, active keyboards) cross-referenced with privacy manifest reasons; reason codes must be on Apple's published list
     severity: blocking
     enforcement: scan
-    policy_ref: 5.1.1 + ITMS-91065
+    policy_ref: 5.1.1 + ITMS-91053
     rationale: app-store-compliance
   - id: info-plist
     title: >
-      Purpose strings (`NS*UsageDescription`) for every declared permission, ATS configured, CFBundleDisplayName ≤ 30 chars
+      Purpose strings (`NS*UsageDescription`) for every declared permission, ATS configured, CFBundleDisplayName ≤ 30 chars, `MinimumOSVersion` ≥ 13 for iOS and iPadOS builds (upload requirement since 2026-09-09)
     severity: blocking
     severity_varies: error/warning
     enforcement: scan
-    policy_ref: none
+    policy_ref: 2.1 + 2.3.7 + 5.1.1
     rationale: app-store-compliance
   - id: code-signing
     title: >
@@ -69,10 +69,10 @@ rules:
     rationale: app-store-compliance
   - id: embedded-sdk
     title: >
-      Third-party SDKs on [Apple's 86 SDK list](https://developer.apple.com/support/third-party-SDK-requirements/) signed + have PrivacyInfo
+      Third-party SDKs on [Apple's commonly used SDK list](https://developer.apple.com/support/third-party-SDK-requirements/) signed + have PrivacyInfo
     severity: blocking
     enforcement: scan
-    policy_ref: none
+    policy_ref: ITMS-91061 + ITMS-91065 + ITMS-90174
     rationale: app-store-compliance
   - id: entitlement
     title: >
@@ -160,7 +160,7 @@ rules:
     rationale: app-store-compliance
   - id: sdk-floor
     title: >
-      `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28)
+      `DTSDKName` / `DTPlatformVersion` major ≥ 26 and `DTXcode` ≥ 2600 (iOS 26 / Xcode 26 floor, in force since 2026-04-28); a build below the announced iOS 27 / Xcode 27 floor (uploads from April 2027) gets an info entry
     severity: blocking
     enforcement: scan
     policy_ref: ITMS-90725

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -33,7 +33,7 @@ Run all steps automatically:
 ```
 Step 0: DOCTOR      node $HOME/.claude/scripts/doctor.mjs  -  exit 2 or 4 STOPS the sync
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 65 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 66 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -229,7 +229,7 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**65 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**66 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
@@ -241,7 +241,7 @@ prune-prompts, purge, refactor, research, resume, review,
 review-analysis, review-issue, review-jira, route-off, route-on,
 route-status, routines, save, scaffold, scan, scenario-audit, search,
 security-review, serve, setup, stack, status, steer, store-ready, sync, test, test-accessibility,
-test-dark-mode, test-dynamic-type, test-screenshots, testflight-validation,
+test-dark-mode, test-dynamic-type, test-gen, test-screenshots, testflight-validation,
 uninstall, update
 ```
 

package/pipeline/skills/shared/core/multi-agent-test-gen/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: multi-agent-test-gen
+description: "Write the tests an app lacks, stage by stage, each gated on its artefact: inventory, read-only gap analysis, handles, tests, runs, per-test classification. Use when screens, flows or a change need tests."
+user-invocable: true
+argument-hint: "[scope] [--platform ios|android|web] [--repo <path>]  -  scope: a screen, route or flow, or empty for what changed since the last test-gen run"
+metadata:
+  language: en
+  not-for: test, bug-bash, scenario-audit, manual-test
+---
+
+# multi-agent-test-gen
+
+**Input**: $ARGUMENTS
+
+Writes the tests an app is missing, in the repo's own frameworks, and reports
+what they found. Seven stages run as subagents, each leaving one artefact that a
+script gates before the next stage starts: inventory, discovery, gaps, handles,
+write, run, classify. The two analysis stages run as a read-only agent type, so
+nothing they do can change the repository.
+
+Stage contract, read before Step 1:
+
+```
+$HOME/.claude/multi-agent-refs/test-gen/stages.md
+$HOME/.claude/multi-agent-refs/features/test-classification.md
+```
+
+Scripts: `test-gen-gate.mjs` (artefact, handle and write gates),
+`handle-diff-audit.mjs` (handles only), `test-classify.mjs`,
+`test-gen-state.mjs` (change base, revision cap), `evidence-gate.mjs`, all under
+`$HOME/.claude/scripts/`. Schemas: `test-gen-inventory`, `test-gen-gaps`,
+`test-gen-results` under `$HOME/.claude/schemas/`.
+
+## Gotchas
+
+- An analysis stage that wants to "just fix" something is out of its lane. Discovery and gaps go to `test-gen-analyst`, whose grant is an allowlist of read-only tools.
+- The handle stage adds handles and nothing else. A wrapped view, a renamed element or a changed condition fails `handle-diff-audit.mjs`; revert the hunk, do not argue with the audit.
+- `HANDLES: none-needed` is a claim that the handles exist. It needs the `file:line` of each.
+- A test that passed once is not green. Unstable is a fail, and a red test with no base to compare is `not_measured`, not a regression.
+- Test data is named in `dataNeeds[]`, never filled in by the run. A credential is a `secretRef`.
+- A product bug is reported, never fixed here. In autopilot it parks the run.
+
+## Step 1 - Prepare
+
+1. Repo: `--repo`, else the current directory; confirm it in one line.
+   Platform: `--platform`, else detect as `multi-agent-test` does. Run id
+   `tg-<timestamp>`; `RUN="$HOME/.claude/logs/test-gen/<repo>/<timestamp>"`,
+   created with `mkdir -p "$RUN"`.
+2. Toolkit: `test_results_classify`, `coverage_gap` and `ui_locator_codegen`
+   need `@mmerterden/multi-agent-toolkit-mcp` >= v3.25.0. Check the tool list
+   once. Each missing tool has a fallback in `stages.md` (classify from the
+   repeats, the analyst matches coverage itself with every match `inferred`,
+   locators written by hand from the handles); say which fallbacks are in use,
+   once.
+3. Change base. `TG_STATE="$HOME/.claude/knowledge/<project>/test-gen-state.json"`:
+
+   ```bash
+   node "$HOME/.claude/scripts/test-gen-state.mjs" base-scan --state "$TG_STATE" --repo "$REPO" \
+     --graph "$HOME/.claude/knowledge/<project>/code-graph.json" > "$RUN/base-scan.json"
+   ```
+
+   Exit 0: the changed files and their dependents narrow an empty scope. Exit 1
+   (`measured: false`, first run or base gone): nothing is narrowed, and the
+   reason goes in the report.
+
+## Step 2 - Inventory and priority
+
+Stage 1 of `stages.md`, then the priority pick: ask which items to cover
+(one question to the user; autopilot: the top three, recorded as `autopilot-top3`). Gate:
+
+```bash
+node "$HOME/.claude/scripts/test-gen-gate.mjs" check --stage inventory --file "$RUN/inventory.json"
+node "$HOME/.claude/scripts/evidence-gate.mjs" --claim artefact --status passed \
+  --evidence "$RUN/inventory.json" --stage-start "$STAGE_START"
+```
+
+## Step 3 - Discovery and gaps (read-only)
+
+Stages 2 and 3, both with `subagent_type: "test-gen-analyst"`. Write each answer
+with the Write tool, then gate each file with `evidence-gate.mjs --claim
+artefact` against its own stage start, and each with `test-gen-gate.mjs check`
+(`--stage discovery`, `--stage gaps`). Show the gaps (bucket, priority,
+expectation) and the `dataNeeds[]`; ask for the data or the credential names
+(autopilot: write only the scenarios whose needs are met).
+
+## Step 4 - Handles
+
+Stage 4. Snapshot first (`test-gen-gate.mjs baseline`), then the subagent, then
+both gates against that snapshot: `test-gen-gate.mjs handles` and
+`handle-diff-audit.mjs --baseline` exit 0. The gates read only the stage's own
+change; the person's uncommitted work is never the stage's to revert. Skip the
+stage when no gap has `handlesNeeded`, and say so.
+
+## Step 5 - Write, run, classify
+
+Stages 5 to 7: a new snapshot, the tests and `written.json`, the
+`test-gen-gate.mjs written --baseline` gate (test files only, inside the repo
+and changed by the stage, no test gaming, a discovered runner, more than zero
+tests run), the repeated runs, then
+`results.json` through `test-classify.mjs` and `test-gen-gate.mjs results`.
+
+## Step 6 - Triage
+
+Stage 8, one verdict per non-pass result, each through `test-gen-state.mjs
+revise`. Exit 3 parks the run: stop, keep every artefact, report why, and record
+no change base, because the run did not finish.
+
+## Step 7 - Report and base
+
+Print, in this order: the tests written (file, scenario, expectation), the
+results table from `results.json` with every `fail` and `not_measured` reason,
+the triage verdicts, the handles added (`handles.md`), the scenarios blocked by
+data, and `gaps.json`'s `unmeasured[]`. State which parts are mechanical (the
+gates, the classification, the handle audit) and which are judgement (the
+inventory, the gaps, the triage). Then record the change base
+(`test-gen-state.mjs base-record`).
+
+Offer, one question: open the product bugs through `multi-agent` with each
+failing test as the acceptance check, or stop. **No commit, no push, no issue
+from this command.**

package/pipeline/skills/shared/external/app-store-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: app-store-review
-description: "App Store submission readiness and rejection prevention: Review Guidelines 2.1, 2.3, 2.5.1, 3.1.1, 4.2 and 5.1.2, PrivacyInfo.xcprivacy manifests and required-reason codes, IAP and StoreKit rules, ATT consent, EU DMA distribution, entitlements and usage strings, metadata limits, screenshots, TestFlight, phased release, Resolution Center appeals, HIG review items, widget and Live Activity review rules. Use when preparing a submission, fixing a rejection, auditing a privacy manifest, implementing the ATT prompt or checking IAP compliance. Not for keyword research, ranking, conversion copy, screenshot order or A/B tests (app-store-optimization)."
+description: "App Store submission readiness and rejection prevention: Review Guidelines 1.2, 2.1, 2.3, 2.3.14, 2.5.1, 2.5.19, 3.1.1, 4.2 and 5.1.2, upload floors, age rating and medical device declarations, PrivacyInfo.xcprivacy manifests and required-reason codes, IAP and StoreKit rules, ATT consent, EU DMA distribution, entitlements and usage strings, metadata limits, screenshots, TestFlight, phased release, Resolution Center appeals, HIG review items, widget and Live Activity review rules. Use when preparing a submission, fixing a rejection, auditing a privacy manifest, implementing the ATT prompt or checking IAP compliance. Not for keyword research, ranking, conversion copy, screenshot order or A/B tests (app-store-optimization)."
 metadata:
   source: multi-agent-pipeline
 ---
@@ -42,8 +42,10 @@ Limits to state on every metadata answer:
 A full audit reports two lists: things that stop upload or review, and cleanup.
 Treat these as blockers:
 
-1. The build is uploaded after April 28, 2026 and was not produced with Xcode 26
-   or later against the platform's 26 SDK or later.
+1. The build was not produced with Xcode 26 or later against the platform's 26
+   SDK or later (required since April 28, 2026; the 27 SDK is required from
+   April 2027), or its deployment target is below iOS 13 (required since
+   September 9, 2026).
 2. The privacy manifest, the nutrition label, the privacy policy, the ATT state,
    what bundled SDKs transmit and what the app does on the network (audited at
    runtime) do not tell the same story.
@@ -54,11 +56,27 @@ Treat these as blockers:
    missing for an app that runs on iPad.
 5. Features behind a login, or features a reviewer would not find alone, ship
    with no demo credentials, no demo mode and no App Review notes.
+6. The App Store Connect declarations are missing: the age rating questionnaire
+   including its social media questions, or, for a Health & Fitness or Medical
+   app, the regulated medical device status.
 
 Everything else (copy polish, an optional screenshot, a HIG nit) is cleanup.
 
 ## Guidelines that cause most rejections
 
+### 1.2 User-generated and AI-generated content
+
+Applies to social apps, user-generated content platforms and apps that create
+content with AI. Required: filtering of objectionable material, reporting with
+timely responses, blocking abusive users, and published contact information.
+Apps used primarily for random or anonymous chat, pornography, objectifying
+real people or bullying do not belong on the App Store, whatever moderation
+they add. The guideline names nonconsensual intimate imagery among the risks,
+and Apple's announcement of 16.10.2026 asks apps to prevent and remove it,
+AI-generated imagery included. A developer who adds no safeguards, or does not
+remediate after Apple's notice, may be considered in violation of the
+Developer Code of Conduct.
+
 ### 2.1 App Completeness
 
 Rejected: placeholder text, lorem ipsum or visible test records; broken links and
@@ -79,6 +97,13 @@ run every flow from start to finish including its empty and error states.
   belong. The primary
   category must match the main function.
 
+### 2.3.14 Creative assets
+
+Creative assets appear in the product page header and in search results. They
+must relate to the app's content, function or brand, follow the metadata rules
+and suit all audiences: no references to other apps meant to mislead, no
+unverifiable claims, no specific or discounted prices.
+
 ### 4.2 Minimum Functionality
 
 - A shell around `WKWebView` is rejected unless it adds meaningful native
@@ -92,12 +117,38 @@ run every flow from start to finish including its empty and error states.
 
 - Public APIs only. Private API use is rejected outright.
 - From April 28, 2026, uploads need Xcode 26+ and the matching 26+ platform SDK.
-- The minimum deployment target is a product and compatibility choice; App
-  Review does not set it.
+  From April 2027 the floor is the 27 SDK.
+- App Store Connect accepts iOS and iPadOS uploads that target iOS 13 or later.
+  Above that floor the deployment target is a product choice.
 - The app may not download or run code that adds or changes features after
   review. The exception is interpreted code that Apple's guidelines and
   agreements explicitly allow.
 
+### 2.5.19 Hidden, dormant or undocumented features
+
+Every feature is visible to users and to App Review. A feature switched on by
+remote config after approval, a dormant code path, or functionality hidden in
+the binary through obfuscation leads to removal and can end the developer
+account. Feature flags are fine when the review notes name what they gate and
+the reviewer can reach it.
+
+## App Store Connect declarations
+
+These live in App Store Connect, not in the repo, so an audit reports them as
+manual checks:
+
+- Age rating questionnaire, including the social media capability questions
+  (required since September 2026). Apps with social features show a Social
+  Media descriptor; turning those features off for users under 13 exempts them
+  from the Social Media Time Allowance.
+- Regulated medical device status for apps whose primary or secondary category
+  is Health & Fitness or Medical, or that frequently reference medical or
+  treatment information (EEA, UK, US). Required for new apps; existing apps
+  cannot submit updates without it from early 2027.
+- Regional age ratings where they apply (for example Korea GRAC, Australia,
+  Vietnam) and age assurance through the Declared Age Range API where the law
+  requires it.
+
 ## Privacy manifest in brief
 
 `PrivacyInfo.xcprivacy` is needed whenever code in the app, in an executable, in
@@ -146,7 +197,9 @@ Rules around the purchase:
   happens, that it renews automatically, and how to cancel, all before purchase.
 - Strip any route to an outside checkout for digital goods, whether a link, a
   button or a nudge in copy, unless the storefront's current rule or a granted
-  entitlement permits it. These rules differ by region and have changed recently; read the
+  entitlement permits it. A StoreKit External Purchase Link entitlement or,
+  where permitted, a Music Streaming Services entitlement allows a link to a
+  permitted destination; the US storefront needs no entitlement. These rules differ by region and have changed recently; read the
   current 3.1.1(a) and 3.1.3 text for the target storefront.
 - Reader apps may link out to account sign-up with the matching entitlement, but
   may not offer a way around IAP for in-app purchases.
@@ -327,8 +380,16 @@ implementation.
 - [ ] IAP for digital content; terms shown before purchase; restore works; no
       external purchase CTAs unless allowed
 - [ ] Standard navigation; the UI holds up in Dark Mode and at large Dynamic Type
-- [ ] Toolchain is Xcode 26+ with a 26+ SDK (required from April 28, 2026); no
-      private APIs; every entitlement justified
+- [ ] Toolchain is Xcode 26+ with a 26+ SDK (required from April 28, 2026; 27 SDK
+      from April 2027); deployment target iOS 13+; no private APIs; every
+      entitlement justified
+- [ ] No feature gated by remote config or hidden code that the review notes
+      leave out (2.5.19)
+- [ ] User or AI-generated content has filtering, reporting, blocking, contact
+      and a way to report and remove NCII (1.2); the app is not primarily random
+      or anonymous chat
+- [ ] Age rating (social media questions) and, for health apps, the medical
+      device declaration are filled in App Store Connect
 - [ ] ATT prompt only if the app tracks
 
 Full lists: [review checklists](references/review-checklists.md).

package/pipeline/skills/shared/external/app-store-review/evals/evals.json

@@ -39,6 +39,18 @@
         "Names the 6.9-inch iPhone and 13-inch iPad screenshot sets",
         "Does not produce a full keyword plan or rewrite the marketing copy"
       ]
+    },
+    {
+      "id": 4,
+      "prompt": "Our photo app lets users generate stylized portraits with an on-device model and share them to a public feed. A new filter is switched on by remote config after approval. The deployment target is iOS 12. What does App Review object to?",
+      "expected_output": "A blocker-first answer covering the upload floor, 1.2 for AI-generated and shared content, 2.5.19 for the remote-config feature, and the age rating social media questions.",
+      "files": [],
+      "expectations": [
+        "States that App Store Connect rejects uploads targeting below iOS 13",
+        "Applies guideline 1.2 to the AI-generated, shared content: filtering, reporting, blocking, published contact, and prevention and removal of nonconsensual intimate imagery",
+        "Cites 2.5.19: a feature switched on after approval must be described in the review notes and reachable by the reviewer, or it is a hidden feature",
+        "Says the age rating questionnaire's social media questions must be answered because the app has a public feed"
+      ]
     }
   ]
 }

package/pipeline/skills/shared/external/app-store-review/references/review-checklists.md

@@ -125,9 +125,18 @@ Design:
 
 Technical:
 
-- [ ] Uploads after April 28, 2026 built with Xcode 26+ and SDK 26+.
+- [ ] Built with Xcode 26+ and SDK 26+ (required since April 28, 2026); SDK 27+ from April 2027.
+- [ ] Deployment target iOS 13 or later (required for upload since September 9, 2026).
 - [ ] No private APIs.
 - [ ] No code downloaded and executed to change features.
+- [ ] No hidden, dormant or undocumented features; every remote-config flag is named in the review notes (2.5.19).
 - [ ] Every entitlement justified, with usage descriptions.
 - [ ] Every background mode justified and in use.
 - [ ] Deployment target chosen on purpose and tested on the oldest supported OS.
+
+App Store Connect:
+
+- [ ] Age rating questionnaire answered, social media capability questions included.
+- [ ] Health & Fitness or Medical apps: regulated medical device status declared.
+- [ ] Creative assets relate to the app and carry no prices or unverifiable claims (2.3.14).
+- [ ] User or AI-generated content: filtering, reporting, blocking, published contact, a way to report and remove NCII (1.2); not primarily random or anonymous chat.

package/pipeline/skills/shared/external/fix-review-verdicts/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: fix-review-verdicts
+description: "Independent fix review with three verdicts, test-gaming, scope and root-cause, each backed by file:line findings; the result is computed from findings, never from a claim. Use when reviewing a fix made to turn tests green. Not a full review checklist."
+metadata:
+  source: multi-agent-pipeline
+  version: 1.0.0
+---
+
+# Fix review verdicts
+
+Tests can be made green without fixing anything: hide the element only under
+test, branch on an automation flag, loosen a check, swallow the error. The
+tests pass and report nothing. Only someone reading the diff catches it, and
+that reader should not be the one who wrote the fix.
+
+## 1. Inputs
+
+The reviewer does not see the author's conversation. It reads:
+
+- the approved root-cause statement: what broke, where, and the agreed fix;
+- the diff;
+- the evidence runs: did the expected tests turn green, did the guard tests
+  stay green;
+- machine check results (lint, types, unit tests) from the project's own
+  approved commands;
+- the author's report, as a claim to verify, not as evidence.
+
+The reviewer changes no code. Its only output is the review.
+
+## 2. The three required verdicts
+
+Each one gets an explicit verdict and a reason.
+
+**test-gaming: `clean` | `violation`.** A violation is any of:
+
+- an environment branch in product code: `navigator.webdriver`,
+  `process.env.CI`, `window.Cypress`, a user-agent or URL-parameter check,
+  `ProcessInfo` arguments or environment, an `isRunningTests` flag, a
+  test-only build flag;
+- detecting automation, or showing or hiding an element only under test;
+- hard-coding the text or value the test looks for;
+- a swallowed error: an empty `catch`, a discarded `try?`, an ignored
+  `runCatching`;
+- a loosened product validation, an inflated timeout, a skipped or disabled
+  test;
+- an existing assertion, fixture or snapshot changed so that it accepts what
+  it used to reject (a weaker matcher, a widened tolerance, a re-recorded
+  snapshot, a fixture edited to dodge the bug) in a fix whose cause is in
+  product code.
+
+Not a violation: a new regression test that encodes the bug, fails on the
+unfixed code and passes on the fix. That is the bug-fix protocol (a failing
+test first), and it is expected. Check it actually fails without the fix; a
+new test that passes on the unfixed base proves nothing and is a suggestion
+finding.
+
+**scope: `clean` | `violation`.** The diff touches only the approved cause.
+Unrelated files, reformatting, opportunistic refactors, lockfile or dependency
+changes and configuration changes are violations.
+
+**root-cause: `root` | `symptom`.** Does the fix remove the cause or suppress
+the result? Fixing contrast by hiding the element, overflow by clipping it, an
+error by deleting its message, a race by retrying until it passes, or bad
+input by clamping it are symptoms.
+
+## 3. Findings
+
+```json
+{ "severity": "blocking", "area": "test-gaming", "file": "src/cart/Total.tsx", "line": 42, "note": "returns the expected total when navigator.webdriver is set" }
+```
+
+- `severity`: `blocking` or `suggestion`.
+- `area`: `test-gaming`, `scope`, `symptom`, `correctness`, `security`,
+  `performance`, `maintainability`, `accessibility`.
+- Each verdict maps to one finding area: test-gaming `violation` to area
+  `test-gaming`, scope `violation` to area `scope`, root-cause `symptom` to
+  area `symptom`. Every such verdict comes with at least one blocking finding
+  in its area. A correctness or security defect is blocking.
+- A suspicion without a line to show is a suggestion with its reason. A line
+  that shows test-gaming, scope creep or a symptom fix is blocking, without
+  hedging.
+
+## 4. Computing the result
+
+The result is derived, never declared. An author's "all green", a reviewer's
+"looks good" and a summary field saying passed are ignored. It has three
+states: `passed`, `blocked`, `not_measured`.
+
+```
+VERDICT_AREA = {test-gaming: violation -> test-gaming,
+                scope: violation -> scope,
+                root-cause: symptom -> symptom}
+
+if the review was never submitted:
+    result = not_measured
+elif any of the three verdicts is missing or outside its allowed values:
+    result = not_measured            # an invalid review measures nothing
+else:
+    for each (verdict, value) -> area in VERDICT_AREA that matches:
+        if no blocking finding exists in that area:
+            add a blocking finding in that area, built from the verdict's reason
+    for each machine check:
+        failed on the fix and not on the base   -> blocking finding (correctness)
+        changed the working tree                -> blocking finding (checks read, never write)
+        failed on the base as well              -> preexisting: reported, not blocking
+        had no approved command (undefined)     -> unmeasured check
+        could not run (tool missing, timeout)   -> unmeasured check
+    if any finding is blocking:
+        result = blocked
+    elif any unmeasured check:
+        result = not_measured
+    else:
+        result = passed
+```
+
+`blocked` wins over `not_measured`: a known defect is reported even when part
+of the review could not run. `not_measured` never counts as `passed`; the fix
+does not ship on it, and the report names what was not measured and why.
+
+## 5. Output
+
+The structured review (three verdicts with reasons, findings, a two to four
+sentence summary) and a report: each verdict with its reason, the findings
+with `file:line`, and a "could not measure" section.
+
+## Related
+
+- The stack's review rubric for the general pass: `ai-android-toolkit`
+  `reference/review-checklist`, `ai-ios-toolkit:ios-coding-standard`, and the
+  built-in `/code-review`.
+- `security-review` when the diff touches auth, input handling or secrets.
+- `test-result-triage`, which decides whether a red test was a product bug
+  before any fix is written.