@mmerterden/multi-agent-pipeline 20.27.2 → 20.28.0

package/pipeline/scripts/usage-register.mjs

@@ -52,7 +52,16 @@
  * @module pipeline/scripts/usage-register
  */
 
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { postJson as postHttp } from "./_http-post.mjs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { join } from "node:path";
@@ -70,6 +79,7 @@ import {
   sshKeygenBin,
 } from "./usage-identity.mjs";
 import { lockTimeoutFrom, updateJsonFileSync } from "../lib/json-file-lock.mjs";
+import { BEACON_ENV, beaconUrl, httpReason, transportReason } from "./usage-register-beacon.mjs";
 
 const DEFAULT_ENDPOINT = "https://mmerterden.com/api/usage/ingest";
 const BUILT_IN_HOSTS = ["mmerterden.com"];
@@ -196,30 +206,39 @@ export function registerUrlAllowed(url, trustedHosts = []) {
   return trusted.has(u.hostname.toLowerCase());
 }
 
+// Transport goes through _http-post.mjs, which retries a connection-level
+// failure through curl (proxy variables, system trust store). The failure text
+// keeps both causes so a blocked corporate network is diagnosable.
 async function postJson(url, body, bearer = null) {
-  const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
-  const headers = { "Content-Type": "application/json" };
-  if (bearer) headers.Authorization = `Bearer ${bearer}`;
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      redirect: "error",
-      signal: ctrl.signal,
-    });
-    const json = await res.json().catch(() => null);
-    return { res, json, failure: null };
-  } catch (e) {
+  const headers = bearer ? { Authorization: `Bearer ${bearer}` } : {};
+  const r = await postHttp({ url, headers, body: JSON.stringify(body), timeoutMs: TIMEOUT_MS });
+  if (r.failure) {
+    const causes = [r.fetchFailure && `fetch ${r.fetchFailure}`, `curl ${r.failure}`]
+      .filter(Boolean)
+      .join(", ");
+    const what = r.fetchFailure === "timeout" ? "endpoint timed out" : "endpoint unreachable";
     return {
       res: null,
       json: null,
-      failure: e?.name === "AbortError" ? "endpoint timed out" : "endpoint unreachable",
+      failure: `${what} (${causes})`,
+      reason: transportReason(r.fetchFailure, r.failure),
     };
-  } finally {
-    clearTimeout(timer);
   }
+  if (r.status >= 300 && r.status < 400) {
+    return {
+      res: null,
+      json: null,
+      failure: `endpoint redirected (${r.status})`,
+      reason: "redirected",
+    };
+  }
+  let json = null;
+  try {
+    json = JSON.parse(r.body);
+  } catch {
+    /* non-JSON answer: the status alone decides */
+  }
+  return { res: { ok: r.status >= 200 && r.status < 300, status: r.status }, json, failure: null };
 }
 
 const SSH_REFUSALS = {
@@ -265,11 +284,16 @@ function refusal(status, json, body, method) {
 }
 
 async function requestToken(url, body, proof, method) {
-  const { res, json, failure } = await postJson(url, body, proof);
-  if (failure) return { token: null, why: failure };
+  const { res, json, failure, reason } = await postJson(url, body, proof);
+  if (failure) return { token: null, why: failure, reason };
   if (!res.ok) {
     const code = typeof json?.code === "string" ? json.code : null;
-    return { token: null, code, why: refusal(res.status, json, body, method) };
+    return {
+      token: null,
+      code,
+      why: refusal(res.status, json, body, method),
+      reason: httpReason(res.status, code),
+    };
   }
   if (json?.accepted === false)
     return { token: null, declined: true, why: "the endpoint declined this login" };
@@ -277,7 +301,7 @@ async function requestToken(url, body, proof, method) {
   const pinnedLogin = typeof json?.u === "string" && json.u.trim() ? json.u.trim() : null;
   return token
     ? { token, why: null, login: pinnedLogin }
-    : { token: null, why: "endpoint returned no token" };
+    : { token: null, why: "endpoint returned no token", reason: "other" };
 }
 
 /**
@@ -323,20 +347,26 @@ export function challengeUrl(url) {
 
 async function requestTokenWithSsh(url, body, key) {
   const ch = await postJson(challengeUrl(url), { u: body.u });
-  if (ch.failure) return { token: null, why: ch.failure };
+  if (ch.failure) return { token: null, why: ch.failure, reason: ch.reason };
   if (!ch.res.ok) {
     if (ch.res.status === 404 || ch.res.status === 405) {
       return {
         token: null,
         why: `the endpoint does not accept an SSH key as proof yet (challenge answered ${ch.res.status})`,
+        reason: "other",
       };
     }
-    return { token: null, why: refusal(ch.res.status, ch.json, body, "ssh") };
+    const code = typeof ch.json?.code === "string" ? ch.json.code : null;
+    return {
+      token: null,
+      why: refusal(ch.res.status, ch.json, body, "ssh"),
+      reason: httpReason(ch.res.status, code),
+    };
   }
   const challenge = typeof ch.json?.challenge === "string" ? ch.json.challenge : "";
   const namespace = typeof ch.json?.namespace === "string" ? ch.json.namespace : "";
   if (!challenge || !/^[A-Za-z0-9@._-]{1,128}$/.test(namespace)) {
-    return { token: null, why: "the endpoint returned no usable SSH challenge" };
+    return { token: null, why: "the endpoint returned no usable SSH challenge", reason: "other" };
   }
   const signature = sshSign(key, namespace, challenge);
   if (!signature) {
@@ -344,6 +374,7 @@ async function requestTokenWithSsh(url, body, key) {
     return {
       token: null,
       why: `could not sign with the SSH key ${shown} (it needs a passphrase and is not in ssh-agent); run \`ssh-add ${shown}\`, then retry with --refresh`,
+      reason: "no-proof",
     };
   }
   return requestToken(url, { ...body, ssh: { challenge, signature } }, null, "ssh");
@@ -538,6 +569,57 @@ function reportingStaysOff(status, detail) {
   return status === "skipped" && !QUIET_REASONS.has(detail);
 }
 
+export const LAST_REGISTER_FILE = "usage-last-register.json";
+
+/**
+ * Overwrites the record of the most recent registration attempt. Registration
+ * runs quietly from setup, update and Phase 0, so this file is where a machine
+ * that never registers shows why; doctor reads it. It holds no token.
+ */
+function recordRegister(home, status, detail) {
+  const dir = join(home, ".claude", "logs", "multi-agent");
+  const target = join(dir, LAST_REGISTER_FILE);
+  const tmp = `${target}.${process.pid}.tmp`;
+  try {
+    mkdirSync(dir, { recursive: true });
+    const entry = {
+      t: new Date().toISOString(),
+      status,
+      detail: String(detail ?? "").slice(0, 300),
+    };
+    writeFileSync(tmp, JSON.stringify(entry) + "\n", { mode: 0o600 });
+    renameSync(tmp, target);
+  } catch {
+    /* logs dir unwritable - never break the caller */
+  }
+}
+
+/**
+ * Report a failed registration to the site, detached so it never delays or
+ * fails the caller (usage-register-beacon.mjs). Only for a failure the person
+ * did not choose, never on a dry run or for an opted-out machine, only under a
+ * login this run had, and only to a register URL the proof may go to.
+ */
+function sendFailureBeacon({ home, prefsPath, login, reason, dryRun }) {
+  if (dryRun || !reason || typeof login !== "string" || !LOGIN_RE.test(login)) return;
+  const usageLog = readJson(prefsPath)?.global?.usageLog || {};
+  if (usageLog.optOut === true) return;
+  const url = registerUrl(usageLog.endpoint);
+  if (!registerUrlAllowed(url, usageLog.trustedHosts || [])) return;
+  try {
+    spawn(process.execPath, [join(import.meta.dirname, "usage-register-beacon.mjs")], {
+      detached: true,
+      stdio: "ignore",
+      env: {
+        ...process.env,
+        [BEACON_ENV]: JSON.stringify({ home, url: beaconUrl(url), login, reason }),
+      },
+    }).unref();
+  } catch {
+    // reporting never fails the caller
+  }
+}
+
 async function main(argv) {
   const opts = {
     quiet: false,
@@ -566,7 +648,16 @@ async function main(argv) {
     if (!opts.quiet) process.stdout.write(`${line}\n`);
   };
   const identity = { login: undefined };
-  const done = (status, detail) => {
+  const beacon = { login: null };
+  const done = (status, detail, reason = null) => {
+    if (!opts.dryRun) recordRegister(HOME, status, detail);
+    sendFailureBeacon({
+      home: HOME,
+      prefsPath,
+      login: beacon.login,
+      reason,
+      dryRun: opts.dryRun,
+    });
     if (opts.json) {
       const needsPersonalAccount = personalAccountMissing(readJson(prefsPath), identity.login);
       process.stdout.write(`${JSON.stringify({ status, detail, needsPersonalAccount })}\n`);
@@ -602,7 +693,8 @@ async function main(argv) {
     }
     if (!opts.dryRun && !declareLogin(prefsPath, name)) {
       say("  -> operational reporting: could not write preferences");
-      return done("unavailable", "prefs write failed");
+      beacon.login = name;
+      return done("unavailable", "prefs write failed", "prefs-write");
     }
     opts.refresh = true;
   }
@@ -629,6 +721,7 @@ async function main(argv) {
     who = { login: declared, method: "claim", key: null, reason: "declared by the person" };
   }
   identity.login = who.login;
+  beacon.login = who.login || null;
   const decision = decideRegistration(current, {
     hasStoredToken: has,
     forFeedback: opts.feedback,
@@ -649,7 +742,8 @@ async function main(argv) {
           return done("enabled", decision.reason);
         }
         say("  -> operational reporting: could not write preferences");
-        return done("unavailable", "prefs write failed");
+        beacon.login = beacon.login || cu.registeredAs || null;
+        return done("unavailable", "prefs write failed", "prefs-write");
       }
     }
     if (
@@ -702,11 +796,11 @@ async function main(argv) {
           ? `the git credential helper no longer returns a GitHub token for ${user}; retry with --refresh`
           : `gh has no token for ${user}; run \`gh auth login\` for that account`;
       say(`  -> operational reporting left off (${why})`);
-      return done("unavailable", why);
+      return done("unavailable", why, "no-proof");
     }
     result = await requestToken(url, { u: user, c: host }, proof, who.method || "gh");
   }
-  const { token, why, declined, code, login: pinnedLogin } = result;
+  const { token, why, declined, code, reason, login: pinnedLogin } = result;
   if (who.method === "claim" && ["not_collaborator", "proof_required"].includes(code))
     declareLogin(prefsPath, null);
   else if (who.method === "claim" && !token && !declined)
@@ -717,7 +811,7 @@ async function main(argv) {
   }
   if (!token) {
     say(`  -> operational reporting left off (${why})`);
-    return done("unavailable", why);
+    return done("unavailable", why, reason || "other");
   }
 
   const optedOut = prefs.global?.usageLog?.optOut === true;
@@ -729,7 +823,8 @@ async function main(argv) {
   });
   if (set.status !== 0) {
     say("  -> operational reporting left off (the credential store refused the token)");
-    return done("unavailable", "credential store write failed");
+    beacon.login = pinnedLogin || user;
+    return done("unavailable", "credential store write failed", "credential-store");
   }
   persistPrefs(prefsPath, entry, {
     enableTelemetry: !optedOut,

package/pipeline/scripts/usage-report.mjs

@@ -22,6 +22,7 @@
  * Usage:
  *   node usage-report.mjs --state /path/to/agent-state.json [--event <kind>]
  *   node usage-report.mjs --task-id PROJ-123 [--phase N] [--event <kind>]
+ *   node usage-report.mjs --task-id PROJ-123 --print-state   (prints the run's agent-state.json path)
  *
  *   node usage-report.mjs --lifecycle   (report the installed version when it changed)
  *   --event  phase | completed | halted | parked  (default: derived from state)
@@ -29,6 +30,7 @@
  * @module pipeline/scripts/usage-report
  */
 
+import { postJson } from "./_http-post.mjs";
 import {
   readFileSync,
   existsSync,
@@ -86,6 +88,7 @@ function parseArgs(argv) {
     else if (a === "--event") out.event = argv[++i];
     else if (a === "--dry-run") out.dryRun = true;
     else if (a === "--lifecycle") out.lifecycle = true;
+    else if (a === "--print-state") out.printState = true;
   }
   return out;
 }
@@ -737,40 +740,31 @@ function hostOf(url) {
  * instead, so a moved endpoint is visible rather than silent.
  */
 async function post(endpoint, token, event) {
-  const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  const r = await postJson({
+    url: endpoint,
+    headers: { "X-Usage-Token": token },
+    body: JSON.stringify(event),
+    timeoutMs: TIMEOUT_MS,
+  });
+  const via = r.fetchFailure ? { transport: r.transport, fetchFailure: r.fetchFailure } : {};
+  if (r.failure) {
+    return { outcome: "failed", reason: codeOf(String(r.failure), 40), ...via };
+  }
+  if (r.status >= 300 && r.status < 400) {
+    return { outcome: "redirected", status: r.status, location: hostOf(r.location || ""), ...via };
+  }
+  if (r.status < 200 || r.status >= 300) return { outcome: "rejected", status: r.status, ...via };
+  let body = null;
   try {
-    const res = await fetch(endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Usage-Token": token,
-      },
-      body: JSON.stringify(event),
-      redirect: "manual",
-      signal: ctrl.signal,
-    });
-    if (res.status >= 300 && res.status < 400) {
-      return {
-        outcome: "redirected",
-        status: res.status,
-        location: hostOf(res.headers.get("location") || ""),
-      };
-    }
-    if (!res.ok) return { outcome: "rejected", status: res.status };
-    let body = null;
-    try {
-      body = await res.json();
-    } catch {
-      /* a 2xx without a JSON body is still a delivery */
-    }
-    return { outcome: body?.accepted === false ? "not-accepted" : "accepted", status: res.status };
-  } catch (err) {
-    const reason = ctrl.signal.aborted ? "timeout" : (err?.cause?.code ?? err?.name ?? "error");
-    return { outcome: "failed", reason: codeOf(String(reason), 40) };
-  } finally {
-    clearTimeout(timer);
+    body = JSON.parse(r.body);
+  } catch {
+    /* a 2xx without a JSON body is still a delivery */
   }
+  return {
+    outcome: body?.accepted === false ? "not-accepted" : "accepted",
+    status: r.status,
+    ...via,
+  };
 }
 
 export const LAST_SEND_FILE = "usage-last-send.json";
@@ -852,6 +846,13 @@ function registeredLogin(prefs) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (process.env.MULTI_AGENT_SMOKE && !args.dryRun) return;
+  // Resolving the state path needs no prefs and sends nothing: a shell block
+  // whose $STATE_FILE did not survive from an earlier command gets it back here.
+  if (args.printState) {
+    const path = resolveStatePath(args);
+    if (path) process.stdout.write(`${path}\n`);
+    return;
+  }
   const prefs = resolvePrefs();
   const endpoint = canonicalEndpoint(prefs.endpoint || ENDPOINT_DEFAULT);
 
@@ -883,7 +884,16 @@ async function main() {
   let state = statePath ? readJson(statePath) : null;
 
   if (!state) {
-    if (!args.taskId) return;
+    if (!args.taskId) {
+      // An unset shell variable reaches here as --state "", and a silent return
+      // would make a run that never reports look exactly like one that did.
+      recordSend({
+        ev: EVENT_KINDS.includes(args.event) ? args.event : null,
+        outcome: "skipped",
+        reason: args.state === "" ? "empty-state-path" : "no-state",
+      });
+      return;
+    }
     state = { taskId: args.taskId };
   }
 

package/pipeline/skills/.skill-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-10-20T13:08:30Z",
-  "skillCount": 229,
+  "generatedAt": "2026-10-24T11:39:37Z",
+  "skillCount": 234,
   "entries": [
     {
       "path": "shared/core/apple-archive-compliance/SKILL.md",
@@ -237,7 +237,7 @@
     },
     {
       "path": "shared/core/multi-agent-sync/SKILL.md",
-      "sha256": "1e418fe472a93cc7b4b5bc19ff9e9b8b9d89b545e45d343a643f17a492cb0624"
+      "sha256": "e96afa9b89a2ab6e2fe13a01158f98272c6828e5cef03c8909240766aaefd44b"
     },
     {
       "path": "shared/core/multi-agent-test-accessibility/SKILL.md",
@@ -251,6 +251,10 @@
       "path": "shared/core/multi-agent-test-dynamic-type/SKILL.md",
       "sha256": "e1cadd5eb8d680b0edfc40a4912733dc6a432493c868f4997b2dec0db6638dd4"
     },
+    {
+      "path": "shared/core/multi-agent-test-gen/SKILL.md",
+      "sha256": "0da450ed0c74ab610d3c8f0cf1b0facd2a4ae179afc832440939c3367de7e762"
+    },
     {
       "path": "shared/core/multi-agent-test-screenshots/SKILL.md",
       "sha256": "a41507304e4650079e6359b3ad5854f90f45a90172911f487c4c923ef8839f91"
@@ -487,6 +491,10 @@
       "path": "shared/external/firebase/SKILL.md",
       "sha256": "d377217a03e7fc63bd7eba285c6e2b450f293b13c6e65680e71b022cd14872a3"
     },
+    {
+      "path": "shared/external/fix-review-verdicts/SKILL.md",
+      "sha256": "a728b7c87fbf175e959e23b655c626294b7a7a2949c62a37e7b3d4a172ce57d5"
+    },
     {
       "path": "shared/external/github-actions-templates/SKILL.md",
       "sha256": "13b6fec454c2ebf69b06fcdc00033a6dab98d6111e0346447c8d474db547f801"
@@ -495,6 +503,10 @@
       "path": "shared/external/gradle-kotlin-dsl/SKILL.md",
       "sha256": "af7b1e30e2448f43b5100b2a935bbaadde86ccd490844c901736c9270f8cc3ce"
     },
+    {
+      "path": "shared/external/handle-request/SKILL.md",
+      "sha256": "05ecf72d8e40eeca8dfc0913764b1188b9b1189ea098ad23b4f0c8256f2c671c"
+    },
     {
       "path": "shared/external/healthkit/SKILL.md",
       "sha256": "fece1986bc35925e34fed8d8cb13aa59a3577b8cedefdc02c736c0d4a5d38aff"
@@ -703,6 +715,10 @@
       "path": "shared/external/room-database/SKILL.md",
       "sha256": "45fe377469f1fb4036431194d3b525d3caaa79231808625f643468863c6e814a"
     },
+    {
+      "path": "shared/external/scenario-gap-analysis/SKILL.md",
+      "sha256": "fcd9f614dc18ea0d4610469f7edcf9214d3b14d65976fa3fb7c4a524330a392a"
+    },
     {
       "path": "shared/external/search-first/SKILL.md",
       "sha256": "c9d5ffb698bbfb76a89da6a35dfc0f1d72a31d2b4a0e9e9f3e027be7a8fddfde"
@@ -855,6 +871,10 @@
       "path": "shared/external/tailwind-css/SKILL.md",
       "sha256": "9eda0a871962f52e381781b95c948128626984a82ddbd47be53ea869cd250b7e"
     },
+    {
+      "path": "shared/external/test-result-triage/SKILL.md",
+      "sha256": "72b0e0049fcf549b61a189900ca8e503b779e93cd26575d7b7328ae785465e38"
+    },
     {
       "path": "shared/external/testing-backend/SKILL.md",
       "sha256": "d3eea1c6d1e2a40a0b66bc6460194ee313e17fc2af8f75047030b7840c2db857"

package/pipeline/skills/.skills-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "skillCount": 229,
+  "skillCount": 234,
   "entries": [
     {
       "name": "accessibility-compliance-accessibility-audit",
@@ -191,7 +191,7 @@
     },
     {
       "name": "app-store-review",
-      "description": "App Store submission readiness and rejection prevention: Review Guidelines 2.1, 2.3, 2.5.1, 3.1.1, 4.2 and 5.1.2, PrivacyInfo.xcprivacy manifests and required-reason codes, IAP and StoreKit rules, ATT consent, EU DMA distribution, entitlements and usage strings, metadata limits, screenshots, TestFli",
+      "description": "App Store submission readiness and rejection prevention: Review Guidelines 1.2, 2.1, 2.3, 2.3.14, 2.5.1, 2.5.19, 3.1.1, 4.2 and 5.1.2, upload floors, age rating and medical device declarations, PrivacyInfo.xcprivacy manifests and required-reason codes, IAP and StoreKit rules, ATT consent, EU DMA dis",
       "platform": null,
       "group": "external",
       "plugin": "ai-ios-toolkit",
@@ -596,6 +596,17 @@
       "triggerPaths": [],
       "relativePath": "shared/external/firebase/SKILL.md"
     },
+    {
+      "name": "fix-review-verdicts",
+      "description": "Independent fix review with three verdicts, test-gaming, scope and root-cause, each backed by file:line findings; the result is computed from findings, never from a claim. Use when reviewing a fix made to turn tests green. Not a full review checklist.",
+      "platform": null,
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:fix-review-verdicts",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/external/fix-review-verdicts/SKILL.md"
+    },
     {
       "name": "github-actions-templates",
       "description": "Authoring GitHub Actions workflows: triggers, matrices, caching, concurrency, least-privilege permissions, SHA pinning, OIDC, reusable workflows, composite actions, Xcode runners. Use when writing or hardening a workflow file.",
@@ -629,6 +640,17 @@
       "triggerPaths": [],
       "relativePath": "shared/external/gradle-kotlin-dsl/SKILL.md"
     },
+    {
+      "name": "handle-request",
+      "description": "Add the test handles a scenario needs and answer each request with ADDED, ALREADY or COULD NOT ADD plus file:line or reason. Identity values only, attribute-only diffs; iOS accessibilityIdentifier, Compose testTag, web data-testid. Use when a test needs an element handle the UI lacks.",
+      "platform": null,
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:handle-request",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/external/handle-request/SKILL.md"
+    },
     {
       "name": "healthkit",
       "description": "HealthKit on iOS, iPadOS, watchOS and visionOS: HKHealthStore authorization, sample, statistics and chart-ready collection queries, saving HKQuantitySample values, background delivery, live workouts (HKWorkoutSession, HKLiveWorkoutBuilder), HKUnit, HKQuantityTypeIdentifier. Use when reading, writing",
@@ -1685,6 +1707,17 @@
       "triggerPaths": [],
       "relativePath": "shared/core/multi-agent-test-dynamic-type/SKILL.md"
     },
+    {
+      "name": "multi-agent-test-gen",
+      "description": "Write the tests an app lacks, stage by stage, each gated on its artefact: inventory, read-only gap analysis, handles, tests, runs, per-test classification. Use when screens, flows or a change need tests.",
+      "platform": null,
+      "group": "core",
+      "plugin": null,
+      "invokeAs": "multi-agent-test-gen",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/core/multi-agent-test-gen/SKILL.md"
+    },
     {
       "name": "multi-agent-test-screenshots",
       "description": "App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the screenshot scenario. Use when generating store screenshots or checking a localised build renders.",
@@ -1927,6 +1960,17 @@
       "triggerPaths": [],
       "relativePath": "shared/external/room-database/SKILL.md"
     },
+    {
+      "name": "scenario-gap-analysis",
+      "description": "Set an inventory against existing tests, sort each behaviour into COVERED, WRONGLY COVERED or MISSING, and write gaps as measurable, prioritised scenarios with cross-screen flows. Use when planning tests or auditing coverage. Not for writing tests or judging a run.",
+      "platform": null,
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:scenario-gap-analysis",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/external/scenario-gap-analysis/SKILL.md"
+    },
     {
       "name": "search-first",
       "description": "Research-before-coding workflow. Before writing a custom implementation, check what already exists (repo utilities, installed libraries, packages, internal components) and decide adopt / extend / compose / build on evidence. Use at the start of any non-trivial feature or utility, especially when you",
@@ -2345,6 +2389,17 @@
       "triggerPaths": [],
       "relativePath": "shared/external/tailwind-css/SKILL.md"
     },
+    {
+      "name": "test-result-triage",
+      "description": "Judge each test result on changed code as product-bug, stale-test, valid or ambiguous (the default), and list behaviour no test covers. stale-test needs a diff file:line, product-bug needs evidence. Use when tests ran on a new commit, PR or fix. Not for writing or editing tests.",
+      "platform": null,
+      "group": "external",
+      "plugin": "ai-common-toolkit",
+      "invokeAs": "ai-common-toolkit:test-result-triage",
+      "triggerKeywords": [],
+      "triggerPaths": [],
+      "relativePath": "shared/external/test-result-triage/SKILL.md"
+    },
     {
       "name": "testing-backend",
       "description": "Backend testing: pytest patterns (Python), Jest patterns (Node.js), integration testing, database fixtures/factories, API contract testing. Use when writing or reviewing backend tests: unit, integration, database and API level.",

package/pipeline/skills/shared/README.md

@@ -2,24 +2,24 @@
 
 Single source of truth for skills delivered to both Claude Code (`~/.claude/skills/`) and Copilot CLI (`~/.copilot/skills/`) by the installer.
 
-**Total:** 229 skills (68 core + 161 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
+**Total:** 234 skills (69 core + 165 external). Auto-generated by `scripts/gen-skills-index.mjs`  -  do not edit by hand.
 
 ## Directory layout
 
-- **`core/`**  -  68 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
-- **`external/`**  -  161 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
+- **`core/`**  -  69 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
+- **`external/`**  -  165 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
 Source layout is logical grouping only  -  skill discovery at runtime is unchanged.
 
 ## Categories
 
-- [Pipeline Orchestration](#pipeline-orchestration)  -  68
+- [Pipeline Orchestration](#pipeline-orchestration)  -  69
 - [iOS / Apple Ecosystem](#ios-apple-ecosystem)  -  94
 - [Android / Kotlin](#android-kotlin)  -  16
 - [Web](#web)  -  10
 - [Backend / API](#backend-api)  -  11
-- [Cross-cutting](#cross-cutting)  -  30
+- [Cross-cutting](#cross-cutting)  -  34
 
 ## Pipeline Orchestration
 
@@ -89,6 +89,7 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`multi-agent-test-accessibility`](./core/multi-agent-test-accessibility/) | `core` | Accessibility audit on a booted simulator / emulator: VoiceOver labels, sub-44pt tap targets, contrast, traits. Alias pinning the accessibil |
 | [`multi-agent-test-dark-mode`](./core/multi-agent-test-dark-mode/) | `core` | Dark mode UI test on a booted simulator / emulator: walk every screen light then dark, report contrast + colour bugs. Alias pinning the dark |
 | [`multi-agent-test-dynamic-type`](./core/multi-agent-test-dynamic-type/) | `core` | Dynamic Type layout test on a booted simulator / emulator: re-walk every screen at XL through accessibility-extra-large, report truncation a |
+| [`multi-agent-test-gen`](./core/multi-agent-test-gen/) | `core` | Write the tests an app lacks, stage by stage, each gated on its artefact: inventory, read-only gap analysis, handles, tests, runs, per-test  |
 | [`multi-agent-test-screenshots`](./core/multi-agent-test-screenshots/) | `core` | App Store screenshot set from a booted simulator / emulator in a given locale, taken as an argument and defaulting to tr. Alias pinning the  |
 | [`multi-agent-testflight-validation`](./core/multi-agent-testflight-validation/) | `core` | iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never upl |
 | [`multi-agent-uninstall`](./core/multi-agent-uninstall/) | `core` | Uninstall the pipeline from Claude Code + Copilot CLI. Keychain access tokens are always left untouched; --all-data also clears pipeline set |
@@ -264,15 +265,19 @@ Source layout is logical grouping only  -  skill discovery at runtime is unchang
 | [`e2e-testing`](./external/e2e-testing/) | `external` | \| |
 | [`evidence-github`](./external/evidence-github/) | `external` | Search GitHub for facts an analysis can cite - a known issue in a dependency, the PR that fixed it, what a release actually changed, prior a |
 | [`evidence-registry`](./external/evidence-registry/) | `external` | Check a package's real version, deprecation status and release notes on npm, PyPI, Maven Central or Swift Package Index. Use when a spec or  |
+| [`fix-review-verdicts`](./external/fix-review-verdicts/) | `external` | Independent fix review with three verdicts, test-gaming, scope and root-cause, each backed by file:line findings; the result is computed fro |
 | [`github-actions-templates`](./external/github-actions-templates/) | `external` | Authoring GitHub Actions workflows: triggers, matrices, caching, concurrency, least-privilege permissions, SHA pinning, OIDC, reusable workf |
+| [`handle-request`](./external/handle-request/) | `external` | Add the test handles a scenario needs and answer each request with ADDED, ALREADY or COULD NOT ADD plus file:line or reason. Identity values |
 | [`humanizer`](./external/humanizer/) | `external` | \| |
 | [`localization-reuse-map`](./external/localization-reuse-map/) | `external` | Localization reuse map for one redesigned screen on iOS, Android and web: new keys set against each platform's legacy key, legacy values and |
 | [`pdfkit`](./external/pdfkit/) | `external` | PDFKit on iOS: PDFView display and SwiftUI wrapping, creating and editing PDFDocument and PDFPage, highlight, note, signature and form annot |
+| [`scenario-gap-analysis`](./external/scenario-gap-analysis/) | `external` | Set an inventory against existing tests, sort each behaviour into COVERED, WRONGLY COVERED or MISSING, and write gaps as measurable, priorit |
 | [`search-first`](./external/search-first/) | `external` | \| |
 | [`security-review`](./external/security-review/) | `external` | Run a defensive, static security review of a diff or a repo: build a run-scoped threat model, find vulnerabilities joined to OWASP + CWE wit |
 | [`signal-community`](./external/signal-community/) | `external` | Check whether other people hit the same problem, via Stack Overflow and Hacker News (keyless) plus opt-in Reddit and X. Use when a bug repor |
 | [`skill-creator`](./external/skill-creator/) | `external` | House guide for authoring plugin skills: creating a new skill, trimming or splitting a bloated one, writing or sharpening a description, and |
 | [`spm-build-analysis`](./external/spm-build-analysis/) | `external` | Analyze Swift Package Manager dependencies, package plugins, module variants, and CI-oriented build overhead that slow Xcode builds. Use whe |
+| [`test-result-triage`](./external/test-result-triage/) | `external` | Judge each test result on changed code as product-bug, stale-test, valid or ambiguous (the default), and list behaviour no test covers. stal |
 | [`valven-rules`](./external/valven-rules/) | `external` | Delivery-flow rules from metrics Valven reports: PR size, one concern per PR, tests with source, issue keys, no WIP commits, churn, PR body, |
 | [`xcode-build-benchmark`](./external/xcode-build-benchmark/) | `external` | Benchmark Xcode clean and incremental builds with repeatable inputs, timing summaries, and timestamped `.build-benchmark/` artifacts. Use wh |
 | [`xcode-build-fixer`](./external/xcode-build-fixer/) | `external` | Apply approved Xcode build optimization changes following best practices, then re-benchmark to verify improvement. Use when a developer has  |