@mmerterden/multi-agent-pipeline 20.29.0 → 20.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.29.0",
+  "version": "20.33.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -86,6 +86,8 @@
     "CHANGELOG.md",
     "LICENSE",
     "SECURITY.md",
+    "!pipeline/office-src/**",
+    "!pipeline/office-art/**",
     "!pipeline/scripts/smoke-figma-config-schema.sh",
     "!pipeline/scripts/smoke-personal-data.sh",
     "!pipeline/scripts/validate-prefs.mjs",

package/pipeline/commands/multi-agent/analysis/SKILL.md

@@ -117,7 +117,7 @@ Two channels run in parallel at every phase boundary:
 ```bash
 # Phase 0, very first shell call (every CLI):
 bash $HOME/.claude/scripts/phase-tracker.sh init "$TASK_ID"
-for p in "0:Init" "1:Plan" "3:Review" "4:Commit" "5:Report"; do
+for p in "0:Intake" "1:Evidence" "2:Synthesis" "3:Review" "4:Publish" "5:Report"; do
   bash $HOME/.claude/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
 done
 bash $HOME/.claude/scripts/phase-tracker.sh update 0 in_progress
@@ -131,13 +131,13 @@ bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <in> <out> [cached]
 
 ### Visual channel  -  Claude Code (native TaskList widget, required)
 
-In Claude Code the agent MUST also drive the native TaskList widget so the user sees a sticky phase tile stack  -  this is the only progress signal Claude Code surfaces. Register one tile per phase of the active set (`0:Init 1:Plan 3:Review 4:Commit 5:Report`) with `TaskCreate`, persist each `taskId` via `phase-tracker.sh meta <N> tasklist_id "<taskId>"`, and at every phase entry, sub-step and exit pair a `TaskUpdate` (status or `activeForm`) with the matching `phase-tracker.sh update`. Call pattern: `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "Call pattern". Mirror each with `phase-tracker.sh task` ("Mirroring the host's task list").
+In Claude Code the agent MUST also drive the native TaskList widget so the user sees a sticky phase tile stack  -  this is the only progress signal Claude Code surfaces. Register one tile per phase of the active set (`0:Intake 1:Evidence 2:Synthesis 3:Review 4:Publish 5:Report`) with `TaskCreate`, persist each `taskId` via `phase-tracker.sh meta <N> tasklist_id "<taskId>"`, and at every phase entry, sub-step and exit pair a `TaskUpdate` (status or `activeForm`) with the matching `phase-tracker.sh update`. Call pattern: `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "Call pattern". Mirror each with `phase-tracker.sh task` ("Mirroring the host's task list").
 
-`analysis` mode does NOT TaskCreate phase 2: register tiles for the active set only.
+`analysis` mode TaskCreates all 6 phases (no phase is skipped).
 
 #### TaskCreate ordering (strict)
 
-**All TaskCreate calls in a batch fire in strict phase-number order BEFORE any TaskUpdate is applied**, and a later batch only ever appends phases numbered above everything already registered. For `analysis` that means: Phase 0 → Phase 1 → Phase 3 → Phase 4 → Phase 5. The native widget renders by creation order, not by phase number  -  out-of-order calls produce visually scrambled tile stacks (e.g. `1 ✓ · 2 ✓ · 4 ✓ · 0 ▶ · 3 ☐`) even when the underlying state is correct. Pre-marking phases as completed/skipped before Phase 0 starts is FORBIDDEN  -  register the tile in order, then flip status via TaskUpdate when the phase actually short-circuits. Full ordering contract in `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "TaskCreate ordering (strict)".
+**All TaskCreate calls in a batch fire in strict phase-number order BEFORE any TaskUpdate is applied**, and a later batch only ever appends phases numbered above everything already registered. For `analysis` that means: Phase 0 → Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5. The native widget renders by creation order, not by phase number  -  out-of-order calls produce visually scrambled tile stacks (e.g. `1 ✓ · 2 ✓ · 4 ✓ · 0 ▶ · 3 ☐`) even when the underlying state is correct. Pre-marking phases as completed/skipped before Phase 0 starts is FORBIDDEN  -  register the tile in order, then flip status via TaskUpdate when the phase actually short-circuits. Full ordering contract in `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "TaskCreate ordering (strict)".
 
 ### Visual channel  -  Copilot CLI / plain shell
 

package/pipeline/commands/multi-agent/autopilot-on/SKILL.md

@@ -206,25 +206,23 @@ installer puts it; the runner tries the captured path first, then that `PATH`.
 "Configure only" is a real answer and the safe default to offer first: the queue
 can be watched with `autopilot-status` for a while before anything runs.
 
-On **Start**:
+On **Start**, load the schedule and the awake agent with the same script the
+office panel's `POST /v1/autopilot/on` calls, naming every repo selected in step 3:
 
 ```bash
-launchctl bootstrap "gui/$(id -u)" "$HOME/Library/LaunchAgents/com.multi-agent.autopilot.plist" 2>/dev/null \
-  || launchctl load "$HOME/Library/LaunchAgents/com.multi-agent.autopilot.plist"
+node "$HOME/.claude/scripts/autopilot-control.mjs" on --repo <owner/name> [--repo <owner/name>...]
 ```
 
-Then the awake agent, rendered from
-`templates/multi-agent-autopilot-awake.plist.template` with the `awake.display`
-answer saved above:
-
-```bash
-. "$HOME/.claude/lib/autopilot-state.sh"
-node "$(ma_ap_asset scripts/autopilot-awake.mjs)" install
-```
-
-A non-zero exit means launchd refused the job: say so, with its path, and say
-the Mac may sleep between ticks until it is fixed. The schedule itself stays on.
-"Configure only" installs neither.
+It keeps exactly those repos in `config.json`, probes their credentials again
+(`autopilot-arming.mjs probeCredentials`), renders
+`templates/multi-agent-autopilot.plist.template` with its seven placeholders
+(NODE, TICK, LABEL, ROOT, INTERVAL, HOME, CLAUDE), loads it with `launchctl
+bootstrap` (falling back to `load`) and installs the awake agent with the
+`awake.display` answer saved above. `scheduled: false` with probe problems means
+nothing was loaded; say so with the problems. Exit 1 with `launchd refused`
+means launchd refused the job: say so, with its path, and say the Mac may sleep
+between ticks until it is fixed. "Configure only" is `--configure-only`, which
+saves the selection and installs neither.
 
 ### 9. Report what is now true
 

package/pipeline/commands/multi-agent/office-off/SKILL.md

@@ -0,0 +1,27 @@
+---
+description: "Close the office panel and stop its local server. Use when done with the panel."
+description-tr: "Ofis panelini hemen kapatır: office-on'un başlattığı yerel sözleşme sunucusunu durdurur. Arkada hiçbir şey kalmaz (relay yok, oturum yok, izleyici yok)."
+argument-hint: "(no arguments)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
+allowed-tools: Bash
+---
+
+# multi-agent office-off  -  close the panel
+
+Stops the server `office-on` started, through the same script:
+
+```bash
+node "$HOME/.claude/scripts/office-control.mjs" off --json
+```
+
+Only the pid `office-on` recorded is signalled (SIGTERM), and only when its
+token file still names it, its command is `contract-server.mjs` and its start
+time matches; no other process is looked up or touched. The server removes its
+token file on the way out, so the old page stops working.
+
+Report in `outputLanguage`: whether a server was stopped (`stopped`), and the
+`remote` line as the script gives it. A panel that was already closed is not
+an error.

package/pipeline/commands/multi-agent/office-on/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: "Open the office: a local browser page that shows runs and agents live and drives the ecosystem (new runs, jobs, PRs, keys, memory, system, cleanup). Use when you want to watch or drive runs from a browser."
+description-tr: "Ofisi açar: koşuları ve ajanları canlı gösteren, ekosistemi yöneten yerel web sayfası (yeni koşu, işler, PR'lar, anahtarlar, hafıza, sistem, temizlik). Yerel sözleşme sunucusunu gerektiğinde başlatır; sunucu /multi-agent:office-off ile durdurulana kadar çalışır."
+argument-hint: "(no arguments)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
+allowed-tools: Bash
+---
+
+# multi-agent office-on  -  open the panel
+
+The panel is a page (`$HOME/.claude/office/index.html`) served by the
+pipeline's local contract server (`contract-server.mjs`, 127.0.0.1 only, a
+fresh bearer token per start). This command and `office-off` /
+`office-status` share one script, `office-control.mjs`.
+
+## Steps
+
+1. **Start or reuse the server and open the browser:**
+
+   ```bash
+   node "$HOME/.claude/scripts/office-control.mjs" on --json
+   ```
+
+   It starts `contract-server.mjs` in the background with the panel page, or
+   reuses the one it started earlier, then opens the browser at `/office` with
+   a one-time code in the URL fragment (valid 10 seconds, one use, handed over
+   through a 0600 launcher file, never on a command line), which the
+   page trades for the token. The token is never printed; do not read the
+   token file or pass `--print-token` yourself, since anything printed lands
+   in this transcript.
+
+2. **Report** (in `outputLanguage`): the page URL (`url`, without a code),
+   whether a server was started or reused (`restarted` true means the running
+   one was older than the installed pipeline and was replaced), that it keeps
+   running until `/multi-agent:office-off` stops it. If `opened` is false, tell the user
+   to run the command again from a desktop session; a link works once, so a
+   reload of the page needs a new `office-on`.
+
+## What it does not do
+
+- No daemon or file watcher beside the one server, which runs until
+  `office-off`, and no hook of its own: the task lists come from the
+  `task-mirror` hook that install registers for every run.
+- The panel's writes call the same scripts the terminal commands call; it adds
+  no behaviour of its own.
+- The server listens on 127.0.0.1 only. Remote access is not part of this
+  installation; `office-status` says whether a separate remote layer is
+  present.

package/pipeline/commands/multi-agent/office-status/SKILL.md

@@ -0,0 +1,29 @@
+---
+description: "Whether the office panel is running, its URL (never the token) and its last actions. Use when unsure if the panel is open."
+description-tr: "Ofis panelinin durumunu raporlar: yerel sunucu çalışıyor mu, sayfa adresi (token asla), boşta kapanma süresi, uzak erişim, eşleşmiş telefonlar ve panelden yapılan son işlemler."
+argument-hint: "(no arguments)"
+parameters: []
+gui: button
+destructive: false
+confirm: none
+allowed-tools: Bash
+---
+
+# multi-agent office-status  -  what the panel is doing
+
+```bash
+node "$HOME/.claude/scripts/office-control.mjs" status --json
+```
+
+Report in `outputLanguage`:
+
+- `running`, and when it is, `url` and `idleMinutes` (0 means it runs until `office-off`);
+- `remote`: "not available in this installation" unless a separate remote
+  layer is installed; report the line as given;
+- `pairedDevices`: the devices the phone registry lists; revoking one is
+  `phone-devices.mjs revoke`;
+- `recentActions`: the last writes taken through the server (route, step,
+  status, when, and whether from the panel page), from
+  `office-actions.jsonl`. They carry no request body.
+
+Never print the token or read the token file.

package/pipeline/commands/multi-agent/prune-logs/SKILL.md

@@ -21,7 +21,10 @@ whole task dirs, with optional age / project / task filters.
 Backed by `$HOME/.claude/scripts/prune-logs.sh`. Safe by default: it previews
 and deletes nothing until you confirm. The audit trail (`audit.jsonl` +
 rotations) and the metrics corpus (`metrics.jsonl`, `metrics-summary.md`) live
-at the log-root top level and are never removed; `.counter` files survive too.
+at the log-root top level and are never removed; `.counter` files survive too. A run that can still be resumed (its `agent-state.json` status is not
+finished, abandoned or cancelled) keeps its log however old it is, and
+so does a folder written in the last 10 minutes; `--task` names one dir and
+bypasses both.
 
 Unlike `/multi-agent:purge` (which wipes worktrees, branches, logs, and state
 together), this only removes log dirs and leaves your worktrees and branches

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -41,10 +41,11 @@ Branch-mode runs print to chat only. PR-mode runs print to chat AND post the ver
 : "${TASK_ID:=review-$(date +%s)-$$}"
 export TASK_ID
 
-# Clean up scratch files on exit so /tmp doesn't accumulate diffs and SHAs.
 trap 'rm -f /tmp/multi-agent-review-${TASK_ID}-*' EXIT
 ```
 
+Standalone only (a `review-` id): register a tracker record per `$HOME/.claude/multi-agent-refs/review-standalone-tracker.md`.
+
 ### 1. Parse the input  -  pick a resolution path
 
 ```bash
@@ -379,10 +380,10 @@ If the post fails (network, token, harness block), `post-pr-review.sh` exits non
 Per the `$HOME/.claude/multi-agent-refs/tracker-contract.md` tokens contract, after each reviewer LLM call:
 
 ```bash
-bash $HOME/.claude/scripts/phase-tracker.sh tokens 4 <input_count> <output_count>
+bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <input_count> <output_count>
 ```
 
-Standalone `/multi-agent:review` runs use phase id 3 (matches Phase 3 Review in the full pipeline) so cost aggregation stays consistent.
+`<N>`: the run's Review phase, or step 2 for a standalone review.
 
 ## Input matrix
 

package/pipeline/commands/multi-agent/scenario-audit/SKILL.md

@@ -55,7 +55,9 @@ Read the candidate lines it returns. A term nothing matched is listed under
 
 ## Step 3 - Verdict
 
-Write `/tmp/ma-verdicts.json`: `[{id, status, citations, searched, note}]`.
+Write the verdicts to a file in a folder of this run's own
+(`VERDICTS="$(mktemp -d)/verdicts.json"`, never a fixed `/tmp` name another
+user or a second audit could share): `[{id, status, citations, searched, note}]`.
 
 | Status | When | Needs |
 |---|---|---|
@@ -66,7 +68,7 @@ Write `/tmp/ma-verdicts.json`: `[{id, status, citations, searched, note}]`.
 
 ```bash
 node "$HOME/.claude/scripts/scenario-audit.mjs" verify --csv "<scenarios.csv>" \
-  --verdicts /tmp/ma-verdicts.json --repo "<repo>" --lang "<outputLanguage>"
+  --verdicts "$VERDICTS" --repo "<repo>" --lang "<outputLanguage>"
 ```
 
 ## Step 4 - Report

package/pipeline/commands/multi-agent/serve/SKILL.md

@@ -61,5 +61,7 @@ environment `launch.json` declares; the client starts the process.
 `POST /v1/runs/{id}/answer` accepts only an option the run's pending question
 offered. `POST /v1/runs/{id}/kill` and `POST /v1/gc` act only on a second
 request carrying the single-use confirm token the first one returned, and a
-kill never deletes the remote branch or the logs. Autopilot can be turned off
-over HTTP, never on.
+kill never deletes the remote branch or the logs. Autopilot on, a stack change
+and a routine removal take the same two steps, accept no browser origin but
+the server's own page, and are tagged `local-only` for any future remote
+carrier.

package/pipeline/commands/multi-agent/stack/SKILL.md

@@ -105,14 +105,21 @@ ON=$(MP="$MP" node -e 'import(process.env.HOME+"/.claude/scripts/_stack-routing.
 })' "$@") || exit 1
 ```
 
-After resolving `$ON`, edit `.claude/settings.json` (create `{ "enabledPlugins": {} }` if absent) so that:
-- every plugin in `$ON` is set to `true`,
-- every stack toolkit **not** in `$ON` is set to `false` (leave non-`@multi-agent-plugins` entries untouched),
-- `ai-common-toolkit@multi-agent-plugins` and `ai-analyst-toolkit@multi-agent-plugins` are always `true`,
-- every `ai-*-engineering-toolkit@multi-agent-plugins` key is **deleted** (retired names).
-- `xcode-integration@xcode-apple` follows `ios` (`true` with it, `false` without), only when `~/.claude/xcode-apple-marketplace` exists.
-
-Use the Read + Edit/Write tools (JSON must stay valid). Then print the resulting `enabledPlugins` block and run step 5 (Copilot/Codex refresh offer).
+Then write it with the one writer of these rules (the office panel's
+`POST /v1/stack` calls the same script):
+
+```bash
+node "$HOME/.claude/scripts/stack-toggle.mjs" set --repo "$PWD" "$@" --json
+```
+
+`stack-toggle.mjs` applies the write rules above (selection `true`, every other
+stack toolkit `false`, `ai-common-toolkit` and `ai-analyst-toolkit` always
+`true`, retired `ai-*-engineering-toolkit` keys deleted, `xcode-integration@xcode-apple`
+following `ios` when the Apple marketplace is linked, every other key kept),
+writes the file atomically and prints the resulting `enabledPlugins`. It refuses
+an empty selection and an unknown stack (exit 1) and never hand-edits the JSON.
+`stack-toggle.mjs status --repo "$PWD" --json` is the read for status mode.
+Then print the resulting `enabledPlugins` block and run step 5 (Copilot/Codex refresh offer).
 
 ## Notes
 

package/pipeline/commands/multi-agent/steer/SKILL.md

@@ -71,18 +71,19 @@ is being replaced.
    and `$INSTRUCTION` the text from step 3:
 
    ```bash
-   printf '{"pendingSteer":{"text":%s,"at":"%s","appliedAt":null,"appliedPhase":null}}' \
-     "$(node -e 'process.stdout.write(JSON.stringify(process.argv[1]))' "$INSTRUCTION")" \
-     "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-     | node $HOME/.claude/scripts/write-state.mjs "$STATE_FILE"
+   node "$HOME/.claude/scripts/steer-run.mjs" "$STATE_FILE" --text "$INSTRUCTION"
    ```
 
-   The instruction is JSON-encoded by `node -e`, not by hand: it is arbitrary
-   user text, and a quote or newline in it would otherwise produce invalid JSON
-   or, worse, a payload that merges into fields nobody meant to touch.
+   `steer-run.mjs` takes the same lock `write-state.mjs` owns and merges
+   `pendingSteer` (`text`, `at`, `appliedAt: null`, `appliedPhase: null`) into
+   the state; the instruction is passed as one argument and JSON-encoded by the
+   script, never by hand, so a quote or newline in it cannot produce invalid
+   JSON or a payload that merges into other fields. It refuses a finished run
+   (exit 1) and prints the unconsumed instruction it replaced, if any. The
+   office panel's `POST /v1/runs/{id}/steer` calls the same function.
 
-   Exit 2 (lock timeout) → the task is mid-write. Retry once, then report it
-   rather than forcing the write.
+   Exit 2 (usage) or a lock timeout → the task is mid-write. Retry once, then
+   report it rather than forcing the write.
 
 6. **Confirm**: `🧭 Steer queued for #N  -  applies at the entry to Phase {N+1}`
 

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -73,12 +73,13 @@ Run every step automatically:
 ```
 Step 0: DOCTOR      doctor.mjs  -  exit 2 or 4 stops the sync
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 66 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 69 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
 Step 3d: DEV-TOOLKIT companion MCP server -> detect movement, run the ship gates, commit + publish
+Step 3e: OFFICE      panel page is current, installed copies match it, toolkit version recorded
 Step 4: WEBSITE     Version + phase/model counts -> {website-host} (i18n + projects.ts)
 Step 5: Commit      Commit + push all changed repos
 Step 6: Report      Summary: synced targets, platform, changed files, deploy status, multi-agent-toolkit version
@@ -131,6 +132,7 @@ Step 0 gate rules and why: `features/doctor.md`.
    - `~/.claude/CLAUDE.md`, `~/.claude/rules/`, `~/.claude/knowledge/`
    - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh`, `agent-guard.sh`, `agent-guard.py`, and `build-stack-plugins.mjs` (generic, synced)
    - `~/.claude/settings.json`
+   - `~/.claude/office/`  -  the office panel flows the other way: its source is the repo (`pipeline/office-src`, built by `office-build.mjs` into `pipeline/office`), and the installer copies it to each host. Never copy it from `~/.claude` into the repo; Step 3e checks it instead
    - `~/.claude/multi-agent-refs/registries/`  -  the installer copies gate registries there from `pipeline/skills/shared/external`; the repo already holds the source
    - **Any `~/.claude/commands/multi-agent/*/SKILL.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin's skills exposed as `multi-agent:<name>`. Syncing them would leak the private plugin/skill names into the public pipeline. Skip them at copy time; the backstop below proves none reached `pipeline/commands/`.
      ```bash
@@ -226,9 +228,19 @@ When invoked with the `release` argument:
 8. WEBSITE       Version + features -> {website-host} (maintainer identity, build verified Ready)
 9. COPILOT       Copilot CLI instructions + skills sync
 9b. CODEX        Codex CLI router skill + refs + agent TOML (node install.js --codex)
+9c. OFFICE       Step 3e: the installed panel matches the release
 10. Report       Summary: version, touched repos, deploy status
 ```
 
+### Step 3e: OFFICE (every sync, and step 9c of a release)
+
+The office panel ships with the pipeline, so a sync carries it by checking it, not by copying it:
+
+1. `node ~/multi-agent-pipeline/pipeline/scripts/office-build.mjs --check`: the committed page is what `pipeline/office-src` builds to, and `office/toolkit.json` carries the toolkit version in `docs/facts.json`. Either stale fails the sync until it is rebuilt and committed; a release that regenerates facts rebuilds the office right after.
+2. After the install steps, compare `pipeline/office/index.html` with the installed copies (`~/.claude/office/`, and the Copilot and Codex trees when installed), byte for byte, plus the asset list. A difference means the install is behind: run `node install.js --installed` and compare again.
+3. Report the toolkit version the installed `office/toolkit.json` carries: it is what the office Tools window starts, and it moves forward with every release.
+4. An office server that is already running picks the update up by itself: the open page shows a reload banner, and `/multi-agent:office-on` replaces a server whose code changed. Nothing to restart by hand.
+
 ---
 
 ## Sub-Command Sync (Claude Code <-> Copilot CLI Skills)
@@ -241,14 +253,14 @@ same specs as reference files rather than as peer skills, via Step 2b -  see
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**66 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**69 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off, autopilot-on,
 autopilot-status, bug-bash, build-optimize, channels, complaint-analysis, create-jira,
 design-check, diff-explain, doctor, estimate, feedback, forget, garbage-collect, graph, help,
 ios-coding-standard, issue, jira, kill, language, log,
-manual-test, model, postmortem, prune-logs, prune-prompts, purge, refactor, research, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
+manual-test, model, office-off, office-on, office-status, postmortem, prune-logs, prune-prompts, purge, refactor, research, resume, review, review-analysis, review-issue, review-jira, route-off, route-on, route-status,
 routines, save, scaffold, scan, scenario-audit, search, security-review, serve, setup, stack, status, steer, store-ready, sync, test,
 test-accessibility, test-dark-mode, test-dynamic-type, test-gen, test-screenshots,
 testflight-validation, uninstall, update

package/pipeline/commands/multi-agent/test-gen/SKILL.md

@@ -47,9 +47,32 @@ Scripts: `test-gen-gate.mjs` (artefact, handle and write gates),
 ## Step 1 - Prepare
 
 1. Repo: `--repo`, else the current directory; confirm it in one line.
-   Platform: `--platform`, else detect as `/multi-agent:test` does. Run id
-   `tg-<timestamp>`; `RUN="$HOME/.claude/logs/test-gen/<repo>/<timestamp>"`,
-   created with `mkdir -p "$RUN"`.
+   Platform: `--platform`, else detect as `/multi-agent:test` does. One
+   timestamp names the run everywhere: `TS="$(date +%Y%m%d%H%M%S)"`, run id
+   `tg-$TS`, `RUN="$HOME/.claude/logs/test-gen/<repo>/$TS"`, created with
+   `mkdir -p "$RUN"`.
+   Register the run so its progress shows wherever runs are read (the office
+   panel, `/multi-agent:status`), with one step per stage below:
+
+   ```bash
+   TG_ID="tg-$TS"
+   S="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/$TG_ID"; mkdir -p "$S"
+   printf '{"taskId":"%s","mode":"test-gen","status":"in_progress","currentPhase":0}' "$TG_ID" \
+     | node "$HOME/.claude/scripts/write-state.mjs" "$S/agent-state.json" >/dev/null
+   export MULTI_AGENT_TASK_ID="$TG_ID"
+   bash "$HOME/.claude/scripts/phase-tracker.sh" init "$TG_ID"
+   for p in "0:Prepare" "1:Inventory" "2:Discovery" "3:Handles" "4:Tests" "5:Report"; do
+     bash "$HOME/.claude/scripts/phase-tracker.sh" add "${p%%:*}" "${p#*:}"
+   done
+   bash "$HOME/.claude/scripts/phase-tracker.sh" update 0 in_progress
+   ```
+
+   Each step below starts with `update <N> in_progress` and ends with
+   `update <N> completed` (Step 5 and Step 6 share step 4), every call prefixed
+   `MULTI_AGENT_TASK_ID=<the tg- id, written out> MULTI_AGENT_STRICT_TASK_ID=1`
+   since it runs in a new shell where `$TG_ID` is gone, and on
+   Claude Code each gets a task-widget tile named as its tracker line
+   (`tracker-contract.md`, "Call pattern").
 2. Toolkit: `test_results_classify`, `coverage_gap` and `ui_locator_codegen`
    need `@mmerterden/multi-agent-toolkit-mcp` >= v3.25.0. Check the tool list
    once. Each missing tool has a fallback in `stages.md` (classify from the
@@ -122,3 +145,6 @@ inventory, the gaps, the triage). Then record the change base
 Offer, one question: open the product bugs through `/multi-agent` with each
 failing test as the acceptance check, or stop. **No commit, no push, no issue
 from this command.**
+
+Last, close the run record: `phase-tracker.sh update 5 completed`, then the
+same `write-state.mjs` call with `"status":"complete","currentPhase":5`.

package/pipeline/contract/CHANGELOG.md

@@ -3,6 +3,114 @@
 Versions of the client contract (`manifest.json` `contractVersion`), separate
 from the package version. See `README.md` for what counts as minor and major.
 
+## 1.6.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/system` (`system-status.mjs --json`): CPU, memory, disk and the
+  pipeline's own processes, numbers only.
+- `GET /v1/credentials` (`office-credentials.mjs --json [--probe]`, local-only):
+  logical names, state and probe verdict per credential, never a value.
+- `GET /v1/memory` (`office-memory.mjs --json`, local-only): per-repository code
+  graph age and learning, finding and session-note counts, redacted.
+- `POST /v1/prune-logs` (two steps, local-only): the task log folders older than
+  7, 30 or 90 days, then a prune of exactly that list; 409 `changed` when the
+  folders moved since the preview.
+- `GET /v1/settings` and `POST /v1/settings` (two steps, local-only, one change
+  at a time): output language, the fable rung and model routing; a route-on
+  preview names a saved free provider chain in `change.freeChain`.
+- runs and run (1.3.0): `source`, `prNumber`, `mode`, `channels`, and the
+  local-only `channelUrls`, dropped from a redacted answer.
+- activity, activity stream, agent chat, routines, routine delete, repo add and
+  remove (1.1.0): tables carry `source`, `pr`, `channels`, `waitingFor`,
+  `currentTask`, `progress` and each phase's `tasks`; seats carry their own
+  `tasks` and recent `mcp` calls.
+- prs, issue maturity, review verdict (1.1.0): a pull request names the
+  `account` it was listed for, numbered in a redacted answer.
+
+## 1.5.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/repos?all=1` (`launch-request.mjs repos --all`): `suggested`
+  (checkouts earlier runs worked in that launch does not accept yet) and
+  `missing` (registered entries whose folder is gone), each with an `id`; a
+  page sees ids and names, never paths.
+- `POST /v1/repos` (two steps, `repo-request.schema.json`,
+  `repo-change.schema.json`, `local-only`/`high`): register a suggestion by id
+  or an absolute path to a git checkout. `DELETE /v1/repos/{id}` (two steps)
+  removes a registered entry; configured autopilot repositories are not
+  touched.
+- `version` on `GET /v1/tools`: the exact toolkit version the panel starts.
+- `GET /v1/jobs` (`office-jobs.schema.json`): the jobs the office can start,
+  from `schemas/office-jobs.json`. `POST /v1/jobs` (two steps,
+  `job-request.schema.json`, `job-change.schema.json`, `local-only`/`high`)
+  starts one with `claude --bg` under the unattended profile; it is the one
+  route that starts a session itself.
+- `--idle-minutes 0` and `--max-hours 0` mean no idle stop and no lifetime.
+
+## 1.4.0
+
+Added. Nothing existing changes shape; one narrowing for browser pages.
+
+- `remote` and `risk` on every surface in `manifest.json` and every route in
+  `ROUTES`: the scope a remote carrier would require (`read`, `answer`,
+  `launch`, `local-only`) and the confirmation tier (`read`, `low`, `high`).
+- `GET /v1/activity` and `GET /v1/activity/stream` (`activity.schema.json`):
+  a room per repository, a table (team) per run, a seat per agent; the stream is
+  `text/event-stream`, at most 4 at once (429 `too-many-streams`).
+- `GET /v1/agents/{sessionId}/{agentId}/chat` (`activity-chat.schema.json`):
+  one page of an agent's transcript, redacted; `before`, `limit`.
+- `POST /v1/autopilot/on` (two steps, `autopilot-on.schema.json`), `POST
+  /v1/runs/{id}/steer` (two steps, `launch`/`high`: the text and a preview
+  with a token bound to the run and the text, then the token alone;
+  `steer.schema.json`), `GET /v1/routines`, `DELETE /v1/routines/{name}` (two
+  steps), `GET /v1/stack`, `POST /v1/stack` (two steps).
+- `GET /v1/ledger` (`ledger.schema.json`): tokens and estimated USD today, this
+  week and this month, by run, repository, model and phase, each amount with
+  its source; an unmeasurable run is `not-measured`, never 0.
+- `GET /v1/runs/{id}/results` and `/evidence/{name}`: diff summary, review
+  findings, test outcome, screenshots and analysis documents from the run's
+  own files; a document is read only inside the run's roots (log directory,
+  artifacts, a worktree git lists) and only as Markdown or HTML.
+- `GET /v1/issues/{key}/maturity` (lib/issue-fetcher.sh), `GET /v1/prs`
+  (GitHub; Bitbucket reported as not implemented), `POST
+  /v1/runs/{id}/review-verdict` (two steps, lib/post-pr-review.sh; only for a
+  finished review with every finding triaged, 409 `review-incomplete`
+  otherwise; the token is bound to the decision and `findingsDigest`, 409
+  `confirm-mismatch` when they changed).
+- `GET /v1/tools`, `POST /v1/tools/{name}/call` (`local-only`): the
+  registered toolkit MCP server's tools, arguments checked against each
+  inputSchema, risk from each tool's annotations, and `allowed`/`reason`:
+  calls are denied by default (403 `tool-not-allowed`) except for read-only
+  tools that take no location and are outside the web and context families;
+  a `confirm` argument is refused; the toolkit child always runs with
+  `MULTI_AGENT_UNATTENDED=1` and `MCP_TOOLKIT_URL_POLICY=strict`.
+- `GET /v1/services/confluence`, `/crashlytics`, `/figma`: one page, issue or
+  frame through the pipeline's existing clients; a Confluence URL only on the
+  configured host (409 `host-not-allowed`); one request per service at a time
+  (429 `busy`).
+- `GET /v1/permissions`: the shape for pending host permission prompts;
+  `available: false` until the host records them readably.
+- `GET /office`: the optional panel page, 404 when none is installed;
+  `POST /office/code` and `POST /office/exchange` hand the page the token
+  through a one-time 10 second code instead of a URL; `GET
+  /office/assets/<name>.png` serves its sprites.
+- `--max-hours` (default 8): an absolute lifetime for the server.
+- `contract-error.schema.json`: `no-selection`, `repo-not-configured`,
+  `invalid-config`, `not-installed`, `repo-ambiguous`, `unreadable-settings`,
+  `not-removable`, `not-steerable`, `too-many-streams`, `no-review`,
+  `upstream-failed`, `tool-not-allowed`, `busy`, `review-incomplete`,
+  `host-not-allowed`.
+- Narrowed: a write (POST, DELETE) from a page on an `--allow-origin` origin is
+  now 403 `forbidden-origin`; only the server's own page may write. A native
+  client sends no Origin and is unaffected.
+- `?repo=` also takes a repository name from `GET /v1/repos` (on the stack
+  route and on `POST /v1/launch`), since a browser reads that list redacted,
+  without paths. The repository must still be a configured or registered one:
+  an unknown name is 403 `repo-not-allowed`, an ambiguous one 409
+  `repo-ambiguous`. A relative path is no longer 400 but resolved as a name.
+
 ## 1.3.0
 
 Added. Every new field is optional for a decoder: a run written before this