@mmerterden/multi-agent-pipeline 20.30.0 → 20.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.30.0",
+  "version": "20.33.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -87,6 +87,7 @@
     "LICENSE",
     "SECURITY.md",
     "!pipeline/office-src/**",
+    "!pipeline/office-art/**",
     "!pipeline/scripts/smoke-figma-config-schema.sh",
     "!pipeline/scripts/smoke-personal-data.sh",
     "!pipeline/scripts/validate-prefs.mjs",

package/pipeline/commands/multi-agent/analysis/SKILL.md

@@ -117,7 +117,7 @@ Two channels run in parallel at every phase boundary:
 ```bash
 # Phase 0, very first shell call (every CLI):
 bash $HOME/.claude/scripts/phase-tracker.sh init "$TASK_ID"
-for p in "0:Init" "1:Plan" "3:Review" "4:Commit" "5:Report"; do
+for p in "0:Intake" "1:Evidence" "2:Synthesis" "3:Review" "4:Publish" "5:Report"; do
   bash $HOME/.claude/scripts/phase-tracker.sh add "${p%%:*}" "${p#*:}"
 done
 bash $HOME/.claude/scripts/phase-tracker.sh update 0 in_progress
@@ -131,13 +131,13 @@ bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <in> <out> [cached]
 
 ### Visual channel  -  Claude Code (native TaskList widget, required)
 
-In Claude Code the agent MUST also drive the native TaskList widget so the user sees a sticky phase tile stack  -  this is the only progress signal Claude Code surfaces. Register one tile per phase of the active set (`0:Init 1:Plan 3:Review 4:Commit 5:Report`) with `TaskCreate`, persist each `taskId` via `phase-tracker.sh meta <N> tasklist_id "<taskId>"`, and at every phase entry, sub-step and exit pair a `TaskUpdate` (status or `activeForm`) with the matching `phase-tracker.sh update`. Call pattern: `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "Call pattern". Mirror each with `phase-tracker.sh task` ("Mirroring the host's task list").
+In Claude Code the agent MUST also drive the native TaskList widget so the user sees a sticky phase tile stack  -  this is the only progress signal Claude Code surfaces. Register one tile per phase of the active set (`0:Intake 1:Evidence 2:Synthesis 3:Review 4:Publish 5:Report`) with `TaskCreate`, persist each `taskId` via `phase-tracker.sh meta <N> tasklist_id "<taskId>"`, and at every phase entry, sub-step and exit pair a `TaskUpdate` (status or `activeForm`) with the matching `phase-tracker.sh update`. Call pattern: `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "Call pattern". Mirror each with `phase-tracker.sh task` ("Mirroring the host's task list").
 
-`analysis` mode does NOT TaskCreate phase 2: register tiles for the active set only.
+`analysis` mode TaskCreates all 6 phases (no phase is skipped).
 
 #### TaskCreate ordering (strict)
 
-**All TaskCreate calls in a batch fire in strict phase-number order BEFORE any TaskUpdate is applied**, and a later batch only ever appends phases numbered above everything already registered. For `analysis` that means: Phase 0 → Phase 1 → Phase 3 → Phase 4 → Phase 5. The native widget renders by creation order, not by phase number  -  out-of-order calls produce visually scrambled tile stacks (e.g. `1 ✓ · 2 ✓ · 4 ✓ · 0 ▶ · 3 ☐`) even when the underlying state is correct. Pre-marking phases as completed/skipped before Phase 0 starts is FORBIDDEN  -  register the tile in order, then flip status via TaskUpdate when the phase actually short-circuits. Full ordering contract in `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "TaskCreate ordering (strict)".
+**All TaskCreate calls in a batch fire in strict phase-number order BEFORE any TaskUpdate is applied**, and a later batch only ever appends phases numbered above everything already registered. For `analysis` that means: Phase 0 → Phase 1 → Phase 2 → Phase 3 → Phase 4 → Phase 5. The native widget renders by creation order, not by phase number  -  out-of-order calls produce visually scrambled tile stacks (e.g. `1 ✓ · 2 ✓ · 4 ✓ · 0 ▶ · 3 ☐`) even when the underlying state is correct. Pre-marking phases as completed/skipped before Phase 0 starts is FORBIDDEN  -  register the tile in order, then flip status via TaskUpdate when the phase actually short-circuits. Full ordering contract in `$HOME/.claude/multi-agent-refs/tracker-contract.md` section "TaskCreate ordering (strict)".
 
 ### Visual channel  -  Copilot CLI / plain shell
 

package/pipeline/commands/multi-agent/office-on/SKILL.md

@@ -1,6 +1,6 @@
 ---
-description: "Open the office panel: a local browser page with agents at work, their chats, cost ledger and new runs. Use when you want to watch or drive runs from a browser."
-description-tr: "Ofis panelini açar: çalışan her ajanı (koşu başına bir masa, ekip faz sırasıyla oturur), sohbetlerini, maliyet defterini, autopilot'u, rutinleri, stack'leri, toolkit araçlarını ve yeni koşu başlatmayı gösteren yerel web sayfası. Yerel sözleşme sunucusunu gerektiğinde başlatır; panel kapanınca hiçbir şey çalışmaz."
+description: "Open the office: a local browser page that shows runs and agents live and drives the ecosystem (new runs, jobs, PRs, keys, memory, system, cleanup). Use when you want to watch or drive runs from a browser."
+description-tr: "Ofisi açar: koşuları ve ajanları canlı gösteren, ekosistemi yöneten yerel web sayfası (yeni koşu, işler, PR'lar, anahtarlar, hafıza, sistem, temizlik). Yerel sözleşme sunucusunu gerektiğinde başlatır; sunucu /multi-agent:office-off ile durdurulana kadar çalışır."
 argument-hint: "(no arguments)"
 parameters: []
 gui: button
@@ -33,16 +33,17 @@ fresh bearer token per start). This command and `office-off` /
    in this transcript.
 
 2. **Report** (in `outputLanguage`): the page URL (`url`, without a code),
-   whether a server was started or reused, that it stops by itself after
-   `idleMinutes` without a request (and after 8 hours in any case), and that
-   `/multi-agent:office-off` stops it now. If `opened` is false, tell the user
+   whether a server was started or reused (`restarted` true means the running
+   one was older than the installed pipeline and was replaced), that it keeps
+   running until `/multi-agent:office-off` stops it. If `opened` is false, tell the user
    to run the command again from a desktop session; a link works once, so a
    reload of the page needs a new `office-on`.
 
 ## What it does not do
 
-- No daemon, hook or file watcher: when the page is closed, the server exits
-  after its idle time and nothing else runs.
+- No daemon or file watcher beside the one server, which runs until
+  `office-off`, and no hook of its own: the task lists come from the
+  `task-mirror` hook that install registers for every run.
 - The panel's writes call the same scripts the terminal commands call; it adds
   no behaviour of its own.
 - The server listens on 127.0.0.1 only. Remote access is not part of this

package/pipeline/commands/multi-agent/office-status/SKILL.md

@@ -17,7 +17,7 @@ node "$HOME/.claude/scripts/office-control.mjs" status --json
 
 Report in `outputLanguage`:
 
-- `running`, and when it is, `url` and `idleMinutes`;
+- `running`, and when it is, `url` and `idleMinutes` (0 means it runs until `office-off`);
 - `remote`: "not available in this installation" unless a separate remote
   layer is installed; report the line as given;
 - `pairedDevices`: the devices the phone registry lists; revoking one is

package/pipeline/commands/multi-agent/prune-logs/SKILL.md

@@ -21,7 +21,10 @@ whole task dirs, with optional age / project / task filters.
 Backed by `$HOME/.claude/scripts/prune-logs.sh`. Safe by default: it previews
 and deletes nothing until you confirm. The audit trail (`audit.jsonl` +
 rotations) and the metrics corpus (`metrics.jsonl`, `metrics-summary.md`) live
-at the log-root top level and are never removed; `.counter` files survive too.
+at the log-root top level and are never removed; `.counter` files survive too. A run that can still be resumed (its `agent-state.json` status is not
+finished, abandoned or cancelled) keeps its log however old it is, and
+so does a folder written in the last 10 minutes; `--task` names one dir and
+bypasses both.
 
 Unlike `/multi-agent:purge` (which wipes worktrees, branches, logs, and state
 together), this only removes log dirs and leaves your worktrees and branches

package/pipeline/commands/multi-agent/review/SKILL.md

@@ -41,10 +41,11 @@ Branch-mode runs print to chat only. PR-mode runs print to chat AND post the ver
 : "${TASK_ID:=review-$(date +%s)-$$}"
 export TASK_ID
 
-# Clean up scratch files on exit so /tmp doesn't accumulate diffs and SHAs.
 trap 'rm -f /tmp/multi-agent-review-${TASK_ID}-*' EXIT
 ```
 
+Standalone only (a `review-` id): register a tracker record per `$HOME/.claude/multi-agent-refs/review-standalone-tracker.md`.
+
 ### 1. Parse the input  -  pick a resolution path
 
 ```bash
@@ -379,10 +380,10 @@ If the post fails (network, token, harness block), `post-pr-review.sh` exits non
 Per the `$HOME/.claude/multi-agent-refs/tracker-contract.md` tokens contract, after each reviewer LLM call:
 
 ```bash
-bash $HOME/.claude/scripts/phase-tracker.sh tokens 4 <input_count> <output_count>
+bash $HOME/.claude/scripts/phase-tracker.sh tokens <N> <input_count> <output_count>
 ```
 
-Standalone `/multi-agent:review` runs use phase id 3 (matches Phase 3 Review in the full pipeline) so cost aggregation stays consistent.
+`<N>`: the run's Review phase, or step 2 for a standalone review.
 
 ## Input matrix
 

package/pipeline/commands/multi-agent/scenario-audit/SKILL.md

@@ -55,7 +55,9 @@ Read the candidate lines it returns. A term nothing matched is listed under
 
 ## Step 3 - Verdict
 
-Write `/tmp/ma-verdicts.json`: `[{id, status, citations, searched, note}]`.
+Write the verdicts to a file in a folder of this run's own
+(`VERDICTS="$(mktemp -d)/verdicts.json"`, never a fixed `/tmp` name another
+user or a second audit could share): `[{id, status, citations, searched, note}]`.
 
 | Status | When | Needs |
 |---|---|---|
@@ -66,7 +68,7 @@ Write `/tmp/ma-verdicts.json`: `[{id, status, citations, searched, note}]`.
 
 ```bash
 node "$HOME/.claude/scripts/scenario-audit.mjs" verify --csv "<scenarios.csv>" \
-  --verdicts /tmp/ma-verdicts.json --repo "<repo>" --lang "<outputLanguage>"
+  --verdicts "$VERDICTS" --repo "<repo>" --lang "<outputLanguage>"
 ```
 
 ## Step 4 - Report

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -79,6 +79,7 @@ Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scr
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
 Step 3d: DEV-TOOLKIT companion MCP server -> detect movement, run the ship gates, commit + publish
+Step 3e: OFFICE      panel page is current, installed copies match it, toolkit version recorded
 Step 4: WEBSITE     Version + phase/model counts -> {website-host} (i18n + projects.ts)
 Step 5: Commit      Commit + push all changed repos
 Step 6: Report      Summary: synced targets, platform, changed files, deploy status, multi-agent-toolkit version
@@ -131,6 +132,7 @@ Step 0 gate rules and why: `features/doctor.md`.
    - `~/.claude/CLAUDE.md`, `~/.claude/rules/`, `~/.claude/knowledge/`
    - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh`, `agent-guard.sh`, `agent-guard.py`, and `build-stack-plugins.mjs` (generic, synced)
    - `~/.claude/settings.json`
+   - `~/.claude/office/`  -  the office panel flows the other way: its source is the repo (`pipeline/office-src`, built by `office-build.mjs` into `pipeline/office`), and the installer copies it to each host. Never copy it from `~/.claude` into the repo; Step 3e checks it instead
    - `~/.claude/multi-agent-refs/registries/`  -  the installer copies gate registries there from `pipeline/skills/shared/external`; the repo already holds the source
    - **Any `~/.claude/commands/multi-agent/*/SKILL.md` whose frontmatter has `local-only: true`** - these are user/repo-specific alias wrappers that delegate to a private marketplace plugin's skills exposed as `multi-agent:<name>`. Syncing them would leak the private plugin/skill names into the public pipeline. Skip them at copy time; the backstop below proves none reached `pipeline/commands/`.
      ```bash
@@ -226,9 +228,19 @@ When invoked with the `release` argument:
 8. WEBSITE       Version + features -> {website-host} (maintainer identity, build verified Ready)
 9. COPILOT       Copilot CLI instructions + skills sync
 9b. CODEX        Codex CLI router skill + refs + agent TOML (node install.js --codex)
+9c. OFFICE       Step 3e: the installed panel matches the release
 10. Report       Summary: version, touched repos, deploy status
 ```
 
+### Step 3e: OFFICE (every sync, and step 9c of a release)
+
+The office panel ships with the pipeline, so a sync carries it by checking it, not by copying it:
+
+1. `node ~/multi-agent-pipeline/pipeline/scripts/office-build.mjs --check`: the committed page is what `pipeline/office-src` builds to, and `office/toolkit.json` carries the toolkit version in `docs/facts.json`. Either stale fails the sync until it is rebuilt and committed; a release that regenerates facts rebuilds the office right after.
+2. After the install steps, compare `pipeline/office/index.html` with the installed copies (`~/.claude/office/`, and the Copilot and Codex trees when installed), byte for byte, plus the asset list. A difference means the install is behind: run `node install.js --installed` and compare again.
+3. Report the toolkit version the installed `office/toolkit.json` carries: it is what the office Tools window starts, and it moves forward with every release.
+4. An office server that is already running picks the update up by itself: the open page shows a reload banner, and `/multi-agent:office-on` replaces a server whose code changed. Nothing to restart by hand.
+
 ---
 
 ## Sub-Command Sync (Claude Code <-> Copilot CLI Skills)

package/pipeline/commands/multi-agent/test-gen/SKILL.md

@@ -47,9 +47,32 @@ Scripts: `test-gen-gate.mjs` (artefact, handle and write gates),
 ## Step 1 - Prepare
 
 1. Repo: `--repo`, else the current directory; confirm it in one line.
-   Platform: `--platform`, else detect as `/multi-agent:test` does. Run id
-   `tg-<timestamp>`; `RUN="$HOME/.claude/logs/test-gen/<repo>/<timestamp>"`,
-   created with `mkdir -p "$RUN"`.
+   Platform: `--platform`, else detect as `/multi-agent:test` does. One
+   timestamp names the run everywhere: `TS="$(date +%Y%m%d%H%M%S)"`, run id
+   `tg-$TS`, `RUN="$HOME/.claude/logs/test-gen/<repo>/$TS"`, created with
+   `mkdir -p "$RUN"`.
+   Register the run so its progress shows wherever runs are read (the office
+   panel, `/multi-agent:status`), with one step per stage below:
+
+   ```bash
+   TG_ID="tg-$TS"
+   S="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/$TG_ID"; mkdir -p "$S"
+   printf '{"taskId":"%s","mode":"test-gen","status":"in_progress","currentPhase":0}' "$TG_ID" \
+     | node "$HOME/.claude/scripts/write-state.mjs" "$S/agent-state.json" >/dev/null
+   export MULTI_AGENT_TASK_ID="$TG_ID"
+   bash "$HOME/.claude/scripts/phase-tracker.sh" init "$TG_ID"
+   for p in "0:Prepare" "1:Inventory" "2:Discovery" "3:Handles" "4:Tests" "5:Report"; do
+     bash "$HOME/.claude/scripts/phase-tracker.sh" add "${p%%:*}" "${p#*:}"
+   done
+   bash "$HOME/.claude/scripts/phase-tracker.sh" update 0 in_progress
+   ```
+
+   Each step below starts with `update <N> in_progress` and ends with
+   `update <N> completed` (Step 5 and Step 6 share step 4), every call prefixed
+   `MULTI_AGENT_TASK_ID=<the tg- id, written out> MULTI_AGENT_STRICT_TASK_ID=1`
+   since it runs in a new shell where `$TG_ID` is gone, and on
+   Claude Code each gets a task-widget tile named as its tracker line
+   (`tracker-contract.md`, "Call pattern").
 2. Toolkit: `test_results_classify`, `coverage_gap` and `ui_locator_codegen`
    need `@mmerterden/multi-agent-toolkit-mcp` >= v3.25.0. Check the tool list
    once. Each missing tool has a fallback in `stages.md` (classify from the
@@ -122,3 +145,6 @@ inventory, the gaps, the triage). Then record the change base
 Offer, one question: open the product bugs through `/multi-agent` with each
 failing test as the acceptance check, or stop. **No commit, no push, no issue
 from this command.**
+
+Last, close the run record: `phase-tracker.sh update 5 completed`, then the
+same `write-state.mjs` call with `"status":"complete","currentPhase":5`.

package/pipeline/contract/CHANGELOG.md

@@ -3,6 +3,52 @@
 Versions of the client contract (`manifest.json` `contractVersion`), separate
 from the package version. See `README.md` for what counts as minor and major.
 
+## 1.6.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/system` (`system-status.mjs --json`): CPU, memory, disk and the
+  pipeline's own processes, numbers only.
+- `GET /v1/credentials` (`office-credentials.mjs --json [--probe]`, local-only):
+  logical names, state and probe verdict per credential, never a value.
+- `GET /v1/memory` (`office-memory.mjs --json`, local-only): per-repository code
+  graph age and learning, finding and session-note counts, redacted.
+- `POST /v1/prune-logs` (two steps, local-only): the task log folders older than
+  7, 30 or 90 days, then a prune of exactly that list; 409 `changed` when the
+  folders moved since the preview.
+- `GET /v1/settings` and `POST /v1/settings` (two steps, local-only, one change
+  at a time): output language, the fable rung and model routing; a route-on
+  preview names a saved free provider chain in `change.freeChain`.
+- runs and run (1.3.0): `source`, `prNumber`, `mode`, `channels`, and the
+  local-only `channelUrls`, dropped from a redacted answer.
+- activity, activity stream, agent chat, routines, routine delete, repo add and
+  remove (1.1.0): tables carry `source`, `pr`, `channels`, `waitingFor`,
+  `currentTask`, `progress` and each phase's `tasks`; seats carry their own
+  `tasks` and recent `mcp` calls.
+- prs, issue maturity, review verdict (1.1.0): a pull request names the
+  `account` it was listed for, numbered in a redacted answer.
+
+## 1.5.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/repos?all=1` (`launch-request.mjs repos --all`): `suggested`
+  (checkouts earlier runs worked in that launch does not accept yet) and
+  `missing` (registered entries whose folder is gone), each with an `id`; a
+  page sees ids and names, never paths.
+- `POST /v1/repos` (two steps, `repo-request.schema.json`,
+  `repo-change.schema.json`, `local-only`/`high`): register a suggestion by id
+  or an absolute path to a git checkout. `DELETE /v1/repos/{id}` (two steps)
+  removes a registered entry; configured autopilot repositories are not
+  touched.
+- `version` on `GET /v1/tools`: the exact toolkit version the panel starts.
+- `GET /v1/jobs` (`office-jobs.schema.json`): the jobs the office can start,
+  from `schemas/office-jobs.json`. `POST /v1/jobs` (two steps,
+  `job-request.schema.json`, `job-change.schema.json`, `local-only`/`high`)
+  starts one with `claude --bg` under the unattended profile; it is the one
+  route that starts a session itself.
+- `--idle-minutes 0` and `--max-hours 0` mean no idle stop and no lifetime.
+
 ## 1.4.0
 
 Added. Nothing existing changes shape; one narrowing for browser pages.

package/pipeline/contract/README.md

@@ -42,7 +42,11 @@ same bytes (`test/contract-parity.test.mjs`):
 | Assigned issues | `issues.mjs --json [--source S] [--project K] [--max N]` | `GET /v1/issues` |
 | Worktrees | `worktrees.mjs --json [--measure] [--redact]` | `GET /v1/worktrees` |
 | Launch shape | `launch-request.mjs spec` | `GET /v1/launch-spec` |
-| Launch repositories | `launch-request.mjs repos [--redact]` | `GET /v1/repos` |
+| Launch repositories | `launch-request.mjs repos [--redact] [--all]` | `GET /v1/repos[?all=1]` |
+| Add a launch repository (two steps; the route also requires a git checkout) | `launch-request.mjs register-repo <path>` | `POST /v1/repos` |
+| Remove a registered repository (two steps) | - | `DELETE /v1/repos/{id}` |
+| Office jobs | `job-launch.mjs list` | `GET /v1/jobs` |
+| Start an office job (two steps) | - | `POST /v1/jobs` |
 | Start a run | write the request file, then `launch-request.mjs plan FILE --repo P --session-id U [--channel phone]` | `POST /v1/launch?repo=P` |
 | Answer a question | `answer-question.mjs STATE --question Q --answer IDS` | `POST /v1/runs/{id}/answer` |
 | A run's log | `run-log.mjs ID [--tail N]` (1-2000, default 200) | `GET /v1/runs/{id}/log?tail=N` |
@@ -56,6 +60,12 @@ same bytes (`test/contract-parity.test.mjs`):
 | Agent activity | `activity-snapshot.mjs --json` | `GET /v1/activity`, `GET /v1/activity/stream` (SSE) |
 | An agent's chat | `activity-snapshot.mjs chat SESSION [AGENT] [--before N] [--limit N]` | `GET /v1/agents/{sessionId}/{agentId}/chat` |
 | Cost ledger | `office-ledger.mjs --json` | `GET /v1/ledger` |
+| Machine resources | `system-status.mjs --json` | `GET /v1/system` |
+| Key cabinet (names and verdicts, never values) | `office-credentials.mjs --json [--probe]` | `GET /v1/credentials` |
+| Institutional memory | `office-memory.mjs --json` | `GET /v1/memory` |
+| Prune old run logs (two steps) | `office-prune.mjs preview\|apply N --json` | `POST /v1/prune-logs` |
+| Office settings | `office-settings.mjs --json` | `GET /v1/settings` |
+| Change one setting (two steps) | `office-settings.mjs set SETTING VALUE --json` | `POST /v1/settings` |
 | What a run produced | `run-results.mjs ID --json` | `GET /v1/runs/{id}/results` |
 | One screenshot | `run-results.mjs ID --evidence NAME` | `GET /v1/runs/{id}/evidence/{name}` |
 | Post a review verdict (two steps) | `work-items.mjs verdict ID [--post]` | `POST /v1/runs/{id}/review-verdict` |
@@ -72,16 +82,19 @@ same bytes (`test/contract-parity.test.mjs`):
 
 Every surface in `manifest.json` carries `remote` (the scope a remote carrier
 would require: `read`, `answer`, `launch`, or `local-only` for anything that
-widens what runs on this machine: autopilot on, stack, routine removal, kill,
-gc) and `risk` (the confirmation tier: `read`, `low`, `high`). Locally the
+widens what runs on this machine (autopilot on, stack, routine removal, kill,
+gc, prune, settings) and for a read that stays on this machine for privacy
+(credentials, memory, settings)) and `risk` (the confirmation tier: `read`, `low`, `high`). Locally the
 bearer token is the only credential; nothing enforces the tags yet. They are
 there so a later carrier reuses these routes without redefining them.
 
-Starting a run is always the client's act. `POST /v1/launch` validates the
+Starting a run is the client's act. `POST /v1/launch` validates the
 request, writes it (0600) and returns the argv, environment and working
-directory from `launch.json`; it never starts a session (the only `claude` the
-server runs is `claude stop`, for a kill). Spawn the argv without
-a shell. `launch.json` is marked `verified: false` until a live launch trial, so
+directory from `launch.json`; spawn the argv without a shell. The office panel
+is a client that starts its own: `POST /v1/jobs` (two steps, `local-only`)
+starts a job from `schemas/office-jobs.json` in the background after the
+unattended profile, workspace trust and sandbox checks. Besides that the only
+`claude` the server runs is `claude stop`, for a kill. `launch.json` is marked `verified: false` until a live launch trial, so
 treat the shape as provisional.
 
 The run starts with no permission prompts, so its input is held to a shape: a
@@ -155,7 +168,8 @@ answer to the old one.
   (own Origin only, no bearer); a used, expired or unknown code is 401.
   `GET /office/assets/<name>.png` serves the page's sprites, also without a
   token: a plain file name, a PNG of at most 256 KiB directly in the assets
-  directory beside the page, and 404 for anything else.
+  directory beside the page, and 404 for anything else. `GET /favicon.ico`
+  answers an empty 204 without a token, since browsers request it on their own.
 - Every write route appends one line (who, route, step, status; never a body
   or token) to `~/.claude/logs/multi-agent/office-actions.jsonl`.
 - Bodies are JSON, at most 64 KiB, and must satisfy the route's schema.

package/pipeline/contract/fixtures/error-invalid-request.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "invalid-request",
   "message": "the launch request was refused",
   "errors": [

package/pipeline/contract/fixtures/error-unauthorized.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "unauthorized",
   "message": "a bearer token is required"
 }

package/pipeline/contract/fixtures/error-unsigned.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "unsigned",
   "message": "a device signature is required"
 }

package/pipeline/contract/fixtures/launch-plan.json

@@ -22,7 +22,7 @@
     "MULTI_AGENT_UNATTENDED": "1",
     "MULTI_AGENT_SESSION_ID": "00000000-0000-4000-8000-000000000201",
     "MCP_TOOLKIT_URL_POLICY": "strict",
-    "MCP_TOOLKIT_INDEX_DENY": "~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains",
+    "MCP_TOOLKIT_INDEX_DENY": "~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains,~/.claude/logs/multi-agent/contract-server,~/.claude/logs/multi-agent/office",
     "LOGS_ROOT": "/Users/example/.multi-agent-unattended/logs",
     "MA_LAUNCH_REQUEST": "/Users/example/.claude/autopilot/requests/00000000-0000-4000-8000-000000000201.json"
   },

package/pipeline/contract/fixtures/runs-awaiting-question.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -68,7 +68,12 @@
       "estUsd": 0,
       "unlockedWrites": 0,
       "runType": "autopilot",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0,
       "currentTask": null,
       "processAlive": false

package/pipeline/contract/fixtures/runs-empty.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 0,
   "runs": []

package/pipeline/contract/fixtures/runs-failed.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -88,7 +88,12 @@
       "estUsd": 0.0353,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0.75,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-old-schema.json

@@ -64,7 +64,12 @@
         "cached": 1800
       },
       "estUsd": 0.0236,
-      "unlockedWrites": 0
+      "unlockedWrites": 0,
+      "mode": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {}
     }
   ]
 }

package/pipeline/contract/fixtures/runs-pr-opened-redacted.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "count": 1,
   "runs": [
     {
@@ -109,7 +109,11 @@
       "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": 104,
+      "channels": [],
       "progress": 1,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-pr-opened.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -114,7 +114,12 @@
       "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": 104,
+      "channels": [],
+      "channelUrls": {},
       "progress": 1,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-running.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -99,7 +99,12 @@
       "estUsd": 0.0236,
       "unlockedWrites": 0,
       "runType": "autopilot",
+      "mode": null,
       "title": "Fix the crash on the login screen",
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0.8333333333333334,
       "currentTask": {
         "subject": "Make the test pass",