@mmerterden/multi-agent-pipeline 20.30.0 → 20.33.0

package/pipeline/multi-agent-refs/features/office-threat-model.md

@@ -1,5 +1,13 @@
 # Office routes: threat model
 
+<!-- toc -->
+- [Assets](#assets)
+- [Attackers](#attackers)
+- [Threats and controls](#threats-and-controls)
+- [Residual risks](#residual-risks)
+- [Later, with a remote carrier](#later-with-a-remote-carrier)
+<!-- /toc -->
+
 The office routes of `scripts/contract-server.mjs` let a client watch the
 agents on this machine, read what they said, answer and steer runs, and change
 what runs here (autopilot, stacks, routines). A browser panel may be served at
@@ -20,6 +28,8 @@ not mitigated here.
 | Run state | `agent-state.json`, `tracker-state.json` | an answer or steer written here changes what a run does |
 | Machine configuration | autopilot `config.json` and launchd jobs, a repo's `.claude/settings.json`, routine commands | widening any of them changes what runs unattended |
 | PR verdicts | posted to GitHub or Bitbucket with the user's own credential | an approval in the user's name |
+| Learning stores | `~/.claude/memory/multi-agent/<repo>/` and `~/.claude/knowledge/<repo>/` | statements a run wrote down, which can quote code or a pasted secret |
+| Run logs | `~/.claude/logs/multi-agent/<project>/<task>/` | deleting the wrong folder loses a live run's state |
 
 ## Attackers
 
@@ -36,20 +46,28 @@ not mitigated here.
 |---|---|---|---|
 | T1 | DNS rebinding: a page on an attacker host resolves to 127.0.0.1 and calls the API under its own name | Every request, `/office` and the event stream included, must carry `Host: 127.0.0.1:<port>` or `localhost:<port>`; anything else is 403 before routing | `smoke-office-security.sh` T1, `test/office-routes.test.mjs` "403 under a rebound Host" |
 | T2 | CSRF: a page posts to a write route | Writes (POST, DELETE) accept no `Origin` but the server's own, even an origin allowed with `--allow-origin`; a foreign preflight is 403 and no CORS header is ever sent to a foreign page; writes that widen what runs here take a second request with a single-use, route-bound confirm token | `smoke-office-security.sh` T2, `office-routes.test.mjs` "a write from a foreign page is refused" |
-| T3 | Token theft or replay | The token is read from the `Authorization` header only (never a cookie or a query parameter), compared in constant time over digests, never written into a response, an error or a log line. It never appears in a URL: `office-on` opens the page with a one-time code in the fragment (10 seconds, one use, minted by the bearer holder at `POST /office/code` with no Origin), and the page trades it at `POST /office/exchange`, which accepts only the server's own Origin; a second use, an expired or an unknown code is 401. The code never reaches a command line, which every local user can read (`ps`): the browser is opened on a 0600 launcher page in the 0700 state directory that carries the code and forwards with `location.replace`, under a CSP that allows only its own script by hash; the launcher is removed after 15 seconds. An Origin header can be forged by a non-browser client, so the code's secrecy and its 10 second, single-use life are what protect the exchange. The page keeps the token in memory and strips the fragment. The server exits after 8 hours however busy it is, so a token cannot outlive a working day | `office-control.test.mjs` "the opener's argv carries no code", "the launcher page has a strict CSP", "the launcher is deleted"; `office-routes.test.mjs` "a panel code trades for the token once", "a code is refused from a foreign page", "an expired code is 401", "exits at its absolute lifetime"; `smoke-office-page.sh` "the code trades once" |
+| T3 | Token theft or replay | The token is read from the `Authorization` header only (never a cookie or a query parameter), compared in constant time over digests, never written into a response, an error or a log line. It never appears in a URL: `office-on` opens the page with a one-time code in the fragment (10 seconds, one use, minted by the bearer holder at `POST /office/code` with no Origin), and the page trades it at `POST /office/exchange`, which accepts only the server's own Origin; a second use, an expired or an unknown code is 401. The code never reaches a command line, which every local user can read (`ps`): the browser is opened on a 0600 launcher page in the 0700 state directory that carries the code and forwards with `location.replace`, under a CSP that allows only its own script by hash; the launcher is removed after 15 seconds. An Origin header can be forged by a non-browser client, so the code's secrecy and its 10 second, single-use life are what protect the exchange. The page keeps the token in memory and strips the fragment. A server started by `contract-server.mjs` alone exits after 8 hours however busy it is; the panel's own server (`office-on`) runs until `office-off`, because a person keeps it open beside their work. Its token lives only in the server's memory, the page's memory and a 0600 file, is never on a command line or in a URL, and is replaced each time `office-on` starts a server | `office-control.test.mjs` "the opener's argv carries no code", "the launcher page has a strict CSP", "the launcher is deleted"; `office-routes.test.mjs` "a panel code trades for the token once", "a code is refused from a foreign page", "an expired code is 401", "exits at its absolute lifetime"; `smoke-office-page.sh` "the code trades once" |
 | T4 | Secret exposure through a response | Transcripts are read through `_transcript-tail.mjs`, which never parses api-request records and drops thinking blocks; every string passes the credential redactor and the scrubber; the finished office and chat documents are checked by the outbound gate; seat labels come from allow-listed fields (tool name, file basename, sidecar description), never a command line; credentials are read only by the service scripts and never returned | `smoke-office-privacy.sh`, `smoke-office-security.sh` T4, `test/office-activity.test.mjs` "carries no credential" |
 | T5 | Path traversal into arbitrary files | Session, agent, run, routine, tool and evidence ids are matched against safe character sets after decoding; transcripts are looked up by name under the projects root only; a screenshot must resolve (real path) inside the run's evidence directory; an analysis document named in run state is read only when its real path is inside the run's log directory, its artifacts or a worktree git lists under the state's projectRoot, and only when it is Markdown or HTML | `smoke-office-security.sh` T5, `test/office-work.test.mjs` "nothing outside its directory", "analysis documents are read only inside the run's roots", "a worktreePath counts only when git lists it" |
 | T6 | Oversized or malformed input | Bodies are capped at 64 KiB and validated against the route's schema; tool arguments are checked against the tool's inputSchema; launch input goes through `launch-request.mjs` validation only; chat paging is capped at 500 | `smoke-office-security.sh` T6, `office-work.test.mjs` "refuses an unknown tool, invalid arguments and an oversized body" |
-| T7 | Resource exhaustion | At most four event streams and 64 connections; a phone request has five seconds to send its body before any signature work; at most 256 confirm tokens, the oldest dropped first; service clients, the work list and autopilot control run as child processes, never blocking the event loop, one at a time per service (429 `busy` for a second one); one snapshot is computed per poll from bounded tail reads; the session list is cached for ten seconds; the server exits after its idle time, after 8 hours in any case, and on SIGTERM | `smoke-office-security.sh` T7; `office-routes.test.mjs` "connections past the cap are dropped", "never sends its body", "confirm tokens are capped"; `office-work.test.mjs` "a slow service read neither blocks other routes nor runs twice at once" |
+| T7 | Resource exhaustion | At most four event streams and 64 connections; a phone request has five seconds to send its body before any signature work; at most 256 confirm tokens, the oldest dropped first; service clients, the work list and autopilot control run as child processes, never blocking the event loop, one at a time per service (429 `busy` for a second one); one snapshot is computed per poll from bounded tail reads; the session list is cached for ten seconds; a server started on its own exits after its idle time and after 8 hours in any case, the one `office-on` starts runs until `office-off`, and both stop on SIGTERM | `smoke-office-security.sh` T7; `office-routes.test.mjs` "connections past the cap are dropped", "never sends its body", "confirm tokens are capped"; `office-work.test.mjs` "a slow service read neither blocks other routes nor runs twice at once" |
 | T8 | XSS from hostile transcript or issue text | The panel renders every server string with `textContent` or canvas text; markdown is shown as plain text; server images only as `data:` URLs of image types; the office sprites are same-origin PNGs from `/office/assets/`, which answers only a plain file name (no separator or escape) whose real path is a PNG directly in the installed assets directory, and 404 otherwise; the page language the server stamps comes from a two-value set (`en`, `tr`), whatever the preferences file holds; the page's CSP allows only its per-response nonce for script and style, `connect-src 'self'`, no framing, no base URI, no form action | `smoke-office-page.sh`, `office-routes.test.mjs` "stamps the page language from outputLanguage", "serves a sprite and nothing else under /office/assets/", `office-build.test.mjs`, `smoke-office-runtime.sh` |
 | T9 | Clickjacking | `frame-ancestors 'none'` on the page and on every API response | `office-routes.test.mjs` "serves the page without a token, with a nonce CSP" |
 | T10 | An action nobody can account for | Every write leaves one line (who, route, step, status; never a body or token) in `office-actions.jsonl` | `office-routes.test.mjs` "every write leaves a line" |
-| T11 | The panel widening the machine silently | Autopilot on, stack changes and routine removal are tagged `local-only` and `high`, take two requests, and run the same scripts as the terminal commands | `smoke-office-routes.sh`, `smoke-office-single-source.sh` |
+| T11 | The panel widening the machine silently | Autopilot on, stack changes, routine removal and adding or removing a launch repository are tagged `local-only` and `high`, take two requests, and run the same scripts as the terminal commands where one exists (removing a launch repository has none). A repository is added only as a git checkout that is neither the home directory nor the root; a suggestion is named by an opaque id and resolved again on the server, so a page never sends or sees a path it did not type | `smoke-office-routes.sh`, `smoke-office-single-source.sh`, `office-repos.test.mjs`, `smoke-office-ui.sh` |
 | T12 | A toolkit tool used as a reader of local files or services (a path, a `file://` or loopback URL, a shared browser page, an index of files) | Tool calls are denied by default: only a tool that declares readOnlyHint, is not destructive, is not in the `web` or `context` family and whose inputSchema takes no location (a property named for a path, URL, file, directory, output, project, root and similar, or a uri format, at any depth) is callable; everything else is 403 `tool-not-allowed` and never reaches the server. A `confirm` argument is refused, so a tool's own preview is never skipped. The toolkit child always runs with `MULTI_AGENT_UNATTENDED=1` and `MCP_TOOLKIT_URL_POLICY=strict`, applied after the registration's own environment. An `@latest` registration is pinned to a configured version or refused. The route is `local-only`, and its audit line names the tool and carries a SHA-256 of the arguments, never the arguments | `office-work.test.mjs` "refuses every tool outside the allowlist with 403 and never runs it", "refuses a confirm argument", "runs unattended with the strict URL policy", "pinned to a known version or refused", "the audit line names the tool and hashes the arguments" |
 | T13 | A steer instruction injected into an unattended run | Steering is tagged `launch` and `high` and takes two requests: the first shows the text, the run's phase and the unread instruction it replaces, and returns a token bound to that run and exactly that text; the second carries only the token. A finished run cannot be steered | `office-routes.test.mjs` "previews first, then queues on confirm", "a steer token is single use, bound to its run and cannot carry new text" |
 | T14 | A review verdict posted from a stale or unfinished review | A verdict is previewed only for a finished review whose every finding is accepted, rejected or deferred (409 `review-incomplete` otherwise); the confirm token is bound to the decision and a digest of the findings, and a confirmation after either changed is 409 `confirm-mismatch` | `office-work.test.mjs` "a running review or one with an untriaged finding cannot be previewed", "refused when the findings changed after the preview" |
 | T15 | A service read pointed at another host | A Confluence URL is accepted only on the configured Confluence host, and with no host configured only a page id is accepted (409 `host-not-allowed`), before the client script runs; Crashlytics takes only a Firebase console URL | `office-work.test.mjs` "a Confluence URL on another host is refused before the client runs", "only a page id is accepted" |
 | T16 | Machine paths leaking through errors, or `office-off` signalling a reused pid | Error bodies name no absolute path (the launchd refusal and the unreadable settings message say what failed, not where); `office-off` sends SIGTERM only when the recorded pid's token file still names it, its command is `contract-server.mjs` and its start time matches the token file's | `office-routes.test.mjs` "refused without naming its path", "reported without the plist path"; `smoke-office-control.sh` "off never signals a pid that is not its server" |
+| T17 | A reload code minted for another page, or a stale server outliving an update | `POST /office/reload` and `GET /office/version` need the bearer token and refuse any Origin other than the panel's own (a request with no Origin, a terminal client, is accepted); the reload code is the same 10 second, single-use code `office-on` uses, so a page that already holds the token gains nothing it did not have. A server whose code changed on disk is reported stale and `office-on` replaces it instead of reusing it | `office-repos.test.mjs` "/office/version reports the installed build", "/office/reload mints a one-time code"; `smoke-office-ui.sh` |
+| T18 | The panel starting work nobody asked for, or work wider than asked | `POST /v1/jobs` takes only a job named in `schemas/office-jobs.json`, each parameter checked by its kind (a pull request URL or `repo#N`, a Jira key, a run id the index knows, a branch name, a path that stays inside the repository, an enumerated value; a pipeline run's work item goes through the launch request rules). Two requests: the preview names the role, the repository, the exact prompt and what the job writes outside the machine (a branch and PR for a pipeline run; review and clarify jobs report locally, since agent-guard keeps GitHub writes to the runner), and the token is bound to that payload. At the confirmation the repository must still be allowed, the unattended profile installed, the workspace trusted, agent-guard.sh registered for every tool and the autopilot runner's sandbox check passing; the session runs `claude --bg` with no permission prompts under that profile, without a shell, and claude's own output stays in the server's log, not the page. The unattended profile denies reading the server's token directory, so a session it starts cannot pick up the bearer. A team job is refused while a run is live in the same repository, from the moment its session starts. Tagged `local-only`/`high`: no phone route reaches it. Every start is recorded under `logs/multi-agent/office/jobs/` and in `office-actions.jsonl` | `office-jobs.test.mjs`, `smoke-office-ui.sh` |
+| T19 | The key cabinet leaking a credential, or the panel becoming a place to enter one | `GET /v1/credentials` runs `lib/credential-inventory.sh`, whose probe reads each credential through the credential store with its output discarded, so no value reaches the server process. The route keeps the logical name, a state and a probe verdict from fixed vocabularies and a capability line cut to 160 characters; anything else in the script's output is dropped. Tagged `local-only`: not even the state goes to a phone. There is no write route: renewing a credential stays in the terminal (`/multi-agent:setup`), so a secret never passes through the browser | `office-routes.test.mjs` "GET /v1/credentials names each credential and its verdict, never a value" |
+| T20 | A learned statement carrying a secret or a machine path to the page | `GET /v1/memory` returns counts, the code graph's age and size, and the five newest learning statements per repository, each passed through the transcript redactor (provider credential rules, paths and addresses) and cut to 120 characters. Repository names are matched against a safe character set before any file is opened. Read only; `local-only` | `office-routes.test.mjs` "GET /v1/memory reports every shelf, redacted" |
+| T21 | Machine details through the resource panel | `GET /v1/system` returns numbers only (cores, load, memory, free disk, process counts, log folder size) and two fixed warnings; no path, process argument, user or host name. The schema allows nothing else. The measurement runs as child processes off the event loop, concurrent requests share one measurement, and the log folder size is reused for a minute. Readable from a phone, since it names nothing | `office-routes.test.mjs` "GET /v1/system returns numbers only: no path, user or host name" |
+| T22 | Old run logs deleted wider than asked, or a live run's log removed | `POST /v1/prune-logs` takes only an age from a fixed set (7, 30 or 90 days) and runs `prune-logs.sh`, the script `/multi-agent:prune-logs` runs: the dry run is the preview; the confirmed step lists the folders again, refuses with `changed` when they differ, and then prunes only the previewed list through `--only-from`, under a token bound to that age and list. The script never touches the audit trail, the metrics corpus or the task counters, refuses a log root that is `/`, the home folder or a git checkout, and spares a folder written in the last minutes and a run that can still be resumed. Tagged `local-only`/`high` | `office-routes.test.mjs` "POST /v1/prune-logs previews, then prunes only on the token" |
+| T23 | Pull request listing exposing a token, or the native task mirror writing into another run | Each GitHub account gh is logged in to is asked with `gh auth token` for that host and login; the token travels in `GH_TOKEN` (and `GH_ENTERPRISE_TOKEN` for an Enterprise Server host) for the child process only, never on a command line, in a response or a log. Bitbucket Server is read over https only (a plain-http host is refused unless it is the loopback), redirects are not followed, and the token, read from the credential store with a deadline, travels in the `Authorization` header only; an unreachable host is a reason on that source, not a failure of the list. A redacted answer drops URLs and logins, numbering the accounts instead. The task-mirror hook (PostToolUse on TaskCreate and TaskUpdate) writes only into the run whose recorded session is the calling session, skips phase tiles, never prints, and exits 0 on any input it cannot read | `work-items-prs.test.mjs`, `task-mirror.test.mjs` |
+| T24 | The panel changing a preference wider than the terminal would, or posting addresses to a phone | `POST /v1/settings` takes one of three settings and one of its two values, previews the change and runs, under a token bound to that setting and value, what `/multi-agent:language`, `/multi-agent:model` or `/multi-agent:route-on`/`route-off` runs; route on passes the saved strategy back so only the switch changes, nothing the panel sends can add rules or a free provider, and two changes never run at once. Tagged `local-only`/`high`. Report links: `channelResults` URLs must be https, travel only in the run record's `channelUrls` (local, dropped from a redacted answer) and are shown as text, never followed | `office-routes.test.mjs` "POST /v1/settings changes a switch only on the token, through its script", `runs-index.test.mjs` |
 
 ## Residual risks
 
@@ -64,9 +82,9 @@ not mitigated here.
   nothing local does.
 - **A page on the server's own origin** is trusted. Only the page this server
   serves can be there, and its CSP keeps other code out.
-- **Starting a session**: the server returns the launch plan and never starts
-  a host process, so a panel without a local process to run the plan cannot
-  start work by itself. That is a deliberate boundary of the contract.
+- **Starting a session**: `POST /v1/launch` returns the launch plan for a
+  client to start. `POST /v1/jobs` starts a session itself, because the office
+  is that client; it is bounded by T18 and is never reachable from a phone.
 - **Host permission prompts** are not forwarded: the host records none where
   another process can read them (`GET /v1/permissions` says `available:
   false`).

package/pipeline/multi-agent-refs/features/unattended-security.md

@@ -566,7 +566,7 @@ protected paths (`~/.claude/**`, `~/.copilot/**`, `~/.codex/**`,
 `~/.config/gh`, `~/.config/git`, `~/.gitconfig`, `~/.npmrc`, `~/.netrc`,
 `~/.git-credentials`, `.git/hooks/**`, `.git/config`, `**/.github/workflows/**`),
 and the toolkit env `MCP_TOOLKIT_URL_POLICY=strict` and
-`MCP_TOOLKIT_INDEX_DENY=~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains`.
+`MCP_TOOLKIT_INDEX_DENY=~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains,~/.claude/logs/multi-agent/contract-server,~/.claude/logs/multi-agent/office`.
 
 The runner hands the file to each child with `claude --settings`, so only the
 unattended session loads it. `~/.claude/settings.json` is the attended posture

package/pipeline/multi-agent-refs/help/en.md

@@ -86,9 +86,9 @@ Status & Resume:
   /multi-agent:autopilot-status  Running, queued, awaiting an answer, today's PRs
   /multi-agent:autopilot-off  Stop picking work up (running work finishes; --now stops it)
   /multi-agent:serve          Contract server for a client: 127.0.0.1, token, stops when idle
-  /multi-agent:office-on      Open the office panel in your browser: agents at work, chats, ledger, runs
+  /multi-agent:office-on      Open the office in your browser: live runs and agents, PRs, keys, memory, system, jobs; its orientation room explains the rest
   /multi-agent:office-status  Is the panel running, its URL (never the token), its last actions
-  /multi-agent:office-off     Close the panel now (it also stops by itself when idle)
+  /multi-agent:office-off     Stop the panel's server (it runs until you do)
 
 Post-Hoc & Side-Channel:
 

package/pipeline/multi-agent-refs/help/tr.md

@@ -85,9 +85,9 @@ Status & Resume:
   /multi-agent:autopilot-status  Koşan, sıradaki, cevap bekleyen, bugünkü PR'lar
   /multi-agent:autopilot-off  Yeni madde alma (koşan iş biter; --now onu da durdurur)
   /multi-agent:serve          İstemci için sözleşme sunucusu: 127.0.0.1, token, boşta durur
-  /multi-agent:office-on      Ofis panelini tarayıcıda aç: çalışan ajanlar, sohbetler, defter, koşular
+  /multi-agent:office-on      Ofisi tarayıcıda aç: canlı koşular ve ajanlar, PR'lar, anahtarlar, hafıza, sistem, işler; gerisini oryantasyon odası anlatır
   /multi-agent:office-status  Panel çalışıyor mu, adresi (token asla), son işlemleri
-  /multi-agent:office-off     Paneli hemen kapat (boşta kalınca kendisi de kapanır)
+  /multi-agent:office-off     Panelin sunucusunu durdur (sen durdurana kadar çalışır)
 
 Post-Hoc & Side-Channel:
 

package/pipeline/multi-agent-refs/phases/modes.md

@@ -66,19 +66,19 @@ Full contract: `$HOME/.claude/multi-agent-refs/phases/phase-5-report.md` (Autopi
 
 ## Analysis Mode (`/multi-agent:analysis`)
 
-A different **output kind**, not a shorter pipeline. It produces the analysis document and stops; no code, no branch, no PR. The 6-phase contract holds: Phase 2 is skipped and Phases 1, 3 and 4 are reinterpreted.
+A different **output kind**, not a shorter pipeline. It produces the analysis document and stops; no code, no branch, no PR. It runs the same six slots under its own step names (`phases.json` `modes.analysis.names`), so the tracker and the task widget show what it is doing.
 
 ```
-Phase 0: Init -> Phase 1: Plan (analysis) -> Phase 3: Review -> Phase 4: Publish -> Phase 5: Report
+Phase 0: Intake -> Phase 1: Evidence -> Phase 2: Synthesis -> Phase 3: Review -> Phase 4: Publish -> Phase 5: Report
 ```
 
 | Phase | Analysis mode |
 |---|---|
-| 0 Init | Same intake, but **no worktree**: nothing is isolated because nothing is built, so `state.run.repoPath` is the repo itself |
-| 1 Plan | The engine (`multi-agent-refs/analysis/*`): evidence, synthesis, render, humanizer, `validate-analysis-doc.mjs`. **No task decomposition** - there is no code to plan |
-| 2 Dev | **SKIP** |
-| 3 Review | Document review plus the open questions still marked `Acik / Open` |
-| 4 Commit | **Publish** instead: Local file / Confluence / Jira. Locked 6 still forbids `git add` and `git commit` |
+| 0 Intake | Same intake, but **no worktree**: nothing is isolated because nothing is built, so `state.run.repoPath` is the repo itself |
+| 1 Evidence | Every declared source fetched in parallel, repo evidence, Code Connect index, conventions (`multi-agent-refs/analysis/evidence.md`) |
+| 2 Synthesis | Pass A concept layer, the convention preview, Pass B per platform (`multi-agent-refs/analysis/synthesis.md`). **No task decomposition** - there is no code to plan |
+| 3 Review | Render, the humanizer, `validate-analysis-doc.mjs`, the document review and the open questions still marked `Acik / Open` |
+| 4 Publish | Local file / Confluence / Jira. Locked 6 still forbids `git add` and `git commit` |
 | 5 Report | Channels, same as every mode |
 
 **No `autopilot` variant.** Worktree isolation buys nothing when no code is written, and the intake, the Pass B convention preview and the open-question resolution are interactive by nature; a zero-interaction analysis would be a document nobody agreed to.

package/pipeline/multi-agent-refs/phases/phase-5-report.md

@@ -1,9 +1,9 @@
 ### Phase 5: Report
 
-> **TLDR**  -  Close the loop in two halves: **External delivery** delegated to `/multi-agent:channels` (multi-select kanal + content  -  always pauses in autopilot, 30-min timeout ends session). **Internal capture** stays inline: `agent-log.md` finalization, telemetry emission, knowledge base + memory update. Channels command is the single source of truth for Jira/Confluence/Wiki/PR-description delivery  -  full contract in `commands/multi-agent/channels/SKILL.md`.
+> **TLDR**  -  Two halves. **External delivery** goes to `/multi-agent:channels`, the single source of truth for Jira, Confluence, wiki and PR-description delivery (channel and content multi-select; always pauses in autopilot, a 30-minute timeout ends the session; contract in `commands/multi-agent/channels/SKILL.md`). **Internal capture** stays inline: `agent-log.md`, telemetry, knowledge base and memory.
 
 <!-- progress-contract: applied -->
-Progress emission per `$HOME/.claude/multi-agent-refs/progress-contract.md`  -  lines for channels dispatch entry, per-adapter result, agent-log finalization, telemetry emission, knowledge+memory write.
+Progress per `$HOME/.claude/multi-agent-refs/progress-contract.md`: channels dispatch, each adapter's result, agent-log, telemetry, knowledge and memory.
 
 ## Sub-step Tracking (required)
 
@@ -96,6 +96,11 @@ Pre-ticks from `prefs.global.reportChannels` + `prefs.global.reportContent`. Gre
 
 Tracker: `phase-tracker.sh sub 5 1 "Channels dispatch" completed` (or `failed` if ALL adapters failed; `skipped` if user declined all).
 
+For the office, record each adapter's `{status, url}` (https only) under `channelResults.<pr|jira|confluence|wiki|issue>`; `write-state.mjs` merges, Step 1.5 adds `issue`:
+
+```bash
+printf '%s' '{"channelResults":{"pr":{"status":"posted","url":"<url>"},"confluence":{"status":"skipped"}}}' | node $HOME/.claude/scripts/write-state.mjs "$STATE_FILE" >/dev/null
+```
 ---
 
 ## Step 1.5  -  GitHub Issue channel (when tracker is a GitHub issue)
@@ -112,6 +117,7 @@ bash ~/.claude/scripts/phase-tracker.sh sub 5 1.5 "Issue comment" in_progress
 # unattended: skipped - the runner posts (features/unattended-security.md)
 gh issue comment "$ISSUE_NUMBER" --repo "$ORG/$REPO" --body-file /tmp/channels-${TASK_ID}-issue.md
 bash ~/.claude/scripts/phase-tracker.sh sub 5 1.5 "Issue comment" completed
+printf '%s' '{"channelResults":{"issue":{"status":"posted","url":"<url>"}}}' | node $HOME/.claude/scripts/write-state.mjs "$STATE_FILE" >/dev/null
 
 # 2. Sync the Progress flag table from agent-state.json. Idempotent  -  the
 #    script no-ops if the body already matches.
@@ -150,7 +156,7 @@ Write `agent-log.md` with ALL sections:
 
 ## Plan Todo Rollup (when `prefs.global.planTodos.enabled`)
 
-Rendered via `$HOME/.claude/lib/plan-todos.sh list "$TASK_ID"`. Inline the resulting markdown checklist verbatim  -  one line per todo with status marker ([x] / [~] / [/] / [!]), ID, task text, and notes when present. Status summary one-liner ("4/6 done, 1 skipped, 1 failed") goes at the top from `plan-todos.sh status`.
+Rendered via `$HOME/.claude/lib/plan-todos.sh list "$TASK_ID"` and inlined verbatim: one line per todo with its marker ([x] / [~] / [/] / [!]), ID, text and notes, under the one-line summary from `plan-todos.sh status` ("4/6 done, 1 skipped, 1 failed").
 
 Skipped sections: when `planTodos.enabled` is false or no `plan.todos[]` was emitted, the Plan Todo block is omitted (no empty header). Phase 2 task-by-task progress still appears in the Timeline section either way.
 
@@ -183,7 +189,7 @@ Skipped sections: when `planTodos.enabled` is false or no `plan.todos[]` was emi
 
 ## Repo Profile
 
-(from `node $HOME/.claude/scripts/repo-profile.mjs report --repo "$PROJECT_ROOT" --state "$STATE_FILE"` and `state.repoProfile`: the `action`, whether it was confirmed, the fields that were `derived` against those `confirmed` or `manual`, and every `ignored[]` field with its confidence and reason. Omitted when the run has no `repoProfile`.)
+(from `node $HOME/.claude/scripts/repo-profile.mjs report --repo "$PROJECT_ROOT" --state "$STATE_FILE"` and `state.repoProfile`: the `action`, whether it was confirmed, `derived` fields against `confirmed` or `manual` ones, and each `ignored[]` field with confidence and reason; omitted without a `repoProfile`.)
 
 ## Channels Summary
 
@@ -243,14 +249,14 @@ This is independent of the channels-side `reportContent.costSummary` (which gate
 bash $HOME/.claude/scripts/capture-flush.sh --state "$STATE_FILE"
 ```
 
-Every phase boundary already made this call (`operations.md`), so by Phase 5 it usually writes 0 rows - and that is the point. Phase 5 is the last flush, not the only one: it is the phase a run is least likely to reach, and a run killed in Phase 2 keeps what it established.
+Every phase boundary already made this call (`operations.md`), so here it usually writes 0 rows: Phase 5 is the last flush, not the only one, because it is the phase a run is least likely to reach.
 
 What it does, so this doc stays inspectable:
 
-- **Triage ingest** (`triage-memory.mjs ingest`). accepted/deferred/rejected rows into the per-repo corpus, so Phase 1 enrichment and Phase 3 prior-art recall them later. Idempotent. Reads the salvaged copy under `artifactsPath` FIRST: Phase 4 removes the worktree, and a worktree-first reader degrades silently for exactly the runs worth rescuing. JSONL at `~/.claude/memory/multi-agent/<repo-slug>/triage-corpus.jsonl`, per-repo, never cross-leaking. Off when `prefs.global.priorArtEnrichment.ingestOnComplete = false`.
-- **Ledger distill** (`learnings-ledger.mjs from-triage`). Rejected findings become durable `rejected-preference` entries so reviewers stop re-raising them. Idempotent. Safety: blocking-severity rejections are NOT distilled - a wrong rejection must never permanently suppress that class; `learnings-ledger.mjs forget` clears a stale one. JSONL beside the corpus; its brief replays into Phase 1 and Phase 3. On by default via `prefs.global.learningsLedger.enabled`.
+- **Triage ingest** (`triage-memory.mjs ingest`): accepted, deferred and rejected rows into the per-repo corpus (`~/.claude/memory/multi-agent/<repo-slug>/triage-corpus.jsonl`, never cross-repo) that Phase 1 enrichment and Phase 3 prior-art recall. Idempotent. It reads the salvaged copy under `artifactsPath` first, because Phase 4 removes the worktree and a worktree-first reader silently loses the runs worth rescuing. Off when `prefs.global.priorArtEnrichment.ingestOnComplete = false`.
+- **Ledger distill** (`learnings-ledger.mjs from-triage`): rejected findings become durable `rejected-preference` entries so reviewers stop re-raising them. Idempotent. A blocking-severity rejection is never distilled, so a wrong one cannot suppress its class for good; `learnings-ledger.mjs forget` clears a stale entry. JSONL beside the corpus, replayed into Phase 1 and Phase 3; on via `prefs.global.learningsLedger.enabled`.
 
-No model runs in the flush - it derives everything from `triage-output.json` plus `agent-state.json`, which is what lets a hook call it. The model-dependent parts of this phase (Step 3 knowledge capture, memory synthesis) stay here, because a hook cannot think.
+No model runs in the flush: it derives everything from `triage-output.json` and `agent-state.json`, which is what lets a hook call it. The parts that need a model (Step 3 knowledge capture, memory synthesis) stay here.
 
 A durable architectural fact is a judgement call, so it stays here rather than in the flush:
 
@@ -303,13 +309,13 @@ Extract reusable knowledge from this task and **append** to `$HOME/.claude/knowl
 
 **First task** (no knowledge dir): `mkdir -p`, create initial architecture.md + patterns.md from Phase 1. Log: "Knowledge base initialized for {project}"
 
-**Code graph refresh:** when `prefs.global.codeGraph.enabled` and `prefs.global.codeGraph.autoRefresh` are both true, rebuild the graph and re-render `GRAPH_REPORT.md`  -  the branch just changed the code the Phase 1 graph described. Costs no API tokens, never fails the run. Commands: `$HOME/.claude/multi-agent-refs/features/code-graph.md`.
+**Code graph refresh:** with `prefs.global.codeGraph.enabled` and `.autoRefresh` both true, rebuild the graph and `GRAPH_REPORT.md`, since the branch changed the code Phase 1 described. No API tokens, never fails the run; commands in `$HOME/.claude/multi-agent-refs/features/code-graph.md`.
 
 **Save preferences**: Update prefs with Phase 5 selections (via channels return: `reportChannels`, `reportContent`, `confluenceUrls` per-project LRU).
 
 **Per-repo memory synthesis (opt-in via `prefs.global.perRepoMemory`):**
 
-After the knowledge-capture pass, dispatch a scoped synthesis subagent (sonnet, 10 turns max) that reads the current run's `agent-log.md` + the existing MEMORY.md index, and returns 0-3 new memory entries as a JSON array. Each entry: `{type: "user|feedback|project|reference", slug, title, description, body}`. The orchestrator saves them all, in order:
+After knowledge capture, a scoped synthesis subagent (sonnet, 10 turns max) reads this run's `agent-log.md` and the MEMORY.md index and returns 0-3 new entries as a JSON array of `{type: "user|feedback|project|reference", slug, title, description, body}`. The orchestrator saves them all, in order:
 
 ```bash
 bash $HOME/.claude/scripts/memory-save.sh "$PROJECT_ROOT" --from-json memory-synthesis.json

package/pipeline/multi-agent-refs/review-standalone-tracker.md

@@ -0,0 +1,37 @@
+# Standalone review: its own tracker record
+
+A standalone review (the command seeded a `review-` id, so no pipeline run
+owns this session) registers itself, so its progress shows wherever runs
+are read (the office panel, `/multi-agent:status`). Inside a pipeline run the
+run's own tracker already covers it; skip this block.
+
+```bash
+case "$TASK_ID" in review-*)
+  S="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/$TASK_ID"; mkdir -p "$S"
+  printf '{"taskId":"%s","mode":"review","status":"in_progress","currentPhase":0}' "$TASK_ID" \
+    | node "$HOME/.claude/scripts/write-state.mjs" "$S/agent-state.json" >/dev/null
+  export MULTI_AGENT_TASK_ID="$TASK_ID"
+  bash "$HOME/.claude/scripts/phase-tracker.sh" init "$TASK_ID"
+  for p in "0:Input" "1:Diff" "2:Reviewers" "3:Triage" "4:Report"; do
+    bash "$HOME/.claude/scripts/phase-tracker.sh" add "${p%%:*}" "${p#*:}"
+  done
+  bash "$HOME/.claude/scripts/phase-tracker.sh" update 0 in_progress ;;
+esac
+```
+
+Step 1 (1, 1a) is tracker step 0, step 2 (2-2c) step 1, steps 3-4b step 2,
+step 5 step 3 and steps 6-7 step 4: `update <N> in_progress` on entry and `completed` on exit. Each later
+call runs in a new shell where `$TASK_ID` is no longer set, so it carries the
+review's id written out literally (the `review-...` value the registration
+used) and refuses the global pointer, which another run's `init` can move:
+
+```bash
+MULTI_AGENT_TASK_ID=review-1 MULTI_AGENT_STRICT_TASK_ID=1 \
+  bash "$HOME/.claude/scripts/phase-tracker.sh" update 2 completed
+```
+
+After step 7 a standalone review closes its record with the same `write-state.mjs` call and
+`"status":"complete","currentPhase":4`.
+
+Reviewer token counts (`phase-tracker.sh tokens <N> ...`) go under step 2
+(Reviewers); inside a pipeline run they go under the run's Review phase.

package/pipeline/multi-agent-refs/tracker-contract.md

@@ -93,7 +93,7 @@ Phases by mode:
 | `/multi-agent` | 0,1,2,3,4,5 |
 | answered local at Step 5b | 0,1,2,3,4,5 (the user test needs a worktree checkout and local has none, so that STEP inside Review is skipped - the phase is not) |
 | `/multi-agent:autopilot` | 0,1,2,3,4,5 (autopilot drops the interactive user test inside Review) |
-| `/multi-agent:analysis` | 0,1,3,4,5 (no code is written, so Dev is not in the set) |
+| `/multi-agent:analysis` | 0,1,2,3,4,5 under its own names (`schemas/phases.json` `modes.analysis.names`: Intake, Evidence, Synthesis, Review, Publish, Report) |
 
 Every entry registers its whole set in one batch: the set is a property of the command, known before the tracker boots.
 
@@ -404,7 +404,7 @@ call for call, so a reader that is not the host (`runs-index.mjs`, and every
 client behind the contract server) sees the same list under the same phase:
 
 ```bash
-bash $HOME/.claude/scripts/phase-tracker.sh task <N> <task_id> pending|in_progress|completed \
+bash $HOME/.claude/scripts/phase-tracker.sh task <N> <task_id> pending|in_progress|completed|deleted \
   [--subject "<subject>"] [--active-form "<activeForm>"]
 ```
 
@@ -416,10 +416,15 @@ bash $HOME/.claude/scripts/phase-tracker.sh task <N> <task_id> pending|in_progre
 
 `<N>` is the phase the task belongs to: the phase in progress when it was
 created. A new task needs `--subject`; an update may pass the status alone and
-keeps the subject and active form it had. Phase tiles themselves are not
+keeps the subject and active form it had. `deleted` takes the task off the list, as a native `TaskUpdate` with status `deleted` does. Phase tiles themselves are not
 mirrored: the phase list already is the state file. The call is quiet (it
 renders nothing), so it never replaces the host's own update; it records it.
 
+On Claude Code the `task-mirror.sh` PostToolUse hook makes this call itself
+for every `TaskCreate` and `TaskUpdate` of the session bound to the run, under
+the phase in progress, and leaves phase tiles out. A manual `task` call on top
+of it is harmless: the second write sets the same values.
+
 ## Resume behaviour
 
 When `/multi-agent:resume <task_id>` is called:

package/pipeline/office/NOTICE.md

@@ -4,7 +4,10 @@ The office page (`index.html`, built from `pipeline/office-src` by
 `pipeline/scripts/office-build.mjs`) draws sprites from pixel-agents
 (https://github.com/pixel-agents-hq/pixel-agents, commit b1bafd0): the six
 character sheets, the floor and wall tiles and the furniture, kept unchanged
-in `assets/`. pixel-agents'
+in `assets/`. The company furniture (kitchen, restroom, server room, archive,
+reception, lab and mail room pieces) is this project's own drawing: its
+sources are the pixel grids in `pipeline/office-art`, which the build renders
+into `assets/` with the pixel-agents palette. pixel-agents'
 characters are based on JIK-A-4's MetroCity free top-down character pack
 (https://jik-a-4.itch.io/metrocity-free-topdown-character-pack), released
 under CC0 1.0.