@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/CHANGELOG.md

@@ -16,6 +16,104 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.35.0] - 2026-10-27
+
+### Added
+
+- Office: each person wears their own sheet, recoloured at build time from the CC0 character sheets (`office-art/employees.json`), with a name, agent and model tier; clicking a person opens their card, and a Building window lists every room and who works there.
+- Office remote layer, first part: `features/office-remote-protocol.md` (the end-to-end layer, relay, pairing and passkey tiers around the existing signed phone routes) and `lib/office-remote.mjs`, the machine side of its cryptography: P-256 ECDH with HKDF into one AES-256-GCM key per direction, counter nonces that refuse replays, the pairing envelope keyed with the one-time secret, the comparison code, and the WebAuthn assertion check.
+- Office remote client: `office-remote-client.mjs` polls the relay, opens each frame with the paired device's key, applies the passkey tier (read session, low-risk window, per-request for launch), forwards only phone routes to the loopback server without an `Authorization` header and seals the reply; one audit line per frame without bodies or header values. `office-on` starts it only when a device is paired, `office-off` stops it.
+- Office pairing: `office-pair.mjs start | wait | confirm <code> | cancel` registers a pairing with the relay (only the SHA-256 of the machine's relay token leaves the machine), shows the QR code on the local screen through the dependency-free encoder in `lib/qr-code.mjs`, opens the phone's sealed pairing message with the one-time secret carried in the link fragment, and enrols the device with scopes `read,answer` only after the comparison code is typed back. `phone-devices.mjs revoke` also drops the device's remote keys; `office-status` reports remote access as off, configured or paired.
+
+- `answer-check.sh`, a PostToolUse hook on AskUserQuestion: a question the user submitted without a choice is named back to the model, so it is asked again instead of resolved to the Recommended option. Registered by `install` in every session; it only adds context.
+- `worktree-prepare-all.mjs` creates a multi-repo task's worktrees in one step and, when a repo fails, rolls back what it created: worktrees without `--force`, and a branch only when it created that branch and it still points at `origin/<base>`. Phase 0 uses it for multi-repo runs; `worktree-prepare.sh` reports `newBranch`.
+- `test-stability-gate.mjs` compares the repeated runs (`.pipeline/repeat-<k>.junit.xml`) of the new and changed tests: a test whose outcome differs across runs, a missing run or a test that failed every time is not GREEN.
+
+### Changed
+
+- agent-guard asks on a `git commit` from the session driving an attended run (where prompts are off it denies until `confirm-command.mjs` records the user's yes), and inside that run refuses a commit subject with no conventional type or over 72 characters, and a PR, issue or Jira body with a literal `\n` or an HTML entity outside code.
+- `prefs.global.attendedCommitGate.mode` defaults to `auto`: a commit by the session driving the run is refused without the run's build and test evidence, and from Phase 4 on without a passing `review-decision`, which attended runs now record. Other sessions are warned as before; `warn`, `block` and `off` still apply when set.
+- Triage judges anonymized findings end to end: the verdict carries each finding's `foundBy` label (or a gate `tag`) instead of a reviewer name, `validate-triage.mjs --anonymized` refuses a verdict that names a reviewer, and `anonymize-findings.mjs --restore` writes the reviewer family back from the label map after validation.
+- `scope-check-gate.mjs --rejected <triage> --rework-base <rev>` lists `rejectedTouched[]`: findings triage rejected whose lines a rework hunk changed. Phase 2 records the reviewed commit per review round with `rework-base.mjs record` (`.pipeline/rework-base-<N>`).
+- `validate-planning.mjs --spec` checks UI tasks against the analysis Section 6 inventory: a task touching a view file names its component in the new `design` field, and the name must be a Section 6 row.
+- `update-issue-progress.sh` exits 5 without editing the issue unless the account has commented on it since the run started with the template's `Ref: #N` footer: the comment and the Progress flags go together. `--comment-file` posts the comment first through the outbound gate; the unattended runner's issue update uses it with the PR link. Issue coordinates that are not an owner/repo and a number exit 6.
+- `write-state.mjs` refuses to leave Phase 2 of an attended run with a tracked issue unless `phases["2"].trackerStatus` is `verified`, `declined` or `not-tracked`. A run already in Phase 2 when this lands records the status once before it moves on.
+- `task-mirror.sh` records a phase tile's id as its `tasklist_id` and notes a tile created after a higher-numbered phase's tile.
+- `write-state.mjs` refuses to leave Phase 1 of an attended full run without `phases["1"].planApprovedAt`, and refuses to change a `sessionId` already set (exit 6, nothing written). Autopilot, background launches and analysis mode are not asked for a plan approval.
+- A run cannot complete while a repo's commit has no recorded push: `projects[].pushStatus` must be `pushed`, `rebase-pushed` or `skipped`, or the repo has a pull request. `pushStatus` is declared in the state schema.
+- agent-guard: a closing keyword in a `gh pr create/edit --title` or in a commit message asks first; AI attribution in a gh pull request or issue title, body, body file or comment is blocked; `vercel` with `--token` is refused; `purge.sh`, `prune-logs.sh --yes` and `run-kill.mjs apply` ask first; a stored secret read with nothing capturing or consuming its output is refused.
+- `pre-commit-check.sh` refuses signing material and keystores (`.p12`, `.p8`, `.mobileprovision`, `.jks`, `.keystore` ...) and `Pods/`, `.build/`, `DerivedData/` paths by name, binaries included; `.DerivedData/` joins the clone-local exclude list.
+- `run-scope-guard` also registers on `Bash|WebFetch`: a Figma read over HTTP (figma.com, api.figma.com) after analysis is denied under the same phase rule, and a direct write to `agent-state.json` or `tracker-state.json` (Edit/Write, a redirect or `tee`) is denied in any session. The wrapper starts node only when the payload mentions Figma or a state file.
+- The test-integrity gate flags a test switched off (`XCTSkip`, `.skip(`, `xit(`, `@Disabled`, `@Ignore`, `@pytest.mark.skip`, `t.Skip(`, a `.disabled` trait) as a blocking `disabled-test` finding; a conditional skip is left alone.
+- `worktree-prepare.sh` refuses a worktree outside `<project>/.worktrees/` and a new branch outside `feature/`, `bugfix/`, `hotfix/`, `release/`; an existing branch, local or on origin, is re-entered as it is.
+- agent-guard asks before a POST or PUT to a Jira comment, a Confluence page or a Slack webhook, and refuses a Bitbucket pull request PUT whose body has no reviewers, fromRef or toRef (the PUT replaces the record and would wipe them).
+- agent-guard refuses a side effect from a read-only subagent (one whose definition denies it Write), identified by the hook's `agent_type`: run-state writes, git commit or push, write requests with curl-like clients, and gh pull request, issue and api writes. Reads stay open.
+- `run-scope-guard` denies `AskUserQuestion` from a bound autopilot run (it derives or records a halt) and `git add -A`, `--all` or `.` inside a bound run (files are staged by name); it now registers on `Bash|WebFetch|AskUserQuestion`.
+- `validate-planning.mjs --spec` refuses a raw pixel or point value in a task when the spec carries a Figma design; values are named by design token.
+- `gate-ledger.mjs append` pauses the run on the fourth consecutive failing `evidence-gate/build` or `evidence-gate/test` verdict (status `paused`, `haltReason <phase>:retry-cap`, exit 5): the three-attempt fix loop ends on a record.
+- A commit inside a live pipeline run is refused when its author (`--author`, `-c user.email=`, or the repository's config) is not the identity Phase 0 chose (`run-commit-check.mjs`, called from the commit hook; silent outside a bound run).
+- `phase-tracker.sh init` refuses to re-initialize a tracker that already holds phases; `--force` starts it over.
+- `phase0-exit-gate.mjs` fails below the published version floor, reading the answer Step 0.6 cached (`update-check.sh --cache-only`, any age, never the network).
+
+### Fixed
+
+- File locks (`json-file-lock.mjs`, `write-state.mjs`) read a lock's PID and its identity through one descriptor, and reclaim a dead holder's lock by moving it aside first. Read by path twice, a lock released and re-acquired in between looked like a dead holder's, and the live one was deleted, so two writers held it and one update was lost.
+
+### Added
+
+- Office: the pull request window ranks open pull requests by graph reach, the number of files that depend on what each one changes, read from that repository's own code graph. A repository with no graph says so instead of ranking. Served by a new local-only route `GET /v1/prs/reach` (`work-items.mjs reach`); contract 1.7.0 adds `pr-reach.schema.json`.
+
+### Changed
+
+- Every skill companion file over 100 lines (references, patterns, templates beside a `SKILL.md`) now opens with a generated table of contents, as the multi-agent-refs already did. `gen-ref-toc.mjs` covers `pipeline/skills/` and takes `--dir <skills-tree>` for the plugin marketplace; a file with fewer than three sections at its section depth lists the depth below as well.
+- Skill text that aged with the calendar no longer does: `app-store-review` drops "As of May 2026", and `google-play-compliance` points at its Rule 1 for the target API level instead of quoting a number in prose. `google-play-compliance` and `channels` name the MCP server and say when they apply.
+- `google-play-compliance` Rule 1 carries the current target API requirement: 36 for new apps and updates on phones and tablets from 31 Aug 2026 (extension to 1 Nov 2026), 35 on Wear OS and Automotive, 34 on TV and XR.
+- The bulk reader and Phase 3 triage write terse machine fields (a short phrase per `why` / `reason`), keeping every negation, number and path; the explorer already did.
+- `test/project.test.mjs` also holds optional, peer and bundled dependencies at zero and the development tooling to its recorded set.
+
+## [20.34.0] - 2026-10-26
+
+### Added
+
+- Plans carry `reviewFocus[]` (at most five inputs the spec implies but no task's tests exercise, each owned by a task whose tests add it) and `globalConstraints[]` (project-wide values every task brief quotes). `validate-planning.mjs` checks both and, with `--spec`, warns when a plan runs more than four times the length of its spec. Planning schema 1.1.0.
+- The plan critic has two more lenses: `unstated-input`, an input the spec implies (empty, boundary, expired, concurrent) that no task's tests exercise, and `underspecified`, a decision a task leaves to its implementer that the analysis or the user should make.
+- `rework-rulings.mjs`: at the rework cap every accepted finding still open gets a recorded ruling. Blocking and security findings (a `SEC-*` rule, a security criteria source, or the security auditor's `security` object) escalate to the user; the rest are parked as follow-ups and the run continues to Phase 4 instead of stopping.
+- Phase 4 Step 0b lists deferred and parked findings before the commit and asks once whether to ship with them as follow-ups.
+- Code graph: `graph-query.mjs --path <from> <to>` finds the shortest path between two symbols or files; an ambiguous name is refused with candidate ids and an unknown one gets its nearest names. External modules end a path but are never walked through.
+- `GRAPH_REPORT.md` gains import cycles, clusters of files with a cohesion score (label propagation over imports and references) and questions worth asking before a change; `graph-report.mjs --diff <older graph>` lists what changed between two builds. All deterministic (`_graph-analysis.mjs`).
+- `graph-links.mjs`: which files of one repository import another, by matching each graph's unresolved imports against what the others export (package name, Python packages, Swift targets, Go module, Kotlin types). A Kotlin link holds only files whose import names the exporting file's package, and a repository name counts only when the stack names no export. Graphs stay separate (ADR-0018).
+- Kotlin graphs index a capitalised `fun` as its own `composable` kind and make it a reference target, so a change to a Compose UI function reaches its callers; an extension function is named after the function, not its receiver.
+- `debt-ledger.mjs`: one list per repository of the limits accepted on purpose (`shortcut: <limit>, <when to replace>` markers a diff adds in a comment outside any string, deferred findings, parked rulings), fed by `capture-flush.sh`, secret-scanned, closable with `resolve`.
+- `file-context.sh`, a PostToolUse hook on Read: once per file per session it hands the model what the repo's memory says about the file just read (ledger facts whose scope covers it and that feedback has not suppressed, its latest review findings, its open known limits) as untrusted context, after the secret scan. On inside a pipeline run, everywhere with `prefs.global.fileContext.enabled: true`, never with `false`.
+- `scope-check-gate.mjs --patch` (or `--repo <dir> --patch-range <a>...<b>`, which reads the diff itself) lists hunks that only change layout (`formatOnly[]`): whitespace outside string literals and comments, never a space that keeps two operators apart, a line break after `return` or before a leading operator in Kotlin and Swift, a leading indent in Python, YAML or a Makefile, or the space around brackets and colons outside C-family languages and Python. A pure addition or deletion is never layout-only. Reported to reviewers and never fatal; the code reviewer gains a fit lens (follow the surrounding code, leave untouched lines alone) and reads `shortcut:` markers as known limits.
+- `pipeline/eval/ab/write-lean.json` measures a candidate write-time rule for the GREEN step against none. It is not shipped: its run scored below the baseline.
+- Ledger entries earn or lose weight: `learnings-ledger.mjs feedback --id <L:id> --outcome useful|dead_end|corrected` (Phase 5 records it for injected entries). A corrected entry, or one judged a dead end at least twice and more often than useful, leaves `brief` and `profile`; one useful at least twice ranks by a strength that fades with age. A new entry that repeats an existing one in other words (TF-IDF cosine 0.9 or more, same numbers and negations) is not added (`_memory-policy.mjs`).
+- When `check-read-size.sh` turns a whole-file read away it also prints what the repo's memory says about that file (`file-context.mjs --lines`), so the delegated read starts from what is already known.
+- `knowledge.md` documents progressive recall over a large ledger or triage corpus through the toolkit's existing full-text index (`context_index`, `context_search`, `context_get`).
+- `npm run audit:refs` (`ref-filler-audit.mjs`): filler phrases and sentences copied verbatim across the instruction docs, with the tokens a rewrite would win back. Advisory; it rewrites nothing.
+- The explorer returns its JSON with nothing around it, in short phrases, keeping negations, numbers and paths exactly as found.
+- `prefs.global.memory.excludeProjects`: repos whose ledger, triage corpus and debt list are never written.
+- Reviewers return `cannotVerify[]` for requirements that live in code the diff does not touch; triage settles each as verified (citing the file:line read), a finding (citing the file:line of the accepted or deferred finding) or out of scope, and `validate-triage.mjs --reviewers` or `--reviewers-dir` fails one left unsettled or settled without that evidence. Reviewer output 1.6.0, triage output 3.6.0.
+- `smoke-skill-size.sh`: no `pipeline/commands/**/SKILL.md` may reach 20,000 bytes, and a file between 18,000 and 19,999 bytes is reported as a warning. After context compaction Claude Code re-attaches each invoked skill truncated at about 20k characters, so anything past that point would silently stop applying mid-run. Runs through `run-smokes.mjs` and the CI lite workflow.
+
+### Changed
+
+- The five command skills over that limit now keep their step skeleton, stop conditions and hard rules, with explicit "Read <ref> before Step N" pointers to the long reference sections, moved without changing their meaning: `channels` (33,925 to 17,749 bytes; `multi-agent-refs/channels/menu.md`, `generator.md`, `preview.md`, `reference.md`, plus the Step 1 target resolution in `multi-repo.md`), `setup` (26,000 to 17,452; `setup/language.md`, `multi-repo-group.md`, `summaries.md`, `accounts.md`, `hooks-and-plugins.md`, and sections appended to `token-save-flow.md`, `app-store-connect.md`, `firebase.md`, `google-play.md`), the `/multi-agent` dispatcher (24,130 to 17,548; `orchestrator/dispatcher.md`), `review` (24,033 to 17,838; `review/inputs.md`, `module-guides.md`, `valven.md`) and `resume` (20,102 to 17,586; `resume/details.md`). `setup` and `channels` leave the token-budget grace list, now under the hard cap.
+- Token ceilings: phase-3 17200 to 17260, phase-4 6600 to 6650, phase-5 5700 to 5710, total 63550 to 63710, after the review-settled contracts above (triage settles `cannotVerify`, the PR body carries deferred, parked and marked limits, Phase 5 records ledger outcomes). Existing prose in phases 1 to 5 was compressed first and absorbed every earlier addition of this release.
+- The reply-shape rule keeps negations, numbers, units and paths when it shortens a list.
+
+### Fixed
+
+- Office: the autopilot window could open empty with "busy" when the panel's own status poll was still running, because `GET /v1/autopilot` refused a second caller. It, `GET /v1/prs` and the maturity read now answer every concurrent caller from the one run in flight; at most two maturity reads for different issues run at once. A window that reloads after a request now redraws only if it is still the open one, so a late answer for Skills no longer replaces the autopilot window.
+- `eval-ab-judge.mjs` showed the judge `blocker` as the string "true|false", so judges answered with a string and the judgement was dropped; the example is a boolean now and a quoted "true"/"false" is read as one. `MULTI_AGENT_EVAL_USER_SETTINGS=1` lets a live eval log in on a host that keeps its CLI login in user settings.
+
+### Security
+
+- The learnings ledger (`add`, `from-triage`) and the triage corpus (`ingest`) run every row through the secret scan before writing it, through one shared helper (`scripts/_secret-scan.mjs`) that the transcript miner uses too. A refused row is counted in `droppedBySecretScan`; a missing scanner refuses the row instead of writing it unchecked. `<private>...</private>` spans are removed before anything is stored. Control bytes are removed from the scanned copy, so a NUL cannot make the scanner treat the text as binary and skip it. The triage corpus scans every stored field, task id, title, stack and reviewer included.
+- A token hard-wrapped by a space or a line break is still refused: a run that starts with a known token prefix is scanned a second time with its whitespace removed.
+- Every memory store refuses a repository slug that could leave the memory folder (a path separator, NUL, `.` or `..`); spaces and non-ASCII letters stay valid, and slugs compare in Unicode NFC, so `excludeProjects` matches either normal form. The transcript miner honours `memory.excludeProjects` for the ledger and the `CLAUDE.local.md` block alike.
+- `file-context.mjs --lines`, used when a whole-file read is turned away, prints inside the same untrusted-data block as the hook and stays silent when `fileContext.enabled` is false.
+
 ## [20.33.0] - 2026-10-25
 
 ### Added
@@ -114,7 +212,6 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 - `prefs.global.readOnlyRepos[]`: checkouts that may not be edited, committed or pushed.
 - `/multi-agent:doctor` reports template hooks that are not registered or not executable and preferences that no registered hook enforces. The installer registers the run hooks itself, records them in `multi-agent-hook-manifest.json` after settings.json is written, and does not re-add a hook the user removed.
 
-
 ## [20.28.0] - 2026-10-24
 
 ### Added

package/README.md

@@ -297,7 +297,7 @@ the pipeline merges.
 - **Operations around a run.** A second launchd agent keeps the Mac awake while the mode is on (`caffeinate -s -i`, plus `-d` if you answer yes to the display question at `autopilot-on`), and each run holds a sleep lock until its tick ends. Every credential a configured repo needs is probed before the schedule is offered and again on every tick, so a locked keychain refuses with the key and the fix. A circuit breaker stops launching after consecutive attempts that produced nothing, `costCeilingUsd` caps spend over a rolling 24 hours, `maxParallelAgents` caps sessions working at once, and once a day the runner writes a cleanup report and, when enabled, a digest. [Autopilot operations](./pipeline/multi-agent-refs/features/autopilot-operations.md)
 - **A fail-closed guard.** Under the variable, the Bash guard judges a command only when it reduces to simple commands joined by `;`, `&&`, `||` and plain pipes, and refuses anything else unparsed. On what it can parse: no push, PR, issue or tracker write, no Keychain read, no fetch outside the network allowlist, no package install or manifest edit, no write into a protected path. Ticket, page and PR text reaches the model inside untrusted-data delimiters. The permission profile (`install --unattended`) is a second line; the boundary is a separate non-admin macOS user and GitHub rulesets on the default and release branches, which the operator applies. [Unattended security](./pipeline/multi-agent-refs/features/unattended-security.md)
 - **Claims are checked, not trusted.** With the quality gates active, a run's claims about the repository are checked before it commits: a localization key or endpoint the change references exists, open analysis questions are answered or park the run, a triage citation quotes the line it cites, a "pre-existing" finding points at a line the diff did not touch, the plan's steps are covered, and a test pass shows a positive executed count read with the stack's own markers (8 stacks: `ios`, `android`, `web`, `backend-node`, `python`, `go`, `rust`, `jvm`) along with a new test that fails without the change. Every verdict goes to a gate ledger, and the commit hook refuses a commit whose mandatory gates did not pass for HEAD. [Unattended gates](./pipeline/multi-agent-refs/features/unattended-gates.md), [stack adapters](./pipeline/multi-agent-refs/features/stack-adapters.md)
-- **Spec, plan and review discipline.** `/multi-agent:analysis` writes a project constitution (security, accessibility, architecture and licensing rules, each tied to a source), and a spec-consistency gate checks by id that every requirement has a task and a test and that nothing waives a binding rule. Phase 1 ends with one plan-critic round under four lenses (scope, feasibility, security, a cheaper alternative), answered once and judged by a script. In review, a `blocking` finding stops the run only when two independent reviewers carry it or a failing test shows it; otherwise it is lowered to `important`, never dropped. [Constitution](./pipeline/multi-agent-refs/features/constitution.md), [plan critic](./pipeline/multi-agent-refs/features/plan-critic.md), [review decision](./pipeline/multi-agent-refs/features/review-decision.md)
+- **Spec, plan and review discipline.** `/multi-agent:analysis` writes a project constitution (security, accessibility, architecture and licensing rules, each tied to a source), and a spec-consistency gate checks by id that every requirement has a task and a test and that nothing waives a binding rule. Phase 1 ends with one plan-critic round under six lenses (scope, feasibility, security, a cheaper alternative, an unstated input, a decision left to the implementer), answered once and judged by a script. In review, a `blocking` finding stops the run only when two independent reviewers carry it or a failing test shows it; otherwise it is lowered to `important`, never dropped. [Constitution](./pipeline/multi-agent-refs/features/constitution.md), [plan critic](./pipeline/multi-agent-refs/features/plan-critic.md), [review decision](./pipeline/multi-agent-refs/features/review-decision.md)
 - **A client contract.** Commands and run questions are declared as data. `/multi-agent:serve` starts a localhost HTTP server over the same JSON the CLI prints, and `pipeline/contract/` ships the manifest, TypeScript types and fixtures a client builds against. Four phone routes read redacted runs, answer a parked question with one of its offered options, and, only when switched on, queue a launch; every request carries an Ed25519 signature from an enrolled device. The phone app is a separate project. [Client kit](./pipeline/contract/README.md), [phone API](./pipeline/multi-agent-refs/features/phone-api.md)
 
 **Attended use is unchanged.** Every behaviour above keys on
@@ -503,6 +503,8 @@ The **secret scan** runs as a `PreToolUse` hook on Claude Code (hard-blocks a co
 | `run-scope-guard.sh` (Figma phase rule, worktree boundary warning) | PreToolUse Figma tools, file edits | none: the phase records its own MCP calls | none |
 | `run-stop-guard.sh` (no silent stop mid-run) | Stop | none: halts stay the phase's own write | none |
 | `task-mirror.sh` (native task list into the run tracker, so the office shows it) | PostToolUse `TaskCreate`/`TaskUpdate` | none: the phase calls `phase-tracker.sh task` itself | none: the phase calls `phase-tracker.sh task` itself |
+| `file-context.sh` (what the repo's memory says about a file, after it is read) | PostToolUse `Read` | none | none |
+| `answer-check.sh` (an AskUserQuestion submitted without a choice is asked again, not defaulted) | PostToolUse `AskUserQuestion` | none | none |
 | `edit-syntax-gate.sh` | PostToolUse file edits | PostToolUse `apply_patch` | none: Copilot discards postToolUse output |
 | `check-read-size.sh`, capture hooks | registered | none | none |
 

package/README.tr.md

@@ -297,7 +297,7 @@ pipeline'daki hiçbir şey merge etmez.
 - **Koşunun etrafındaki operasyonlar.** Mod açıkken ikinci bir launchd ajanı Mac'i uyanık tutar (`caffeinate -s -i`; `autopilot-on`'daki ekran sorusuna evet dersen `-d` de eklenir), her koşu da tick'i bitene kadar bir uyku kilidi tutar. Yapılandırılmış bir reponun ihtiyaç duyduğu her credential zamanlama önerilmeden önce ve her tick'te yeniden yoklanır; kilitlenmiş bir keychain, anahtarın adı ve çözümüyle reddedilir. Üst üste hiçbir şey üretmeyen denemelerden sonra bir devre kesici yeni başlatmayı durdurur, `costCeilingUsd` harcamayı 24 saatlik yuvarlanan pencerede sınırlar, `maxParallelAgents` aynı anda çalışan oturum sayısını sınırlar, koşucu günde bir kez bir temizlik raporu ve açıksa bir özet (digest) yazar. [Autopilot operasyonları](./pipeline/multi-agent-refs/features/autopilot-operations.md)
 - **Kapalı başarısız olan (fail-closed) bir guard.** Değişken açıkken Bash guard bir komutu yalnızca `;`, `&&`, `||` ve düz pipe'larla birleşen basit komutlara indirgeyebildiğinde değerlendirir, gerisini ayrıştırmadan reddeder. Ayrıştırabildiklerinde: push, PR, issue ya da tracker yazımı yok, Keychain okuması yok, ağ izin listesi dışına istek yok, paket kurulumu ya da manifest düzenlemesi yok, korunan bir yola yazma yok. Ticket, sayfa ve PR metni modele güvenilmeyen-veri sınırlayıcıları içinde ulaşır. İzin profili (`install --unattended`) ikinci hattır; sınırın kendisi ayrı, admin olmayan bir macOS kullanıcısı ve varsayılan ile release branch'lerindeki GitHub ruleset'leridir, bunları operatör uygular. [Gözetimsiz güvenlik](./pipeline/multi-agent-refs/features/unattended-security.md)
 - **İddialar güvenilmez, kontrol edilir.** Kalite kapıları açıkken koşunun repo hakkındaki iddiaları commit'ten önce kontrol edilir: değişikliğin referans verdiği lokalizasyon anahtarı ya da endpoint gerçekten var, açık analiz soruları cevaplanmış ya da koşuyu park ediyor, bir triyaj alıntısı andığı satırı birebir alıntılıyor, "önceden vardı" denen bulgu diff'in dokunmadığı bir satırı gösteriyor, planın adımları karşılanmış, ve bir test başarısı stack'in kendi işaretleriyle okunan pozitif bir çalıştırılmış test sayısı gösteriyor (8 stack: `ios`, `android`, `web`, `backend-node`, `python`, `go`, `rust`, `jvm`), yanında da değişiklik olmadan kırmızıya dönen yeni bir test. Her karar bir gate ledger'a yazılır ve commit hook'u, zorunlu kapıları HEAD için geçmemiş bir commit'i reddeder. [Gözetimsiz kapılar](./pipeline/multi-agent-refs/features/unattended-gates.md), [stack adaptörleri](./pipeline/multi-agent-refs/features/stack-adapters.md)
-- **Spec, plan ve review disiplini.** `/multi-agent:analysis` bir proje anayasası yazar (güvenlik, erişilebilirlik, mimari ve lisans kuralları, her biri bir kaynağa bağlı); spec-consistency kapısı id üzerinden her gereksinimin bir görevi ve bir testi olduğunu, hiçbir şeyin bağlayıcı bir kuralı askıya almadığını kontrol eder. Faz 1 dört mercekle (kapsam, uygulanabilirlik, güvenlik, daha ucuz bir alternatif) tek bir plan-critic turuyla biter; itirazlar bir kez cevaplanır ve bir script karar verir. Review'da `blocking` bir bulgu koşuyu ancak iki bağımsız reviewer aynı bulguyu taşıdığında ya da başarısız bir test onu gösterdiğinde durdurur; aksi halde `important`'a düşürülür, asla silinmez. [Anayasa](./pipeline/multi-agent-refs/features/constitution.md), [plan critic](./pipeline/multi-agent-refs/features/plan-critic.md), [review kararı](./pipeline/multi-agent-refs/features/review-decision.md)
+- **Spec, plan ve review disiplini.** `/multi-agent:analysis` bir proje anayasası yazar (güvenlik, erişilebilirlik, mimari ve lisans kuralları, her biri bir kaynağa bağlı); spec-consistency kapısı id üzerinden her gereksinimin bir görevi ve bir testi olduğunu, hiçbir şeyin bağlayıcı bir kuralı askıya almadığını kontrol eder. Faz 1 altı mercekle (kapsam, uygulanabilirlik, güvenlik, daha ucuz bir alternatif, spec'in ima ettiği ama test edilmeyen girdi, uygulayıcıya bırakılmış karar) tek bir plan-critic turuyla biter; itirazlar bir kez cevaplanır ve bir script karar verir. Review'da `blocking` bir bulgu koşuyu ancak iki bağımsız reviewer aynı bulguyu taşıdığında ya da başarısız bir test onu gösterdiğinde durdurur; aksi halde `important`'a düşürülür, asla silinmez. [Anayasa](./pipeline/multi-agent-refs/features/constitution.md), [plan critic](./pipeline/multi-agent-refs/features/plan-critic.md), [review kararı](./pipeline/multi-agent-refs/features/review-decision.md)
 - **Bir istemci sözleşmesi.** Komutlar ve koşu soruları veri olarak beyan edilir. `/multi-agent:serve`, CLI'ın bastığı aynı JSON üzerinde localhost'ta bir HTTP sunucusu başlatır; `pipeline/contract/` bir istemcinin üzerine kurulacağı manifest'i, TypeScript tiplerini ve fixture'ları taşır. Dört telefon route'u redakte edilmiş koşuları okur, park etmiş bir soruyu sunulan seçeneklerden biriyle cevaplar ve yalnızca açıldığında bir başlatmayı kuyruğa alır; her istek kayıtlı bir cihazın Ed25519 imzasını taşır. Telefon uygulaması ayrı bir proje. [İstemci kiti](./pipeline/contract/README.md), [telefon API'si](./pipeline/multi-agent-refs/features/phone-api.md)
 
 **Elle kullanım değişmedi.** Yukarıdaki her davranış `MULTI_AGENT_UNATTENDED=1`
@@ -504,6 +504,7 @@ triage notu bunu belirtir.
 | `run-scope-guard.sh` (Figma faz kuralı, worktree sınırı uyarısı) | PreToolUse Figma araçları, dosya düzenlemeleri | yok: faz kendi MCP çağrılarını kaydeder | yok |
 | `run-stop-guard.sh` (koşu ortasında sessizce durmaz) | Stop | yok: duraklama fazın kendi yazımı olarak kalır | yok |
 | `task-mirror.sh` (terminaldeki görev listesini koşunun takipçisine yazar, ofis de onu gösterir) | PostToolUse `TaskCreate`/`TaskUpdate` | yok: faz `phase-tracker.sh task`'ı kendisi çağırır | yok: faz `phase-tracker.sh task`'ı kendisi çağırır |
+| `file-context.sh` (okunan dosya hakkında repo hafızasının söylediklerini verir) | PostToolUse `Read` | yok | yok |
 | `edit-syntax-gate.sh` | PostToolUse dosya düzenlemeleri | PostToolUse `apply_patch` | yok: Copilot postToolUse çıktısını atar |
 | `check-read-size.sh`, capture hook'ları | kayıtlı | yok | yok |
 

package/docs/adr/0018-cross-repo-links-not-a-global-graph.md

@@ -0,0 +1,43 @@
+# 18. Cross-repository links, not a global graph
+
+**Status:** Accepted · 2026-10-26 · extends [ADR-0010](./0010-own-code-graph.md)
+
+## Context
+
+A run can touch a main repository and the libraries it depends on (the
+dev-context picker adds submodules and extra repositories). Each has its own
+code graph under `~/.claude/knowledge/<project>/`, and a change in a library is
+only half understood until the files that import it in the main repository are
+known.
+
+`Graphify-Labs/graphify` (Apache-2.0) answers this with one global graph
+across repositories, linking calls and types between them. That merges every
+repository into one store that must be rebuilt as a whole, carries names from
+unrelated repositories into each other's queries, and makes a per-project
+graph no longer the single answer for its project.
+
+## Decision
+
+Graphs stay separate. `graph-links.mjs build --projects <a,b,...>` joins them
+by one fact each graph already has: an import of a name the repository does
+not declare (a `module:` node). Each such name is matched against what the
+other repositories export (package name, Python packages, Swift targets, the
+Go module path, Kotlin top-level types) and every match is one row in
+`~/.claude/knowledge/_links.json`: importing repository, files, imported name,
+exporting repository. `graph-links.mjs affected --project <b>` lists the files
+elsewhere that import b. The link file is rebuilt in a second, so it has no
+incremental state.
+
+## Consequences
+
+- A per-project graph keeps meaning what it meant; nothing is merged into it.
+- Links are as good as the import patterns: a dynamic import or a name built
+  at run time is not linked, the same limit the per-project graph states.
+- A Kotlin import keeps only its class name in the graph, so a link is kept
+  only for the importing files whose `import <package>.<Name>` names the
+  package the exporting file declares. That check reads both repositories
+  from disk; a repository that moved since its graph was built links nothing.
+- The repository directory name counts as an export only when the stack
+  names none, so a library called `core` does not catch every `core.*` import.
+- The link file holds file paths of every listed repository; it is written
+  0600 beside the graphs and never leaves the machine.

package/docs/adr/README.md

@@ -25,8 +25,9 @@ Format: lightly adapted from [Michael Nygard's ADR template](https://cognitect.c
 | [0013](./0013-lsp-code-intelligence.md)                            | A language server for the answers regex cannot give                 | Accepted                                                                 |
 | [0014](./0014-six-phase-consolidation.md)                          | Six phases, because two of the eight were doing the same work twice | Accepted (amended by 0015: the depth answer is removed)                  |
 | [0015](./0015-one-pipeline-no-depth-answer.md)                     | One pipeline: the depth question is removed                         | Accepted (extended by 0016: the workspace and resume names go too)       |
-| [0016](./0016-the-run-shape-is-asked-not-typed.md)                  | The shape of a run is asked, not typed into its name                | Accepted                                                                 |
+| [0016](./0016-the-run-shape-is-asked-not-typed.md)                 | The shape of a run is asked, not typed into its name                | Accepted                                                                 |
 | [0017](./0017-change-impact-from-the-graph.md)                     | Change impact from the graph: spans, a transitive walk, freshness   | Accepted                                                                 |
+| [0018](./0018-cross-repo-links-not-a-global-graph.md)              | Cross-repository links, not a global graph                          | Accepted                                                                 |
 
 ## Writing a New ADR
 

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-10-25",
-  "version": "20.33.0",
+  "generatedAt": "2026-10-27",
+  "version": "20.35.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -40,7 +40,7 @@
   "skillCountAll": 237,
   "agentCount": 11,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 208,
+  "toolCount": 213,
   "toolCategories": {
     "ios": 42,
     "web": 38,
@@ -51,6 +51,7 @@
     "design": 7,
     "repo": 6,
     "voice": 6,
+    "graph": 5,
     "ui": 5,
     "context": 4,
     "pass": 4,
@@ -64,5 +65,5 @@
     "test": 1
   },
   "pluginSkillCount": 261,
-  "toolkitVersion": "3.26.0"
+  "toolkitVersion": "3.27.0"
 }

package/docs/features.md

@@ -340,7 +340,7 @@ Stack adapters cover 8 stacks: `ios`, `android`, `web`, `backend-node`, `python`
 
 ### Plan Critic
 
-With the gates active, Phase 1 ends with one adversarial critic (`agents/plan-critic.md`) under four lenses: scope, feasibility, security and a cheaper alternative. Each objection carries evidence anchors; the planner answers each once, accepting and revising or rebutting with evidence, and `plan-critique-gate.mjs` judges with no model call. An objection citing a binding constitution rule blocks unless its reply resolves it with an anchor that holds; the rest is advisory and appears in the plan render and the PR summary. One round, because further rounds move agents toward each other rather than toward the right answer. The critic follows the fable switch. Detail: [`plan-critic.md`](../pipeline/multi-agent-refs/features/plan-critic.md).
+With the gates active, Phase 1 ends with one adversarial critic (`agents/plan-critic.md`) under six lenses: scope, feasibility, security, a cheaper alternative, an input the spec implies that no test exercises, and a decision left to the implementer. Each objection carries evidence anchors; the planner answers each once, accepting and revising or rebutting with evidence, and `plan-critique-gate.mjs` judges with no model call. An objection citing a binding constitution rule blocks unless its reply resolves it with an anchor that holds; the rest is advisory and appears in the plan render and the PR summary. One round, because further rounds move agents toward each other rather than toward the right answer. The critic follows the fable switch. Detail: [`plan-critic.md`](../pipeline/multi-agent-refs/features/plan-critic.md).
 
 ### Review Decision Rule
 

package/install/_dev-only-files.mjs

@@ -69,6 +69,7 @@ const DEV_ONLY_TOOLING = Object.freeze([
   "check-rewrite-overlap.mjs", // compares a rewrite against a source only a maintainer has
   "gen-catalog-history.mjs", // reads the repo's git history; an install has none
   "gen-ref-toc.mjs", // regenerates the repo's own reference tree; an install has no pipeline/
+  "ref-filler-audit.mjs", // audits the repo's own instruction docs; an install has no pipeline/
   "validate-schemas.mjs", // validates the repo's own schema files, needs ajv
   "permission-baseline.mjs", // reads the repo's own command, skill and agent tree; an install has none
   "sync-parity-check.sh",