@mmerterden/multi-agent-pipeline 20.34.0 → 20.36.0

package/pipeline/skills/shared/core/multi-agent-sync/SKILL.md

@@ -33,7 +33,7 @@ Run all steps automatically:
 ```
 Step 0: DOCTOR      node $HOME/.claude/scripts/doctor.mjs  -  exit 2 or 4 STOPS the sync
 Step 1: DETECT      Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 69 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 70 sub-command skills)
 Step 2b: CODEX      Claude Code -> Codex CLI (1 router skill + sub-command specs as refs + agent TOML)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub)
 Step 3d: DEV-TOOLKIT Companion MCP server -> detect movement, ship gates, commit + publish
@@ -229,14 +229,14 @@ When invoked with the `release` argument:
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}/SKILL.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**69 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**70 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-jira, analysis-resolve, autopilot, autopilot-off,
 autopilot-on, autopilot-status, bug-bash, build-optimize, channels, complaint-analysis,
 create-jira, design-check, diff-explain, doctor, estimate, feedback, forget,
 garbage-collect, graph, help, ios-coding-standard, issue, jira, kill,
-language, log, manual-test, model, office-off, office-on, office-status, postmortem, prune-logs,
+language, log, manual-test, model, office-off, office-on, office-pair, office-status, postmortem, prune-logs,
 prune-prompts, purge, refactor, research, resume, review,
 review-analysis, review-issue, review-jira, route-off, route-on,
 route-status, routines, save, scaffold, scan, scenario-audit, search,

package/pipeline/skills/shared/external/alarmkit/references/alarmkit-patterns.md

@@ -1,5 +1,19 @@
 # AlarmKit patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Full alarm flow with intents](#full-alarm-flow-with-intents)
+- [Full timer flow](#full-timer-flow)
+- [Authorization manager](#authorization-manager)
+- [State store with async sequences](#state-store-with-async-sequences)
+- [Widget extension for countdown and paused UI](#widget-extension-for-countdown-and-paused-ui)
+- [Recurrence](#recurrence)
+- [Snooze and custom secondary actions](#snooze-and-custom-secondary-actions)
+- [Info.plist](#infoplist)
+- [Error handling](#error-handling)
+- [Apple documentation](#apple-documentation)
+<!-- /toc -->
+
 Longer, end-to-end examples. Everything here targets iOS 26 and iPadOS 26 with
 Swift 6.3. Code that uses the stopButton-free
 `AlarmPresentation.Alert(title:secondaryButton:secondaryButtonBehavior:)`

package/pipeline/skills/shared/external/android-architecture/references/patterns.md

@@ -1,5 +1,11 @@
 # Android Clean Architecture -- Reference Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Feature api/impl Split](#feature-apiimpl-split)
+- [Cross-Module Navigation Graph Aggregation](#cross-module-navigation-graph-aggregation)
+<!-- /toc -->
+
 Full code for the patterns summarized in `SKILL.md`. Load the section you need
 when implementing that specific structure.
 

package/pipeline/skills/shared/external/android-build-quality-gates/references/patterns.md

@@ -1,5 +1,15 @@
 # Android Build Quality Gates - Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Layer-dependency gate](#layer-dependency-gate)
+- [Coverage floor with Kover](#coverage-floor-with-kover)
+- [Compose-stability gate](#compose-stability-gate)
+- [Lint on diff](#lint-on-diff)
+- [Screenshot validation task](#screenshot-validation-task)
+- [Wiring gates into check](#wiring-gates-into-check)
+<!-- /toc -->
+
 Full, copy-ready code for the gates summarized in
 [../SKILL.md](../SKILL.md). Each section mirrors a heading there. Adapt names to
 the project's module conventions; nothing here hardcodes a product.

package/pipeline/skills/shared/external/android-datastore/references/patterns.md

@@ -1,5 +1,16 @@
 # Android DataStore Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Preferences DataStore](#preferences-datastore)
+- [Typed DataStore with a Serializer](#typed-datastore-with-a-serializer)
+- [Encrypted Typed DataStore](#encrypted-typed-datastore)
+- [Migrating from SharedPreferences](#migrating-from-sharedpreferences)
+- [Versioned Data Migrations](#versioned-data-migrations)
+- [Reading and Writing as Flow](#reading-and-writing-as-flow)
+- [Testing](#testing)
+<!-- /toc -->
+
 Full code examples backing the guidance in `SKILL.md`. Headings mirror the
 SKILL.md sections. Package, class, and key names are placeholders; adapt them.
 

package/pipeline/skills/shared/external/android-design-tokens-codegen/references/patterns.md

@@ -1,5 +1,13 @@
 # Android Design Tokens Codegen - Patterns
 
+<!-- toc -->
+- [Task wrapper](#task-wrapper)
+- [preBuild wiring](#prebuild-wiring)
+- [Check mode](#check-mode)
+- [Caching](#caching)
+- [Generated shapes](#generated-shapes)
+<!-- /toc -->
+
 Copy-ready Gradle and Kotlin for the schema-to-typed-code pipeline. Each heading
 mirrors a section in `SKILL.md`. All input is a local JSON schema; all output is
 generated Kotlin under the build directory. Names are illustrative and generic.

package/pipeline/skills/shared/external/android-jetpack-compose-expert/references/patterns.md

@@ -1,5 +1,11 @@
 # Compose runtime patterns
 
+<!-- toc -->
+- [Who owns a piece of state](#who-owns-a-piece-of-state)
+- [Side effects](#side-effects)
+- [Modifiers](#modifiers)
+<!-- /toc -->
+
 Loaded on demand from `../SKILL.md`.
 
 ## Who owns a piece of state

package/pipeline/skills/shared/external/android-mvi-viewmodel/references/patterns.md

@@ -1,5 +1,15 @@
 # Android MVI BaseViewModel Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Assembled BaseViewModel](#assembled-baseviewmodel)
+- [MVI contracts for a screen](#mvi-contracts-for-a-screen)
+- [A concrete ViewModel](#a-concrete-viewmodel)
+- [Lifecycle-aware event collector](#lifecycle-aware-event-collector)
+- [Stateless screen composable](#stateless-screen-composable)
+- [Testing the ViewModel](#testing-the-viewmodel)
+<!-- /toc -->
+
 Full code examples backing the guidance in `SKILL.md`. Load this file when you
 need a complete implementation to adapt. Headings mirror the SKILL.md sections.
 

package/pipeline/skills/shared/external/android-performance/references/patterns.md

@@ -1,5 +1,18 @@
 # Android Performance Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Baseline Profiles](#baseline-profiles)
+- [Compose Stability](#compose-stability)
+- [Recomposition Debugging](#recomposition-debugging)
+- [Lazy Layout Performance](#lazy-layout-performance)
+- [R8 Optimization](#r8-optimization)
+- [Memory Leak Detection](#memory-leak-detection)
+- [Startup Optimization](#startup-optimization)
+- [Image Loading with Coil](#image-loading-with-coil)
+- [General Performance Patterns](#general-performance-patterns)
+<!-- /toc -->
+
 Full code examples for the Android Performance skill. Each section mirrors a
 heading in `SKILL.md`. Load the section named in the guide when implementing or
 reviewing that area.

package/pipeline/skills/shared/external/android-security/references/patterns.md

@@ -1,5 +1,21 @@
 # Android Security -- Reference Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Secure Data Storage](#secure-data-storage)
+- [Encrypted DataStore](#encrypted-datastore)
+- [Database Key Hierarchy](#database-key-hierarchy)
+- [Build-Type Security Gating](#build-type-security-gating)
+- [Biometric Authentication](#biometric-authentication)
+- [Certificate Pinning](#certificate-pinning)
+- [API Key Protection](#api-key-protection)
+- [R8 Obfuscation](#r8-obfuscation)
+- [Play Integrity API](#play-integrity-api)
+- [Root Detection](#root-detection)
+- [Secure Network Communication](#secure-network-communication)
+- [Secure Coding Patterns](#secure-coding-patterns)
+<!-- /toc -->
+
 Full code for the patterns summarized in `SKILL.md`. Load the section you need
 when implementing that specific security feature.
 

package/pipeline/skills/shared/external/api-patterns/references/contract-details.md

@@ -1,5 +1,14 @@
 # API contract details
 
+<!-- toc -->
+- [Contents](#contents)
+- [Evolving a contract](#evolving-a-contract)
+- [Pagination](#pagination)
+- [Idempotency for retried writes](#idempotency-for-retried-writes)
+- [One error shape everywhere](#one-error-shape-everywhere)
+- [Webhooks done properly](#webhooks-done-properly)
+<!-- /toc -->
+
 Versioning rules and worked examples for the pagination, idempotency, error-shape and webhook rules summarised in SKILL.md.
 
 ## Contents

package/pipeline/skills/shared/external/api-security-best-practices/references/abuse-controls.md

@@ -1,5 +1,17 @@
 # Abuse Controls
 
+<!-- toc -->
+- [Contents](#contents)
+- [1. Layers of limits](#1-layers-of-limits)
+- [2. Choosing a rate limit algorithm](#2-choosing-a-rate-limit-algorithm)
+- [3. Keys: what to limit by](#3-keys-what-to-limit-by)
+- [4. A shared-store limiter](#4-a-shared-store-limiter)
+- [5. Telling clients about limits](#5-telling-clients-about-limits)
+- [6. Size, time and cost limits](#6-size-time-and-cost-limits)
+- [7. Protecting business flows](#7-protecting-business-flows)
+- [8. Operating the limits](#8-operating-the-limits)
+<!-- /toc -->
+
 Limits that keep one caller, script or bug from exhausting the service or its
 budget. Covers OWASP API4 (unrestricted resource consumption) and API6
 (unrestricted access to sensitive business flows).

package/pipeline/skills/shared/external/api-security-best-practices/references/identity-and-access.md

@@ -1,5 +1,18 @@
 # Identity and Access
 
+<!-- toc -->
+- [Contents](#contents)
+- [1. Choosing a credential type](#1-choosing-a-credential-type)
+- [2. Validating JWT access tokens](#2-validating-jwt-access-tokens)
+- [3. Refresh tokens and sessions](#3-refresh-tokens-and-sessions)
+- [4. API keys for machine clients](#4-api-keys-for-machine-clients)
+- [5. Service-to-service identity](#5-service-to-service-identity)
+- [6. Authorization models](#6-authorization-models)
+- [7. Enforcing authorization in code](#7-enforcing-authorization-in-code)
+- [8. Credential endpoints](#8-credential-endpoints)
+- [9. Scoping a lookup by principal](#9-scoping-a-lookup-by-principal)
+<!-- /toc -->
+
 How a request proves who it is, and how the server decides what that identity
 may do. Examples use TypeScript on Node with `jose` and Python with `PyJWT`;
 the rules are the same in any stack.

package/pipeline/skills/shared/external/api-security-best-practices/references/request-handling.md

@@ -1,5 +1,17 @@
 # Request Handling
 
+<!-- toc -->
+- [Contents](#contents)
+- [1. Validate at the edge with a schema](#1-validate-at-the-edge-with-a-schema)
+- [2. Writable fields only (mass assignment)](#2-writable-fields-only-mass-assignment)
+- [3. Shape every response explicitly](#3-shape-every-response-explicitly)
+- [4. Injection](#4-injection)
+- [5. Files and uploads](#5-files-and-uploads)
+- [6. Fetching user-supplied URLs (SSRF)](#6-fetching-user-supplied-urls-ssrf)
+- [7. Errors that do not leak](#7-errors-that-do-not-leak)
+- [8. Consuming third-party APIs](#8-consuming-third-party-apis)
+<!-- /toc -->
+
 Everything that crosses the boundary is untrusted until a schema says
 otherwise: body, query, path, headers, cookies, uploaded files, and responses
 from other services.

package/pipeline/skills/shared/external/app-clips/references/data-handoff-notifications-location.md

@@ -1,5 +1,14 @@
 # Data handoff, notifications and location
 
+<!-- toc -->
+- [Handing data to the full app](#handing-data-to-the-full-app)
+- [Keychain](#keychain)
+- [Sign in with Apple](#sign-in-with-apple)
+- [Ephemeral notifications](#ephemeral-notifications)
+- [Location confirmation](#location-confirmation)
+- [Lifecycle and short-lived state](#lifecycle-and-short-lived-state)
+<!-- /toc -->
+
 Moving state to the full app, signing people in once, notifying them within
 the clip's window, and proving they are where the code is. Summary in
 `../SKILL.md`.

package/pipeline/skills/shared/external/app-clips/references/routing-and-experiences.md

@@ -1,5 +1,13 @@
 # Routing and experiences
 
+<!-- toc -->
+- [Handling the invocation URL](#handling-the-invocation-url)
+- [App Store Connect experiences](#app-store-connect-experiences)
+- [Invocation sources](#invocation-sources)
+- [Smart App Banner](#smart-app-banner)
+- [Local testing](#local-testing)
+<!-- /toc -->
+
 How an App Clip learns what to show, how App Store Connect maps URLs to
 experiences, which sources can launch a clip, and how to test it. Summary in
 `../SKILL.md`.

package/pipeline/skills/shared/external/app-clips/references/size-capabilities-and-promotion.md

@@ -1,5 +1,15 @@
 # Size, capabilities and promotion
 
+<!-- toc -->
+- [Feasibility review outline](#feasibility-review-outline)
+- [Size limits](#size-limits)
+- [Background Assets](#background-assets)
+- [Promoting the full app with SKOverlay](#promoting-the-full-app-with-skoverlay)
+- [What the clip can use](#what-the-clip-can-use)
+- [What provides no functionality](#what-provides-no-functionality)
+- [Further restrictions](#further-restrictions)
+<!-- /toc -->
+
 What fits in an App Clip, what the platform withholds, and how to offer the
 full app without getting in the way. Summary in `../SKILL.md`.
 

package/pipeline/skills/shared/external/app-intents/references/appintents-advanced.md

@@ -1,5 +1,26 @@
 # App Intents: advanced guide
 
+<!-- toc -->
+- [Contents](#contents)
+- [Parameter initializers](#parameter-initializers)
+- [Entity queries](#entity-queries)
+- [EntityPropertyQuery: filter and sort](#entitypropertyquery-filter-and-sort)
+- [Controls](#controls)
+- [Snippets](#snippets)
+- [Visual Intelligence](#visual-intelligence)
+- [Assistant schemas (iOS 18+)](#assistant-schemas-ios-18)
+- [Focus filters](#focus-filters)
+- [Moving off SiriKit](#moving-off-sirikit)
+- [Errors and dialogs](#errors-and-dialogs)
+- [Confirmation](#confirmation)
+- [Authentication](#authentication)
+- [URL representations (iOS 18+)](#url-representations-ios-18)
+- [Spotlight](#spotlight)
+- [Visible content for Siri (iOS 26+)](#visible-content-for-siri-ios-26)
+- [Conditional parameter summaries](#conditional-parameter-summaries)
+- [Core Spotlight without App Intents](#core-spotlight-without-app-intents)
+<!-- /toc -->
+
 ## Contents
 
 - [Parameter initializers](#parameter-initializers)

package/pipeline/skills/shared/external/app-store-optimization/references/keyword-research-methodology.md

@@ -1,5 +1,14 @@
 # Keyword Research Methodology
 
+<!-- toc -->
+- [What App Store search reads](#what-app-store-search-reads)
+- [Research process](#research-process)
+- [Scoring](#scoring)
+- [Filling the slots](#filling-the-slots)
+- [Seasonal rotation](#seasonal-rotation)
+- [Before and after](#before-and-after)
+<!-- /toc -->
+
 ## What App Store search reads
 
 Apple documents two kinds of search signal: text relevance from the name,

package/pipeline/skills/shared/external/app-store-optimization/references/product-page-variants.md

@@ -1,5 +1,12 @@
 # Product Page Variants
 
+<!-- toc -->
+- [Custom Product Pages](#custom-product-pages)
+- [Product Page Optimization tests](#product-page-optimization-tests)
+- [In-App Event configuration](#in-app-event-configuration)
+- [Writing screenshot captions](#writing-screenshot-captions)
+<!-- /toc -->
+
 Limits below are App Store Connect values as Apple's documentation stated them
 at the time of writing; confirm them in App Store Connect Help before quoting.
 

package/pipeline/skills/shared/external/app-store-review/SKILL.md

@@ -326,8 +326,8 @@ time.
 - Name and subtitle: 30 characters each. The subtitle is a short value statement.
   A bare category word such as "Photo Editor" is likely rejected; so are
   competitor or trademarked terms and prices. The name must be unique.
-- Screenshots: 1 to 10 per required platform and localization. As of May 2026,
-  the 6.9-inch iPhone set is the primary one; the 6.5-inch set is required only
+- Screenshots: 1 to 10 per required platform and localization. The
+  6.9-inch iPhone set is the primary one; the 6.5-inch set is required only
   when there is no 6.9-inch set, and smaller iPhones get scaled images. Apps that
   run on iPad need 13-inch iPad screenshots; smaller iPads are scaled.
 - Screenshot content: the real UI; never show a feature the build lacks. Captions and

package/pipeline/skills/shared/external/app-store-review/references/privacy-manifest.md

@@ -1,5 +1,15 @@
 # Privacy Manifest (PrivacyInfo.xcprivacy)
 
+<!-- toc -->
+- [When Required](#when-required)
+- [Structure](#structure)
+- [Required API Reason Codes](#required-api-reason-codes)
+- [Keys Reference](#keys-reference)
+- [Third-Party SDK Manifests](#third-party-sdk-manifests)
+- [Collected Data Types Declaration](#collected-data-types-declaration)
+- [Sources To Re-Check](#sources-to-re-check)
+<!-- /toc -->
+
 ## When Required
 
 A bundle needs a privacy manifest when its code calls an API in one of the

package/pipeline/skills/shared/external/app-store-review/references/review-checklists.md

@@ -1,5 +1,14 @@
 # Review Checklists
 
+<!-- toc -->
+- [App Review Information Checklist](#app-review-information-checklist)
+- [Privacy Manifest Checklist](#privacy-manifest-checklist)
+- [In-App Purchase Checklist](#in-app-purchase-checklist)
+- [Screenshot and App Preview Checklist](#screenshot-and-app-preview-checklist)
+- [HIG Compliance Checklist](#hig-compliance-checklist)
+- [Pre-Submission Checklist](#pre-submission-checklist)
+<!-- /toc -->
+
 Working lists for a submission audit. Tick each line against the build that
 will actually be uploaded, not against a debug build.
 
@@ -41,7 +50,7 @@ will actually be uploaded, not against a debug build.
 
 ## Screenshot and App Preview Checklist
 
-- [ ] 1 to 10 screenshots per platform and localization. As of May 2026 the
+- [ ] 1 to 10 screenshots per platform and localization. The
       6.9-inch iPhone set is the primary one.
 - [ ] A 6.5-inch set only when there is no 6.9-inch set, or when you choose to
       tune that fallback by hand.

package/pipeline/skills/shared/external/apple-on-device-ai/references/coreml-conversion.md

@@ -1,5 +1,27 @@
 # Core ML conversion with coremltools
 
+<!-- toc -->
+- [Contents](#contents)
+- [Installing coremltools](#installing-coremltools)
+- [Where Core ML sits](#where-core-ml-sits)
+- [ML program versus neural network](#ml-program-versus-neural-network)
+- [ct.convert parameters](#ctconvert-parameters)
+- [From PyTorch](#from-pytorch)
+- [From TensorFlow, scikit-learn and XGBoost](#from-tensorflow-scikit-learn-and-xgboost)
+- [ONNX](#onnx)
+- [Describing inputs and outputs](#describing-inputs-and-outputs)
+- [Flexible shapes](#flexible-shapes)
+- [Deployment targets](#deployment-targets)
+- [Float16 or Float32](#float16-or-float32)
+- [Which processors to allow](#which-processors-to-allow)
+- [Keeping state between predictions](#keeping-state-between-predictions)
+- [Several functions in one package](#several-functions-in-one-package)
+- [Utilities](#utilities)
+- [Controlling graph passes](#controlling-graph-passes)
+- [Unsupported PyTorch ops](#unsupported-pytorch-ops)
+- [Conversion mistakes](#conversion-mistakes)
+<!-- /toc -->
+
 This file is about the Python side: exporting from the training framework,
 converting, choosing a deployment target and input shapes, and preparing for
 compression. Swift runtime wiring belongs to the `coreml` skill. In a

package/pipeline/skills/shared/external/apple-on-device-ai/references/coreml-optimization.md

@@ -1,5 +1,22 @@
 # Core ML compression and profiling
 
+<!-- toc -->
+- [Contents](#contents)
+- [Picking a technique](#picking-a-technique)
+- [Data-free weight quantization](#data-free-weight-quantization)
+- [Palettization](#palettization)
+- [Pruning](#pruning)
+- [Combining techniques](#combining-techniques)
+- [Per-op settings](#per-op-settings)
+- [Quantization-aware training](#quantization-aware-training)
+- [Swift at a glance](#swift-at-a-glance)
+- [MLTensor](#mltensor)
+- [Neural Engine habits](#neural-engine-habits)
+- [Faster loading](#faster-loading)
+- [Profiling](#profiling)
+- [Compression mistakes](#compression-mistakes)
+<!-- /toc -->
+
 Keep the work here on the Python tooling and on profiling. Swift prediction
 code and runtime setup belong to the `coreml` skill unless the user asked for
 app code; the Swift section below is only a quick orientation.

package/pipeline/skills/shared/external/apple-on-device-ai/references/foundation-models.md

@@ -1,5 +1,27 @@
 # Foundation Models reference
 
+<!-- toc -->
+- [Contents](#contents)
+- [What the framework is for](#what-the-framework-is-for)
+- [SystemLanguageModel](#systemlanguagemodel)
+- [Availability and locale](#availability-and-locale)
+- [Use cases and guardrails](#use-cases-and-guardrails)
+- [Sessions](#sessions)
+- [Prewarming](#prewarming)
+- [Text responses](#text-responses)
+- [Generable types](#generable-types)
+- [Tools](#tools)
+- [Runtime schemas](#runtime-schemas)
+- [Handling errors](#handling-errors)
+- [Sampling and length](#sampling-and-length)
+- [Safety](#safety)
+- [Adapters](#adapters)
+- [Long conversations](#long-conversations)
+- [One coordinator for all calls](#one-coordinator-for-all-calls)
+- [Writing prompts](#writing-prompts)
+- [Sending feedback](#sending-feedback)
+<!-- /toc -->
+
 ## Contents
 
 - [What the framework is for](#what-the-framework-is-for)

package/pipeline/skills/shared/external/apple-on-device-ai/references/mlx-swift.md

@@ -1,5 +1,22 @@
 # MLX Swift, llama.cpp and routing between backends
 
+<!-- toc -->
+- [Contents](#contents)
+- [How MLX works](#how-mlx-works)
+- [Loading and generating](#loading-and-generating)
+- [Model sizes by device](#model-sizes-by-device)
+- [Memory rules](#memory-rules)
+- [Owning the model lifecycle](#owning-the-model-lifecycle)
+- [Going to the background](#going-to-the-background)
+- [llama.cpp](#llamacpp)
+- [GGUF quant types](#gguf-quant-types)
+- [llama.cpp or MLX Swift](#llamacpp-or-mlx-swift)
+- [Routing across backends](#routing-across-backends)
+- [Built-in frameworks first](#built-in-frameworks-first)
+- [Performance habits](#performance-habits)
+- [Checklist](#checklist)
+<!-- /toc -->
+
 ## Contents
 
 - [How MLX works](#how-mlx-works)

package/pipeline/skills/shared/external/authentication/references/keychain-biometric.md

@@ -1,5 +1,14 @@
 # Keychain and Biometrics
 
+<!-- toc -->
+- [Where secrets go](#where-secrets-go)
+- [A small token vault](#a-small-token-vault)
+- [Biometrics with `LAContext`](#biometrics-with-lacontext)
+- [Items that require biometrics to read](#items-that-require-biometrics-to-read)
+- [Errors](#errors)
+- [Apple documentation](#apple-documentation)
+<!-- /toc -->
+
 The minimum storage and biometric patterns that sign-in code needs. This is a
 quick reference, not a security architecture: Keychain migration,
 access-control policy design, CryptoKit, Secure Enclave, pinning, sharing

package/pipeline/skills/shared/external/authentication/references/passkeys.md

@@ -1,5 +1,16 @@
 # Passkeys
 
+<!-- toc -->
+- [Before writing code](#before-writing-code)
+- [Registering a passkey](#registering-a-passkey)
+- [Signing in](#signing-in)
+- [One delegate for every credential type](#one-delegate-for-every-credential-type)
+- [Inline suggestions with AutoFill](#inline-suggestions-with-autofill)
+- [Physical security keys](#physical-security-keys)
+- [Failure modes](#failure-modes)
+- [Apple documentation](#apple-documentation)
+<!-- /toc -->
+
 A passkey is a public/private key pair. For platform passkeys the private key
 sits in iCloud Keychain and syncs across the person's devices; the
 relying-party server keeps the public credential material and verifies every

package/pipeline/skills/shared/external/avkit/references/avkit-patterns.md

@@ -1,5 +1,18 @@
 # AVKit patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Custom player with AVPlayerLayer](#custom-player-with-avplayerlayer)
+- [Interstitials](#interstitials)
+- [Background playback](#background-playback)
+- [Errors](#errors)
+- [Observing playback](#observing-playback)
+- [Video frame analysis](#video-frame-analysis)
+- [HDR](#hdr)
+- [SwiftUI player model](#swiftui-player-model)
+- [Wrapping AVPlayerViewController for SwiftUI](#wrapping-avplayerviewcontroller-for-swiftui)
+<!-- /toc -->
+
 Advanced playback recipes for iOS 26 and Swift 6.3.
 
 ## Contents

package/pipeline/skills/shared/external/background-processing/references/background-task-patterns.md

@@ -1,5 +1,14 @@
 # Background Task Patterns
 
+<!-- toc -->
+- [Debugging](#debugging)
+- [Processing tasks in depth](#processing-tasks-in-depth)
+- [Background URLSession details](#background-urlsession-details)
+- [Silent push details](#silent-push-details)
+- [SwiftUI `.backgroundTask`](#swiftui-backgroundtask)
+- [Continued processing specifics](#continued-processing-specifics)
+<!-- /toc -->
+
 Deeper material for the `background-processing` skill: debugging, error codes,
 checkpointed processing, background transfer details, silent push limits, the
 SwiftUI modifier and continued-processing specifics.

package/pipeline/skills/shared/external/callkit-voip/references/callkit-patterns.md

@@ -1,5 +1,15 @@
 # CallKit Patterns
 
+<!-- toc -->
+- [An observable call manager](#an-observable-call-manager)
+- [Hold and mute in the delegate](#hold-and-mute-in-the-delegate)
+- [Several calls at once](#several-calls-at-once)
+- [Watching call state](#watching-call-state)
+- [Filtering encrypted VoIP pushes](#filtering-encrypted-voip-pushes)
+- [Incremental Call Directory updates](#incremental-call-directory-updates)
+- [Testing VoIP locally](#testing-voip-locally)
+<!-- /toc -->
+
 Longer examples that back the `callkit-voip` skill. Read its SKILL.md first;
 this file assumes the provider setup, push rules and audio rules described
 there.

package/pipeline/skills/shared/external/cloudkit-sync/references/cloudkit-patterns.md

@@ -1,5 +1,20 @@
 # CloudKit Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Incremental zone fetches](#incremental-zone-fetches)
+- [Server change tokens](#server-change-tokens)
+- [Sharing with `CKShare`](#sharing-with-ckshare)
+- [`UICloudSharingController`](#uicloudsharingcontroller)
+- [Zones](#zones)
+- [Files with `CKAsset`](#files-with-ckasset)
+- [Batches](#batches)
+- [Quality of service and groups](#quality-of-service-and-groups)
+- [Encrypted fields](#encrypted-fields)
+- [CloudKit Dashboard](#cloudkit-dashboard)
+- [Discovering changed zones](#discovering-changed-zones)
+<!-- /toc -->
+
 Lower-level operations and features behind the [skill overview](../SKILL.md):
 incremental fetching, tokens, sharing, zones, files, batching, scheduling,
 encryption and the Dashboard.

package/pipeline/skills/shared/external/compose-components/references/patterns.md

@@ -1,5 +1,12 @@
 # Jetpack Compose Components Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Two-Layer Design Tokens](#two-layer-design-tokens)
+- [Bridging Tokens to Material 3](#bridging-tokens-to-material-3)
+- [Component Catalog](#component-catalog)
+<!-- /toc -->
+
 Full code examples backing the guidance in `SKILL.md`. Headings mirror the
 SKILL.md sections.
 

package/pipeline/skills/shared/external/compose-navigation/references/patterns.md

@@ -1,5 +1,12 @@
 # Compose Navigation -- Reference Patterns
 
+<!-- toc -->
+- [Contents](#contents)
+- [Custom NavType Type-Map](#custom-navtype-type-map)
+- [SafeNavController](#safenavcontroller)
+- [Navigation as a One-Shot Effect](#navigation-as-a-one-shot-effect)
+<!-- /toc -->
+
 Full code for the patterns summarized in `SKILL.md`. Load the section you need
 when implementing that specific navigation feature.