@mmerterden/multi-agent-pipeline 20.36.0 → 20.37.1

package/CHANGELOG.md

@@ -16,6 +16,43 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.37.1] - 2026-10-31
+
+### Fixed
+
+- `write-state.mjs --replace` applies the same phase-transition refusals as a merge write: leaving Phase 1 without plan approval, leaving Phase 2 without a recorded tracker move, and changing or dropping `sessionId` are refused with exit 6. A state file that does not parse can still be replaced.
+- `validate-triage.mjs` exits 2 when the over-rejection guard trips, even when it also corrected a contradiction; the corrected verdict is still in the result, and Phase 3 acts on it after the human check. `eval-triage.mjs` fails a fixture whose verdict needed correcting.
+- `rework-rulings.mjs` escalates any finding with `foundBy: "security-auditor"` at the rework cap. The triage schema drops the auditor's `security` envelope, so a medium-severity finding without a SEC rule used to be parked.
+- `scope-check-gate.mjs` keeps every line break in shell, Ruby (including `Podfile`, `Gemfile`, `Rakefile` and the fastlane files), TOML, `.envrc`, `Jenkinsfile`, `Vagrantfile` and Dockerfiles or Containerfiles of any suffix when it decides whether a hunk is layout only, so joining two commands onto one line is no longer listed as format-only.
+- `validate-planning.mjs --spec` fails when the named spec cannot be read, instead of warning and skipping the design-value and citation checks.
+- Memory stores stay off when `multi-agent-preferences.json` exists but cannot be parsed, and say so once on stderr; a missing file still means no exclusions.
+- `office-on` stops the server it started whenever the start fails (no ready line, a ready line that is not JSON, a state write error, or a server that dies right after it), and closes the ready file's descriptor. `MA_OFFICE_READY_MS` (a positive integer) overrides the 15 s window.
+- The office world loop cancels its queued animation frame on stop, so hiding and showing the tab no longer adds a render loop.
+- The user test (Phase 3 on Claude Code and Copilot CLI, and `/multi-agent:manual-test`) hands the branch over through `user-test-handoff.sh`. The agent makes the WIP commit itself, so it passes the approval and secret-scan hooks like any commit. `checkout` refuses with nothing moved when the main repo has uncommitted changes (exit 3), or when the worktree or a submodule holds uncommitted work, a commit on no remote branch, an unpushed local branch or a stash (5); a submodule's git dir is removed with the worktree, so all of that would be lost. It then moves every ignored entry of the worktree (the run artefacts under `.pipeline/` and `.multi-agent/`, logs, `.env`, build output) and the main repo's current branch into a hold in the same repository, removes the worktree and checks the branch out. `restore` returns the main repo to the branch it was on, re-adds the worktree, moves the held entries back and keeps anything found at the worktree path aside; it refuses while the user's edits sit on the task branch in the main repo (3) and finishes an interrupted run when called again. Success is judged by where the branch ends up, so a failing post-checkout hook cannot cost the held entries. Both answers to the test start with `restore`, so `manual-test.json` is written into a worktree that exists.
+- Phase 4 folds every checkpoint commit of the run (Phase 2's `wip(...)` commits and the user-test `WIP:` commit) back before the real commit through `checkpoint-fold.sh`, per repository in multi-repo runs. It follows first parents from HEAD and stops at the first commit that is neither, bounded by `origin/<base>` when that ref exists. It undid only one commit before, so Phase 2's checkpoints reached the PR.
+- Phase 2's build log goes through the context-offload filter on every run; only multi-repo builds used it. Offload node ids carry the current phase numbers.
+
+### Changed
+
+- Phase docs keep the call and the decision; conditional detail loads on demand. New refs: `features/dev-multi-repo.md` (Phase 2), `features/commit-multi-repo.md` (Phase 4) and `features/test-gap.md` (Phase 3); the Phase 3 evidence flows moved into `audit-guide.md`. TDD token forwarding and the push retry policy stay in the phase docs because every run uses them. Every phase doc now has more room than its usual edit size.
+- Phase 1 and the `autopilotSafetyGate` preference description point at `classify-plan-safety.mjs` for the safety classifier's rules and state its trigger correctly (one signal of weight 30+, two of weight 20+, or a score of 50).
+- Phase 5 no longer describes an `outputQuality` / nested `channels` metrics shape that no writer produces; `log-metric.sh` writes flat key/value details.
+- `rules/figma-pipeline.md` lists the Phase 0 tier probe and Phase 1's analysis half (Step 1.4) as allowed to reach Figma and Phase 1's planning half as not, and says which of those the scope guard enforces.
+- Phase 4's Push-must-succeed policy and Telemetry are their own sections instead of sitting under Multi-Repo Mode, since every run uses them.
+- `smoke-phase-telemetry-ids.sh` checks that every feature ref loaded inside a phase emits under that phase's id.
+
+## [20.37.0] - 2026-10-31
+
+### Added
+
+- `/multi-agent:status` answers what is happening right now through `status-overview.mjs`: each open Claude Code session with the run it drives and its token spend (subagents included), the last 24 hours of tokens, the github.com accounts gh holds with the active one marked, the git author, and which logical credentials are registered. Credentials are checked by name against `credential-store.sh list`; no value is ever read.
+
+### Changed
+
+- Every SKILL.md is under its soft token cap (79 were over). Long tables, worked examples, option catalogs and rationale moved into `multi-agent-refs/<command>/` files or a skill's `references/` directory, and each SKILL.md points at the file and says when to read it; steps, stop conditions and safety rules stay in the SKILL.md. The Copilot help skill reads the shared `help/en.md` and `help/tr.md` catalogs. `localization-reuse-map` keeps its references in one `references/` directory.
+- `swift-testing-pro` declares `not-for: swiftdata-pro`, which settles the last trigger collision.
+- `runs-index.mjs` 1.4.0: a run whose status is complete, completed, done, abandoned or cancelled is in a new `done` group instead of being grouped by phase, so a finished run is no longer offered `resume`. The text table folds `done` and `unknown` into a count unless `--all` or `--group` names them, and a phase past the contract's last one shows as an old number (`7 old`) instead of `7/5`. Client contract 1.8.0.
+
 ## [20.36.0] - 2026-10-31
 
 ### Added

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
   "generatedAt": "2026-10-31",
-  "version": "20.36.0",
+  "version": "20.37.1",
   "phaseSchema": 2,
   "phases": [
     {
@@ -65,5 +65,5 @@
     "test": 1
   },
   "pluginSkillCount": 261,
-  "toolkitVersion": "3.27.0"
+  "toolkitVersion": "3.27.1"
 }

package/docs/features.md

@@ -237,7 +237,7 @@ After triage returns, output is validated by `validate-triage.mjs`:
 | ----- | ------------------------------------------------------------ |
 | **0** | Valid and clean - act on triage output                       |
 | **1** | Invalid structure - retry once, then fallback                |
-| **2** | Over-rejection guard tripped - pause for human               |
+| **2** | Over-rejection guard tripped - pause for human; act on `result.corrected` when set |
 | **3** | Contradiction auto-corrected - proceed with corrected output |
 
 ### Bidirectional Approved↔Blocking Auto-Correction

package/docs/recovery-guide.md

@@ -71,7 +71,7 @@ Path forward:
 | ---- | ------------------------ | ---------------------------------------------- |
 | 0    | Valid & clean            | Proceed to Phase 4                             |
 | 1    | Invalid JSON / schema    | Retry triage ONCE. On second exit-1, fallback: treat ALL raw findings as accepted. |
-| 2    | Over-rejection (>80%)    | Pause for human confirmation                   |
+| 2    | Over-rejection (>80%)    | Pause for human confirmation; act on `result.corrected` when set |
 | 3    | Contradiction corrected  | Use `result.corrected`, continue               |
 
 If exit 1 fires twice (fallback path):