@mmerterden/multi-agent-pipeline 20.36.0 → 20.37.1

package/pipeline/skills/shared/core/multi-agent-review/SKILL.md

@@ -44,89 +44,21 @@ Skip Phase 0-3 and review a diff only. Input shapes: a PR (`#N`, `repo#N`, GitHu
    - branch name -> `kind=branch` (local).
    - **empty + interactive** -> `kind=pick` (Step 1a picker); **empty + autopilot** -> current branch.
 
-1a. **No-input PR picker** (interactive only): list open PRs across both providers and multi-select which to review.
-   - GitHub: `gh pr list --state open --json number,title,url,headRefName,updatedAt` (current repo) plus `gh search prs --state open --review-requested=@me`/`--author=@me`.
-   - Bitbucket Server: for each configured repo, `GET /rest/api/1.0/projects/{KEY}/repos/{slug}/pull-requests?state=OPEN` (creds via `credential-store`).
-   - Merge + label each row `(github)`/`(bitbucket)`, then AskUserQuestion `multiSelect: true` (breadcrumb per `multi-agent-refs/picker-contract.md`). Review each selected PR (loop steps 2-6). Empty list or none selected -> fall back to the current branch.
+1a. **No-input PR picker** (interactive only): list open PRs across both providers (a missing token or CLI contributes nothing), AskUserQuestion `multiSelect: true` (breadcrumb per `multi-agent-refs/picker-contract.md`), and review each selected PR (loop steps 2-6). Empty list or none selected -> fall back to the current branch. List commands and picker fields: `$HOME/.claude/multi-agent-refs/review/inputs.md` "Step 1a".
 
-2. **Get the diff**  -  kind-aware:
-   ```bash
-   # branch: git diff origin/develop...HEAD
-   # github PR: gh pr diff "$N" --repo "$org/$repo"  (+ head SHA for inline anchors)
-   # bitbucket PR: curl -u "$BB_USER:$BB_TOKEN" .../pull-requests/$N/diff?contextLines=10
-   ```
+2. **Get the diff**  -  kind-aware (branch `git diff origin/develop...HEAD`; GitHub `gh pr diff` + head SHA for inline anchors; Bitbucket the REST diff with credentials via `credential-store`, never on argv). Exact commands: `review/inputs.md` "Step 2".
 
-2c. **Valven delivery rules**  -  required on every input. Run `node "$HOME/.claude/scripts/valven-gate.mjs" --mode review --out "$VG_FILE"` plus the input's sources: a branch adds `--repo . --base origin/develop --head <ref>`; a PR adds `--branch <headRef> --pr-body-file <body> --commits-file <one subject per line> --pr-meta-file <timeline>` (GitHub: `node "$HOME/.claude/scripts/pr-timeline.mjs" --repo <owner/repo> --pr <N> --out <file>` writes the PR with its ready-for-review time and bot-typed reviews; read the head ref, body and commits from it and pass it as the timeline. Bitbucket `fromRef.displayId`, `description`, `/commits`, and a timeline written as `{createdAt, readyAt, isDraft, reviewerCount, firstReviewAt, approvedAt, mergedAt, closedAt}` from the PR and `/activities`, reviews by the author left out) and either `--repo . --base origin/<baseRef> --head FETCH_HEAD` after `git fetch origin <headRef>` when the cwd is that repo, or `--diff-file <patch>` (rework then reports `not-measured`). Exit 0 clean, 1 findings, 2 could not run: print `Valven: not measured (<reason>)`, never "passed". `findings[]` (`tag: valven`) join the reviewer findings at step 5 and are accepted unless the task is exempt, so an `important` one makes step 7 NEEDS WORK. Old-work findings (`VLV-AGE-01`, `VLV-BEHIND-01`, `VLV-TRACE-03`; commit lines are `<ISO author date>\t<subject>`) get the `valven-port.mjs` plan in their fix: new branch, dropped commits, then "open the new PR, close this one". When `splitRequired`, run `valven-split.mjs` with the same base and head (no `--apply`) and add its slice table to the `VLV-SIZE-01` fix. The duration rules (`VLV-CYCLE-01..03`) are `suggestion` findings with a Valven score and never set NEEDS WORK on their own; `VLV-PICKUP-01` is `important` for no reviewer and a `suggestion` for a draft older than 3 hours. Step 6 adds `Valven scores: churn · coding · pickup · review` from the report's `scores`, `-` where one is missing. The registry's judgement rules (`VLV-SCOPE-02`, `VLV-PRDESC-02`, from the `valven-rules` skill's `references/rules.yml`) go into every reviewer prompt in step 3. Contract: the `valven-rules` skill.
-
-3. **Start parallel reviewers**  -  three on every host; only the second slot differs, because GPT-5.4 exists on Copilot and Codex but not on Claude Code, where Opus fills it:
-
-   **Claude Code (3 in parallel while the fable rung is on, 2 while it is off).** Resolve the fable slots first; this command has no Phase 0:
-   `REVIEW_RUNG=$(bash "$HOME/.claude/lib/model-dispatch.sh" subagent --persona reviewer --default fable)` and the same with `--persona triage` for `TRIAGE_RUNG`. Anything but `fable` drops Agent 1 and runs triage on `TRIAGE_RUNG`.
-   - Agent 1: `claude-fable-5-1` → security + architecture (only when `REVIEW_RUNG` is `fable`)
-   - Agent 2: `claude-opus-5-5` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-5-5` → general quality
-
-   **Copilot CLI (3 in parallel):**
-   - Agent 1: `claude-opus-4.7` → security + architecture (Fable is not offered on Copilot CLI)
-   - Agent 2: `gpt-5.4` → edge cases, different perspective
-   - Agent 3: `claude-sonnet-4.6` → general quality
-
-   **Codex CLI (3 in parallel, single vendor):**
-   - Agent 1: `gpt-5.6` @ `xhigh` → security + architecture
-   - Agent 2: `gpt-5.4` @ `high` → edge cases, different perspective
-   - Agent 3: `gpt-5.6` @ `medium` → general quality
-
-   The rung switch and its resolution: `multi-agent-refs/features/model-fallback.md`.
-
-4. **Store-compliance cross-reference**  -  if iOS/Android release-relevant files changed, the matching catalog is loaded:
-
-   | Platform | Trigger files | Catalog to load |
-   |---|---|---|
-   | iOS | `**/Info.plist`, `**/PrivacyInfo.xcprivacy`, `**/*.entitlements`, `**/*App.swift`, `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/project.pbxproj` | `$HOME/.claude/skills/apple-archive-compliance/SKILL.md`  -  18 rules + ITMS refs |
-   | Android | `**/AndroidManifest.xml`, `**/build.gradle(.kts)`, `**/proguard-rules.pro`, `**/network_security_config.xml` | `$HOME/.claude/skills/google-play-compliance/SKILL.md`  -  21 rules + Play policy refs |
-
-   It appends the catalog's `ruleID` + the Apple ITMS / Play policy ref to each finding:
-   - iOS example: `(apple-archive-compliance / info-plist  -  Guideline 5.1.1)`
-   - Android example: `(google-play-compliance / dangerous-permissions  -  Policy  -  Permissions)`
-
-   It does NOT invoke any binary/tool  -  the review stage only uses the catalog. For a full scan use `multi-agent-test "store-ready"`.
-
-4b. **Platform parity cross-check** (advisory, read-only)  -  when a counterpart repo
-   resolves whose `stack` is the other mobile platform and the diff touches a screen, a
-   service, a request model or a localization file, compare the change against that repo
-   on four axes: endpoints called, parameters sent, business rules around the call,
-   localization keys used. When the project belongs to a product
-   (`prefs.global.products`), the counterparts are the product's other repositories,
-   resolved with `product-context.mjs refs` and compared at their latest integration
-   branch through the toolkit's `repo_*` tools, pinned to a sha
-   (`features/product-context.md`). Otherwise the counterpart is resolved automatically and in both
-   directions (ios ↔ android) from four sources in this order, first hit wins:
-   `--with <path|owner/repo>` (a one-off override, remembered like any other resolution),
-   then a remembered `prefs.projects[<slug>].counterpartRoots[]`, then the primary
-   checkout's sibling directories, then `state.siblings[]` from the Phase 0 dev-context
-   picker. None of them is a precondition for the others. One match is used and
-   remembered; several are asked about interactively and skipped in autopilot; none
-   skips silently. Stack comes from marker files, never from the repo name.
-
-   The counterpart is located through the code graph, capped at 8 files, and is **read
-   only**  -  never edited, staged, committed, pushed or built. Output is its own
-   `Platform parity` section; findings are advisory and never blocking. No counterpart
-   repo, or nothing comparable in the diff → skipped silently.
-
-   Contract: `$HOME/.claude/multi-agent-refs/platform-parity.md`.
-
-5. **Triage**  -  classify the findings:
-   - 🔴 **Blocking** → must fix
-   - 🟡 **Important** → fix recommended
-   - 🟢 **Suggestion** → optional
-
-   Triage also settles every reviewer `cannotVerify` row: `verified` with the file:line read, `finding` with the file:line of the accepted or deferred finding, or `out-of-scope`. Unsettled rows are listed in the summary.
-
-6. **Show a summary** (always prints, any mode):
-   ```
-   🔍 Review Complete
-   | Model | Verdict | Blocking | Important | Suggestion |
-   Consensus: ✅ APPROVED
-   ```
+2c. **Valven delivery rules**  -  required on every input. Read `$HOME/.claude/multi-agent-refs/review/valven.md` before this step: gate arguments per input (branch, GitHub with `pr-timeline.mjs`, Bitbucket), checkout vs `--diff-file`, old-work port plans, split plans, cycle and pickup severities, and the judgement rules (`VLV-SCOPE-02`, `VLV-PRDESC-02`) that go into every reviewer prompt in step 3. Two rules always hold: exit 2 prints `Valven: not measured (<reason>)`, never "passed"; `findings[]` (`tag: valven`) join at step 5 and are accepted unless the task is exempt, so an `important` one makes step 7 NEEDS WORK.
+
+3. **Start parallel reviewers**  -  three on every host. On Claude Code resolve the fable slots first (this command has no Phase 0):
+   `REVIEW_RUNG=$(bash "$HOME/.claude/lib/model-dispatch.sh" subagent --persona reviewer --default fable)` and the same with `--persona triage` for `TRIAGE_RUNG`. Anything but `fable` drops Agent 1 and runs triage on `TRIAGE_RUNG`. Read `$HOME/.claude/multi-agent-refs/review/panel.md` "Reviewers" before dispatch: the Claude Code, Copilot CLI (Opus + GPT-5.4 + Sonnet, no Fable) and Codex CLI panels. The rung switch: `multi-agent-refs/features/model-fallback.md`.
+
+4. **Store-compliance cross-reference**  -  if iOS/Android release-relevant files changed, load the matching catalog (`$HOME/.claude/skills/apple-archive-compliance/SKILL.md` or `$HOME/.claude/skills/google-play-compliance/SKILL.md`) and append its `ruleID` + the Apple ITMS / Play policy ref to each finding. Catalog only, never a binary; a full scan is `multi-agent-test "store-ready"`. Trigger files and citation format: `review/panel.md` "Store compliance".
+
+4b. **Platform parity cross-check** (advisory, read-only)  -  when a counterpart repo on the other mobile platform resolves and the diff touches a screen, service, request model or localization file, compare endpoints, parameters, business rules and localization keys. In a product (`prefs.global.products`) the counterparts come from `product-context.mjs refs` and the toolkit's `repo_*` tools, pinned to a sha; otherwise from `--with`, a remembered `counterpartRoots[]`, sibling checkouts, then `state.siblings[]`, first hit wins. Several are asked about interactively and skipped in autopilot; none skips silently. The counterpart is **read only**  -  never edited, staged, committed, pushed or built; findings are advisory, in their own `Platform parity` section. Contract: `$HOME/.claude/multi-agent-refs/platform-parity.md`.
+
+5. **Triage**  -  classify 🔴 **Blocking** / 🟡 **Important** / 🟢 **Suggestion**, and settle every reviewer `cannotVerify` row: `verified` with the file:line read, `finding` with the file:line of the accepted or deferred finding, or `out-of-scope`. Unsettled rows are listed in the summary.
+
+6. **Show a summary** (always prints, any mode): one row per reviewer, then consensus (`review/panel.md` "Summary").
 
 7. **Post to PR**  -  only when `kind=pr` (full contract: `$HOME/.claude/multi-agent-refs/channels/pr-review-actions.md`). Decision from accepted findings: 0 accepted blocking AND 0 accepted important -> APPROVE, else NEEDS WORK. Posts one inline comment per accepted blocking/important finding (in `outputLanguage`), then sets the review state via the provider API. Interactive prompts to post (default yes); autopilot auto-posts; `--no-post` skips. Entry point: `bash $HOME/.copilot/lib/post-pr-review.sh "$TASK_ID"`. No monolithic advisory comment. Branch/pick-fallback runs stay chat-only.

package/pipeline/skills/shared/core/multi-agent-setup/SKILL.md

@@ -18,11 +18,7 @@ metadata:
 
 ## Step 0 - What is actually wrong
 
-```bash
-node "$HOME/.copilot/scripts/doctor.mjs"
-```
-
-Run it before the first question and again at the end. The first run makes setup targeted: never ask for a token that is already mapped and answering. The second run is how setup ends - "setup complete" is a claim, and the doctor's exit code is the evidence. Report both in `outputLanguage`; if the second run still shows a BLOCK, say so plainly rather than closing on the word "complete".
+Run `node "$HOME/.copilot/scripts/doctor.mjs"` before the first question (never ask for a token that is already mapped and answering) and again at the end: its exit code, not the word "complete", decides how setup ends. Report both in `outputLanguage`; a remaining BLOCK is said plainly.
 
 ## Sections
 
@@ -30,318 +26,77 @@ Run it before the first question and again at the end. The first run makes setup
 
 ## Setup (Credential Store + Git Identity Onboarding)
 
-Uses `~/.copilot/lib/credential-store.sh` to read/write secrets in the macOS Keychain (`security`, built in); the pipeline is macOS only (ADR-0012). Run `~/.copilot/lib/credential-store.sh doctor` first  -  it prints the platform and whether the backend is usable. The shell driver auto-delegates `get`/`set`/`delete` to the deterministic Python helper at `$HOME/.copilot/scripts/keychain.py` (Python 3 stdlib only, no external deps). The Python path writes both `-l` (label) and `-s` (service) attributes so items are findable regardless of how callers look them up. Set `KEYCHAIN_DELEGATE=0` to force the raw shell path.
-
 ### Step 0  -  Language Selection
 
-Ask BEFORE anything else, so every subsequent setup prompt and the rest of the pipeline honour the choice. The pipeline has two language axes:
-
-- `promptLanguage`: picker chrome only (the `AskUserQuestion` `header` chip, host error UI, internal contract identifiers). **Not configurable  -  fixed to `en`**; the chip is capped at 12 chars, which most Turkish equivalents overflow.
-- `outputLanguage`: the assistant's non-interactive explanations, status updates, error messages and pipeline-generated reports. Set here, changeable later via `/multi-agent-language <en|tr>`.
-
-`promptLanguage` is seeded as `"en"` and never offered to the user. Language matrix: `multi-agent-refs/rules.md`.
-
-The wizard asks one question (English UI per skill-prompt rules):
-
-```
-Which language should the assistant use for ITS OWN explanations,
-status updates, and pipeline-generated reports?
-  1) English
-  2) Türkçe
-Select (1-2):
-```
-
-**Rules:**
-
-- **Already set in prefs** → skip silently. User can change later with `/multi-agent-language <en|tr>` or `/multi-agent-language output <en|tr>`.
-- **New value** → validate against the schema enum (`en`, `tr`), write `prefs.global.outputLanguage` via atomic rename, force `prefs.global.promptLanguage = "en"`, then echo a confirmation in the just-chosen `outputLanguage`:
-  - `en`: `outputLanguage=<Y>. promptLanguage stays "en". Commits stay English; PR/Jira/wiki bodies follow it.`
-  - `tr`: `outputLanguage=<Y>. promptLanguage "en" sabit. Commit'ler İngilizce; PR/Jira/wiki metinleri onu izler.`
-- **Unknown input** → re-ask once, then abort setup with a hint pointing to `/multi-agent-language`.
-
-From here on, every prompt in Steps 1-6 follows the per-field matrix in
-`$HOME/.claude/multi-agent-refs/rules.md` ("Language Application"): `question`, `label`
-and `description` render in `outputLanguage`, `header` stays English; wizard status and
-the post-setup summary follow `outputLanguage`. `promptLanguage` governs only the button
-and chip chrome, never the question a user reads.
+Ask BEFORE anything else: one question, `outputLanguage` (`en` / `tr`); already set: skip silently. `promptLanguage` is fixed to `"en"` and never offered. From here on `question`, `label` and `description` render in `outputLanguage`; `header` stays English. Read `$HOME/.claude/multi-agent-refs/setup/language.md` before Step 0.
 
 ### Step 0.5  -  Dependency check
 
-```bash
-~/.copilot/lib/credential-store.sh doctor
-command -v pdftotext >/dev/null 2>&1 || echo "pdftotext: MISSING"
-```
-
-| Output | Action |
-|--------|--------|
-| `Backend: ✓` | Continue to Step 1 |
-| Platform `unknown` or `ERR: macOS only` | Halt  -  the pipeline runs on macOS only (ADR-0012). |
-| `pdftotext: MISSING` | Advisory. Print `brew install poppler`, continue. `.docx` needs nothing. |
+Run `~/.copilot/lib/credential-store.sh doctor` and `command -v pdftotext`. `Backend: ✓`: continue. Platform `unknown` or `ERR: macOS only`: **halt**. `pdftotext` missing: advise `brew install poppler`, continue.
 
 ### Credential Key Naming Rule
 
-- **New token** (first-time creation in Step 3): ALWAYS use the standard key name (`${USER}_Jira_Access_Token`, etc.). This ensures cross-machine consistency.
-- **Existing token** (discovered in Step 1): NEVER rename or migrate. Map the discovered key name as-is into `keychainMapping`. The mapping layer abstracts the actual key name  -  the pipeline never reads the credential store directly by standard name.
+- **New token** (Step 3): ALWAYS the standard key name (`${USER}_Jira_Access_Token`, etc.).
+- **Existing token** (Step 1): NEVER rename or migrate; map the discovered name as-is into `keychainMapping`.
 
 ### Step 1  -  Dynamic Credential Discovery
 
-Full procedure: `$HOME/.claude/multi-agent-refs/setup/discovery.md`. Read it for Step 1.
+Read `$HOME/.claude/multi-agent-refs/setup/discovery.md` for Step 1.
 
 ### Step 2  -  Show Discovery Summary + Save Mapping
 
-Show results grouped by status:
-
-```
-Keychain Token Discovery (${USER}):
-
-  Jira               -> ${USER}_Jira_Access_Token
-  GitHub             -> ${USER}_Github
-  Figma              -> ${USER}_Figma_Access_Token
-  Firebase           -> ${USER}_Firebase_Access_Json
-  Confluence         -> MISSING
-  Jenkins            -> MISSING
-  ---
-  Git identities: check preferences file (see Step 3)
-
-  Mapped: 8 | Missing: 4
-```
-
-Save the resolved mapping to `prefs.global.keychainMapping`  -  every service ID gets an entry, the discovered key name verbatim or `null` when nothing was found:
-
-```json
-{ "jira": "${USER}_Jira_Access_Token", "github": "${USER}_Github", "confluence": null, "...": "..." }
-```
-
-Full key list and shape: `$HOME/.claude/multi-agent-refs/keychain.md`.
-
-`null` = not mapped (missing or skipped). Pipeline phases read this mapping to retrieve tokens dynamically  -  never hardcoded key names.
+Show one line per service with its key or `MISSING`, then the counts (`$HOME/.claude/multi-agent-refs/setup/summaries.md`). Save every service ID to `prefs.global.keychainMapping`, the discovered key name verbatim or `null` (key list: `$HOME/.claude/multi-agent-refs/keychain.md`). Phases read this mapping, never hardcoded key names.
 
 ### Step 2.7  -  Operational reporting
 
-Ask (in `outputLanguage`), and proceed only on an explicit yes:
-
-```
-Do you have an operational-reporting token from your admin?
-[ Paste token / Skip ]
-```
-
-On paste, store it in the credential store ONLY - never in a file, prefs value,
-git or any synced tree - under the standard per-user name, so it is revocable on
-its own:
+Ask whether the user has an operational-reporting token; proceed only on an explicit yes. On paste, store it in the credential store ONLY (never a file, prefs value, git or synced tree): `pbpaste | ~/.copilot/lib/credential-store.sh set "${USER}_Usage_Ingest_Token" -` then `pbcopy < /dev/null`. Pasted or skipped, run `node "$HOME/.copilot/scripts/usage-register.mjs" --json`; on `"needsPersonalAccount":true` ask once for a GitHub username (Skip leaves reporting off) and re-run with `--login <name>`. What is sent: `$HOME/.claude/multi-agent-refs/features/usage-reporting.md`.
 
-```bash
-pbpaste | ~/.copilot/lib/credential-store.sh set "${USER}_Usage_Ingest_Token" -
-pbcopy < /dev/null
-```
-
-Then, **whether they pasted or skipped**, run:
-
-```bash
-node "$HOME/.copilot/scripts/usage-register.mjs" --json
-```
-
-If its JSON line says `"needsPersonalAccount":true`, ask once for the person's
-GitHub username (free text; Skip leaves reporting off) and run
-`node "$HOME/.copilot/scripts/usage-register.mjs" --login <name> --json`.
-
-It maps whatever token exists and switches reporting on, and requests a
-per-machine write-only one when none resolves. Setup is a registration entry point
-in its own right, so a machine that runs setup and never runs update still reports.
-What is sent, what never is, and `usageLog.optOut`:
-`$HOME/.claude/multi-agent-refs/features/usage-reporting.md`.
-
-### Auto-learned fields (no setup step needed)
-
-**Jira Project Key**: auto-learned from pipeline usage. User runs `/multi-agent ABC-123` → `ABC` is extracted and saved to `prefs.global.defaultJiraKey` (first ever) and `prefs.projects[{project}].jiraProjectKeys` (per-project). Multiple keys accumulate over time  -  most recent first, deduped. Phase 0 Step 1 (Parse Input) handles extraction.
-
-**Git Identity**: auto-learned from token onboarding. Each token saved in Step 3 triggers an identity prompt (see Token Save Flow Step C). No separate identity setup step.
+The Jira project key and git identity are learned from use, never asked (`$HOME/.claude/multi-agent-refs/setup/accounts.md` "Auto-learned fields").
 
 ### Step 3  -  Interactive token onboarding (for missing tokens)
 
-Git identities are NOT asked as a separate step. They are learned when tokens are added via the Token Save Flow below. Each token save triggers an identity prompt:
-
-```
-Token saved. Which git identity uses this token?
-  1. Ada Lovelace <ada@example.com>
-  2. Ada Lovelace <ada@personal.com>
-  n. Create new identity
-Select:
-```
-
-- First token ever → no existing identities → asks name + email → creates identity → maps token
-- Subsequent tokens → pick existing or create new → maps token to that identity's `servicePatMap`
-- Multiple accounts per platform supported (e.g. two GitHub tokens, each mapped to a different identity)
-- Identity is stored in `prefs.global.identities[]`, token-to-identity binding in `identity.servicePatMap`
-
-**Legacy compatibility**: If `prefs.global.gitIdentities` (deprecated) is present, `migrate-prefs.mjs` renames it to `identities` automatically.
-
-For each MISSING service, run the **Token Save Flow** below. When creating new tokens, use the **standard key name** from Step 1b table.
-
-#### Sequential onboarding loop (strict)
-
-The Step 2 discovery summary is never the end of setup. Immediately after showing it, walk the missing services ONE BY ONE in this fixed order and run the Token Save Flow for each:
-
-1. `jira`
-2. `bitbucket_token` (then `bitbucket_user` right after, if missing)
-3. `github`
-4. `confluence`
-5. `figma`  -  Figma Personal Access Token (Tier 2, REST)
-6. `figma_mcp`  -  Figma MCP auth (Tier 1); its own prompt, never folded into the PAT prompt
-7. `fortify`
-8. `graylog`
-9. `firebase`
-10. `jenkins`
-11. App Store Connect block (Step 3b; only when the target repo is iOS)
-12. Google Play block (Step 3d; only when the target repo is Android)
-13. Free-model keys `llm-<id>` (only after `route-on --free`): `$HOME/.claude/multi-agent-refs/setup/free-models.md`
-
-Loop rules:
-
-- **One prompt per service.** Never collapse the list into a single "add missing tokens now?" yes/no, and never offer one multi-select covering all services: each service has its own source URL, key name, identity binding and host prompt, so each gets its own Token Save Flow pass.
-- **Each service pass asks, in order: token → author → host → read binding (GitHub, Bitbucket; Token Save Flow Step 3.7).** Step A/B collect the secret, Step C binds the git identity (author)  -  Bitbucket and GitHub included; every saved token gets an author  -  and Step 3.5 asks the host domain inline for hosted services (jira, confluence, bitbucket, fortify, graylog) - plus the Fortify project versions and the optional Graylog test instance. GitHub and Figma skip the host question (fixed domains); `bitbucket_user` skips author binding (username, not a PAT). Never end a service pass with the token saved but the author or a required host unasked.
-- **Skip is per-service.** A Skip answer leaves that service's `keychainMapping` at `null` and the loop continues with the next service. Skips never abort the loop.
-- **`figma` and `figma_mcp` are distinct credentials for distinct tiers  -  ask both.** Skipping the PAT does not imply skipping MCP, and vice versa. The `figma_mcp` pass opens with a Remote / Local mode question instead of a clipboard paste (see "Figma MCP Setup" below): Remote generates a `figu_` OAuth token for the current user, Local wires the PAT-based local server.
-- The loop ends only when every missing service has been asked exactly once; then continue to Step 4 (Verify all).
-
----
-
-### Token Save Flow (reusable)
+Identities are learned in the Token Save Flow (Step C), never asked separately.
 
-Full procedure: `$HOME/.claude/multi-agent-refs/setup/token-save-flow.md`. Read it for every token prompt (Steps 3, 3b, 3c and any command that saves a token).
+Walk the missing services ONE BY ONE, in this order: `jira`, `bitbucket_token` (then `bitbucket_user`), `github`, `confluence`, `figma` (PAT), `figma_mcp` (its own prompt), `fortify`, `graylog`, `firebase`, `jenkins`, App Store Connect (3b, iOS), Google Play (3d, Android), free-model keys `llm-<id>` (only after `route-on --free`: `$HOME/.claude/multi-agent-refs/setup/free-models.md`). One prompt per service, never one yes/no or multi-select for all; each pass asks token, author, host, read binding; Skip is per-service and never aborts the loop. Read `$HOME/.claude/multi-agent-refs/setup/token-save-flow.md` before the loop and for every token prompt: the loop rules, Steps 3.5 / 3.7 and identity learning.
 
-### Step 3b  -  App Store Connect onboarding (iOS only, optional)
+### Steps 3b-3d  -  Store and Firebase onboarding (optional)
 
-Runs inside Step 3. Every part of the API key lives in the Keychain, the `.p8` included: ask for the `.p8` as a path, validate it BEFORE saving with `node "$HOME/.copilot/scripts/probe-store-key.mjs" --asc ...` (exit 0 only), map `appstore_connect_private_key`, store it from the file with `credential-store.sh set appstore_connect_private_key - < <AuthKey_<keyId>.p8>`, run `node "$HOME/.copilot/scripts/write-store-config.mjs"`, then offer (picker, default keep) to delete the file. `store_asc_*` and `ios_testflight_validate` then read the key from the Keychain. The five entries, the tier picker and the probes: `$HOME/.claude/multi-agent-refs/setup/app-store-connect.md`. On Skip, nothing is written.
-
-### Step 3c  -  Firebase / Crashlytics onboarding (optional)
-
-Runs inside Step 3. Measure first  -  `bash "$HOME/.copilot/lib/fetch-crashlytics.sh" --probe` answers `tier-1-ready` / `tier-1-no-grant` / `malformed` / `unreachable`  -  then ask by that answer, never blind. Store the Firebase service-account JSON as issued; never base64 it. Skip writes nothing. Then offer appId discovery: `bash "$HOME/.copilot/scripts/firebase-app-discovery.sh" <repo> --json` reads the pairs the repo already carries, for `firebase.accounts[].apps[]`  -  it saves a round trip per run; skipping costs nothing. The picker, both tiers, the role-request wording and the v1alpha caveat: `$HOME/.claude/multi-agent-refs/setup/firebase.md`.
-
-### Step 3d  -  Google Play onboarding (Android only, optional)
-
-Runs inside Step 3, only when the target repo is Android. One entry, `google_play`: the service-account JSON the toolkit's `store_play_*` tools use, which lets `/multi-agent-store-ready` run Android Gate 2. Ask for the JSON's path, validate BEFORE saving with `node "$HOME/.copilot/scripts/probe-store-key.mjs" --play --service-account <path>`, map `google_play`, then `credential-store.sh set google_play - < <path>` and `write-store-config.mjs`. Account prerequisites, the picker and the probe hints: `$HOME/.claude/multi-agent-refs/setup/google-play.md`. Skip writes nothing.
-
-### Step 3.5  -  Host Prompt (embedded in Token Save Flow)
-
-Part of the Token Save Flow reference above.
+Each key is validated BEFORE it is saved and lives only in the Keychain; Skip writes nothing. Read the matching file under `$HOME/.claude/multi-agent-refs/setup/` first: `app-store-connect.md` (3b, iOS, `.p8` included), `firebase.md` (3c: probe with `fetch-crashlytics.sh --probe` before asking; store the Firebase service-account JSON as issued), `google-play.md` (3d, Android).
 
 ### Step 3.6  -  Per-account host overrides (optional)
 
-**Runs only when** `~/.copilot/lib/account-resolver.sh` returns **more than one** account AND at least one account has Jira or Bitbucket tokens.
-
-For each non-default account (two identities, each with its own Jira host), ask once: "Account {label} has Jira/Bitbucket tokens but no host override yet. Use the global default ({hosts.jira}) or set a per-account host?" with options **1) Use global default** / **2) Set per-account host**. On `2`, prompt for `jiraHost` / `bitbucketHost` / `confluenceHost` (each optional) and save to `prefs.global.accounts[]`, e.g. `{ "id": "client-x", "jiraHost": "jira.client-x.example.com", "bitbucketHost": "bitbucket.client-x.example.com" }`.
-
-`account-resolver.sh` reads this on every invocation; per-account override wins over `global.hosts.*`. Skip this step on autopilot; `/multi-agent-setup accounts` opens it later.
-
----
+Only when `~/.copilot/lib/account-resolver.sh` returns more than one account and one has Jira or Bitbucket tokens. Read `accounts.md` "Per-account host overrides (Step 3.6)" (setup refs). Skipped on autopilot; `/multi-agent-setup accounts` opens it later.
 
 ### Step 4  -  Verify all
 
-Re-run scan from Step 1. Show final status:
-`All tokens present. Pipeline ready to use.` Then list the optional per-project features (configured on first use, nothing to do now): **Phase 5 Report Step 2 Wiki** (component wiki pages + Figma screenshots; activates when the task is a component AND a Figma token is in Keychain; adapters submodule / in-repo / github-wiki / separate-repo; first run asks: auto-detected path, custom path, skip once, or disable for this project, persisted); **channels** (post-hoc multi-channel reporter for Jira/Confluence/Wiki/PR, any branch with an open PR); **Default reviewers** (auto-fetched from the Bitbucket default-reviewers endpoint or GitHub CODEOWNERS on first PR). Next step: `/multi-agent "PROJ-12345"` to start a first task, `/multi-agent-help` for the full usage guide.
-
-If still missing, show which ones and let user skip (pipeline will re-ask for any needed token at Phase 0).
-
-### Step 5  -  Repo Discovery (optional)
-
-Pre-populates the Phase 0 project picker with repos the user is active in, merging three independent sources: local `$HOME` scan (depth 3, repo markers), Bitbucket (last 90 days, token-gated), GitHub (owner + collaborator, push in last 90 days, token-gated). A failing source skips only itself and is reported (never swallowed); discovery is idempotent and never destructive.
-
-```
-Step 5  -  Repo Discovery (optional)
-Scan for recent repos now to pre-populate the Phase 0 picker?
-
-  y  -  all three (local + Bitbucket + GitHub, ~10-30s)
-  l  -  local scan only (fastest, no network)
-  n  -  skip (Phase 0 will prompt for repo path manually)
-```
-
-The scan commands, merge-by-origin dedup, the multi-select picker, the `recentProjects` / `serviceStatus` prefs shapes and the skip / degrade rules live in `$HOME/.claude/multi-agent-refs/setup/repo-discovery.md`  -  read that file when the user opts in.
-
-### Step 6  -  Remember as Multi-Repo Group (optional)
-
-After Step 5, if the user picked **2 or more** repos, offer to remember the combination as a named group; Phase 0's project picker surfaces saved groups at the top, so a multi-repo task becomes a single keypress next time. Auto-skipped if Step 5 was skipped or fewer than 2 repos were selected (single-repo selection is a no-op).
-
-```
-Step 6  -  Remember as a multi-repo group (optional)
-You picked 2 repos: Checkout, UIComponents.
-Save this combo for one-tap selection in Phase 0?
-  Group name (Enter for auto): [Checkout + UIComponents]
-  Skip with 'n'.
-```
+Re-run the Step 1 scan and show the final status (`summaries.md` "Step 4 final status"). Still missing: show which and let the user skip; Phase 0 re-asks.
 
-- **Auto-name** (suggested, editable): 2 repos `"<repoA> + <repoB>"`; 3-4 repos `"<repoA>, <repoB>, <repoC>(+1)"`; 5+ repos `"<repoA> + <count-1> more"`. Labels use the human label from `recentProjects` (path basename, not the full path).
-- **Save** to schema `global.recentGroups[]` (`repos` required, `label` / `count` / `lastUsed` optional), e.g. `{ "label": "Checkout + UIComponents", "repos": ["~/dev/Checkout", "~/dev/UIComponents"], "count": 1, "lastUsed": "2026-04-15T21:08:00Z" }`.
-- **LRU + dedup**: a new group is unshifted to the front. The same set of `repos` (order-independent compare) bumps the existing entry to the front, increments `count`, updates `lastUsed`; do NOT create a duplicate. Schema cap is 10 entries; the oldest past the cap are dropped.
-- **`n`** → not saved; the picker still works for one-time use, and a future Phase 0 selection of the same combo re-prompts.
+### Steps 5-7  -  Repo discovery, groups, identity routing (optional)
 
-### Step 7  -  Platform Identity Routing (optional)
+Read the file under `$HOME/.claude/multi-agent-refs/setup/` for each step the user opts into: `repo-discovery.md` (5: local, Bitbucket, GitHub; a failing source skips only itself and is reported), `multi-repo-group.md` (6: only after 2+ repos), `identity-routing.md` (7).
 
-Full procedure: `$HOME/.claude/multi-agent-refs/setup/identity-routing.md`. Read it for Step 7.
+### Credential store, token sources, Figma MCP
 
-### Cross-Platform Notes (Step 1-9) and Token -> Source Mapping
-
-Every read and write goes through `~/.copilot/lib/credential-store.sh`, which wraps the macOS Keychain; stay on the helper rather than calling `security` directly. Clipboard handling and the no-backend case: `$HOME/.claude/multi-agent-refs/keychain.md` "Credential store mechanics". Standard key names are a convention for NEW tokens; the key names, token types and where to generate each one live in `$HOME/.claude/multi-agent-refs/keychain.md` "Standard key names". Git identities are stored in preferences, never in the credential store.
-
-### Inline Token Save Pattern
-
-All tokens go through `~/.copilot/lib/credential-store.sh` (auto-delegates to `~/.copilot/scripts/keychain.py`, see Setup above).
-
-```bash
-# PAT / API Key / JSON contents (from clipboard)
-pbpaste | ~/.copilot/lib/credential-store.sh set "<SERVICE_NAME>" -
-pbcopy < /dev/null  # clear clipboard
-
-# Non-secret value typed inline (a secret on argv is visible to ps and lands in shell history)
-~/.copilot/lib/credential-store.sh set "<SERVICE_NAME>" "<VALUE>"
-
-# Key file from disk (the .p8, the Google Play JSON; or when the clipboard is unavailable)
-~/.copilot/lib/credential-store.sh set "<SERVICE_NAME>" - < /path/to/file.json
-
-# Read  -  a JSON value comes back exactly as it was stored, newlines included
-~/.copilot/lib/credential-store.sh get "<SERVICE_NAME>"
-
-# Maximum stdin hygiene (the secret never lands on argv / shell history): the Python helper with the - sentinel
-pbpaste | ~/.copilot/scripts/keychain.py set "<SERVICE_NAME>" -
-```
-
-### Figma MCP Setup (Remote / Local question)
-
-Full procedure: `$HOME/.claude/multi-agent-refs/setup/figma.md`. Read it for the Figma MCP question.
+Always `~/.copilot/lib/credential-store.sh` (macOS Keychain, macOS only, ADR-0012), never `security` directly; secrets from the clipboard or a file, never argv. Key names, token sources and store mechanics: `$HOME/.claude/multi-agent-refs/keychain.md`. Identities live in preferences. Figma MCP Remote / Local: `$HOME/.claude/multi-agent-refs/setup/figma.md`.
 
 ### Security Rules
 
-- Never paste tokens into terminal or chat  -  use `pbpaste` for input
+- Never paste tokens into terminal or chat - use `pbpaste` for input
 - Never hardcode tokens in source code
 - Never commit tokens to git history
 - Clear clipboard immediately: `pbcopy < /dev/null`
 - `2>/dev/null` suppresses stderr (prevents metadata leakage)
 
-### Setup from Scratch Summary
-
-On a new machine: (1) `npx @{npm-scope}/multi-agent-pipeline install`; (2) `/multi-agent-setup`; (3) the interactive flow: token scan (shows what is missing) -> Git Identity creation (name + email) -> inline commands for missing tokens -> final verification; (4) ready: `/multi-agent "PROJ-12345"`, `/multi-agent "https://github.com/.../issues/42"` or `/multi-agent "bug description"`.
-
-All tokens are optional in the sense that every service can be answered with Skip  -  but the ASKING is not optional: the Step 3 sequential loop still walks every missing service one by one (token → author → host). Phase 0 re-asks at runtime only for tokens the user skipped here.
+From scratch: `npx @{npm-scope}/multi-agent-pipeline install`, `/multi-agent-setup`, then a task (`summaries.md` "Setup from scratch").
 
 ### Step 8  -  Enforcement hooks (optional)
 
-On Claude Code, offer to merge `$HOME/.claude/templates/claude-hooks.json`: three blocking `PreToolUse` gates (secret scan, agent-guard, read-size) plus non-blocking hooks on `PreCompact`, `SessionEnd`, `SessionStart` and `PostToolUse`, and a blocking `Stop` hook (`run-stop-guard.sh`). What each does: `$HOME/.claude/multi-agent-refs/picker-contract.md`.
-
-- Ask (picker): "Install the pipeline's hooks into `~/.claude/settings.json`?" Default Yes.
-- On Yes, deep-merge EVERY event in the template's `hooks` object (merging `PreToolUse` alone drops the capture hooks); keep existing hooks, never duplicate a matcher calling the same script.
-- Say only the three gates are hookable (no run-specific arguments); the rest are phase-enforced.
-- Say the read-size gate stays inert until `prefs.global.bulkRead.mode` is set; recommend `observe` first (why, and the Phase 3 exemption: `picker-contract.md`).
-
-Codex: offer only the syntax gate, then run `node "$HOME/.codex/scripts/host-hooks.mjs" install --host codex`. Copilot CLI: offer no hook (it discards `postToolUse` output as of 1.0.45).
+Claude Code: offer (picker, default Yes) to merge `$HOME/.claude/templates/claude-hooks.json` into `~/.claude/settings.json`; deep-merge EVERY event, never duplicate a matcher. Read `$HOME/.claude/multi-agent-refs/setup/hooks-and-plugins.md` before Step 8. Codex: only the syntax gate, via `node "$HOME/.codex/scripts/host-hooks.mjs" install --host codex`. Copilot CLI: no hook.
 
 ### Step 9  -  Default stack plugin enablement
 
-Stack skills ship as versioned plugins in the `{owner}/multi-agent-plugins` marketplace. On first setup, wire the stack so the pipeline works out of the box.
-
-1. Ensure the marketplace is known (idempotent):
-   ```bash
-   bash "$HOME/.copilot/scripts/plugin-refresh.sh" {owner} --add-only
-   ```
-2. Ask the detector, then derive (no marker list here; a second list would drift from the detector):
+1. `bash "$HOME/.copilot/scripts/plugin-refresh.sh" {owner} --add-only` (idempotent).
+2. Ask the detector, then derive; no marker list here:
 
    ```bash
    eval "$(bash $HOME/.copilot/lib/stack-detect.sh "$PROJECT_ROOT")"   # MA_STACKS, MA_STACK_WHY
@@ -349,11 +104,4 @@ Stack skills ship as versioned plugins in the `{owner}/multi-agent-plugins` mark
      console.log(m.pluginsForStacks(process.argv[1].split(" ").filter(Boolean)).plugins.join(" ")))' "$MA_STACKS"
    ```
 
-   Report `MA_STACK_WHY` with the result. `ai-common-toolkit` and
-   `ai-analyst-toolkit` are in every answer, the empty one included: neither is
-   stack-specific. **No marker matched is an answer** - those two, not a guess.
-   A name the marketplace does not carry is dropped with `dropped[]` naming it,
-   so a toolkit that was never shipped is caught before it fails to load.
-3. Report the enabled set. To change later, run `/multi-agent-stack <ios|android|web|backend|...>` in the repo. Pipeline Phase 1 auto-detects the stack for its own routing regardless of enablement.
-
-The marketplace name (`multi-agent-plugins`) is generic; a different org points `{owner}` at its own fork.
+3. Report `MA_STACK_WHY` and the enabled set (`hooks-and-plugins.md` "Step 9"); change later with `/multi-agent-stack <stack>`.

package/pipeline/skills/shared/core/multi-agent-status/SKILL.md

@@ -16,10 +16,20 @@ Show every active and completed task as a table.
    question:
 
    ```bash
-   node "$HOME/.claude/scripts/runs-index.mjs"          # grouped table
-   node "$HOME/.claude/scripts/runs-index.mjs" --json   # the same records
+   node "$HOME/.claude/scripts/status-overview.mjs"          # live sessions, tokens, accounts, runs
+   node "$HOME/.claude/scripts/status-overview.mjs" --json   # the same document
+   node "$HOME/.claude/scripts/runs-index.mjs" [--all]       # the full run table
    ```
 
+   `status-overview.mjs` answers "what is happening right now": each live
+   Claude Code session with the run it drives and its token spend (subagents
+   included), the tokens of the last 24 hours, the github.com accounts gh holds
+   with the active one marked, the git author, and which logical credentials
+   from `keychainMapping` are registered. It reads credential names only and
+   never a value; never run `credential-store.sh get` to "check" one. Show its
+   sections as they come, then the run table below. Token figures are list-price
+   estimates, not a bill.
+
    `runs-index.mjs` resolves through `lib/run-paths.sh` / `scripts/_run-paths.mjs`,
    so it sees both directory layouts (`<project>/<id>/` and the flat `<id>/`),
    the salvaged `artifacts/` copy Phase 4 leaves behind, and every spelling of a
@@ -42,6 +52,7 @@ Show every active and completed task as a table.
    | `stopped` - Stopped mid-development | anything else past phase 0 | `resume #N` or `kill #N` |
    | `question` - Left at a question | phase 0, nothing pending | `garbage-collect --abandoned` - nothing was built |
    | `unknown` - Status not recorded | no `status` field | say so; offer nothing |
+   | `done` - Finished | `status` is `complete`, `completed`, `done`, `abandoned` or `cancelled`, checked first | nothing; the table folds it into a count unless `--all` |
 
    A run with no `status` is **not** placed in an actionable group. Unknown is
    not a finding, and calling it dead is the same false claim in the other