@mmerterden/multi-agent-pipeline 20.6.0 → 20.7.0

package/pipeline/multi-agent-refs/features/design-conformance.md

@@ -12,14 +12,12 @@
 <!-- /toc -->
 
 A design audit that reads a screen top to bottom and reports what looks wrong
-finds about one defect per element: the wrong font on a label, and not that same
-label's wrong colour and wrong inset. This file is the catalog, and the three
+catches roughly a single defect per element: it spots a label's wrong font and
+misses the wrong colour and wrong inset on that very label. This file is the catalog, and the three
 mechanisms that turn "I looked at it" into a countable result.
 
-Derived generically from an upstream corporate screen-QA tool (recorded in
-`derivedSkillSources`). The doctrine is portable. Its vendored design-token
-catalogs and product examples are not, and were not taken - section 7 says what
-replaces them.
+The doctrine is generic. It carries no design-token catalog and no product
+examples - section 7 says what stands in for them.
 
 Consumers: `/multi-agent:design-check` (the runner), Phase 3 review when a UI
 diff is under review, and `features/visual-evidence.md` when a capture has to
@@ -27,10 +25,9 @@ prove a fix. Gate: `smoke-design-conformance.sh`.
 
 ## 0. Why this runs as a gate
 
-`design-check` existed as a command for a while with no phase invoking it, so the only
-thing standing between a build and visual drift was the user opening the app and
-looking. On one run that produced 16pt padding where the frame said `Spacing/12`, and a
-full sheet rebuild afterwards.
+A conformance check that no phase invokes leaves the user opening the app as the
+only barrier between a build and visual drift: 16pt padding where the frame says
+`Spacing/12` ships, and is found after the fact.
 
 The reason it cannot be advice is structural, not historical: a reviewer reading a diff
 cannot see spacing. Every other Phase 4 check reads text and reasons about text; this
@@ -49,8 +46,8 @@ once, before any comparison:
    into its parent.
 2. For each row, pre-fill the design side of every rule that applies and leave
    the implementation side blank.
-3. Fill every blank. **A blank cell is a fail-to-verify, not a pass**, and it is
-   reported as one.
+3. Complete every empty cell. **Any blank cell is a fail-to-verify** (never a pass),
+   and the report lists it that way.
 
 The inventory is the coverage guarantee; the rule groups in section 5 are the
 per-cell recipe. A truncated inventory makes the denominator wrong, so it is
@@ -74,15 +71,15 @@ and safe-area insets are not in it.
 ## 3. Adaptive per-component convergence
 
 One pass over a component catches roughly one defect on it. So each component is
-re-checked until **two consecutive attempts find nothing new on it**.
+checked again and again, stopping once **two consecutive attempts find nothing new** there.
 
-- Soft cap: reaching attempt 8 without two consecutive clean attempts stops that
-  component with a `did-not-converge` warning. There is never a ninth attempt.
+- Soft cap: if attempt 8 arrives and the last two attempts were not both clean, the
+  component ends with a `did-not-converge` warning. A ninth attempt never runs.
 - A component with a font, a margin and a colour defect needs about three
   finding attempts plus two clean ones. A correct component needs the two clean
   attempts and nothing more.
-- The screen is done when **every** inventoried component has reached two
-  consecutive clean attempts or its cap with a warning. Not when the walk
+- The screen is finished once **each** component in the inventory has either two
+  clean attempts in a row or has hit its cap and carries the warning. Not when the walk
   reached the bottom.
 
 On a fixing run, each attempt that found something is fixed, re-captured, and
@@ -94,37 +91,37 @@ what each attempt changed rather than one undifferentiated diff.
 | Tag | Meaning |
 |---|---|
 | `[MEASURE]` | Verified in the primary capture: design value against measured pixels or resolved code value (section 2) |
-| `[CAPTURE+]` | Needs an extra capture pass - a second appearance, a mirrored layout, another width, another state. Skipping one is allowed only if the skip is logged |
+| `[CAPTURE+]` | Requires one more capture - a second appearance, a mirrored layout, a different width or state. A pass may be skipped, provided the log records the skip |
 | `[A11Y]` | Accessibility lane: the platform accessibility tree (labels, element frames) plus contrast math |
-| `[DYNAMIC]` | Behavioural or temporal; a static capture cannot show it. Verify by driving the device, or report `not verified (dynamic)`. **Never silently pass a `[DYNAMIC]` item** |
+| `[DYNAMIC]` | Behavioural or temporal; a static capture cannot show it. Drive the device to verify it, or report `not verified (dynamic)`. **Never silently pass a `[DYNAMIC]` item**; it is either exercised or reported |
 
 ## 5. The catalog
 
 Run every applicable item for **every** component, then every gap through
-group 2, then the whole-screen passes (17, 21, 22, 24, 25). A check that was not
-run is a fail-to-verify.
+group 2, then the whole-screen passes (17, 21, 22, 24, 25). Any check left unrun
+counts as a fail-to-verify.
 
-**1. Layout** `[MEASURE]` - x relative to container (never absolute y: the status
-bar offsets it), y relative to an in-content span, L/R/T/B margin to parent,
+**1. Layout** `[MEASURE]` - x measured from the container (y is never taken as an
+absolute value, since the status bar shifts it), y relative to an in-content span, L/R/T/B margin to parent,
 centring, baseline alignment across a row, shared leading edge for siblings,
 label-left/value-right rows aligned at both ends, safe-area and system-bar
 clearance.
 
 > **Horizontal-inset lane** - the most-skipped one. For every element record
 > **both** sides of the leading inset: the design value and the measured
-> implementation value. One side filled is a fail-to-verify. Then two cheap
-> catches that need no per-element math: (a) **leading rail** - every loose,
-> non-carded text in a vertical group must share one leading x; if the
-> implementation puts a subtitle at the card's outer edge while the design insets
-> it, the rail is broken; (b) **sibling consistency** - when sibling screens
-> exist, diff the same element's inset across them; the outlier is usually the
-> bug. A different text-wrap point is a symptom of a different margin, not only
-> of a different font.
+> implementation value. If only one of the two is filled, that is a fail-to-verify.
+> Two inexpensive checks follow that require no per-element arithmetic:
+> (a) **leading rail** - loose text outside any card, stacked vertically, lines up
+> on a single leading x; a subtitle the implementation places on the card's outer
+> edge, where the design indents it, breaks the rail; (b) **sibling consistency** -
+> if the screen has siblings, compare the inset of one element across all of them;
+> the one that differs is usually the defect. Text that wraps at another point
+> often signals a changed margin, and not only a changed font.
 
 **2. Spacing** `[MEASURE]` - outer margins, inner padding, screen edge margin
 (L=R symmetric), text-to-icon and icon-to-button and card-to-card and
 section-to-section gaps, list/grid/row spacing, the vertical gap **between**
-adjacent components (`next.y - (prev.y + prev.h)` against the stack spacing), and
+neighbouring components (compute `next.y - (prev.y + prev.h)` and compare it with the stack spacing), and
 every gap resolving to a spacing token - an off-scale value is a deviation.
 
 **3. Size** `[MEASURE]` - width and height against the design (measured), min and
@@ -166,23 +163,23 @@ single-tint template is a defect), and vector crispness.
 
 **11. Buttons** `[MEASURE]` - width and **measured height** (from the rendered
 fill rect, never a frame token), L/R/T/B spacing with L=R symmetry, the inner
-label's font/weight/colour/alignment **as its own row**, the inner icon
+label as a **separate row** (font, weight, colour, alignment), the inner icon
 (presence, size, colour, side, spacing), centring, fill and border and text
 colour for the current state, `[CAPTURE+]` the state set (group 21).
 
 > A button instance matches no text, icon or field kind, so an inventory built by
 > kind drops it silently - and with it the button height and its nested label.
-> The button is its own row and its children are exploded into their own rows.
+> So each button gets a row, and each child inside it gets a row of its own too.
 
 **12. Input fields** `[MEASURE]` - **measured height** (the rendered field box,
 never a frame or size token, because internal padding is not in the token),
 width, border, radius, placeholder text and its colour and alignment, background
-shade (read-only vs editable), prefix or affix and its colour, cursor and
+shade (editable vs read-only), the prefix or affix with its colour, cursor and
 selection colour, character counter behaviour, `[CAPTURE+]` focus/error/disabled/
 filled states with the error message's colour, position and icon, `[DYNAMIC]`
 keyboard type.
 
-**13. Card** `[MEASURE]` - padding, radius, background, border, shadow, and
+**13. Card** `[MEASURE]` - radius, padding, border, background, shadow, and
 content grouping: **sample the pixel behind every text block** - is it inside a
 card or bare on the page background? A design block in a card that the
 implementation renders bare (or the reverse) is a wrong-container finding
@@ -192,7 +189,7 @@ side is code-verifiable (inside a card helper vs placed bare in a stack with
 padding). Never infer this from a glance.
 
 **14. Lists** `[MEASURE]` - item height and internal padding, divider colour and
-thickness and insets, inter-item spacing, section header grouping and order,
+thickness and insets, spacing between items, how section headers group and order,
 `[DYNAMIC]` scroll behaviour and lazy loading.
 
 **15. Navigation / header** `[MEASURE]` - bar height, title text and alignment,
@@ -200,8 +197,8 @@ back affordance present and correct and mirrored under RTL, right-side actions
 present and ordered, bottom navigation items with icons, labels and selected
 state, `[DYNAMIC]` transition style.
 
-**16. Scroll** - `[DYNAMIC]` smooth scroll, bounce, overscroll, sticky header,
-scroll indicator; `[MEASURE]` the pinned header or footer position, which is the
+**16. Scroll** - `[DYNAMIC]` scroll smoothness, bounce and overscroll, a sticky
+header, the scroll indicator; `[MEASURE]` the pinned header or footer position, which is the
 static part a capture can check.
 
 **17. Responsive** `[CAPTURE+]` - small, medium and large phone widths, tablet,
@@ -214,23 +211,23 @@ width rather than reasoning about it.
 fade/scale/slide/rotation, loading and skeleton animation, haptics. Verify by
 recording the device or report `not verified (dynamic)`.
 
-**20. Visibility** `[CAPTURE+]` - hidden vs visible renders correctly; collapse
-and expand states captured separately.
+**20. Visibility** `[CAPTURE+]` - both the visible and the hidden variant render as
+designed; the expanded and collapsed states each get their own capture.
 
 **21. States** `[CAPTURE+]` per interactive component - default, pressed, focus,
 selected, active, disabled (colour, opacity, and genuinely not tappable),
 loading, empty, error, success.
 
-> **State fidelity gate**: the captured implementation must be in the exact state
-> the design frame depicts - the same toggle position, the same filled or empty
+> **State fidelity gate**: before comparing, put the implementation into precisely
+> the state shown by the design frame - the same toggle position, the same filled or empty
 > content, the same validation result. A capture in the wrong state is redone,
 > not compared.
 
 **22. Accessibility** `[A11Y]` - contrast at least 4.5:1 computed from sampled
 colours, tap target at least 44x44pt / 48x48dp from the accessibility tree,
 screen-reader label present and meaningful plus a meaningful hint, correct
-traits, an accessibility identifier on every interactive element, and a logical
-focus order. Whether to also audit scaled text sizes depends on the project: a
+traits, an accessibility identifier on each element a user can interact with, and
+a logical focus order. Whether to also audit scaled text sizes depends on the project: a
 design system with fixed, non-scaling typography makes a forced-scale render
 meaningless noise, so state which of the two the project is instead of assuming.
 
@@ -258,31 +255,31 @@ overflow. The value itself (a name, a number, a masked field) is not under test.
 **27. Component presence and order  -  hard gate** - the group the whole walk
 exists for.
 
-> Mechanical, not a glance. Number every element of the design list - text **and**
-> every icon, avatar, badge, **and every button** - and for each write its
-> implementation counterpart or `MISSING`. Report the count explicitly: "N design
-> components -> N implementation counterparts". "Complete" may not be concluded
+> Done mechanically, never by eye. Give a number to each element in the design
+> list - the text **and** each icon, avatar and badge, **and each button** - and
+> beside it name the matching implementation element, or write `MISSING`. State
+> the totals outright: "N design components -> N implementation counterparts". "Complete" may not be concluded
 > without that list. A button and the label nested inside it are two presence
 > checks, not one.
 >
-> - **Icons are the most-missed presence class.** For every icon in the design
->   list, locate it in the render by measuring its coloured bounding box. A design
+> - **Presence checks miss icons more than anything else.** Find each design-list
+>   icon in the render by measuring the bounding box of its coloured pixels. A design
 >   icon with roughly no matching pixels is a missing-element finding.
-> - **Recurse into nested blocks.** The gate applies to rows inside cards - masked
->   rows, list rows, key/value rows - not only to top-level sections. "That card
->   looks right" is not a pass.
+> - **Descend into nested blocks.** Rows within cards (masked, list, key/value)
+>   fall under the gate just as top-level sections do. A card that "seems fine"
+>   has not passed.
 > - **Bidirectional, and code-side too.** Diff design-to-implementation
 >   (`MISSING`) *and* implementation-to-design (`EXTRA`). The most-missed extra is
 >   a neutral decoration the implementation adds - a trailing chevron, an
 >   underline, a strikethrough - which a colour-based, one-directional comparison
 >   cannot see. Diff the implementation's explicit decoration modifiers against
 >   the design's own decoration nodes, independently of the string.
-> - **A localization gap does not short-circuit this gate.** Raw keys are one
+> - **Missing localization never ends this gate early.** Raw keys form a single
 >   finding; presence, icon, decoration and structure checks still run, because
 >   they read code and spec rather than the rendered string.
 
-Findings: `MISSING` · `EXTRA` · `MISSING-BETWEEN` (dropped from the middle of the
-sequence) · `REORDERED` · `WRONG-STATE` · `WRONG-CONTAINER` (present but grouped
+Findings: `MISSING` · `EXTRA` · `MISSING-BETWEEN` (absent from inside the sequence,
+not at its ends) · `REORDERED` · `WRONG-STATE` · `WRONG-CONTAINER` (present but grouped
 differently, loose vs carded).
 
 **28. Keyboard and input behaviour** `[DYNAMIC]` - keyboard avoidance with the
@@ -291,17 +288,18 @@ correct field.
 
 **29. Analytics** - out of visual scope; checked only when the spec requires it.
 
-**30. Cross-check matrix** - per component confirm x, y, w, h, the four margins,
-the four paddings, font family/size/weight, line height, letter spacing, text
-colour, background colour, border width/radius/colour, shadow, opacity, icon
-size/colour/position, image size/crop, divider, alignment, responsive, state,
+**30. Cross-check matrix** - for each component confirm x, y, w and h, all four
+margins and all four paddings, the font's family, size and weight, letter spacing,
+line height, text colour, background colour, the border's width, radius and
+colour, shadow, opacity, icon size, colour and position, image crop and size,
+divider, alignment, responsive behaviour, state,
 animation, safe area, and overflow. **Mark only deviations** on the image;
 matches belong in the report text.
 
 ## 6. Output
 
-Mark only problems on the image, with thin lines. Everything else goes in the
-report, whose section keys are stable and whose prose follows `outputLanguage`:
+Draw thin lines on the image around problems and nothing else. All other
+content belongs in the report, whose section keys are stable and whose prose follows `outputLanguage`:
 
 | Key | Content |
 |---|---|
@@ -309,7 +307,7 @@ report, whose section keys are stable and whose prose follows `outputLanguage`:
 | `localization` | Raw keys, missing keys, hardcoded strings |
 | `matches` | What was checked and agreed |
 | `ignored` | What was deliberately out of scope, with the reason |
-| `not_verified` | **Every** `[DYNAMIC]` and `[CAPTURE+]` item that was not run, so the coverage gap is explicit rather than absent |
+| `not_verified` | **Every** `[DYNAMIC]` and `[CAPTURE+]` item left unrun, which makes the coverage gap visible instead of silent |
 
 Each finding is `[what] + [why] + [how]` with `file:line` wherever the
 implementation side is code-resolvable. A finding without a file reference is

package/pipeline/scripts/_notices.mjs

@@ -158,3 +158,14 @@ export function unnamedUpstreams(externalDir) {
   }
   return out;
 }
+
+/**
+ * Skills under shared/external with no `metadata.source`. Every skill that ships
+ * into a stack plugin states where it came from: `multi-agent-pipeline` when it
+ * was written here, `"<upstream> (<license>)"` when it is vendored.
+ */
+export function sourcelessSkills(externalDir) {
+  return skillDirs(externalDir).filter(
+    (s) => !metadataSource(readFileSync(join(externalDir, s, "SKILL.md"), "utf8")),
+  );
+}

package/pipeline/scripts/gen-skills-index.mjs

@@ -81,7 +81,7 @@ md += `Single source of truth for skills delivered to both Claude Code (\`~/.cla
 md += `**Total:** ${total} skills (${breakdown}). Auto-generated by \`scripts/gen-skills-index.mjs\`  -  do not edit by hand.\n\n`;
 md += `## Directory layout\n\n`;
 md += `- **\`core/\`**  -  ${counts.core} \`multi-agent*\` orchestration skills that are pipeline-critical. Edits here are core-code changes.\n`;
-md += `- **\`external/\`**  -  ${counts.external} iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.\n`;
+md += `- **\`external/\`**  -  ${counts.external} iOS / Android / generic skills that ship into the stack plugins. Each names its origin in \`metadata.source\`: \`multi-agent-pipeline\` when written here, or the upstream and license a \`NOTICE-*.md\` in this directory covers.\n`;
 md += `- Install destinations (ADR-0009): Claude Code gets NO local copy of \`external/\` - it loads those skills from the \`multi-agent-plugins\` marketplace, namespaced (\`ai-<stack>-toolkit:<name>\`); only the two compliance catalogs from \`core/\` land in \`~/.claude/skills/\`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. \`external/\` remains the single authoring source that \`build-stack-plugins.mjs\` publishes from.\n\n`;
 md += `Source layout is logical grouping only  -  skill discovery at runtime is unchanged.\n\n`;
 md += `## Categories\n\n`;

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-26T13:39:28Z",
+  "generatedAt": "2026-09-26T16:00:24Z",
   "skillCount": 218,
   "entries": [
     {
@@ -265,7 +265,7 @@
     },
     {
       "path": "shared/external/agent-introspection-debugging/SKILL.md",
-      "sha256": "7a93e115f86092408d0b653968b396276243b49c5dc1543f7c2689c861719767"
+      "sha256": "8506e5cfede72a7d59ae79f108608e84054617c43a9101692a7e97fcea1a5d0a"
     },
     {
       "path": "shared/external/alarmkit/SKILL.md",
@@ -273,7 +273,7 @@
     },
     {
       "path": "shared/external/android-architecture/SKILL.md",
-      "sha256": "5a3b13a2376378ce4977d1df14003a8f65e2d1ef1561ae8c40f10e3e1759c204"
+      "sha256": "71f6af966558767378d0605fae9a280fdf05eeba3379835170ee4a274f1846a4"
     },
     {
       "path": "shared/external/android-build-quality-gates/SKILL.md",
@@ -297,11 +297,11 @@
     },
     {
       "path": "shared/external/android-performance/SKILL.md",
-      "sha256": "5cb7429516fbaccee318af0e3071df631c56381b6857ef4bbd921eb213adef64"
+      "sha256": "1e578cbb63244d461eb3a5ad78d2cff675eb3a5a18a5b5ddb7da60bdbe2d6391"
     },
     {
       "path": "shared/external/android-security/SKILL.md",
-      "sha256": "9d528fbed56fb1b40a34015bbd16b818a4ccccae61e0ab667ad9436efc4ccafa"
+      "sha256": "43c5ef4c6367eb1349b07673fbd3b0bf6922d7c3a2eff18edc48c5c74499bf92"
     },
     {
       "path": "shared/external/api-patterns/SKILL.md",
@@ -353,7 +353,7 @@
     },
     {
       "path": "shared/external/backlog/SKILL.md",
-      "sha256": "abb3b1d9f0efa8413ea73fc969c22caeadfa8f02d0d9f5395259befccdcda7ea"
+      "sha256": "f48d35654410bb800ab477c87b7ce6db8e758671cbb733c36429d8435b7d250f"
     },
     {
       "path": "shared/external/callkit-voip/SKILL.md",
@@ -361,7 +361,7 @@
     },
     {
       "path": "shared/external/ci-cd-pipelines/SKILL.md",
-      "sha256": "8776746817fea8f67bd12354822f674473fdad7018078766e420cef724b086fc"
+      "sha256": "753a90d54c392d0a120c4e36ab34d7a43f9e0fe63609e65154c9c1da6d824763"
     },
     {
       "path": "shared/external/clean-code/SKILL.md",
@@ -373,15 +373,15 @@
     },
     {
       "path": "shared/external/compose-components/SKILL.md",
-      "sha256": "756e0c44643b0688295bd8b896f12dd37f7c30447b3e3a4e08223dfd74f9473e"
+      "sha256": "03ad58d5552b37480978462907539fe1070eeafce80a2a3c943d1c3880983f3f"
     },
     {
       "path": "shared/external/compose-navigation/SKILL.md",
-      "sha256": "2b2ca56d7f61f334cc9089483597453dd16b67378e2f8fa9b3c440fd89cf91e8"
+      "sha256": "5be0bc654b17eb1c81b44ca2eb5273be4e935f6f59043c54157041a0a18926b5"
     },
     {
       "path": "shared/external/compose-testing/SKILL.md",
-      "sha256": "002c9420e063defc5cea13e59a4146bfb4e96075f2e5acb19aaa14bd215c6564"
+      "sha256": "e20c1c3e281778f5a11bbed04d4d42e9ba1c23a857b32d34a98806ed695e2c50"
     },
     {
       "path": "shared/external/contacts-framework/SKILL.md",
@@ -413,7 +413,7 @@
     },
     {
       "path": "shared/external/council/SKILL.md",
-      "sha256": "3556c03e41605785e4dad4e450511043e9c399100cc470587021359bae66e837"
+      "sha256": "6d69ba7de8cbfa06f94f551601b5517c91350f6dd09901df68acf979d3803134"
     },
     {
       "path": "shared/external/cryptokit/SKILL.md",
@@ -421,11 +421,11 @@
     },
     {
       "path": "shared/external/css-modern/SKILL.md",
-      "sha256": "355a6bb67131dcf52cf51fc4fb015ada15705234f5ca5f03124f25cc916b0d4d"
+      "sha256": "911a7f371b24ef43790568e358a941f8ff67c8cb6fa57b5daa1a388964d03310"
     },
     {
       "path": "shared/external/database-patterns/SKILL.md",
-      "sha256": "948044e98af068c315cfc1649f6f7769767a0c43f5f2e3ce3b04c2715d94f98b"
+      "sha256": "1551a9a5d505fd99cb1a618cfe6d64ade566f2935f09fec6d986274f1ddba98b"
     },
     {
       "path": "shared/external/debugging-instruments/SKILL.md",
@@ -453,11 +453,11 @@
     },
     {
       "path": "shared/external/evidence-github/SKILL.md",
-      "sha256": "9cc24e73cb8b66a7495567f83df4bca932d90c1de4dbf3b97b1dd59378dbb75b"
+      "sha256": "cdcd157ecb3579b0a664716b4f6099a17d43361157c28124e44622afb5b1af68"
     },
     {
       "path": "shared/external/evidence-registry/SKILL.md",
-      "sha256": "97d4cceb1a8c52ae15597312c14c54d84b6b55ab9fb007e1a203492c4bf1b046"
+      "sha256": "139a98ede546d2ac60e71ffa0b571fda714d0f5c266e248b3e527265c340ae37"
     },
     {
       "path": "shared/external/fastapi-pro/SKILL.md",
@@ -473,7 +473,7 @@
     },
     {
       "path": "shared/external/gradle-kotlin-dsl/SKILL.md",
-      "sha256": "b0eb32ef4fece08d58e89eebb20e906646be9525ae86261f4c02dd8e4acfb9c3"
+      "sha256": "af7b1e30e2448f43b5100b2a935bbaadde86ccd490844c901736c9270f8cc3ce"
     },
     {
       "path": "shared/external/healthkit/SKILL.md",
@@ -521,11 +521,11 @@
     },
     {
       "path": "shared/external/html-semantic/SKILL.md",
-      "sha256": "00c19304fb6195069d8fd42fe2ead8aeb03e9d01845bc17df17100cd814c829a"
+      "sha256": "43e05d6bf99d59fda858cef3c8c4837ae17e91826ffd1cd517612300cafff739"
     },
     {
       "path": "shared/external/humanizer/SKILL.md",
-      "sha256": "febdbb9843f6e5606d5f5aa9faa556edbc7a5fc387fc85a80aaa831789ea0092"
+      "sha256": "25097784b1724423aebb35fcee60ba6c458a4ff5aa2bb7f45eccfc810a63a192"
     },
     {
       "path": "shared/external/ios-accessibility/SKILL.md",
@@ -533,7 +533,7 @@
     },
     {
       "path": "shared/external/ios-coding-standard/SKILL.md",
-      "sha256": "e70a537cf4dd26fd9537d85bd997eaff307b7b2c26ec7004e88aa82c945cd17f"
+      "sha256": "43a0e7d7c87b6abc9db15c38be5984e79e551bc5d7957394ad802ba50ea3b713"
     },
     {
       "path": "shared/external/ios-debugger-agent/SKILL.md",
@@ -545,7 +545,7 @@
     },
     {
       "path": "shared/external/ios-module-structure/SKILL.md",
-      "sha256": "3a79c225026be7aaf8302be0c9bdf3cce1d54ac445c8a5085b6845a4f26c4a83"
+      "sha256": "abb85b305ffeb1f3cd5015fe630311b22a6914c88c59b8d4b71691496235f7b9"
     },
     {
       "path": "shared/external/ios-networking/SKILL.md",
@@ -553,7 +553,7 @@
     },
     {
       "path": "shared/external/ios-security/SKILL.md",
-      "sha256": "691c1bcc74e7e6445a4786c6ce7e94e5706d8dea725423e68089d37e1cfc7dc4"
+      "sha256": "48924d4faea93fdf435851cbc77ba26cb33f3f8256954787af539f410f64d5c0"
     },
     {
       "path": "shared/external/ios-simulator/SKILL.md",
@@ -569,7 +569,7 @@
     },
     {
       "path": "shared/external/localization-reuse-map/SKILL.md",
-      "sha256": "26ace50f907bc0c25afc323387e79d2eeaacc998c93b50456a5dab2ddc146152"
+      "sha256": "565fa80ffa729f49cb4a54fb8f1da98397de5aaf7fb308753d261b5dc9f51f46"
     },
     {
       "path": "shared/external/macos-menubar-tuist-app/SKILL.md",
@@ -601,7 +601,7 @@
     },
     {
       "path": "shared/external/nextjs-app-router/SKILL.md",
-      "sha256": "6fa24c3362f2b84c0e57390aac7e3c9e9dc69e9a937d260feb55584e5f224731"
+      "sha256": "a6948eb7d1feb1940b222e671d092c8e56e105dc580f009143ea863f0130922e"
     },
     {
       "path": "shared/external/nodejs-backend-patterns/SKILL.md",
@@ -633,7 +633,7 @@
     },
     {
       "path": "shared/external/play-store-review/SKILL.md",
-      "sha256": "30694b29888502dfa3a18626732f5b590f810d871a8ca1ffed136369e362993d"
+      "sha256": "8cfe6ac9c1c078089b92252f1600917f77b01dba80ae7e55f2fd347c409f64e1"
     },
     {
       "path": "shared/external/push-notifications/SKILL.md",
@@ -641,11 +641,11 @@
     },
     {
       "path": "shared/external/python-patterns/SKILL.md",
-      "sha256": "0e7af701790a10dcde9ef2d23f9b4f13a2658b400b093c08c2fda0c7b91b3071"
+      "sha256": "debcbd749acabf8f947b2e0bd1ae52126fdb0263f347b32b69281e6811f2cf99"
     },
     {
       "path": "shared/external/react-best-practices/SKILL.md",
-      "sha256": "c563e28cd54a07301b69147ab421999f67145c8e3989eccc7c2a116506749c0d"
+      "sha256": "6a629cefd6ed3186fbd475df3eef3ffaa0ebeaa62eb6a30c0af5f99b53fe7950"
     },
     {
       "path": "shared/external/realitykit-ar/SKILL.md",
@@ -653,19 +653,19 @@
     },
     {
       "path": "shared/external/rest-api-design/SKILL.md",
-      "sha256": "97ff96b96ca400bdb0a45c66e825afa4fded9230349972c1a4c1a61690f473b1"
+      "sha256": "23b6f35b17680b0e42af6123f063140e3a853d2b7847d4445fe6ddbd0a48f5e1"
     },
     {
       "path": "shared/external/retrofit-networking/SKILL.md",
-      "sha256": "9550ba78f34440019fa030a74ba42f8402fa2c8d9858fc2c9d805f2bfe641bb3"
+      "sha256": "b3991cb24b790e6bc159c9082ff21c6a276ceb0e7516f53111ecb6c5dd4094f0"
     },
     {
       "path": "shared/external/room-database/SKILL.md",
-      "sha256": "0cb50a75676df1e3e5e3f68781d9d5bede06d4ae8156266dac41ad7ed94705fd"
+      "sha256": "45fe377469f1fb4036431194d3b525d3caaa79231808625f643468863c6e814a"
     },
     {
       "path": "shared/external/search-first/SKILL.md",
-      "sha256": "02310dc0325efe94cdb3d3c20ccb3f75558550f7798b71d1abcbfe8665d43eed"
+      "sha256": "c9d5ffb698bbfb76a89da6a35dfc0f1d72a31d2b4a0e9e9f3e027be7a8fddfde"
     },
     {
       "path": "shared/external/security-review/SKILL.md",
@@ -677,11 +677,11 @@
     },
     {
       "path": "shared/external/signal-community/SKILL.md",
-      "sha256": "7d1b3030b3c139932cf983a200c82500800a2fa0a837c955ccda2d4f9c1ee63f"
+      "sha256": "0660107c2bf0e65847e72708a196b672ae7b9469bd98ec70793c988351024298"
     },
     {
       "path": "shared/external/skill-creator/SKILL.md",
-      "sha256": "edba3e08babf6993090edc4b8f3309c43e5a786864d4267b46620fac5297f241"
+      "sha256": "f80c5f74dc285240d0213a4e6e0c178a9f38142f0eb7d6956d7c89c061009b71"
     },
     {
       "path": "shared/external/speech-recognition/SKILL.md",
@@ -813,11 +813,11 @@
     },
     {
       "path": "shared/external/tailwind-css/SKILL.md",
-      "sha256": "2b71f2cf0f82292cf0ff9459378ea32faf8bb36cfa9193e3d8451ce1bec7ed4e"
+      "sha256": "9eda0a871962f52e381781b95c948128626984a82ddbd47be53ea869cd250b7e"
     },
     {
       "path": "shared/external/testing-backend/SKILL.md",
-      "sha256": "5f4c8d5b7e630b640e737aa73bfd0912a9d395ad62004d067ad2b6fdadf5d6ef"
+      "sha256": "d3eea1c6d1e2a40a0b66bc6460194ee313e17fc2af8f75047030b7840c2db857"
     },
     {
       "path": "shared/external/tipkit/SKILL.md",
@@ -825,7 +825,7 @@
     },
     {
       "path": "shared/external/typescript-patterns/SKILL.md",
-      "sha256": "45aea58d2f405f584358a73a71aff12d92410f29c50f38d6e57a41b9fd70214c"
+      "sha256": "784d294aa6ba09ff29bc7ec0f106eb512a006e79c96a01ec92d1699bfa122077"
     },
     {
       "path": "shared/external/vision-framework/SKILL.md",
@@ -833,7 +833,7 @@
     },
     {
       "path": "shared/external/vue-composition/SKILL.md",
-      "sha256": "13468da149715aa2127a1b9fbcaa9a92fee5033107598a4e46b4635b0b11e349"
+      "sha256": "429115ba7c4fdecd134e9ea546840d6341312d348f359a8bf35690cd113c1201"
     },
     {
       "path": "shared/external/weatherkit/SKILL.md",
@@ -841,15 +841,15 @@
     },
     {
       "path": "shared/external/web-accessibility/SKILL.md",
-      "sha256": "9e7f6371f8bc691ba6a385385d0e3dd3c1e4ec94976cbe34adcc297db23852b5"
+      "sha256": "a1cd782292982a3c37fd8d1eedaae85f860886f492b2666b73735c6261025594"
     },
     {
       "path": "shared/external/web-performance/SKILL.md",
-      "sha256": "53ef0855f094f214dd57aa24bc20ff30e1f2d75860dd5b9530569d5963920e03"
+      "sha256": "b9983bb39f9a65daad5aca4fb97c88ecbd7c0639b39023dc5c7c6784c4c1c868"
     },
     {
       "path": "shared/external/web-testing/SKILL.md",
-      "sha256": "f5ba76d7bdd45b8f8a1e6953e3ede67e95cde29487ce4d63d8acda479e954119"
+      "sha256": "3120db537a687adfbf396e500f4e146880e4b1a00ab339f85ab526853c947447"
     },
     {
       "path": "shared/external/widgetkit/SKILL.md",

package/pipeline/skills/shared/README.md

@@ -7,7 +7,7 @@ Single source of truth for skills delivered to both Claude Code (`~/.claude/skil
 ## Directory layout
 
 - **`core/`**  -  64 `multi-agent*` orchestration skills that are pipeline-critical. Edits here are core-code changes.
-- **`external/`**  -  154 iOS / Android / generic skills imported from the upstream skill library. Mirrors of third-party guidance.
+- **`external/`**  -  154 iOS / Android / generic skills that ship into the stack plugins. Each names its origin in `metadata.source`: `multi-agent-pipeline` when written here, or the upstream and license a `NOTICE-*.md` in this directory covers.
 - Install destinations (ADR-0009): Claude Code gets NO local copy of `external/` - it loads those skills from the `multi-agent-plugins` marketplace, namespaced (`ai-<stack>-toolkit:<name>`); only the two compliance catalogs from `core/` land in `~/.claude/skills/`. Copilot CLI and Codex CLI receive a flat copy filtered to the enabled stacks. `external/` remains the single authoring source that `build-stack-plugins.mjs` publishes from.
 
 Source layout is logical grouping only  -  skill discovery at runtime is unchanged.

package/pipeline/skills/shared/external/agent-introspection-debugging/SKILL.md

@@ -7,6 +7,7 @@ description: |
   progress, tool calls keep erroring, or you are about to retry without a new
   hypothesis.
 metadata:
+  source: multi-agent-pipeline
   version: 1.0.0
 ---
 

package/pipeline/skills/shared/external/android-architecture/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: android-architecture
 description: "Design and implement Clean Architecture with multi-module structure on Android. Covers domain/data/presentation layers, Hilt dependency injection with @Module/@Provides/@Binds, UseCase pattern with operator invoke, Repository pattern with Kotlin Flow, and mapper pattern between layers. Use when structuring a new Android project, adding feature modules, setting up DI, or reviewing architecture compliance."
+metadata:
+  source: multi-agent-pipeline
 ---
 
 # Android Clean Architecture

package/pipeline/skills/shared/external/android-performance/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: android-performance
 description: "Optimize Android app performance with Baseline Profiles for startup, Compose stability annotations (@Stable, @Immutable, strong skipping), recomposition debugging (Layout Inspector, recomposition counts), R8 optimization, LeakCanary memory leak detection, Macrobenchmark startup tracing, Coil image loading best practices, and LazyColumn/LazyGrid key-based performance. Use when diagnosing slow startup, janky scrolling, excessive recomposition, memory leaks, or optimizing release builds."
+metadata:
+  source: multi-agent-pipeline
 ---
 
 # Android Performance