@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/eval/triage/08-style-misclassified/input.json

@@ -0,0 +1,14 @@
+{
+  "rawFindings": [
+    {
+      "severity": "blocking",
+      "file": "src/utils/format.ts",
+      "line": 14,
+      "issue": "Function name `fmt` is too short, should be `formatCurrency`",
+      "fix": "Rename fmt to formatCurrency for readability",
+      "reviewer": "sonnet"
+    }
+  ],
+  "scope": "Add currency formatting utility for multi-locale support.",
+  "diffSummary": "src/utils/format.ts: +22 -0"
+}

package/pipeline/eval/triage/08-style-misclassified/notes.md

@@ -0,0 +1,9 @@
+# Case 08 — Stylistic blocker misclassification
+
+Reviewer tagged a naming preference as `severity: "blocking"`. Renaming `fmt` to `formatCurrency` is a style opinion, not a correctness or security issue.
+
+Triage MUST reject this: the blocking severity does not match the nature of the finding. The reason should cite that it is stylistic and that the reviewer over-tagged.
+
+Guards against: accepting a stylistic nitpick because it has a "blocking" tag. Severity must be evaluated by substance, not blindly trusted.
+
+Validator exit code: 0 (1/1 = 100% rejected but total < 5 findings, so over-rejection guard does not trip).

package/pipeline/eval/triage/09-cascading-finding/expected.json

@@ -0,0 +1,23 @@
+{
+  "accepted": [
+    {
+      "severity": "blocking",
+      "file": "src/tests/setup.ts",
+      "line": 5,
+      "issue": "Test setup uses Math.random() without a fixed seed causing flaky results",
+      "fix": "Replace Math.random() with a seeded PRNG for reproducible test data",
+      "reviewer": "sonnet"
+    },
+    {
+      "severity": "blocking",
+      "file": "src/tests/setup.ts",
+      "line": 12,
+      "issue": "Tests fail intermittently in CI due to non-deterministic ordering",
+      "fix": "Fixing the unseeded Math.random() in setup.ts (accepted[0]) should resolve this symptom",
+      "reviewer": "opus"
+    }
+  ],
+  "deferred": [],
+  "rejected": [],
+  "approved": false
+}

package/pipeline/eval/triage/09-cascading-finding/input.json

@@ -0,0 +1,22 @@
+{
+  "rawFindings": [
+    {
+      "severity": "blocking",
+      "file": "src/tests/setup.ts",
+      "line": 12,
+      "issue": "Tests fail intermittently in CI due to non-deterministic ordering",
+      "fix": "Ensure deterministic test execution by fixing random seed initialization",
+      "reviewer": "opus"
+    },
+    {
+      "severity": "blocking",
+      "file": "src/tests/setup.ts",
+      "line": 5,
+      "issue": "Test setup uses Math.random() without a fixed seed causing flaky results",
+      "fix": "Replace Math.random() with a seeded PRNG for reproducible test data",
+      "reviewer": "sonnet"
+    }
+  ],
+  "scope": "Stabilize test infrastructure to eliminate flaky CI runs.",
+  "diffSummary": "src/tests/setup.ts: +8 -2, src/tests/helpers.ts: +4 -1"
+}

package/pipeline/eval/triage/09-cascading-finding/notes.md

@@ -0,0 +1,9 @@
+# Case 09 — Cascading finding (symptom + root cause)
+
+Two findings describe the same underlying problem at different levels: (a) the symptom ("tests fail intermittently") and (b) the root cause ("Math.random() without a fixed seed").
+
+Triage must accept BOTH but order them upstream-first: the root cause (b) comes before the symptom (a) in the accepted array. The fix text for (a) references (b) to document the cascade — fixing the seed should resolve the intermittent failures.
+
+Guards against: treating symptom and root cause as independent issues. The cascade relationship must be explicit in the fix text so the developer addresses root cause first.
+
+Validator exit code: 0 (both accepted with blocking severity, approved:false is consistent).

package/pipeline/eval/triage/10-deferred-crossref/expected.json

@@ -0,0 +1,18 @@
+{
+  "accepted": [],
+  "deferred": [
+    {
+      "finding": {
+        "severity": "important",
+        "file": "src/payments/refund.ts",
+        "line": 55,
+        "issue": "Refund flow doesn't emit audit event for compliance tracking",
+        "fix": "Add an audit event emission after successful refund processing",
+        "reviewer": "opus"
+      },
+      "reason": "out of scope for current task (checkout session creation); HOWEVER this should be addressed before PROJ-5678 (next sprint refund work) because that task assumes audit events exist for refund operations."
+    }
+  ],
+  "rejected": [],
+  "approved": true
+}

package/pipeline/eval/triage/10-deferred-crossref/input.json

@@ -0,0 +1,14 @@
+{
+  "rawFindings": [
+    {
+      "severity": "important",
+      "file": "src/payments/refund.ts",
+      "line": 55,
+      "issue": "Refund flow doesn't emit audit event for compliance tracking",
+      "fix": "Add an audit event emission after successful refund processing",
+      "reviewer": "opus"
+    }
+  ],
+  "scope": "Implement checkout session creation endpoint. Touches src/checkout/ only.",
+  "diffSummary": "src/checkout/session.ts: +45 -0, src/checkout/types.ts: +12 -0"
+}

package/pipeline/eval/triage/10-deferred-crossref/notes.md

@@ -0,0 +1,9 @@
+# Case 10 — Deferred with cross-reference
+
+A real issue (missing audit event in refund flow) that is out of scope for the current task (checkout session creation). However, the next planned task (PROJ-5678, refund work) assumes audit events already exist.
+
+Triage must defer — not reject — because the issue is real. The reason must capture the cross-task dependency: deferring is correct, but the reason needs to surface that PROJ-5678 will be affected.
+
+Guards against: losing inter-task dependencies when deferring. A bare "out of scope" reason is insufficient; the cross-reference to the downstream task ensures Phase 7 captures this for backlog prioritization.
+
+Validator exit code: 0 (deferred + approved:true is consistent because no blocking items in accepted).

package/pipeline/eval/triage/11-vercel-token-leak-blocker/expected.json

@@ -0,0 +1,27 @@
+{
+  "accepted": [
+    {
+      "severity": "blocking",
+      "file": "scripts/deploy.sh",
+      "line": 14,
+      "issue": "Script invokes `vercel deploy --token=$VERCEL_TOKEN`. On retry the Vercel CLI prints failed argv verbatim — the token leaks into the conversation transcript and CI logs. Same shape as the v7.9.1 incident that forced a token rotation.",
+      "fix": "Replace with the safe wrapper: `bash $HOME/.claude/scripts/vercel-deploy.sh deploy --prod`. The wrapper refuses --token argv, reads VERCEL_TOKEN from env, and pipes stdout/stderr through a redact filter that scrubs vcp_… patterns.",
+      "reviewer": "opus"
+    }
+  ],
+  "deferred": [],
+  "rejected": [
+    {
+      "finding": {
+        "severity": "important",
+        "file": "scripts/deploy.sh",
+        "line": 14,
+        "issue": "Token passed as positional argument allows shell history (zsh, bash) to capture it across sessions.",
+        "fix": "Use env var; never argv.",
+        "reviewer": "sonnet"
+      },
+      "reason": "duplicate — same root cause as the accepted blocking finding; merging would dilute the actionable line"
+    }
+  ],
+  "approved": false
+}

package/pipeline/eval/triage/11-vercel-token-leak-blocker/input.json

@@ -0,0 +1,22 @@
+{
+  "rawFindings": [
+    {
+      "severity": "blocking",
+      "file": "scripts/deploy.sh",
+      "line": 14,
+      "issue": "Script invokes `vercel deploy --token=$VERCEL_TOKEN`. On retry the Vercel CLI prints failed argv verbatim — the token leaks into the conversation transcript and CI logs. Same shape as the v7.9.1 incident that forced a token rotation.",
+      "fix": "Replace with the safe wrapper: `bash $HOME/.claude/scripts/vercel-deploy.sh deploy --prod`. The wrapper refuses --token argv, reads VERCEL_TOKEN from env, and pipes stdout/stderr through a redact filter that scrubs vcp_… patterns.",
+      "reviewer": "opus"
+    },
+    {
+      "severity": "important",
+      "file": "scripts/deploy.sh",
+      "line": 14,
+      "issue": "Token passed as positional argument allows shell history (zsh, bash) to capture it across sessions.",
+      "fix": "Use env var; never argv.",
+      "reviewer": "sonnet"
+    }
+  ],
+  "scope": "Add a one-shot deploy script that wraps `vercel deploy` for the marketing site.",
+  "diffSummary": "1 file changed, 28 insertions, 0 deletions"
+}

package/pipeline/eval/triage/11-vercel-token-leak-blocker/notes.md

@@ -0,0 +1,14 @@
+# Case 11 — Vercel token-leak as a blocker (v8.0.0)
+
+Two reviewers flag the same `vercel deploy --token=$VERCEL_TOKEN` call. Triage MUST:
+
+1. **Accept** the Opus finding — it's a real production-affecting blocker, identical in shape to the v7.9.1 incident that forced a token rotation.
+2. **Reject** the Sonnet finding as a duplicate — same root cause (token in argv), additional reviewer would dilute the actionable line. The fix is the same code change either way.
+3. Set `approved: false` because at least one accepted blocking remains.
+
+Guards against:
+- Future regressions where token-leak findings get classified as `suggestion` or `style` (they are blocking — secret leaks reach production logs and force rotation).
+- Triage adding both reviewers' findings to `accepted` and producing two redundant "fix this" lines for the same line of code.
+- Approving the diff while a blocker is open.
+
+Validator exit code: 0 (clean — no contradictions).

package/pipeline/eval/triage/README.md

@@ -0,0 +1,54 @@
+# Triage Eval Suite
+
+Semantic regression detection for Phase 4 triage. Each fixture pair (`input.json` + `expected.json`) tests a specific behavior the triage agent must preserve when its prompt or model changes.
+
+## How it works
+
+Each test case lives in its own subdirectory:
+
+```
+pipeline/eval/triage/
+├── README.md
+├── 01-empty-findings/
+│   ├── input.json       — what reviewers returned (raw findings, scope, diff)
+│   ├── expected.json    — what the triage step MUST produce, normalized
+│   └── notes.md         — why this case matters
+├── 02-real-blocker/
+├── 03-out-of-scope-defer/
+├── 04-false-positive-reject/
+├── ...
+```
+
+Run all cases:
+
+```bash
+node pipeline/scripts/eval-triage.mjs
+```
+
+Filter to one case:
+
+```bash
+node pipeline/scripts/eval-triage.mjs --case 03-out-of-scope-defer
+```
+
+`--json` produces machine-readable output for CI consumption.
+
+## Pass criteria
+
+For each case the runner:
+
+1. Validates `expected.json` against `triage-output.schema.json` (smoke-level sanity).
+2. Runs `validate-triage.mjs` against `expected.json` and asserts the documented exit code.
+3. Compares classification membership: each finding in `input.json.rawFindings` must appear in exactly one of `accepted | deferred | rejected` in `expected.json` (no leaks, no inventions).
+
+This is **not** a model-quality check (we don't run a real triage agent in CI — that requires API keys and is non-deterministic). It's a **contract regression check**: the fixtures encode "for input X, the spec says triage MUST produce Y", and any prompt/spec change that breaks the mapping fails CI.
+
+## Adding new cases
+
+When a new triage edge case is discovered in production:
+
+1. Capture the actual reviewer findings + diff context into a new `pipeline/eval/triage/<NN>-<short-name>/input.json`.
+2. Hand-curate `expected.json` (or paste a known-good triage output and verify by hand).
+3. Add `notes.md` explaining the failure mode this case guards against.
+4. Run the suite locally; `eval-triage.mjs` should pass with your new case.
+5. Commit. CI will keep it green going forward.

package/pipeline/lib/account-resolver.sh

@@ -0,0 +1,204 @@
+#!/bin/bash
+#
+# account-resolver.sh
+# Discovers GitHub / Jira / Bitbucket / Confluence accounts from macOS Keychain
+# and emits a JSON inventory consumed by the multi-agent picker.
+#
+# Each account is identified by a *prefix* — the keychain service-name segment
+# that precedes the provider segment. Examples:
+#   ${USER}_Github_Access_Token        -> prefix=${USER}
+#   ${USER}_Tktech_Github_Access_Token -> prefix=${USER}_Tktech
+#   personal_Github_Auth_Token        -> prefix=personal
+#
+# Usage:
+#   ./account-resolver.sh             # JSON array
+#   ./account-resolver.sh --pretty    # indented JSON
+#   ./account-resolver.sh --providers github   # only accounts with github token
+#
+# Output schema (per account):
+#   { id, label, prefix, providers[], tokens{}, jiraHost, bitbucketHost, isWork }
+
+set -eu
+
+PRETTY=0
+FILTER=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --pretty) PRETTY=1; shift ;;
+    --providers) FILTER="${2:-}"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+prefs_file="$HOME/.claude/multi-agent-preferences.json"
+
+# Read default host overrides from prefs.global.hosts (no hardcoded corporate hostnames).
+prefs_jira_host=$(python3 -c '
+import json,sys
+try: print(json.load(open(sys.argv[1])).get("global",{}).get("hosts",{}).get("jira") or "")
+except: print("")' "$prefs_file" 2>/dev/null)
+prefs_bb_host=$(python3 -c '
+import json,sys
+try: print(json.load(open(sys.argv[1])).get("global",{}).get("hosts",{}).get("bitbucket") or "")
+except: print("")' "$prefs_file" 2>/dev/null)
+
+# Per-account overrides from prefs.global.accounts[]. Returns "" if id not found.
+account_host_override() {
+  local short_id="$1" field="$2"
+  python3 -c '
+import json, sys
+short_id = sys.argv[1]
+field = sys.argv[2]
+try:
+    accounts = json.load(open(sys.argv[3])).get("global",{}).get("accounts",[]) or []
+    for a in accounts:
+        if a.get("id") == short_id:
+            print(a.get(field) or "")
+            sys.exit(0)
+    print("")
+except Exception:
+    print("")
+' "$short_id" "$field" "$prefs_file" 2>/dev/null
+}
+
+# 1. Pull every credential entry that looks like one of our token services.
+#    Includes token entries AND username entries (BB needs the user keychain key).
+#    Uses cross-platform credential-store wrapper (macOS/Windows/Linux backends).
+services=$("$HOME/.claude/lib/credential-store.sh" list 2>/dev/null \
+  | grep -E '_(Github|Jira|Bitbucket|Confluence)_[A-Za-z]+_(Token|Json|Username)$|_Github_Auth_Token$|_Github_Access_Token$|_Jira_Access_Token$|_Bitbucket_Access_Token$|_Bitbucket_Username$|_Confluence_Access_Token$' \
+  || true)
+
+# 2. Compute unique prefixes (everything before the provider segment).
+prefixes=$(printf '%s\n' "$services" \
+  | sed -E 's/_(Github|Jira|Bitbucket|Confluence)_.+$//' \
+  | sort -u)
+
+# Helper: given a prefix and provider keyword, find the matching token service (or "").
+find_token_for() {
+  local prefix="$1" provider="$2"
+  printf '%s\n' "$services" \
+    | grep -E "^${prefix}_${provider}_.*(Token|Json|Auth)$" \
+    | head -n1 || true
+}
+
+# Helper: given a prefix and provider keyword, find the username service entry (or "").
+find_user_key_for() {
+  local prefix="$1" provider="$2"
+  printf '%s\n' "$services" \
+    | grep -E "^${prefix}_${provider}_Username$" \
+    | head -n1 || true
+}
+
+emit_accounts() {
+  local first=1
+  printf '['
+  while IFS= read -r prefix; do
+    [ -z "$prefix" ] && continue
+
+    local gh_token jira_token bb_token conf_token bb_user_key
+    gh_token=$(find_token_for "$prefix" "Github")
+    jira_token=$(find_token_for "$prefix" "Jira")
+    bb_token=$(find_token_for "$prefix" "Bitbucket")
+    conf_token=$(find_token_for "$prefix" "Confluence")
+    bb_user_key=$(find_user_key_for "$prefix" "Bitbucket")
+
+    # Provider filter
+    if [ -n "$FILTER" ]; then
+      local match=0
+      case "$FILTER" in
+        gh|github)    [ -n "$gh_token" ] && match=1 ;;
+        jira)         [ -n "$jira_token" ] && match=1 ;;
+        bb|bitbucket) [ -n "$bb_token" ] && match=1 ;;
+        confluence)   [ -n "$conf_token" ] && match=1 ;;
+      esac
+      [ $match -eq 0 ] && continue
+    fi
+
+    # Provider list
+    local prov_json=""
+    [ -n "$gh_token" ]   && prov_json="${prov_json}\"github\","
+    [ -n "$jira_token" ] && prov_json="${prov_json}\"jira\","
+    [ -n "$bb_token" ]   && prov_json="${prov_json}\"bitbucket\","
+    [ -n "$conf_token" ] && prov_json="${prov_json}\"confluence\","
+    prov_json="${prov_json%,}"
+
+    # Work-account heuristic: bitbucket+jira together indicates corporate.
+    local is_work="false"
+    if [ -n "$bb_token" ] && [ -n "$jira_token" ]; then
+      is_work="true"
+    fi
+
+    # Short id (lower, dashes) — used for per-account override lookup.
+    local short_id
+    short_id=$(printf '%s' "$prefix" | tr '[:upper:]_' '[:lower:]-')
+
+    # Hosts: per-account override (prefs.global.accounts[].jiraHost) wins; falls
+    # back to global.hosts.{jira,bitbucket}; otherwise null. No hardcoded values.
+    local jira_host="null" bb_host="null"
+    local per_jira per_bb
+    per_jira=$(account_host_override "$short_id" "jiraHost")
+    per_bb=$(account_host_override "$short_id" "bitbucketHost")
+    if [ -n "$jira_token" ]; then
+      if   [ -n "$per_jira" ];        then jira_host="\"$per_jira\""
+      elif [ -n "$prefs_jira_host" ]; then jira_host="\"$prefs_jira_host\""
+      fi
+    fi
+    if [ -n "$bb_token" ]; then
+      if   [ -n "$per_bb" ];        then bb_host="\"$per_bb\""
+      elif [ -n "$prefs_bb_host" ]; then bb_host="\"$prefs_bb_host\""
+      fi
+    fi
+
+    # GitHub username — heuristically match to gh CLI accounts
+    local gh_user=""
+    if [ -n "$gh_token" ] && command -v gh >/dev/null 2>&1; then
+      local gh_accounts
+      gh_accounts=$(gh auth status 2>&1 | grep -E 'Logged in to github.com account' | sed 's/.*account //; s/ .*//' || true)
+      local lower_prefix
+      lower_prefix=$(printf '%s' "$prefix" | tr '[:upper:]_' '[:lower:]-')
+      while IFS= read -r u; do
+        [ -z "$u" ] && continue
+        local lower_u
+        lower_u=$(printf '%s' "$u" | tr '[:upper:]' '[:lower:]')
+        # exact-match first segment
+        case "$lower_u" in
+          ${lower_prefix}|${lower_prefix}_*|${lower_prefix}-*) gh_user="$u"; break ;;
+        esac
+      done <<< "$gh_accounts"
+      # second pass: substring match
+      if [ -z "$gh_user" ]; then
+        while IFS= read -r u; do
+          [ -z "$u" ] && continue
+          local lower_u
+          lower_u=$(printf '%s' "$u" | tr '[:upper:]' '[:lower:]')
+          case "$lower_u" in
+            *${lower_prefix}*) gh_user="$u"; break ;;
+          esac
+        done <<< "$gh_accounts"
+      fi
+    fi
+
+    local label="$prefix"
+    [ "$is_work" = "true" ] && label="$prefix (work)"
+    [ -n "$gh_user" ] && label="$label · gh:$gh_user"
+
+    [ $first -eq 0 ] && printf ','
+    first=0
+
+    printf '{"id":"%s","label":"%s","prefix":"%s","providers":[%s],"tokens":{"github":"%s","jira":"%s","bitbucket":"%s","confluence":"%s"},"userKeys":{"bitbucket":"%s"},"users":{"github":"%s"},"jiraHost":%s,"bitbucketHost":%s,"isWork":%s}' \
+      "$short_id" "$label" "$prefix" "$prov_json" \
+      "$gh_token" "$jira_token" "$bb_token" "$conf_token" \
+      "$bb_user_key" \
+      "$gh_user" \
+      "$jira_host" "$bb_host" "$is_work"
+  done <<< "$prefixes"
+  printf ']'
+}
+
+raw=$(emit_accounts)
+
+if [ $PRETTY -eq 1 ]; then
+  printf '%s' "$raw" | python3 -m json.tool
+else
+  printf '%s\n' "$raw"
+fi

package/pipeline/lib/channels-multi-repo.sh

@@ -0,0 +1,218 @@
+#!/bin/bash
+#
+# channels-multi-repo.sh
+# Multi-repo dispatch adapter for `/multi-agent:channels`. Reads agent-state.json
+# `projects[]` array, derives cross-linked PR URL set, and emits per-target
+# bodies for the channels.md Step 6 fan-out.
+#
+# Subcommands:
+#   targets     <state.json>                  Emit JSON array [{repoName, prUrl, isPrimary, crossLinks}] for the dispatcher loop.
+#   render-pr   <state.json> <body.md> <repo> Emit the per-PR body with cross-links substituted (stdout).
+#   render-jira <state.json> <body.md>        Emit the Jira comment with all PR URLs as a bulleted list (stdout).
+#   render-conf <state.json> <body.md>        Emit the Confluence body with `Related PRs` block prepended (stdout).
+#   summary     <state.json>                  Human-readable line: "1 primary + N extras: [pr-urls]" — for autopilot logs.
+#
+# Single-repo tasks: every subcommand falls through to the single PR / single
+# body — `targets` returns one entry, render-* leaves the body unchanged.
+
+set -eu
+
+CMD="${1:-}"
+STATE="${2:-}"
+
+[ -z "$CMD" ] || [ -z "$STATE" ] && {
+  echo "usage: $0 {targets|render-pr|render-jira|render-conf|summary} <state.json> [args]" >&2
+  exit 1
+}
+[ ! -f "$STATE" ] && { echo "ERR: state file not found: $STATE" >&2; exit 2; }
+
+# --- Helpers ----------------------------------------------------------------
+# Extract the targets array from agent-state.json. Output: TSV with columns
+# repoName, prUrl, isPrimary (1/0). One target per row.
+extract_targets() {
+  python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+projects = state.get("projects") or []
+if not projects:
+    # single-repo state — synthesize one target from top-level fields
+    pr = state.get("pr") or {}
+    pr_url = pr.get("url") or ""
+    name = state.get("project") or "primary"
+    print(f"{name}\t{pr_url}\t1")
+    sys.exit(0)
+primary_name = state.get("project") or projects[0].get("project")
+for p in projects:
+    name = p.get("project") or ""
+    pr = p.get("pr") or {}
+    pr_url = pr.get("url") or ""
+    is_primary = "1" if name == primary_name else "0"
+    print(f"{name}\t{pr_url}\t{is_primary}")
+PY
+}
+
+# Collect every PR URL into a single space-separated list (primary first).
+all_pr_urls() {
+  extract_targets | awk -F'\t' '
+    $3=="1" { primary=$2 }
+    $3=="0" { extras=extras " " $2 }
+    END { if (primary) printf "%s", primary; printf "%s\n", extras }
+  '
+}
+
+# --- targets subcommand -----------------------------------------------------
+do_targets() {
+  python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+projects = state.get("projects") or []
+if not projects:
+    pr = state.get("pr") or {}
+    out = [{
+        "repoName": state.get("project") or "primary",
+        "prUrl":    pr.get("url") or "",
+        "prNumber": pr.get("number"),
+        "isPrimary": True,
+        "crossLinks": [],
+    }]
+    print(json.dumps(out))
+    sys.exit(0)
+
+primary_name = state.get("project") or projects[0].get("project")
+all_urls = []
+for p in projects:
+    pr = p.get("pr") or {}
+    if pr.get("url"):
+        all_urls.append({"repo": p["project"], "url": pr["url"]})
+
+out = []
+for p in projects:
+    name = p["project"]
+    pr = p.get("pr") or {}
+    is_primary = (name == primary_name)
+    cross = [u for u in all_urls if u["repo"] != name]
+    out.append({
+        "repoName": name,
+        "prUrl":    pr.get("url") or "",
+        "prNumber": pr.get("number"),
+        "isPrimary": is_primary,
+        "crossLinks": cross,
+    })
+print(json.dumps(out))
+PY
+}
+
+# --- render-pr subcommand ---------------------------------------------------
+# Args: state.json body.md repoName
+# Inserts the cross-link block at the top of the body for the named target.
+do_render_pr() {
+  local body_file="${3:-}" repo="${4:-}"
+  [ -z "$body_file" ] || [ -z "$repo" ] && {
+    echo "usage: $0 render-pr <state.json> <body.md> <repoName>" >&2
+    exit 3
+  }
+  [ ! -f "$body_file" ] && { echo "ERR: body file not found: $body_file" >&2; exit 2; }
+
+  python3 - "$STATE" "$body_file" "$repo" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+body = open(sys.argv[2]).read()
+repo = sys.argv[3]
+
+projects = state.get("projects") or []
+if len(projects) <= 1:
+    # Single-repo: pass through unchanged
+    sys.stdout.write(body)
+    sys.exit(0)
+
+primary_name = state.get("project") or projects[0].get("project")
+is_primary = (repo == primary_name)
+links = []
+for p in projects:
+    if p["project"] == repo:
+        continue
+    pr = p.get("pr") or {}
+    if pr.get("url"):
+        label = "Part of" if not is_primary and p["project"] == primary_name else "Related"
+        links.append(f"{label}: {pr['url']}")
+
+if not links:
+    sys.stdout.write(body)
+    sys.exit(0)
+
+prefix = "\n".join(links) + "\n\n"
+sys.stdout.write(prefix + body)
+PY
+}
+
+# --- render-jira subcommand -------------------------------------------------
+# Single Jira comment for all repos. Replaces the "first line PR URL" with a
+# bulleted list of every PR URL, primary first.
+do_render_jira() {
+  local body_file="${3:-}"
+  [ -z "$body_file" ] && { echo "usage: $0 render-jira <state.json> <body.md>" >&2; exit 3; }
+  [ ! -f "$body_file" ] && { echo "ERR: body file not found: $body_file" >&2; exit 2; }
+
+  local urls
+  urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
+  local count
+  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+
+  if [ "$count" -le 1 ]; then
+    cat "$body_file"
+    return
+  fi
+
+  # Multi-repo: prepend a `* PR: <url>` block for each (Jira wiki markup).
+  printf '%s\n' "$urls" | sed 's/^/* PR: /'
+  printf '\n'
+  cat "$body_file"
+}
+
+# --- render-conf subcommand -------------------------------------------------
+# Single Confluence page for all repos. Prepend a `Related PRs` heading block.
+do_render_conf() {
+  local body_file="${3:-}"
+  [ -z "$body_file" ] && { echo "usage: $0 render-conf <state.json> <body.md>" >&2; exit 3; }
+  [ ! -f "$body_file" ] && { echo "ERR: body file not found: $body_file" >&2; exit 2; }
+
+  local urls
+  urls=$(all_pr_urls | tr ' ' '\n' | grep -v '^$' || true)
+  local count
+  count=$(printf '%s\n' "$urls" | grep -c . || echo 0)
+
+  if [ "$count" -le 1 ]; then
+    cat "$body_file"
+    return
+  fi
+
+  printf '## Related PRs\n\n'
+  printf '%s\n' "$urls" | sed 's/^/- /'
+  printf '\n---\n\n'
+  cat "$body_file"
+}
+
+# --- summary subcommand -----------------------------------------------------
+do_summary() {
+  python3 - "$STATE" <<'PY'
+import json, sys
+state = json.load(open(sys.argv[1]))
+projects = state.get("projects") or []
+if len(projects) <= 1:
+    print("single-repo task")
+    sys.exit(0)
+primary_name = state.get("project") or projects[0].get("project")
+extras = [p for p in projects if p["project"] != primary_name]
+extra_urls = [(p.get("pr") or {}).get("url") or f"<no-pr:{p['project']}>" for p in extras]
+print(f"1 primary ({primary_name}) + {len(extras)} extras: {' '.join(extra_urls)}")
+PY
+}
+
+case "$CMD" in
+  targets)     do_targets ;;
+  render-pr)   do_render_pr "$@" ;;
+  render-jira) do_render_jira "$@" ;;
+  render-conf) do_render_conf "$@" ;;
+  summary)     do_summary ;;
+  *) echo "ERR: unknown subcommand $CMD" >&2; exit 1 ;;
+esac