@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/rules/app-store-guidelines.md

@@ -0,0 +1,59 @@
+## App Store Review Guidelines
+
+### Before You Submit (Checklist)
+
+- Test your app for crashes and bugs on-device
+- Ensure all metadata, screenshots, and previews are complete and accurate
+- Provide a demo account if your app requires login
+- Enable backend services during review
+- Use TestFlight for beta distribution — not the App Store
+- Include detailed App Review notes for non-obvious features or IAPs
+
+### 1. Safety
+
+- No offensive, discriminatory, or mean-spirited content
+- UGC apps: filtering + reporting + blocking + contact info
+- Kids Category: no links out, COPPA/GDPR compliant
+- Medical apps: disclose methodology, no unvalidated claims
+
+### 2. Performance
+
+- Submit only final builds — no placeholder content
+- Screenshots must show app in use; name limit 30 chars
+- No battery drain, no crypto mining, no unrelated background processes
+- Use only public APIs; must function on IPv6-only networks
+
+### 3. Business
+
+- IAP required for unlocking features (no license keys, QR codes, crypto)
+- Subscriptions: 7-day minimum, clear description, retain existing paid users
+- Exceptions: reader apps, multiplatform services, person-to-person, physical goods
+
+### 4. Design
+
+- No copycats; app must go beyond repackaged website
+- No spam (multiple Bundle IDs for same app)
+- Must also offer Sign in with Apple if using third-party social login
+
+### 5. Legal
+
+- Privacy Policy required (in App Store Connect + in-app)
+- Account deletion required if account creation supported
+- ATT required before tracking
+- No unauthorized IP use
+
+### Common Rejection Reasons
+
+| Category    | Reason                                         |
+| ----------- | ---------------------------------------------- |
+| Safety      | Offensive content, false device features       |
+| Performance | Crashes, incomplete metadata, no demo account  |
+| Business    | Features without IAP, misleading subscriptions |
+| Design      | Copied UI, insufficient functionality, spam    |
+| Legal       | Missing privacy policy, no account deletion    |
+
+### After Submission
+
+- Monitor in App Store Connect
+- Expedited review for critical timing (use sparingly)
+- Appeal via App Store appeal form if disagreement

package/pipeline/rules/code-review.md

@@ -0,0 +1,27 @@
+## Code Review Excellence
+
+### Review Priority Order
+
+1. **Correctness**: Does code do what it claims? Edge cases?
+2. **Security**: Input validation, auth/authz, keychain usage
+3. **Performance**: Re-renders, memory leaks, lazy loading
+4. **Maintainability**: Naming, function size, SRP
+5. **Architecture**: Module boundaries, patterns, coupling
+
+### Finding Severity
+
+- Blocking: bugs, security holes, data loss, architecture violations
+- Important: quality impact, performance issues
+- Suggestion: style improvements, minor refactoring
+
+### Feedback Formula: [What] + [Why] + [How]
+
+### iOS Security Checklist
+
+- [ ] No hardcoded secrets or API keys
+- [ ] Sensitive data in Keychain, not UserDefaults
+- [ ] All inputs validated and sanitized
+- [ ] HTTPS only (ATS compliant)
+- [ ] No logging of sensitive data
+- [ ] Auth tokens not in plain text
+- [ ] Permission strings accurate

package/pipeline/rules/code-style.md

@@ -0,0 +1,37 @@
+---
+description: Swift/iOS code style and naming conventions
+globs: "**/*.swift"
+---
+
+## Swift Code Style Rules
+
+### Naming
+
+- Types: UpperCamelCase (`FlightSearchViewModel`)
+- Functions/Properties: lowerCamelCase (`fetchFlightData()`)
+- Constants: lowerCamelCase (`let maxRetryCount = 3`)
+- Protocols: adjective or noun (`Configurable`, `DataSource`)
+- Boolean: prefix with is/has/should (`isLoading`, `hasData`)
+
+### Structure
+
+- MARK comments to organize: `// MARK: - Properties`, `// MARK: - Lifecycle`
+- Extension per protocol conformance
+- Max function length: ~40 lines — split if longer
+- Max file length: ~400 lines — split into extensions
+
+### Patterns
+
+- Guard early, return early — avoid deep nesting
+- Use `[weak self]` in escaping closures, then `guard let self` inside
+- Prefer `let` over `var`
+- Prefer value types (struct/enum) over reference types (class) when possible
+- Use `Result` type or async/await for error handling, not optional returns
+
+### Don'ts
+
+- No force unwraps (`!`) except IBOutlets
+- No force casts (`as!`) — use `as?` with guard
+- No implicitly unwrapped optionals except IBOutlets and test setup
+- No magic numbers — use named constants
+- No `print()` — use `os_log` or `Logger`

package/pipeline/rules/debugging.md

@@ -0,0 +1,24 @@
+## Systematic Debugging
+
+### The Scientific Method for Bugs
+
+1. **Observe**: Reproduce, capture logs/traces/environment
+2. **Hypothesize**: Form 2-3 testable hypotheses
+3. **Experiment**: Change ONE thing at a time
+4. **Analyze**: Binary search, targeted instrumentation
+5. **Conclude**: Document, verify fix, prevent regression
+
+### Common Root Cause Categories
+
+| Category         | Signs                          | Approach                               |
+| ---------------- | ------------------------------ | -------------------------------------- |
+| Race Condition   | Intermittent, timing-dependent | Instrumentation, concurrent tests      |
+| State Corruption | Works initially, fails later   | Trace state changes, invariant checks  |
+| Resource Leak    | Degrades over time             | Monitor memory, check cleanup          |
+| Off-by-One       | Edge cases fail                | Test boundaries: 0, 1, N-1, N, N+1     |
+| Nil/Crash        | Crashes in production          | Guard external data, trace from source |
+
+### Rules
+
+- Never fix a bug without a test that reproduces it first
+- Stack traces: read bottom-up for chain, top for crash location

package/pipeline/rules/figma-pipeline.md

@@ -0,0 +1,190 @@
+## Figma -> Component Generation
+
+Skill set under `pipeline/skills/figma-ios/` (iOS), `pipeline/skills/figma-android/` (Android), and `pipeline/skills/figma-common/` (shared). Activated when the task contains a Figma URL and target files are `.swift` (iOS) or `.kt` (Android).
+
+### Phase Order (platform-agnostic)
+
+```
+0-Init -> 1-Gather -> 2A-TestingIDs -> 2B-Localization -> 2C-Accessibility -> 2D-Analytics
+-> 3-TokenMapping -> 4A-Configuration -> 4B-View -> 4C-Docs -> 4D-Preview -> 4E-Modifiers
+-> 5A-Structural -> 5B-Snapshot -> 5C-Unit -> 6-CodeConnect -> 7-Wiki -> 8-Cleanup
+```
+
+### Configuration
+
+Per-project config at `~/.claude/projects/{slug}/figma-config.json`.
+Schema: `pipeline/schemas/figma-project-config.schema.json`.
+Template: `preferences-template.json` → `_figmaConfigTemplate` section.
+
+### Variable System
+
+All skill files use `{variableName}` placeholders — no hardcoded project values.
+Variables resolved from `figma-config.json` by the orchestrator at Phase 0.
+Placeholder catalog ships alongside each skill's `SKILL.md`.
+
+### Target File Structure
+
+| File                      | Content                             |
+| ------------------------- | ----------------------------------- |
+| {Name}Configuration.swift | Pure value type: all properties     |
+| {Name}View.swift          | SwiftUI view, renders Configuration |
+| {Name}+Modifiers.swift    | Fluent modifier API chain           |
+| {Name}.figma.swift        | Code Connect registration           |
+| FIGMA.md                  | Variant matrix, usage examples      |
+
+### Component Architecture
+
+```swift
+struct ButtonConfiguration {
+    var title: String = ""
+    var style: ButtonStyle = .primary
+    var isEnabled: Bool = true
+}
+
+struct ButtonView: View {
+    let configuration: ButtonConfiguration
+    var body: some View { ... }
+}
+
+extension ButtonView {
+    func title(_ value: String) -> ButtonView {
+        var c = configuration; c.title = value; return ButtonView(configuration: c)
+    }
+}
+```
+
+### Mandatory Token Rules
+
+- No magic numbers: `padding: 16` -> `.Spacing.spacing16`
+- No raw hex colors: `Color(hex: "#E31837")` -> `Color.Primary.primary`
+- No raw `.font()` -> `.typographyStyle(.body1)`
+- Token hierarchy: Spacing > Size > Radius > BorderWidth > Color > Typography
+
+### Pre-Commit Checklist
+
+- [ ] No magic numbers/raw colors/fonts
+- [ ] Accessibility IDs from UITestingIdentifiers
+- [ ] Localization keys defined
+- [ ] 3-layer tests: structural + snapshot + unit
+- [ ] Code Connect .figma.swift written
+- [ ] Preview shows all meaningful variants
+- [ ] FIGMA.md contains variant matrix
+
+### SubPhase Integration (multi-agent Phase 3)
+
+When Figma pipeline is active (`figmaConfigPath` set in project preferences),
+multi-agent Phase 3 (DEV) dispatches Figma sub-phases instead of standard TDD:
+
+```
+Phase 3.0: figma-to-swift-ui-start    → Branch, assign, registry
+Phase 3.1: figma-to-swiftui           → Full 8-phase implementation
+Phase 3.2: figma-commit               → 14-item review + commit + PR
+Phase 3.3: figma-iteration-commit     → Batch iteration commit (if iterating)
+```
+
+### Abstraction Layers
+
+| Layer | Provider Options | Config |
+|-------|-----------------|--------|
+| Board | `github-projects-v2`, `github-labels-only`, `none` | `board.provider` |
+| Registry | `swift-cli`, `json-file`, `none` | `registry.type` |
+| Confluence | enabled/disabled | `confluence.enabled` |
+| Wiki | enabled/disabled | `wiki.enabled` |
+| Figma API | MCP / REST fallback | `figma.mcpEnabled` |
+
+Provider interfaces are defined inline in the platform skill sets — see `pipeline/skills/figma-common/`, `pipeline/skills/figma-ios/`, and `pipeline/skills/figma-android/`.
+
+### Optional Features (graceful skip when disabled)
+
+| Feature | Config | Skip Behavior |
+|---------|--------|---------------|
+| Registry CLI | `registry.enabled` | Manual component name/path input |
+| Projects V2 Board | `board.enabled` | No board column updates |
+| Wiki | `wiki.enabled` | Phase 7 wiki skipped |
+| Confluence | `confluence.enabled` | Phase 7a confluence skipped |
+| Figma MCP | `figma.mcpEnabled` | REST API fallback |
+
+### 14-Item Review Checklist
+
+1. File completeness
+2. No magic numbers (design tokens required)
+3. Configuration purity
+4. +Modifiers correctness
+5. Accessibility identifiers
+6. Analytics tracking
+7. Testing identifier pipeline
+8. Preview quality (LTR + RTL)
+9. Code Connect
+10. View implementation quality
+11. FIGMA.md documentation
+12. Cleanup (artifact cleanup)
+13. Build verification (xcodebuild)
+14. Test verification (ViewInspector + Snapshot)
+
+### Command Catalog (31 commands)
+
+**Core Pipeline:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-to-swiftui <url>` | Full 8-phase pipeline |
+| `/figma-to-swift-ui-start #N` | Start from issue: branch, assign |
+| `/figma-to-swift-ui-implement <url>` | Phases 0-4 only (implementation) |
+| `/figma-to-swift-ui-test <url>` | Phase 5 only (tests) |
+| `/figma-to-swift-ui-wiki <Name>` | Phase 7 only (wiki docs) |
+| `/figma-to-swift-ui-code-connect <url>` | Phase 6 only (Code Connect) |
+| `/figma-to-swift-ui-confluence-sync` | Sync wiki → Confluence |
+| `/figma-to-swift-ui-status-update` | Refresh Confluence dashboard |
+
+**Issue & Board:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-issue open <url>` | Create GitHub Issue + optional Jira |
+| `/figma-review <Name>` | Interactive review (approve/bug) |
+| `/figma-validate <url>` | Pre-implementation validation |
+
+**Commit & PR:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-commit <Name>` | 14-item review + commit + PR |
+| `/figma-iteration-commit <Name>` | Commit to iteration/develop + PR |
+
+**Iteration & Batch:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-iterate` | Auto loop: pick → implement → commit |
+| `/figma-cli-iterate` | Full CLI iterate (all phases) |
+| `/figma-cli-lean-iterate` | Lean iterate (skip test+wiki) |
+| `/figma-cli-iterate-mend` | Re-implement discarded components |
+| `/figma-cli-skip` | Mark component as skipped |
+| `/figma-skip` | Skip + update Confluence |
+
+**Bugfix:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-fix` | Apply targeted bug fixes |
+| `/figma-mend` | Re-implement from scratch |
+
+**Setup & Utility:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/figma-setup` | Environment setup wizard |
+| `/figma-utility` | Figma data fetch (screenshots, metadata) |
+| `/figma-remote-mcp-auth` | Figma MCP OAuth flow |
+| `/figma-ui-patterns` | UI pattern library index |
+| `/figma-price-integration` | Price protocol adoption guide |
+
+**Performance (batch production):**
+
+| Command | What It Does |
+|---------|-------------|
+| `/performance-start #N` | Start component with perf tracking |
+| `/performance-swiftui` | Perf-optimized pipeline |
+| `/performance-tour` | Batch produce multiple components |
+| `/performance-review-next` | Interactive batch review |
+| `/performance-iteration-commit-all` | Batch validate + push all |

package/pipeline/rules/git-conventions.md

@@ -0,0 +1,29 @@
+---
+description: Git commit and branching conventions
+globs: "**"
+---
+
+## Git Conventions
+
+### Commit Messages
+
+- **Default format**: `{type}: {concise description}`
+- **With scope/ticket** (multi-agent pipeline overrides): `{type}({scope}): description [{JIRA_KEY}-{id}]`
+- Types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `style`, `perf`
+- Max 72 chars first line
+- Body for "why", not "what"
+
+### Branching
+
+- `feature/{ticket-id}-{short-description}`
+- `bugfix/{ticket-id}-{short-description}`
+- `hotfix/{description}`
+- `release/{version}`
+
+### Rules
+
+- Never commit secrets, tokens, keys, certificates
+- Never commit .env files, Pods/, .build/, DerivedData/
+- Never force push to main/master/develop
+- Always pull before push
+- Squash WIP commits before merge

package/pipeline/rules/kotlin-android.md

@@ -0,0 +1,92 @@
+---
+description: Kotlin and Android development conventions with Jetpack Compose
+globs: "**/*.kt"
+---
+
+## Kotlin & Android Conventions
+
+### Naming
+
+- Types/Classes: UpperCamelCase (`UserViewModel`, `HomeScreen`)
+- Functions: lowerCamelCase (`loadUserData()`)
+- Composables: UpperCamelCase (`@Composable fun UserCard()`)
+- Constants: SCREAMING_SNAKE_CASE (`const val MAX_RETRY = 3`)
+- Packages: all lowercase (`com.example.feature.home`)
+
+### Jetpack Compose (2024+ standards)
+
+- State: `MutableStateFlow` in ViewModel, `collectAsStateWithLifecycle()` in UI
+- Navigation: Type-safe with `@Serializable` route objects (Navigation 2.8+)
+- Side effects: `LaunchedEffect`, `DisposableEffect`, `SideEffect` — never in body
+- Stability: Mark data classes `@Immutable` or `@Stable` for recomposition optimization
+- Remember: Always `remember {}` for expensive computations
+- ViewModel: Never pass ViewModel to child composables — pass state + lambdas
+
+### Architecture
+
+- MVVM/MVI with `ViewModel` + `StateFlow`
+- UI State as single sealed/data class per screen
+- Repository pattern for data layer
+- Hilt for dependency injection
+- One-way data flow: Event -> ViewModel -> State -> UI
+
+### Patterns
+
+```kotlin
+// UI State
+data class HomeUiState(
+    val isLoading: Boolean = false,
+    val items: List<Item> = emptyList(),
+    val error: String? = null
+)
+
+// ViewModel
+class HomeViewModel @Inject constructor(
+    private val repo: ItemRepository
+) : ViewModel() {
+    private val _uiState = MutableStateFlow(HomeUiState())
+    val uiState: StateFlow<HomeUiState> = _uiState.asStateFlow()
+}
+
+// Screen (stateful wrapper)
+@Composable
+fun HomeScreen(viewModel: HomeViewModel = hiltViewModel()) {
+    val uiState by viewModel.uiState.collectAsStateWithLifecycle()
+    HomeContent(uiState = uiState, onRefresh = viewModel::refresh)
+}
+
+// Content (stateless, testable, previewable)
+@Composable
+fun HomeContent(uiState: HomeUiState, onRefresh: () -> Unit) { ... }
+```
+
+### Coroutines
+
+- Use `viewModelScope.launch` for ViewModel operations
+- `Dispatchers.IO` for blocking I/O
+- `supervisorScope` when child failures shouldn't cancel siblings
+- Never use `GlobalScope`
+- Never catch `CancellationException` (or rethrow)
+
+### Don'ts
+
+- No `!!` force unwrap — use `?.let`, `requireNotNull`, or `checkNotNull`
+- No mutable state exposed from ViewModel — use `StateFlow` + `asStateFlow()`
+- No `Thread.sleep()` — use `delay()` in coroutines
+- No `android.util.Log` in production — use Timber
+- No hardcoded strings in Composables — use `stringResource()`
+- No business logic in Composables — put in ViewModel or UseCase
+
+### Testing
+
+- UI: Compose Testing with `createComposeRule()` + `onNodeWithText/Tag`
+- ViewModel: `runTest` + `TestDispatcher` + `Turbine` for Flow testing
+- Repository: Fake implementations, not mocks
+- Naming: `funName_scenario_expectedBehavior()`
+
+### Gradle
+
+- Version catalog: `libs.versions.toml`
+- Compose BOM for version alignment
+- KSP over KAPT for annotation processing
+- Convention plugins for shared build logic

package/pipeline/rules/performance.md

@@ -0,0 +1,23 @@
+## Performance Optimization
+
+### Measure Before Optimizing
+
+Never optimize without profiling first. Use Instruments.
+
+### Common iOS Bottlenecks
+
+| Area    | Problem                     | Solution                                       |
+| ------- | --------------------------- | ---------------------------------------------- |
+| SwiftUI | Unnecessary re-renders      | `@State` correctly, equatable, `EquatableView` |
+| SwiftUI | Heavy body computation      | Move out of `body`, cache with `@State`        |
+| Images  | Large images on main thread | `AsyncImage` or background decoding            |
+| Network | No caching                  | `URLCache`, ETag, conditional requests         |
+| Memory  | Retain cycles               | `[weak self]`, Instruments Leaks               |
+| Layout  | Complex hierarchies         | Flatten, `LazyVStack`/`LazyHStack`             |
+
+### Caching Strategy
+
+1. In-memory: `NSCache`
+2. Disk: `FileManager` + Codable
+3. Network: `URLCache`
+4. Database: CoreData or SwiftData

package/pipeline/rules/security.md

@@ -0,0 +1,39 @@
+## iOS Security Best Practices
+
+### Secure Data Storage
+
+```swift
+// FORBIDDEN — UserDefaults for sensitive data
+UserDefaults.standard.set(authToken, forKey: "token")
+
+// CORRECT — Keychain
+let query: [String: Any] = [
+    kSecClass as String: kSecClassGenericPassword,
+    kSecAttrAccount as String: "authToken",
+    kSecValueData as String: tokenData
+]
+SecItemAdd(query as CFDictionary, nil)
+```
+
+### Hardcoded Credentials
+
+```swift
+// FORBIDDEN
+let apiKey = "sk-abc123..."
+
+// CORRECT — Info.plist (gitignored) or server-side
+let apiKey = Bundle.main.infoDictionary?["API_KEY"] as? String
+```
+
+### Network Security
+
+- ATS enabled — no HTTP without exception justification
+- Certificate pinning for sensitive endpoints
+- Never log request/response bodies in production
+
+### Privacy
+
+- Only permissions needed for core functionality
+- Purpose strings clearly explain why
+- ATT before any tracking
+- Sign in with Apple alongside other social logins

package/pipeline/rules/swiftui-qa.md

@@ -0,0 +1,32 @@
+## SwiftUI Component QA
+
+### 3-Layer Test Strategy
+
+| Layer          | Tool           | What It Verifies                                 |
+| -------------- | -------------- | ------------------------------------------------ |
+| **Structural** | ViewInspector  | Hierarchy, subview existence, applied modifiers  |
+| **Visual**     | Snapshot Tests | Pixel-accurate render: light/dark, RTL/LTR       |
+| **Behavioral** | Unit Tests     | State changes, closures, configuration mutations |
+
+### Pre-Commit 13-Item Checklist
+
+1. No magic numbers: all values reference design tokens
+2. Configuration purity: no side-effects or view logic
+3. Modifier correctness: valid fluent API
+4. Accessibility identifiers on every interactive element
+5. Accessibility traits: correct VoiceOver traits
+6. Analytics events tracked per spec
+7. Localization: all user-facing strings use keys
+8. Dark mode renders correctly
+9. RTL layout mirrors correctly
+10. Dynamic Type scales without breaking
+11. Preview coverage: all meaningful variants
+12. Code Connect: .figma.swift maps variants
+13. FIGMA.md contains variant matrix
+
+### Accessibility Verification
+
+- Identifier on every interactive element
+- Minimum tap target: 44x44pt
+- VoiceOver labels and hints meaningful
+- Dynamic Type: layout must not break at large sizes

package/pipeline/rules/tdd.md

@@ -0,0 +1,25 @@
+## Test-Driven Development
+
+### The Iron Law
+
+NO PRODUCTION CODE WITHOUT A FAILING TEST FIRST.
+
+### Red-Green-Refactor
+
+1. **RED**: Write ONE minimal failing test
+2. **Verify RED**: Confirm it fails for the RIGHT reason
+3. **GREEN**: Simplest code to pass — nothing more
+4. **Verify GREEN**: Confirm pass AND other tests still pass
+5. **REFACTOR**: Remove duplication, improve names
+
+### Bug Fix Protocol
+
+Bug found -> Write failing test -> TDD cycle -> Test proves fix & prevents regression.
+
+### iOS Testing Pyramid
+
+```
+           [UI Tests / XCUITest] (minimize)
+        [Integration / Snapshot Tests]
+     [Unit Tests / ViewInspector / XCTest] (maximize)
+```

package/pipeline/rules/testing.md

@@ -0,0 +1,37 @@
+---
+description: Testing conventions and standards
+globs: "**/*Tests.swift,**/*Test.swift,**/Tests/**"
+---
+
+## Testing Rules
+
+### Naming
+
+- Test files: `{ClassName}Tests.swift`
+- Test methods: `test{Scenario}_{Expected}` or `test{WhatItDoes}`
+- Example: `testLoginWithInvalidEmail_ShowsError()`
+
+### Structure
+
+- Arrange / Act / Assert pattern
+- One assertion concept per test (multiple XCTAssert for same concept is OK)
+- Use `setUp()` for common setup, `tearDown()` for cleanup
+
+### Framework
+
+- Prefer Swift Testing (`@Test`, `#expect`) for new tests
+- XCTest for UI tests and existing test suites
+- No `sleep()` in tests — use expectations/async
+
+### Coverage
+
+- All public methods must have tests
+- All error paths must have tests
+- Edge cases: nil, empty, boundary values
+
+### Don'ts
+
+- No network calls in unit tests — use mocks/stubs
+- No file system dependencies — use temporary directories
+- No test interdependencies — each test must be isolated
+- No `XCTAssertTrue(result != nil)` — use `XCTAssertNotNil(result)`