@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/commands/multi-agent.md

@@ -1,10 +1,12 @@
 ---
-description: "Task orchestrator — full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Opus triage (CLI-aware: 2-model on Claude Code, 3-model on Copilot CLI), commit, log"
+description: "Task orchestrator  -  full pipeline via Jira ID + branch or GitHub Issue URL: analysis, plan, TDD development, parallel review + Fable triage (CLI-aware: 2-model on Claude Code, 3-model on Copilot CLI), commit, log"
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, TaskList, TaskGet, AskUserQuestion, WebFetch, WebSearch, NotebookEdit, Skill
 ---
 
 # Multi-Agent Task Orchestrator
 
+> **MUST: Figma MCP is BLOCKING for any task with a Figma reference.** Before any UI synthesis runs in this pipeline (analysis, planning, dev, or rework), call `mcp__claude_ai_Figma__get_design_context` for every referenced frame and use the `CodeConnectSnippet` component name verbatim. Backend-only tasks are exempt. See `refs/rules.md` "User Interaction Discipline" and `pipeline/rules/figma-pipeline.md` "MUST: Figma MCP-first (BLOCKING)".
+
 Parse the user input and route to the correct sub-command.
 
 **Input**: $ARGUMENTS
@@ -13,7 +15,7 @@ Parse the user input and route to the correct sub-command.
 
 ## Canonical Invocation (per CLI)
 
-Each helper subcommand has its own slash entry — use the CLI-native form:
+Each helper subcommand has its own slash entry  -  use the CLI-native form:
 
 | Helper | Claude Code | Copilot CLI |
 |--------|-------------|-------------|
@@ -32,7 +34,7 @@ the canonical invocations and the only forms surfaced in autocomplete.
 
 ## Input Parsing
 
-Classification schema lives in `commands/multi-agent/_input-parser.md` — canonical source. Summary:
+Classification schema lives in `commands/multi-agent/_input-parser.md`  -  canonical source. Summary:
 
 | # | Pattern | Type | Picker flow |
 |---|---------|------|--------|
@@ -45,42 +47,44 @@ Classification schema lives in `commands/multi-agent/_input-parser.md` — canon
 | 7 | `issue` | full picker | account → repo (multi) → issue → maturity → dev-context |
 | 8 | Free-text | `freetext` | account → repo (single) → dev-context (maturity skip) |
 
-**Rule**: Whatever the type, **account is always asked** (autopilot picks a default). After issue fetch, **maturity check is mandatory** — blockers halt the pipeline. All picker UI strings render in English (`promptLanguage` is locked to `en`).
+**Rule**: Whatever the type, **account is always asked** (autopilot picks a default). After issue fetch, **maturity check is mandatory**  -  blockers halt the pipeline. All picker UI strings render in English (`promptLanguage` is locked to `en`).
 
 Lib scripts (`~/.claude/lib/`):
-- `account-resolver.sh` — keychain account inventory
-- `issue-fetcher.sh` — Jira/GitHub fetch + maturity scoring
-- `repo-cache.sh` — TTL-cached repo list
-- `submodule-detector.sh` — `.gitmodules` parse → dev-context suggestions
-- `multi-repo-pipeline.sh` — worktree/branch/commit/PR orchestration
+- `account-resolver.sh`  -  keychain account inventory
+- `issue-fetcher.sh`  -  Jira/GitHub fetch + maturity scoring
+- `repo-cache.sh`  -  TTL-cached repo list
+- `submodule-detector.sh`  -  `.gitmodules` parse → dev-context suggestions
+- `multi-repo-pipeline.sh`  -  worktree/branch/commit/PR orchestration
 
 ## Routing
 
 | Input Pattern | Action |
 |---------------|--------|
-| `#N`, `316` | GitHub Issue # — parse, select project, start pipeline |
-| `https://github.com/.../issues/N` | GitHub Issue URL — fetch, auto-detect or ask project |
-| `https://{JIRA_HOST}/browse/{JIRA_KEY}-XXXXX` | Jira URL — fetch, select project, start pipeline |
-| `{JIRA_KEY}-XXXXX` | Jira ID — fetch, select project, start pipeline |
-| Free-text | Bug/feature description — select project, start pipeline |
-| `jira` | 4-step picker (hesap → proje → issue → dev-context) — `commands/multi-agent/jira.md` delegate |
-| `issue` | 4-step picker (hesap → repo → issue → dev-context) — `commands/multi-agent/issue.md` delegate |
+| `#N`, `316` | GitHub Issue #  -  parse, select project, start pipeline |
+| `https://github.com/.../issues/N` | GitHub Issue URL  -  fetch, auto-detect or ask project |
+| `https://{JIRA_HOST}/browse/{JIRA_KEY}-XXXXX` | Jira URL  -  fetch, select project, start pipeline |
+| `{JIRA_KEY}-XXXXX` | Jira ID  -  fetch, select project, start pipeline |
+| Free-text | Bug/feature description  -  select project, start pipeline |
+| `jira` | 4-step picker (hesap → proje → issue → dev-context)  -  `commands/multi-agent/jira.md` delegate |
+| `issue` | 4-step picker (hesap → repo → issue → dev-context)  -  `commands/multi-agent/issue.md` delegate |
 | `status` | List all tasks (scan `$HOME/.claude/logs/multi-agent/`) |
 | `log [id]` | Show task log |
 | `resume [id]` | Resume paused task |
 | `kill [id]` | Delete worktree (logs preserved). Confirm first |
 | `clear-logs` | Clean global log directory. Keep counter |
-| `purge` | Worktree + logs + counter — full reset (double confirm) |
+| `purge` | Worktree + logs + counter  -  full reset (double confirm) |
 | `review` | Review current diff only (lightweight, no worktree) |
+| `analysis ["<feature>"]` | Standalone feature-spec analizi: Figma / Swagger / Confluence / Jira / repo girdileri sabit 7-bölümlük şablona dökülür, humanizer'dan geçer, Local/Confluence/Jira hedef(ler)ine post edilir. Worktree veya commit yok. Dev'e zincirleme yok. |
+| `build-optimize` | iOS-only Xcode build performance wrapper. Vendored `xcode-build-orchestrator`'a dispatch eder; benchmark + compilation / project / SPM analyzer'lar + recommend-first plan `.build-benchmark/optimization-plan.md`. Non-iOS stack'lerde fail-fast. |
 | `channels [PR-url\|#N\|Jira-url\|Jira-id] [--channels pr,jira,confluence,wiki] [--content normal,test,auto-diff,note] [--message "..."]` | Post task report to multi-select channels (PR description, Jira comment, Confluence page, Wiki pages) with multi-select content sources. Humanizer pass per-channel. Bitbucket PR updates use reviewer-preserving PUT. Phase 7 delegates to this command; also invocable post-hoc for fixes made outside the pipeline. No worktree. |
-| `test` or `test [args]` | UI Bug Hunter — screenshot + tap + analyze on booted simulator via MCP (read `$HOME/.claude/commands/sim-test.md`). `/multi-agent:test` also resolves here via the `commands/multi-agent/test.md` delegate. |
-| `manual-test [#id]` | Phase 5 standalone Manual Test — checks out the task branch, prints Xcode / SourceTree hints, waits for user verdict (`ok` / `fix: ...`). |
+| `test` or `test [args]` | UI Bug Hunter  -  screenshot + tap + analyze on booted simulator via MCP (read `$HOME/.claude/commands/sim-test.md`). `/multi-agent:test` also resolves here via the `commands/multi-agent/test.md` delegate. |
+| `manual-test [#id]` | Phase 5 standalone Manual Test  -  checks out the task branch, prints Xcode / SourceTree hints, waits for user verdict (`ok` / `fix: ...`). |
 | `stack [ios\|android\|backend\|mobile\|all]` | Swap skills for next conversation. No arg = show current stack. |
 | `language [en\|tr]` | Show or set the assistant `outputLanguage` (explanations and chat replies). `promptLanguage` is locked to `en` and is not toggleable. No arg = show current `outputLanguage`. With `en` or `tr` = set and persist `outputLanguage`. External payloads (commits, PR bodies, Jira) stay English. |
 | `setup` | Keychain token + Git Identity onboarding |
-| `--dev` | Dev-only: Init -> Dev(Opus) -> Commit -> Report |
-| `--dev autopilot` or `dev-autopilot` | Fastest path — Dev(Opus) + zero interaction |
-| `--local` | No worktree — works directly on local branch |
+| `--dev` | Dev-only: Init -> Dev(Fable) -> Commit -> Report |
+| `--dev autopilot` or `dev-autopilot` | Fastest path  -  Dev(Fable) + zero interaction |
+| `--local` | No worktree  -  works directly on local branch |
 | `autopilot` | Skip user confirmations, auto commit/PR |
 | No args / `help` | Show usage guide |
 
@@ -92,7 +96,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 
 **File layout:**
 - `commands/multi-agent/*.md` → **invocable actions** (each gets its own `/multi-agent:<name>` slash command)
-- `commands/multi-agent/refs/**` → **internal references**, read by the main command, never invoked directly (surface as `/multi-agent:refs:...` in autocomplete — the prefix signals "not an action")
+- `commands/multi-agent/refs/**` → **internal references**, read by the main command, never invoked directly (surface as `/multi-agent:refs:...` in autocomplete  -  the prefix signals "not an action")
 
 | Route | File to Read |
 |-------|-------------|
@@ -104,14 +108,16 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | `help` | `$HOME/.claude/commands/multi-agent/help.md` |
 | `channels` | `$HOME/.claude/commands/multi-agent/channels.md` |
 | `sync` | `$HOME/.claude/commands/multi-agent/sync.md` |
-| `clear-logs` | Handled inline — scan + delete agent-log.md/agent-state.json files |
+| `clear-logs` | Handled inline  -  scan + delete agent-log.md/agent-state.json files |
 | `review` | `$HOME/.claude/commands/multi-agent/review.md` |
+| `analysis` | `$HOME/.claude/commands/multi-agent/analysis.md` |
+| `build-optimize` | `$HOME/.claude/commands/multi-agent/build-optimize.md` |
 | `local` | `$HOME/.claude/commands/multi-agent/local.md` |
 | `local-autopilot` | `$HOME/.claude/commands/multi-agent/local-autopilot.md` |
 | `dev-local` | `$HOME/.claude/commands/multi-agent/dev-local.md` |
 | `dev-local-autopilot` | `$HOME/.claude/commands/multi-agent/dev-local-autopilot.md` |
 | `stack` | `$HOME/.claude/commands/multi-agent/stack.md` |
-| `language` | Handled inline — set/show prompt language in preferences |
+| `language` | Handled inline  -  set/show prompt language in preferences |
 | SwiftUI component task (iOS) | `$HOME/.claude/commands/multi-agent/refs/swiftui-guide.md` |
 | Jetpack Compose task (Android) | `$HOME/.claude/commands/multi-agent/refs/android-guide.md` |
 | Backend API task | `$HOME/.claude/commands/multi-agent/refs/backend-guide.md` |
@@ -122,7 +128,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | `test` | `$HOME/.claude/commands/sim-test.md` (colon-form `/multi-agent:test` uses the delegate at `commands/multi-agent/test.md`) |
 | `manual-test` | `$HOME/.claude/commands/multi-agent/manual-test.md` |
 
-**Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `clear-logs`, `purge`, `review`) are parsed inline by this file — no separate spec files, they compose with the pipeline or do one-shot work.
+**Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `clear-logs`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
 
 **How**: After routing, `Read` the relevant file and follow its instructions. Only load what the current action needs.
 
@@ -134,12 +140,12 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 - Multiple stacks -> load all relevant guides
 
 **Agent definitions** (used in Phase 1 and Phase 4):
-- `$HOME/.claude/agents/code-reviewer.md` — Phase 4 reviewer persona (`preferredModel: opus`; Phase 4 overrides Reviewer 3 to `sonnet`)
-- `$HOME/.claude/agents/explorer.md` — Phase 1 codebase scan persona (`preferredModel: sonnet` — scan work, cost-efficient)
-- `$HOME/.claude/agents/ios-architect.md` — iOS architecture review (`preferredModel: opus`)
-- `$HOME/.claude/agents/android-architect.md` — Android architecture review (`preferredModel: opus`)
-- `$HOME/.claude/agents/backend-architect.md` — Backend/API architecture review (`preferredModel: opus`)
-- `$HOME/.claude/agents/security-auditor.md` — Security audit (`preferredModel: opus`)
+- `$HOME/.claude/agents/code-reviewer.md`  -  Phase 4 reviewer persona (`preferredModel: opus`; Phase 4 overrides Reviewer 3 to `sonnet`)
+- `$HOME/.claude/agents/explorer.md`  -  Phase 1 codebase scan persona (`preferredModel: sonnet`  -  scan work, cost-efficient)
+- `$HOME/.claude/agents/ios-architect.md`  -  iOS architecture review (`preferredModel: opus`)
+- `$HOME/.claude/agents/android-architect.md`  -  Android architecture review (`preferredModel: opus`)
+- `$HOME/.claude/agents/backend-architect.md`  -  Backend/API architecture review (`preferredModel: opus`)
+- `$HOME/.claude/agents/security-auditor.md`  -  Security audit (`preferredModel: opus`)
 
 **Per-persona model routing:** Before each Agent dispatch, the orchestrator reads `preferredModel` from the persona file and exports `CLAUDE_CODE_SUBAGENT_MODEL` (Claude Code) / passes `--model` (Copilot CLI). Precedence: per-dispatch `PHASE_MODEL_OVERRIDE` > persona `preferredModel` > `opus`. Full contract: `skills/shared/core/multi-agent/SKILL.md#agent-dispatch--per-persona-model-routing-v610`.
 
@@ -147,7 +153,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 
 ## language Command
 
-Toggles only `outputLanguage` (`promptLanguage` is locked to `"en"` — see `refs/rules.md` § "Language Application"). Full spec: `pipeline/commands/multi-agent/language.md`.
+Toggles only `outputLanguage` (`promptLanguage` is locked to `"en"`  -  see `refs/rules.md` section "Language Application"). Full spec: `pipeline/commands/multi-agent/language.md`.
 
 ---
 
@@ -155,14 +161,14 @@ Toggles only `outputLanguage` (`promptLanguage` is locked to `"en"` — see `ref
 
 Delegates to `commands/multi-agent/jira.md` (4-step picker). Read that file, then apply:
 
-1. **Pick account** — `_account-picker.md` (`lib/account-resolver.sh --providers jira`)
-2. **Pick projects (multi)** — Jira project list, multi-select
-3. **Pick issue** — aggregate across selected projects, `lib/issue-fetcher.sh` with maturity check
-4. **Maturity check** — halt on blocker, prompt on warning (autopilot auto-continues)
-5. **Dev context** (`_dev-context.md`) — extra repo selection
+1. **Pick account**  -  `_account-picker.md` (`lib/account-resolver.sh --providers jira`)
+2. **Pick projects (multi)**  -  Jira project list, multi-select
+3. **Pick issue**  -  aggregate across selected projects, `lib/issue-fetcher.sh` with maturity check
+4. **Maturity check**  -  halt on blocker, prompt on warning (autopilot auto-continues)
+5. **Dev context** (`_dev-context.md`)  -  extra repo selection
 6. → Interactive Launcher (branch/mode/autopilot) → Phase 0
 
-Steps 1–5 are detailed in `jira.md`; the Interactive Launcher (below) consumes the result.
+Steps 1-5 are detailed in `jira.md`; the Interactive Launcher (below) consumes the result.
 
 ---
 
@@ -170,11 +176,11 @@ Steps 1–5 are detailed in `jira.md`; the Interactive Launcher (below) consumes
 
 Delegates to `commands/multi-agent/issue.md` (4-step picker). Read that file, then apply:
 
-1. **Pick account** — `_account-picker.md` (`--providers github`)
-2. **Pick repos (multi)** — `lib/repo-cache.sh github <owner>`, multi-select
-3. **Pick issue** — aggregate across repos (`gh issue list`), maturity check
-4. **Maturity check** — `lib/issue-fetcher.sh` maturity field; blocker halts, warning prompts
-5. **Dev context** (`_dev-context.md`) — submodule auto-suggest + extra repos
+1. **Pick account**  -  `_account-picker.md` (`--providers github`)
+2. **Pick repos (multi)**  -  `lib/repo-cache.sh github <owner>`, multi-select
+3. **Pick issue**  -  aggregate across repos (`gh issue list`), maturity check
+4. **Maturity check**  -  `lib/issue-fetcher.sh` maturity field; blocker halts, warning prompts
+5. **Dev context** (`_dev-context.md`)  -  submodule auto-suggest + extra repos
 6. → Interactive Launcher → Phase 0
 
 ---
@@ -183,12 +189,12 @@ Delegates to `commands/multi-agent/issue.md` (4-step picker). Read that file, th
 
 When the user supplies an ID/URL/free-text:
 
-1. **Detect type** — per `_input-parser.md`
-2. **Pick account** — always asked (autopilot picks default)
-3. **Fetch issue** — `lib/issue-fetcher.sh "$INPUT"` (Jira/GitHub fetch + maturity)
-4. **Repo picker** — only for `gh-num` (e.g. `316`) when repo is ambiguous, multi-select
-5. **Maturity check** — blocker halts (autopilot too), warning prompt/log
-6. **Dev context** — always runs, empty submit allowed
+1. **Detect type**  -  per `_input-parser.md`
+2. **Pick account**  -  always asked (autopilot picks default)
+3. **Fetch issue**  -  `lib/issue-fetcher.sh "$INPUT"` (Jira/GitHub fetch + maturity)
+4. **Repo picker**  -  only for `gh-num` (e.g. `316`) when repo is ambiguous, multi-select
+5. **Maturity check**  -  blocker halts (autopilot too), warning prompt/log
+6. **Dev context**  -  always runs, empty submit allowed
 7. → Interactive Launcher → Phase 0
 
 ---
@@ -197,7 +203,7 @@ When the user supplies an ID/URL/free-text:
 
 After the user selects an issue from either `jira` or `issue` command:
 
-### Step 1 — Branch Selection
+### Step 1  -  Branch Selection
 Same as Phase 0 Step 3: fetch remote branches, sort (develop* first → release/* → main/master), present with Recent suggestion from prefs:
 ```
 Base branch:
@@ -210,15 +216,15 @@ Select [number] or enter for suggested:
 ```
 Save to `prefs.projects[{project}].branches`.
 
-### Step 2 — Mode Selection
+### Step 2  -  Mode Selection
 ```
 Pipeline mode:
-  1. Full pipeline (8 phases, Sonnet dev, parallel review + triage — CLI-aware reviewer set)
-  2. --dev (fast: Init → Dev(Opus) → Commit → Report)
+  1. Full pipeline (8 phases, Sonnet dev, parallel review + triage  -  CLI-aware reviewer set)
+  2. --dev (fast: Init → Dev(Fable) → Commit → Report)
 Select [1/2]:
 ```
 
-### Step 3 — Autopilot
+### Step 3  -  Autopilot
 ```
 Enable autopilot? (skip confirmations, auto commit/PR)
   1. Yes
@@ -226,12 +232,12 @@ Enable autopilot? (skip confirmations, auto commit/PR)
 Select [1/2]:
 ```
 
-### Step 4 — Launch
+### Step 4  -  Launch
 Compose the final command arguments and start the pipeline:
 - `jira` source → input type is `jira-id` (e.g. `PROJ-1234`)
 - `issue` source → input type is `github-issue-url` (e.g. `https://github.com/org/repo/issues/610`)
 
-Pass selected base branch + mode flags. The pipeline enters Phase 0 Step 1 with the issue already fetched — skip redundant API calls.
+Pass selected base branch + mode flags. The pipeline enters Phase 0 Step 1 with the issue already fetched  -  skip redundant API calls.
 
 ---
 
@@ -241,15 +247,15 @@ When called with `review`:
 1. Detect current branch and project from cwd (or ask)
 2. Get diff: `git diff HEAD` (unstaged + staged)
 3. If no diff, get diff against base branch: `git diff origin/{baseBranch}...HEAD`
-4. Launch Phase 4 review (parallel + Opus triage — 2-model on Claude Code, 3-model on Copilot CLI) on the diff
-5. No worktree, no state file — lightweight one-shot review
+4. Launch Phase 4 review (parallel + Fable triage  -  2-model on Claude Code, 3-model on Copilot CLI) on the diff
+5. No worktree, no state file  -  lightweight one-shot review
 6. Print findings to terminal
 
 ---
 
 ## Rules
 
-**Non-negotiable rules that apply to every phase, every mode.** Full reference at `$HOME/.claude/commands/multi-agent/refs/rules.md` — read before any invocation that writes code, commits, or posts to external systems.
+**Non-negotiable rules that apply to every phase, every mode.** Full reference at `$HOME/.claude/commands/multi-agent/refs/rules.md`  -  read before any invocation that writes code, commits, or posts to external systems.
 
 Quick pointers:
 - No "Copilot/AI/generated by" attribution. Ever.

package/pipeline/commands/sim-test.md

@@ -1,5 +1,5 @@
 ---
-description: "Mobile UI Bug Hunter — iOS Simulator (simctl) + Android Emulator (adb) — auto-detects platform"
+description: "Mobile UI Bug Hunter  -  iOS Simulator (simctl) + Android Emulator (adb)  -  auto-detects platform"
 allowed-tools: Agent, Bash, Read, Write, Edit, TaskCreate, TaskUpdate, TaskList, TaskGet, mcp__dev_toolkit__ios_list_devices, mcp__dev_toolkit__ios_boot_device, mcp__dev_toolkit__ios_screenshot, mcp__dev_toolkit__ios_tap, mcp__dev_toolkit__ios_swipe, mcp__dev_toolkit__ios_type_text, mcp__dev_toolkit__ios_launch_app, mcp__dev_toolkit__ios_terminate_app, mcp__dev_toolkit__ios_list_apps, mcp__dev_toolkit__ios_go_home, mcp__dev_toolkit__ios_set_appearance, mcp__dev_toolkit__ios_set_content_size, mcp__dev_toolkit__ios_set_locale, mcp__dev_toolkit__ios_open_url, mcp__dev_toolkit__ios_status_bar, mcp__dev_toolkit__ios_push_notification, mcp__dev_toolkit__ios_grant_permission, mcp__dev_toolkit__ios_revoke_permission, mcp__dev_toolkit__ios_reset_permissions, mcp__dev_toolkit__ios_set_location, mcp__dev_toolkit__ios_clear_location, mcp__dev_toolkit__ios_set_increase_contrast, mcp__dev_toolkit__ios_record_video, mcp__dev_toolkit__ios_add_media, mcp__dev_toolkit__ios_keychain_reset, mcp__dev_toolkit__ios_get_app_container, mcp__dev_toolkit__ios_erase_device, mcp__dev_toolkit__ios_get_ui_tree, mcp__dev_toolkit__android_list_devices, mcp__dev_toolkit__android_screenshot, mcp__dev_toolkit__android_tap, mcp__dev_toolkit__android_swipe, mcp__dev_toolkit__android_type_text, mcp__dev_toolkit__android_key_event, mcp__dev_toolkit__android_launch_app, mcp__dev_toolkit__android_stop_app, mcp__dev_toolkit__android_list_packages, mcp__dev_toolkit__android_go_home, mcp__dev_toolkit__android_go_back, mcp__dev_toolkit__android_get_ui_tree, mcp__dev_toolkit__android_set_dark_mode, mcp__dev_toolkit__android_set_font_scale, mcp__dev_toolkit__android_set_locale, mcp__dev_toolkit__android_set_location, mcp__dev_toolkit__android_grant_permission, mcp__dev_toolkit__android_revoke_permission, mcp__dev_toolkit__android_record_screen, mcp__dev_toolkit__android_install_apk, mcp__dev_toolkit__android_uninstall_app, mcp__dev_toolkit__android_logcat, mcp__dev_toolkit__android_get_screen_size, mcp__dev_toolkit__android_open_url, mcp__dev_toolkit__android_clear_app_data
 ---
 
@@ -43,7 +43,7 @@ For Android: use `mcp__dev_toolkit__android_*` tools
 
 ## Flow
 
-### Step 1 — Device & App Discovery
+### Step 1  -  Device & App Discovery
 
 ```
 Call: ios_list_devices (or android_list_devices)
@@ -58,13 +58,13 @@ Call: ios_launch_app (bundle_id)
 -> Wait 2 seconds for app to load
 ```
 
-### Step 2 — Clean Status Bar (for screenshots)
+### Step 2  -  Clean Status Bar (for screenshots)
 
 ```
 Call: ios_status_bar (time: "09:41", battery_level: 100)
 ```
 
-### Step 3 — Systematic Screen Exploration
+### Step 3  -  Systematic Screen Exploration
 
 For each screen in the app:
 
@@ -85,7 +85,7 @@ Call: ios_tap (on each tab bar item, button, navigation link)
 4. Scroll: `ios_swipe(200, 600, 200, 200)` to scroll down -> screenshot
 5. Type in text fields: `ios_type_text("test input")`
 
-### Step 4 — Variant Testing (based on input argument)
+### Step 4  -  Variant Testing (based on input argument)
 
 **"dark mode":**
 
@@ -129,13 +129,13 @@ Platform detection:
   cwd contains build.gradle OR build.gradle.kts        -> Android
   Otherwise                                            -> error: "store-ready needs an iOS or Android project"
 
-Step A — run the standard visual + accessibility sweep (light + dark + large text).
+Step A  -  run the standard visual + accessibility sweep (light + dark + large text).
 
-Step B — dispatch compliance skill:
+Step B  -  dispatch compliance skill:
   iOS:
     Load pipeline/skills/shared/core/apple-archive-compliance/SKILL.md
     Prereq: @mmerterden/dev-toolkit-mcp ≥ v2.4 (provides ios_app_store_audit MCP tool)
-            — installable via npm; standalone ArchiveGuard binary deprecated in v8.4.0
+             -  installable via npm; standalone ArchiveGuard binary deprecated in v8.4.0
     Artifact: pick newest .xcarchive under ~/Library/Developer/Xcode/Archives/**
               OR accept explicit path argument after "store-ready"
     Invoke:   mcp__dev_toolkit__ios_app_store_audit({ archive_path: <path>, rules: "all" })
@@ -150,11 +150,11 @@ Step B — dispatch compliance skill:
               apksigner verify, ABI/native scan
   Merge findings with UI-hunter findings -> single report, severity-grouped.
 
-Step C — humanize via `--lang en` by default (promptLanguage is locked to "en"; pass --lang=tr explicitly to opt into Turkish), group by severity
+Step C  -  humanize via `--lang en` by default (promptLanguage is locked to "en"; pass --lang=tr explicitly to opt into Turkish), group by severity
   (error = blocker, warning = risk, info = hygiene), link each finding to the
   Apple ITMS / Play policy reference supplied by the skill catalog.
 
-Step D — offer `/multi-agent:channels` follow-up so findings can land in
+Step D  -  offer `/multi-agent:channels` follow-up so findings can land in
   Jira / Confluence / Wiki / PR body via the normal Phase 7 machinery.
 ```
 
@@ -165,7 +165,7 @@ Step D — offer `/multi-agent:channels` follow-up so findings can land in
 - Run large text -> all screens
 - Compile complete report
 
-### Step 5 — Bug Detection (on EVERY screenshot)
+### Step 5  -  Bug Detection (on EVERY screenshot)
 
 When analyzing each screenshot, check for:
 
@@ -180,7 +180,7 @@ When analyzing each screenshot, check for:
 | **Localization** | Untranslated strings, text clipping in long translations                             |
 | **Interaction**  | Button didn't respond (before/after screenshots identical after tap)                 |
 
-### Step 6 — Report
+### Step 6  -  Report
 
 Create tasks for each bug found:
 
@@ -228,7 +228,7 @@ Then output full report:
 
 Save to: `$HOME/.claude/logs/sim-test/{bundle_id}/{timestamp}.md`
 
-### Step 7 — Fix Offer
+### Step 7  -  Fix Offer
 
 After report is complete, if bugs were found:
 
@@ -247,7 +247,7 @@ If user says yes:
 4. Re-run screenshot on that screen to verify fix
 5. Show before/after comparison
 
-### Step 8 — Cleanup
+### Step 8  -  Cleanup
 
 ```
 Call: ios_set_appearance("light")

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-1-analysis.json

@@ -16,7 +16,7 @@
   ],
   "risks": [
     {
-      "risk": "LoginView başka ekran tarafından preview alanı olarak kullanılıyor olabilir — token değişimi preview snapshot'larını kırabilir",
+      "risk": "LoginView başka ekran tarafından preview alanı olarak kullanılıyor olabilir  -  token değişimi preview snapshot'larını kırabilir",
       "severity": "low",
       "mitigation": "Preview varyantlarını snapshot'lar ile koruyarak incremental değiştir"
     }

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-4-review.json

@@ -6,8 +6,8 @@
         "severity": "blocking",
         "file": "Sources/Auth/LoginView.swift",
         "line": 42,
-        "issue": "Hardcoded .font(.system(size: 14)) kaldı — aynı fix sırasında typography token'ına da bağlanmalı",
-        "fix": "Replace with .typographyStyle(.body1) — same pattern as the color token migration"
+        "issue": "Hardcoded .font(.system(size: 14)) kaldı  -  aynı fix sırasında typography token'ına da bağlanmalı",
+        "fix": "Replace with .typographyStyle(.body1)  -  same pattern as the color token migration"
       }
     ],
     "approved": false

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-4-triage.json

@@ -4,8 +4,8 @@
       "severity": "blocking",
       "file": "Sources/Auth/LoginView.swift",
       "line": 42,
-      "issue": "Hardcoded .font(.system(size: 14)) kaldı — aynı fix sırasında typography token'ına da bağlanmalı",
-      "fix": "Replace with .typographyStyle(.body1) — same pattern as the color token migration",
+      "issue": "Hardcoded .font(.system(size: 14)) kaldı  -  aynı fix sırasında typography token'ına da bağlanmalı",
+      "fix": "Replace with .typographyStyle(.body1)  -  same pattern as the color token migration",
       "reviewer": "opus"
     }
   ],

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/metadata.json

@@ -1,5 +1,5 @@
 {
-  "focus": "SwiftUI bugfix path — verifies that Phase 4 picks up an in-scope but adjacent blocker (token drift) even when the primary issue is resolved.",
+  "focus": "SwiftUI bugfix path  -  verifies that Phase 4 picks up an in-scope but adjacent blocker (token drift) even when the primary issue is resolved.",
   "exercises": [
     "Phase 1 stack detection (iOS / Swift 6 / SwiftUI)",
     "Phase 2 TDD ordering (test before code)",

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-1-analysis.json

@@ -11,7 +11,7 @@
     },
     {
       "path": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
-      "why": "isRefreshing state flow eklenecek — PullToRefreshBox'ın state binding'i için"
+      "why": "isRefreshing state flow eklenecek  -  PullToRefreshBox'ın state binding'i için"
     },
     {
       "path": "feature/orders/src/test/java/com/example/orders/OrdersScreenTest.kt",
@@ -20,7 +20,7 @@
   ],
   "risks": [
     {
-      "risk": "Material3 PullToRefreshBox henüz beta API — 1.3.x'de signature değişti",
+      "risk": "Material3 PullToRefreshBox henüz beta API  -  1.3.x'de signature değişti",
       "severity": "medium",
       "mitigation": "Existing libs.versions.toml'de material3 sürümünü teyit et, gerekirse bump et"
     }

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-4-review.json

@@ -6,14 +6,14 @@
         "severity": "blocking",
         "file": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
         "line": 28,
-        "issue": "refresh() içinde isRefreshing = false finally bloğunda değil — exception fırlatıldığında spinner sonsuza dek takılır",
+        "issue": "refresh() içinde isRefreshing = false finally bloğunda değil  -  exception fırlatıldığında spinner sonsuza dek takılır",
         "fix": "Wrap the body in try/finally and set _isRefreshing.value = false in finally"
       },
       {
         "severity": "important",
         "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
         "line": 0,
-        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir — Compose stability endişesi var",
+        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir  -  Compose stability endişesi var",
         "fix": "Measure recomposition count with Compose Compiler Reports before merging"
       }
     ],
@@ -26,7 +26,7 @@
         "severity": "important",
         "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
         "line": 54,
-        "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor — configuration change'de state kaybı",
+        "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor  -  configuration change'de state kaybı",
         "fix": "Use rememberSaveable or hoist the state up to ViewModel"
       }
     ],

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-4-triage.json

@@ -4,7 +4,7 @@
       "severity": "blocking",
       "file": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
       "line": 28,
-      "issue": "refresh() içinde isRefreshing = false finally bloğunda değil — exception fırlatıldığında spinner sonsuza dek takılır",
+      "issue": "refresh() içinde isRefreshing = false finally bloğunda değil  -  exception fırlatıldığında spinner sonsuza dek takılır",
       "fix": "Wrap the body in try/finally and set _isRefreshing.value = false in finally",
       "reviewer": "opus"
     },
@@ -12,7 +12,7 @@
       "severity": "important",
       "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
       "line": 54,
-      "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor — configuration change'de state kaybı",
+      "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor  -  configuration change'de state kaybı",
       "fix": "Use rememberSaveable or hoist the state up to ViewModel",
       "reviewer": "sonnet"
     }
@@ -23,11 +23,11 @@
         "severity": "important",
         "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
         "line": 0,
-        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir — Compose stability endişesi var",
+        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir  -  Compose stability endişesi var",
         "fix": "Measure recomposition count with Compose Compiler Reports before merging",
         "reviewer": "opus"
       },
-      "reason": "Out of scope for this task — recomposition audit is a performance sweep, not a correctness gate for adding pull-to-refresh"
+      "reason": "Out of scope for this task  -  recomposition audit is a performance sweep, not a correctness gate for adding pull-to-refresh"
     }
   ],
   "rejected": [],

package/pipeline/eval/golden-tasks/02-android-feature-compose/metadata.json

@@ -1,5 +1,5 @@
 {
-  "focus": "Android/Compose feature path with mixed-verdict triage — one finding deferred out-of-scope, two accepted (one blocker + one important cross-reviewer match).",
+  "focus": "Android/Compose feature path with mixed-verdict triage  -  one finding deferred out-of-scope, two accepted (one blocker + one important cross-reviewer match).",
   "exercises": [
     "Phase 1 stack detection (android / Kotlin 2.1 / Jetpack Compose)",
     "Phase 2 3-task decomposition with clear dependency chain (T1 test → T2 VM → T3 UI)",

package/pipeline/eval/golden-tasks/02-android-feature-compose/task.json

@@ -1,6 +1,6 @@
 {
   "title": "Add pull-to-refresh on OrdersScreen",
-  "description": "Compose OrdersScreen'de swipe-to-refresh yok. Material3 PullToRefreshBox eklenmeli, ViewModel refresh() zaten var — UI tarafı bağlanmadı.",
+  "description": "Compose OrdersScreen'de swipe-to-refresh yok. Material3 PullToRefreshBox eklenmeli, ViewModel refresh() zaten var  -  UI tarafı bağlanmadı.",
   "inputType": "free-text",
   "expectedStack": "android",
   "expectedLanguage": "Kotlin",

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-1-analysis.json

@@ -0,0 +1,29 @@
+{
+  "stack": {
+    "primary": "backend",
+    "language": "Python 3.13",
+    "framework": "FastAPI"
+  },
+  "touchedAreas": [
+    {
+      "path": "app/middleware/rate_limit.py",
+      "why": "New sliding-window per-IP limiter implemented as ASGI middleware"
+    },
+    {
+      "path": "app/api/auth.py",
+      "why": "Login router registers the limiter and returns 429 + Retry-After on breach"
+    },
+    {
+      "path": "tests/test_rate_limit.py",
+      "why": "Covers allowed-under-limit, blocked-over-limit, and window reset"
+    }
+  ],
+  "risks": [
+    {
+      "risk": "An in-memory counter does not share state across Gunicorn/Uvicorn workers, so the limit is per-process not per-cluster",
+      "severity": "medium",
+      "mitigation": "Document the single-process assumption now; back it with Redis when the service scales horizontally"
+    }
+  ],
+  "summary": "Brute-force on POST /auth/login is unthrottled. Add a sliding-window per-IP limiter as middleware, wire it into the auth router, and return 429 with Retry-After. Scope is three files; the main caveat is multi-worker state sharing, deferred to a Redis-backed follow-up."
+}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-2-plan.json

@@ -0,0 +1,42 @@
+{
+  "approach": "TDD-first. Write a failing test that fires N+1 requests from one IP and asserts the last one returns 429 with Retry-After (RED). Implement the sliding-window limiter middleware (GREEN). Wire it into the auth router and assert allowed traffic still passes (refactor + integration).",
+  "tasks": [
+    {
+      "id": "T1",
+      "title": "Add failing rate-limit tests (under limit, over limit, window reset)",
+      "type": "test",
+      "files": ["tests/test_rate_limit.py"],
+      "dependsOn": [],
+      "acceptanceCriteria": [
+        "N requests under the limit all return 200",
+        "The N+1th request within the window returns 429 with a Retry-After header",
+        "After the window elapses, requests are allowed again"
+      ]
+    },
+    {
+      "id": "T2",
+      "title": "Implement sliding-window per-IP limiter middleware",
+      "type": "code",
+      "files": ["app/middleware/rate_limit.py"],
+      "dependsOn": ["T1"],
+      "acceptanceCriteria": [
+        "Tracks request timestamps per client IP in a sliding window",
+        "Emits 429 with Retry-After once the threshold is exceeded",
+        "Window bookkeeping is safe under concurrent requests"
+      ]
+    },
+    {
+      "id": "T3",
+      "title": "Register the limiter on the auth login route",
+      "type": "code",
+      "files": ["app/api/auth.py"],
+      "dependsOn": ["T2"],
+      "acceptanceCriteria": [
+        "POST /auth/login passes through the limiter",
+        "Normal login traffic under the limit is unaffected"
+      ]
+    }
+  ],
+  "approved": true,
+  "userFeedback": null
+}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-4-review.json

@@ -0,0 +1,20 @@
+[
+  {
+    "reviewer": "opus",
+    "findings": [
+      {
+        "severity": "blocking",
+        "file": "app/middleware/rate_limit.py",
+        "line": 38,
+        "issue": "The per-IP window dict is read-modified-written without a lock; under concurrent requests two coroutines can both pass the check and under-count, letting bursts through",
+        "fix": "Guard the read-modify-write with an asyncio.Lock keyed per IP, or use an atomic counter structure"
+      }
+    ],
+    "approved": false
+  },
+  {
+    "reviewer": "sonnet",
+    "findings": [],
+    "approved": true
+  }
+]