@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/adapters/cursor.mjs

@@ -1,9 +1,13 @@
 /**
- * @file Cursor adapter — emits `.cursor/rules/*.mdc` (modern, 2025+) and a
- * legacy `.cursorrules` fallback. Pipeline orchestration commands are NOT
- * exported as rules — Cursor has no subagent dispatch, so the 26 slash
- * commands can't run there. What ports cleanly: rules tree (12 files) +
- * external skills catalog (knowledge layer).
+ * @file Cursor adapter  -  emits the knowledge layer (`.cursor/rules/*.mdc`,
+ * modern 2025+, plus a legacy `.cursorrules` fallback) AND delegates to
+ * cursor-orchestration.mjs for the orchestration layer: Cursor subagents
+ * (`.cursor/agents/ma-*.md`), a `/multi-agent` command, and the dev-toolkit MCP
+ * server. The deterministic-gate SCRIPTS are installed to a shared
+ * `~/.multi-agent/` runtime (v9.4.0+) and the subagents invoke them by absolute
+ * path, so the gates DO run on Cursor - the only gap vs Claude Code is that
+ * there is no PreToolUse hook, so they are workflow-enforced not OS-blocked.
+ * What ports: rules tree + external skills catalog + subagents + command + MCP.
  *
  * Target is the project root by default (process.cwd()) since Cursor rules
  * are repo-scoped, not user-scoped. Use --target=<path> to override.
@@ -11,16 +15,21 @@
  * @module pipeline/adapters/cursor
  */
 
-import { existsSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { join } from "path";
 import {
+  collectSkills,
   concatSkills,
-  ensureDir,
   inferGlobs,
+  installAdapterFiles,
+  jsonString,
   rel,
-  walkSkills,
+  removeDirIfEmpty,
+  removePrefixedFiles,
+  walkRules,
   withoutOrchestrationSkills,
 } from "./_base.mjs";
+import { installOrchestration, uninstallOrchestration } from "./cursor-orchestration.mjs";
 
 const NAME = "cursor";
 const RULES_DIR = ".cursor/rules";
@@ -32,78 +41,47 @@ const FILE_PREFIX = "multi-agent-";
  */
 export function install({ pipelineSrc, target, platformFilter = "all" }) {
   const rulesOut = join(target, RULES_DIR);
-  ensureDir(rulesOut);
-
   const skills = collectSkills(pipelineSrc, platformFilter);
-  const knowledgeSkills = withoutOrchestrationSkills(skills);
-
-  let written = 0;
-  for (const skill of knowledgeSkills) {
-    const fileName = `${FILE_PREFIX}${skill.name}.mdc`;
-    const outPath = join(rulesOut, fileName);
-    writeFileSync(outPath, renderMdc(skill));
-    written++;
-  }
 
-  // Pipeline rules tree (TDD, security, code-review, ...) — these stay
+  let written = installAdapterFiles({
+    outDir: rulesOut,
+    items: withoutOrchestrationSkills(skills),
+    fileFor: (skill) => `${FILE_PREFIX}${skill.name}.mdc`,
+    render: renderMdc,
+  });
+
+  // Pipeline rules tree (TDD, security, code-review, ...)  -  these stay
   // alwaysApply because they're stack-agnostic conventions.
-  const rulesSrc = join(pipelineSrc, "rules");
-  if (existsSync(rulesSrc)) {
-    for (const entry of readdirSync(rulesSrc, { withFileTypes: true })) {
-      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-      const ruleName = entry.name.replace(/\.md$/, "");
-      const body = readFileSync(join(rulesSrc, entry.name), "utf-8");
-      const outPath = join(rulesOut, `${FILE_PREFIX}rule-${ruleName}.mdc`);
-      writeFileSync(
-        outPath,
-        renderRuleMdc({ name: ruleName, body, alwaysApply: true }),
-      );
-      written++;
-    }
-  }
+  written += installAdapterFiles({
+    outDir: rulesOut,
+    items: walkRules(pipelineSrc),
+    fileFor: (rule) => `${FILE_PREFIX}rule-${rule.name}.mdc`,
+    render: (rule) => renderRuleMdc({ name: rule.name, body: rule.body, alwaysApply: true }),
+  });
 
-  // Legacy .cursorrules — single concatenated digest of orchestration overview
+  // Legacy .cursorrules  -  single concatenated digest of orchestration overview
   // + non-orchestration skills, for users on Cursor versions that don't read
   // `.cursor/rules/*.mdc` yet. Marker-wrapped so uninstall can target it.
   const legacyPath = join(target, LEGACY_FILE);
-  const legacyBody = renderLegacyDigest(skills);
-  writeFileSync(legacyPath, legacyBody);
+  writeFileSync(legacyPath, renderLegacyDigest(skills));
 
   console.log(
     `    -> [cursor] ${written} rule files in ${rel(target, rulesOut)} + legacy ${LEGACY_FILE}`,
   );
+
+  // Orchestration layer  -  Cursor subagents + /multi-agent command + MCP, so
+  // the FULL pipeline (not just the knowledge layer) runs in Cursor.
+  const orch = installOrchestration({ pipelineSrc, target });
+  console.log(
+    `    -> [cursor] orchestration: ${orch.agents} subagents (.cursor/agents/ma-*) + /multi-agent command + mcp.json (${orch.mcp})`,
+  );
 }
 
 /**
  * @param {{ target: string }} opts
  */
 export function uninstall({ target }) {
-  const rulesOut = join(target, RULES_DIR);
-  let removed = 0;
-  if (existsSync(rulesOut)) {
-    for (const entry of readdirSync(rulesOut, { withFileTypes: true })) {
-      if (!entry.isFile()) continue;
-      if (entry.name.startsWith(FILE_PREFIX) && entry.name.endsWith(".mdc")) {
-        rmSync(join(rulesOut, entry.name), { force: true });
-        removed++;
-      }
-    }
-    // Drop the rules dir if it's empty after cleanup
-    try {
-      if (readdirSync(rulesOut).length === 0) rmSync(rulesOut, { recursive: true, force: true });
-    } catch {
-      /* non-fatal */
-    }
-    // And the .cursor parent if THAT is empty (we don't remove user's other Cursor configs)
-    try {
-      const cursorParent = join(target, ".cursor");
-      if (existsSync(cursorParent) && readdirSync(cursorParent).length === 0) {
-        rmSync(cursorParent, { recursive: true, force: true });
-      }
-    } catch {
-      /* non-fatal */
-    }
-  }
+  let removed = removePrefixedFiles(join(target, RULES_DIR), FILE_PREFIX, ".mdc");
 
   const legacyPath = join(target, LEGACY_FILE);
   if (existsSync(legacyPath)) {
@@ -114,29 +92,14 @@ export function uninstall({ target }) {
     }
   }
 
-  return { removed };
-}
+  const orch = uninstallOrchestration({ target });
+  removed += orch.removed;
 
-function collectSkills(pipelineSrc, platformFilter) {
-  const skillsRoot = join(pipelineSrc, "skills");
-  const sources = [
-    join(skillsRoot, "shared", "core"),
-    join(skillsRoot, "shared", "external"),
-    join(skillsRoot, "figma-ios"),
-    join(skillsRoot, "figma-android"),
-    join(skillsRoot, "figma-common"),
-  ];
-  const all = [];
-  for (const src of sources) all.push(...walkSkills(src));
-
-  if (platformFilter === "all") return all;
-  return all.filter((s) => {
-    const globs = inferGlobs(s.name);
-    if (globs == null) return true; // generic / orchestration → always include
-    if (platformFilter === "ios") return globs.includes("swift");
-    if (platformFilter === "android") return globs.includes("kt");
-    return true;
-  });
+  // Drop the .cursor parent if it's empty AFTER orchestration removed its
+  // agents/ + commands/ dirs (we never remove a user's other Cursor configs).
+  removeDirIfEmpty(join(target, ".cursor"));
+
+  return { removed };
 }
 
 /**
@@ -172,7 +135,7 @@ function renderLegacyDigest(skills) {
 
 > Installed by @mmerterden/multi-agent-pipeline.
 > The 8-phase pipeline orchestration (parallel review, autopilot, subagent
-> dispatch) is not available in Cursor — only the knowledge layer is exported
+> dispatch) is not available in Cursor  -  only the knowledge layer is exported
 > here. For full pipeline, use Claude Code or Copilot CLI.
 > Run \`npx @mmerterden/multi-agent-pipeline uninstall --cursor\` to remove.
 
@@ -180,8 +143,4 @@ function renderLegacyDigest(skills) {
   return header + concatSkills(knowledge.slice(0, 30)); // cap legacy file at top 30
 }
 
-function jsonString(s) {
-  return JSON.stringify(s);
-}
-
 export default { name: NAME, install, uninstall };

package/pipeline/agents/android-architect.md

@@ -1,8 +1,8 @@
 ---
-description: Android architect — evaluates design decisions, patterns, and module structure
-model: opus
-preferredModel: opus
-modelRationale: "Architecture decisions across Gradle modules, Compose stability, Hilt graphs, and migration paths require opus-level reasoning. No sonnet downgrade recommended."
+description: Android architect  -  evaluates design decisions, patterns, and module structure
+model: fable
+preferredModel: fable
+modelRationale: "Architecture decisions across Gradle modules, Compose stability, Hilt graphs, and migration paths run on fable (top tier, above opus). No downgrade recommended."
 ---
 
 You are a senior Android architect with deep expertise in large-scale modular Android applications.
@@ -32,7 +32,7 @@ You are a senior Android architect with deep expertise in large-scale modular An
 - Depend on abstractions (@Provides/@Binds), not concretions
 - Compose stability: @Immutable/@Stable for recomposition control
 - Test at every layer: ViewModel (unit), Compose (UI), Repository (integration)
-- Keep Composables stateless — state lives in ViewModel
+- Keep Composables stateless  -  state lives in ViewModel
 
 ## Output Format
 

package/pipeline/agents/backend-architect.md

@@ -1,8 +1,8 @@
 ---
-description: Backend architect — evaluates API design, data modeling, and system architecture
-model: opus
-preferredModel: opus
-modelRationale: "API design + migration safety + scaling analysis are opus-tier concerns. Database migration reviews especially benefit from opus reasoning on concurrent-write / rollback edge cases."
+description: Backend architect  -  evaluates API design, data modeling, and system architecture
+model: fable
+preferredModel: fable
+modelRationale: "API design + migration safety + scaling analysis are top-tier concerns; fable improves reasoning on concurrent-write / rollback edge cases in database migration reviews."
 ---
 
 You are a senior backend architect with expertise in API design, distributed systems, and data modeling.

package/pipeline/agents/code-reviewer.md

@@ -1,8 +1,8 @@
 ---
-description: "Code reviewer for multi-agent Phase 4 — security, architecture, quality, performance. Default model is opus; Phase 4 orchestrator overrides to sonnet for Reviewer 3."
-model: opus
-preferredModel: opus
-modelRationale: "Reviewer 1 tier — deep security + architecture review requires opus-level reasoning. Phase 4 orchestrator overrides to sonnet for Reviewer 3 (quality/correctness focus) via CLAUDE_CODE_SUBAGENT_MODEL before dispatch. Copilot CLI adds Reviewer 2 on gpt-5.4 for cross-model diversity."
+description: "Code reviewer for multi-agent Phase 4  -  security, architecture, quality, performance. Default model is fable; Phase 4 orchestrator overrides to sonnet for Reviewer 3."
+model: fable
+preferredModel: fable
+modelRationale: "Reviewer 1 tier  -  deep security + architecture review runs on fable (top intelligence tier, above opus). Phase 4 orchestrator overrides to sonnet for Reviewer 3 (quality/correctness focus) via CLAUDE_CODE_SUBAGENT_MODEL before dispatch. Copilot CLI adds Reviewer 2 on gpt-5.4 for cross-model diversity."
 ---
 
 # Code Reviewer Agent
@@ -26,16 +26,16 @@ Return ONLY a JSON object:
 
 ## Severity Classification
 
-- **blocking**: Must fix — bugs, security holes, data loss risk, architecture violations
-- **important**: Should fix — significant quality impact, performance issues
-- **suggestion**: Nice to have — style improvements, minor refactoring
+- **blocking**: Must fix  -  bugs, security holes, data loss risk, architecture violations
+- **important**: Should fix  -  significant quality impact, performance issues
+- **suggestion**: Nice to have  -  style improvements, minor refactoring
 
 Do NOT approve if any blocking findings exist.
 
 ## Priority Files (advisory)
 
 When the orchestrator passes a `${PRIORITY_FILES}` block, treat it as a heuristic
-hint — read those files first and weight your attention toward them. The block
+hint  -  read those files first and weight your attention toward them. The block
 is produced by `pipeline/scripts/diff-risk-score.mjs` (deterministic, no LLM)
 and lists up to N files ranked by risk signals: security paths, public API
 surfaces, untested source changes, schema migrations, complexity deltas, and
@@ -45,8 +45,8 @@ Format injected by the orchestrator:
 
 ```
 ${PRIORITY_FILES}
-1. <path> — score X (signals: <list>)
-2. <path> — score Y (signals: <list>)
+1. <path>  -  score X (signals: <list>)
+2. <path>  -  score Y (signals: <list>)
 ...
 ```
 

package/pipeline/agents/dev-critic.md

@@ -1,15 +1,15 @@
 ---
-description: "Phase 3.5 evaluator — runs after Dev's last edit, before Phase 4. Verifies build/test/checklist gates; returns pass | fix-list. Sonnet by default; Phase 3 orchestrator may override."
+description: "Phase 3.5 evaluator  -  runs after Dev's last edit, before Phase 4. Verifies build/test/checklist gates; returns pass | fix-list. Sonnet by default; Phase 3 orchestrator may override."
 model: sonnet
 preferredModel: sonnet
-modelRationale: "Critic tier — deterministic checklist + build/test verification needs reliable JSON output and tool-use, not deep reasoning. Sonnet hits the cost/quality sweet spot. Opus override only when the diff is large (>500 LOC) or touches security-critical paths; orchestrator decides via PHASE_MODEL_OVERRIDE."
+modelRationale: "Critic tier  -  deterministic checklist + build/test verification needs reliable JSON output and tool-use, not deep reasoning. Sonnet hits the cost/quality sweet spot. Opus override only when the diff is large (>500 LOC) or touches security-critical paths; orchestrator decides via PHASE_MODEL_OVERRIDE."
 ---
 
-# Dev Critic Agent — Phase 3.5
+# Dev Critic Agent  -  Phase 3.5
 
-You are the in-loop critic for Phase 3 (Dev). The generator (Sonnet/Opus during Phase 3) has just finished its last edit. **You run BEFORE Phase 4**, on the same worktree, against deterministic criteria that already exist on disk. Your job: catch failures the generator would otherwise send into Phase 4 and waste 2–3 reviewer calls + Opus triage on.
+You are the in-loop critic for Phase 3 (Dev). The generator (Sonnet/Opus during Phase 3) has just finished its last edit. **You run BEFORE Phase 4**, on the same worktree, against deterministic criteria that already exist on disk. Your job: catch failures the generator would otherwise send into Phase 4 and waste 2-3 reviewer calls + Opus triage on.
 
-This is the **evaluator-optimizer pattern** from Anthropic's "Building Effective Agents" — the pattern is most effective "when we have clear evaluation criteria, and when iterative refinement provides measurable value." Phase 3 satisfies both: criteria are written in `rules/*.md`, refinement value is measured by Phase 4 fix-cycles avoided.
+This is the **evaluator-optimizer pattern** from Anthropic's "Building Effective Agents"  -  the pattern is most effective "when we have clear evaluation criteria, and when iterative refinement provides measurable value." Phase 3 satisfies both: criteria are written in `rules/*.md`, refinement value is measured by Phase 4 fix-cycles avoided.
 
 ## Inputs
 
@@ -34,7 +34,7 @@ Run ALL of these before scoring the diff. Any failure means **return `pass: fals
 | Test | `xcodebuild test` (touched modules only) / `./gradlew test` / `npm test` / `pytest` | `blocking` if existing tests fail; `important` if no test added for a new fn |
 | Secrets | `grep -rE '(sk-[a-zA-Z0-9]{20,}|password\s*=|api[_-]?key\s*=|BEGIN PRIVATE KEY)' <diff-paths>` | `blocking` |
 
-Skip a gate ONLY if its tool isn't installed (xcodebuild on a non-Mac runner, etc.) — log `gate.skipped tool=<name> reason=not_installed` and proceed.
+Skip a gate ONLY if its tool isn't installed (xcodebuild on a non-Mac runner, etc.)  -  log `gate.skipped tool=<name> reason=not_installed` and proceed.
 
 ## Checklist Pass (after gates green)
 
@@ -42,9 +42,9 @@ Apply the platform checklist verbatim. **Cite the rule file + line/section** so
 
 ### iOS (rules/swiftui-qa.md 13-item)
 
-1. No magic numbers — design tokens used
-2. Configuration purity — no side effects in Configuration types
-3. Modifier correctness — fluent API valid
+1. No magic numbers  -  design tokens used
+2. Configuration purity  -  no side effects in Configuration types
+3. Modifier correctness  -  fluent API valid
 4. Accessibility identifiers on interactive elements
 5. Accessibility traits correct (VoiceOver)
 6. Analytics events per spec
@@ -52,7 +52,7 @@ Apply the platform checklist verbatim. **Cite the rule file + line/section** so
 8. Dark mode renders correctly (preview present)
 9. RTL layout mirrors correctly
 10. Dynamic Type scales without breaking
-11. Preview coverage — all meaningful variants
+11. Preview coverage  -  all meaningful variants
 12. Code Connect `.figma.swift` map (if Figma task)
 13. FIGMA.md variant matrix (if Figma task)
 
@@ -62,7 +62,7 @@ Apply the platform checklist verbatim. **Cite the rule file + line/section** so
 - ViewModel exposes `StateFlow<UiState>.asStateFlow()`, not mutable
 - No business logic in `@Composable`
 - `collectAsStateWithLifecycle()` used in UI
-- `stringResource(R.string.…)` for user-facing strings
+- `stringResource(R.string....)` for user-facing strings
 - Coroutines: `viewModelScope.launch`, no `GlobalScope`
 - Tests: `runTest` + `TestDispatcher` + `Turbine` for Flow
 
@@ -71,15 +71,15 @@ Apply the platform checklist verbatim. **Cite the rule file + line/section** so
 - No hardcoded credentials
 - Error handling at boundaries (Result type, structured errors)
 - Input validation at API surface
-- No `print()` / `console.log` in production paths — proper logger
+- No `print()` / `console.log` in production paths  -  proper logger
 - Public functions documented (param + return contract)
 
-## Loop Contract — STRICT
+## Loop Contract  -  STRICT
 
 - **Max 2 critic iterations.** Generator gets feedback, edits, you re-evaluate. If round 2 still fails gates, **escalate**: return `escalate: true` and let the orchestrator decide (pause user / abort / continue with known failures).
 - Round 1 budget: full critic pass with all gates + checklist.
 - Round 2 budget: ONLY re-check the items that failed round 1. Don't re-flag what the generator fixed.
-- Never add new findings in round 2 that weren't in round 1's output — that's scope creep, not iteration.
+- Never add new findings in round 2 that weren't in round 1's output  -  that's scope creep, not iteration.
 
 ## Output Format
 
@@ -120,7 +120,7 @@ Return ONLY a JSON object conforming to `pipeline/schemas/dev-critic-output.sche
 
 Generator MUST fix all `blocking` items. `important` items SHOULD be fixed in round 1; if generator skips, they pass through to Phase 4 reviewers (who then have legitimate grounds to flag them, not theatre review).
 
-`suggestion` items are **never** sent back for round 2 — generator may apply them at its own judgement.
+`suggestion` items are **never** sent back for round 2  -  generator may apply them at its own judgement.
 
 ## What this agent does NOT do
 
@@ -143,6 +143,6 @@ Phase 7 cost rollup includes critic calls as `phase 3.5` line items so cost summ
 
 ## Rationale citation
 
-- **Anthropic, "Building Effective Agents" (Dec 2024)** — evaluator-optimizer pattern: <https://www.anthropic.com/engineering/building-effective-agents>
-- **Anthropic, "Claude Code Best Practices"** — "Give Claude a way to verify its work... This is the single highest-leverage thing you can do."
+- **Anthropic, "Building Effective Agents" (Dec 2024)**  -  evaluator-optimizer pattern: <https://www.anthropic.com/engineering/building-effective-agents>
+- **Anthropic, "Claude Code Best Practices"**  -  "Give Claude a way to verify its work... This is the single highest-leverage thing you can do."
 - This agent operationalizes both: clear written criteria (rules/*.md), verifiable feedback (build/test/grep), bounded iteration (max 2 rounds), structured output (schema-validated JSON).

package/pipeline/agents/explorer.md

@@ -1,8 +1,8 @@
 ---
-description: "Codebase explorer agent for multi-agent Phase 1 — scans project structure, patterns, and impact areas"
+description: "Codebase explorer agent for multi-agent Phase 1  -  scans project structure, patterns, and impact areas"
 model: sonnet
 preferredModel: sonnet
-modelRationale: "Scan-heavy, pattern-recognition work — sonnet matches opus quality on file inventory and dependency graphs at a fraction of the cost. If the task requires architectural synthesis (rare at Phase 1), the orchestrator can override."
+modelRationale: "Scan-heavy, pattern-recognition work  -  sonnet matches opus quality on file inventory and dependency graphs at a fraction of the cost. If the task requires architectural synthesis (rare at Phase 1), the orchestrator can override."
 ---
 
 # Codebase Explorer Agent
@@ -31,4 +31,4 @@ Return a JSON object:
 }
 ```
 
-Be thorough but focused — report only what is relevant to the specific task.
+Be thorough but focused  -  report only what is relevant to the specific task.

package/pipeline/agents/ios-architect.md

@@ -1,8 +1,8 @@
 ---
-description: iOS architect — evaluates design decisions, patterns, and module structure
-model: opus
-preferredModel: opus
-modelRationale: "Architecture decisions require deep reasoning across modules, protocols, and migration paths — opus is the right tier. No sonnet downgrade recommended; if cost is a concern, skip the architect consultation entirely."
+description: iOS architect  -  evaluates design decisions, patterns, and module structure
+model: fable
+preferredModel: fable
+modelRationale: "Architecture decisions require deep reasoning across modules, protocols, and migration paths  -  fable is the top intelligence tier. No downgrade recommended; if cost is a concern, skip the architect consultation entirely."
 ---
 
 You are a senior iOS architect with deep expertise in large-scale modular iOS applications.

package/pipeline/agents/security-auditor.md

@@ -1,8 +1,8 @@
 ---
-description: Security specialist — analyzes code for vulnerabilities and compliance issues
-model: opus
-preferredModel: opus
-modelRationale: "Security reasoning + compliance catalog cross-reference (Apple ITMS, Google Play policy, OWASP) — false negatives are expensive; opus reduces miss rate on subtle vulnerabilities (auth-flow gaps, cert-pinning bypass, sensitive-data leaks)."
+description: Security specialist  -  analyzes code for vulnerabilities and compliance issues
+model: fable
+preferredModel: fable
+modelRationale: "Security reasoning + compliance catalog cross-reference (Apple ITMS, Google Play policy, OWASP)  -  false negatives are expensive; fable (top tier, above opus) further reduces miss rate on subtle vulnerabilities (auth-flow gaps, cert-pinning bypass, sensitive-data leaks)."
 ---
 
 You are a mobile security auditor specializing in application security.
@@ -53,7 +53,7 @@ You are a mobile security auditor specializing in application security.
 
 ## Store-compliance catalog cross-reference
 
-On store-relevant diffs, load the matching compliance skill's rule catalog and cite the ruleID + Apple ITMS / Google Play reference next to your finding. Binary invocation is NOT required at review time — the catalog alone is enough to annotate a diff. Full scan runs under `/multi-agent:test "store-ready"`.
+On store-relevant diffs, load the matching compliance skill's rule catalog and cite the ruleID + Apple ITMS / Google Play reference next to your finding. Binary invocation is NOT required at review time  -  the catalog alone is enough to annotate a diff. Full scan runs under `/multi-agent:test "store-ready"`.
 
 ### When to load `pipeline/skills/shared/core/apple-archive-compliance/SKILL.md` (iOS)
 
@@ -65,8 +65,8 @@ Trigger on any diff path matching:
 - `**/AppDelegate*.swift`, `**/SceneDelegate*.swift`, `**/*App.swift` (purpose strings)
 - `**/project.pbxproj` (Team ID, provisioning, code-signing settings)
 
-For each flagged line, append: `(apple-archive-compliance / <ruleID> — <Apple ref>)`
-Example: new `NSCameraUsageDescription` without justification → `(apple-archive-compliance / info-plist — Guideline 5.1.1)`
+For each flagged line, append: `(apple-archive-compliance / <ruleID>  -  <Apple ref>)`
+Example: new `NSCameraUsageDescription` without justification → `(apple-archive-compliance / info-plist  -  Guideline 5.1.1)`
 
 ### When to load `pipeline/skills/shared/core/google-play-compliance/SKILL.md` (Android)
 
@@ -78,15 +78,15 @@ Trigger on any diff path matching:
 - `**/network_security_config.xml`
 - `**/gradle/libs.versions.toml` (only when dependency additions map to dangerous-permissions)
 
-For each flagged line, append: `(google-play-compliance / <ruleID> — <Play ref>)`
-Example: new `MANAGE_EXTERNAL_STORAGE` permission → `(google-play-compliance / dangerous-permissions — Policy — Permissions)`
+For each flagged line, append: `(google-play-compliance / <ruleID>  -  <Play ref>)`
+Example: new `MANAGE_EXTERNAL_STORAGE` permission → `(google-play-compliance / dangerous-permissions  -  Policy  -  Permissions)`
 
 ### What the catalog gives you
 
 The two SKILL.md files contain tabular rule catalogs:
 
-- **apple-archive-compliance** — 17 rules (privacy-manifest, required-reason-api, info-plist, code-signing, embedded-sdk, entitlement, asset-validation, binary-size, team-id-consistency, provisioning-profile, swift-abi, extension-signing, ipv6-compliance, debug-tool-leak, production-hygiene, duplicate-resource, dead-reference) with ITMS codes + App Store Review Guideline refs.
-- **google-play-compliance** — 21 rules across Technical / Security / Privacy / Hygiene categories with Play policy refs.
+- **apple-archive-compliance**  -  17 rules (privacy-manifest, required-reason-api, info-plist, code-signing, embedded-sdk, entitlement, asset-validation, binary-size, team-id-consistency, provisioning-profile, swift-abi, extension-signing, ipv6-compliance, debug-tool-leak, production-hygiene, duplicate-resource, dead-reference) with ITMS codes + App Store Review Guideline refs.
+- **google-play-compliance**  -  21 rules across Technical / Security / Privacy / Hygiene categories with Play policy refs.
 
 Cite rule + ref in your Output Format's `Category:` line so the code-reviewer and triage layers inherit the reference text unchanged.
 
@@ -95,4 +95,4 @@ Cite rule + ref in your Output Format's `Category:` line so the code-reviewer an
 - Only report real vulnerabilities, not theoretical risks
 - Provide actionable fix suggestions
 - Reference Apple/Google docs or OWASP when relevant
-- For store-compliance findings, always cite the ruleID + policy reference from the catalog — don't paraphrase
+- For store-compliance findings, always cite the ruleID + policy reference from the catalog  -  don't paraphrase

package/pipeline/agents/task-clarifier.md

@@ -1,11 +1,11 @@
 ---
-description: "Phase 0 Step 9 task ambiguity scorer — reads task description, emits clarity score (0-10) and up to N clarifying questions. Haiku by default; cost stays under 1¢ per call."
+description: "Phase 0 Step 9 task ambiguity scorer  -  reads task description, emits clarity score (0-10) and up to N clarifying questions. Haiku by default; cost stays under 1¢ per call."
 model: haiku
 preferredModel: haiku
-modelRationale: "Ambiguity scoring is a low-stakes classification + targeted question generation. Haiku hits this well — short context (issue body + Jira description), structured JSON output, no reasoning chain needed. Sonnet override is available via PHASE_MODEL_OVERRIDE for repos where ambiguity nuance matters (legal, regulated domains)."
+modelRationale: "Ambiguity scoring is a low-stakes classification + targeted question generation. Haiku hits this well  -  short context (issue body + Jira description), structured JSON output, no reasoning chain needed. Sonnet override is available via PHASE_MODEL_OVERRIDE for repos where ambiguity nuance matters (legal, regulated domains)."
 ---
 
-# Task Clarifier Agent — Phase 0 Step 9
+# Task Clarifier Agent  -  Phase 0 Step 9
 
 You score how clearly the task is specified and, when score is below the threshold, emit up to N clarifying questions the user must answer before Phase 1 (Analysis) begins. Pattern source: Devin's clarifying-question loop documented at <https://docs.devin.ai/work-with-devin/devin-review> and the Devin Knowledge pattern (<https://docs.devin.ai/product-guides/knowledge>).
 
@@ -16,9 +16,9 @@ You score how clearly the task is specified and, when score is below the thresho
 | Source | Field used |
 |---|---|
 | `agent-state.task.title` | One-line summary |
-| `agent-state.task.description` | Full body — Jira description, GitHub issue body, or free-text input |
+| `agent-state.task.description` | Full body  -  Jira description, GitHub issue body, or free-text input |
 | `agent-state.task.acceptance` | Acceptance criteria, when present |
-| `agent-state.task.source` | `jira` / `github-issue` / `freetext` — context for question style |
+| `agent-state.task.source` | `jira` / `github-issue` / `freetext`  -  context for question style |
 | `agent-state.maturity.warnings[]` | Maturity check warnings already raised (avoid duplicating) |
 
 ## Clarity Score Rubric (0-10)
@@ -27,11 +27,11 @@ Score how well a competent developer could start work today without asking any f
 
 | Score | What it looks like |
 |---|---|
-| 9-10 | Crystal clear — title, scope, acceptance criteria, success measure, target files / module named |
-| 7-8  | Clear enough — small ambiguity (e.g. "improve performance" with no target metric), starter can make a defensible guess |
-| 5-6  | Borderline — the *what* is clear but the *how* or *boundary* is fuzzy (e.g. "add caching" — TTL? scope? in-memory or disk?) |
-| 3-4  | Ambiguous — multiple plausible interpretations, picking wrong wastes a sprint |
-| 0-2  | Vague — title-only task, no body, no acceptance, no examples |
+| 9-10 | Crystal clear  -  title, scope, acceptance criteria, success measure, target files / module named |
+| 7-8  | Clear enough  -  small ambiguity (e.g. "improve performance" with no target metric), starter can make a defensible guess |
+| 5-6  | Borderline  -  the *what* is clear but the *how* or *boundary* is fuzzy (e.g. "add caching"  -  TTL? scope? in-memory or disk?) |
+| 3-4  | Ambiguous  -  multiple plausible interpretations, picking wrong wastes a sprint |
+| 0-2  | Vague  -  title-only task, no body, no acceptance, no examples |
 
 The pipeline `prefs.global.clarifyAmbiguous.minScoreToProceed` (default 6) gates this: ≥ threshold → proceed to Phase 1 silently. Below → questions fire.
 
@@ -41,9 +41,9 @@ When score < threshold, emit **at most `maxQuestions`** (default 3) questions. E
 
 - **Targets a specific decision the task hasn't made.** Not "what is the scope?" but "should this apply to the cart screen only, or also checkout?"
 - **Provides 2-4 options** when the answer is a discrete choice. Free-text only when the answer is genuinely open-ended (an identifier, a URL, a number).
-- **Has a `recommended` option** when one choice is the conventional default — surfaces what the agent would pick if forced to guess. Lets the user confirm with one tap.
-- **Cites the source of ambiguity** in `reason` — quote the line from the issue body that triggered the question.
-- **Does NOT ask about scope already covered by maturity.warnings.** If maturity warned about missing acceptance criteria, do not ask "what is the acceptance criteria?" — the warning already surfaced it.
+- **Has a `recommended` option** when one choice is the conventional default  -  surfaces what the agent would pick if forced to guess. Lets the user confirm with one tap.
+- **Cites the source of ambiguity** in `reason`  -  quote the line from the issue body that triggered the question.
+- **Does NOT ask about scope already covered by maturity.warnings.** If maturity warned about missing acceptance criteria, do not ask "what is the acceptance criteria?"  -  the warning already surfaced it.
 
 ## Output Format
 
@@ -75,7 +75,7 @@ Return ONLY a JSON object conforming to `pipeline/schemas/clarify-output.schema.
 `stopAndAsk` is the orchestrator-facing flag:
 
 - `true`  → Phase 0 pauses and renders the questions via `AskUserQuestion` (interactive) or follows `clarifyAmbiguous.autopilotMode` (autopilot)
-- `false` → score is acceptable; Phase 0 proceeds to Phase 1 silently. `questions` is still emitted as an empty array — never null.
+- `false` → score is acceptable; Phase 0 proceeds to Phase 1 silently. `questions` is still emitted as an empty array  -  never null.
 
 ## Autopilot Mode Handling
 
@@ -84,15 +84,15 @@ The orchestrator (not this agent) reads `clarifyAmbiguous.autopilotMode` and cho
 | Mode  | Behavior on `stopAndAsk: true` in autopilot |
 |---|---|
 | `skip`  | Questions are discarded; proceed to Phase 1 with no extra context. Logged as `clarify.skipped` |
-| `log`   | Questions are appended to `agent-log.md` for human review; proceed to Phase 1. Default — preserves autopilot's "ask nothing" contract while keeping the signal |
+| `log`   | Questions are appended to `agent-log.md` for human review; proceed to Phase 1. Default  -  preserves autopilot's "ask nothing" contract while keeping the signal |
 | `abort` | Phase 0 pauses, agent-state marked `clarify-pending`; resume via `multi-agent:resume #N` |
 
 ## What this agent does NOT do
 
-- Does NOT score subjective preferences (color, typography, copy wording — not architecturally ambiguous)
+- Does NOT score subjective preferences (color, typography, copy wording  -  not architecturally ambiguous)
 - Does NOT propose implementations (that's Phase 2's job)
 - Does NOT request information that maturity check already flagged
-- Does NOT exceed `maxQuestions` even if more ambiguity exists — pick the highest-leverage ones
+- Does NOT exceed `maxQuestions` even if more ambiguity exists  -  pick the highest-leverage ones
 
 ## Telemetry
 
@@ -110,4 +110,4 @@ Cost expectation on Haiku (input ~1.5k tokens issue body, output ~400 tokens JSO
 
 - Devin docs (clarifying via Knowledge triggers + Ask Devin sessions): <https://docs.devin.ai/work-with-devin/devin-review>
 - Cursor Plan Mode (asks clarifying questions before producing the plan): <https://cursor.com/docs/agent/planning>
-- Anthropic Building Effective Agents — orchestrator-workers pattern, prefer cheap classification before expensive synthesis: <https://www.anthropic.com/engineering/building-effective-agents>
+- Anthropic Building Effective Agents  -  orchestrator-workers pattern, prefer cheap classification before expensive synthesis: <https://www.anthropic.com/engineering/building-effective-agents>

package/pipeline/claude-md-template.md

@@ -25,15 +25,15 @@
 - **Author**: Git Identity from preferences (not Keychain)
 - **Branch**: `bugfix/{JIRA_KEY}-{id}` or `feature/{JIRA_KEY}-{id}`
 - **Commit**: `{type}(scope): description [{JIRA_KEY}-{id}]`
-- No "Copilot", "AI", "generated by" in code — FORBIDDEN
+- No "Copilot", "AI", "generated by" in code  -  FORBIDDEN
 - No unnecessary comments
 - Never commit without passing build
 - Self-documenting code, follow existing style
 
 ### Issue Management
 
-- NEVER auto-close issues (GitHub or Jira) — approvals required
-- PR body: use `Ref: #N` or `Related: #N` — never `Closes/Fixes/Resolves`
+- NEVER auto-close issues (GitHub or Jira)  -  approvals required
+- PR body: use `Ref: #N` or `Related: #N`  -  never `Closes/Fixes/Resolves`
 
 ---
 

package/pipeline/commands/archive-guard.md

@@ -5,7 +5,7 @@ allowed-tools: Bash, Read, Glob
 
 Run the `ios_app_store_audit` MCP tool (shipped in `@mmerterden/dev-toolkit-mcp` ≥ v2.4)
 on an iOS archive. Backed by the same 17-rule catalog as `/multi-agent:test "store-ready"`
-— this command is the lighter, post-hoc form (no platform-detect, no UI sweep).
+ -  this command is the lighter, post-hoc form (no platform-detect, no UI sweep).
 
 > **v8.4.0 migration note:** The standalone `~/ArchiveGuard/.build/release/archive-guard`
 > binary has been retired. The 17 rules live in
@@ -19,7 +19,7 @@ on an iOS archive. Backed by the same 17-rule catalog as `/multi-agent:test "sto
    find ~/Library/Developer/Xcode/Archives/ -name "*.xcarchive" -maxdepth 2 | sort | tail -5
    ```
 2. Ask user which archive to scan (or use the argument if provided: $ARGUMENTS).
-3. Run the scan — preferred mode is the native MCP tool call:
+3. Run the scan  -  preferred mode is the native MCP tool call:
    ```
    mcp__dev_toolkit__ios_app_store_audit({
      archive_path: "<archive_path>",
@@ -40,6 +40,6 @@ on an iOS archive. Backed by the same 17-rule catalog as `/multi-agent:test "sto
    npm i -g @mmerterden/dev-toolkit-mcp
    # or add it to your MCP config and reload the editor
    ```
-6. Summarize results — group by severity (`error` blockers, `warning` risks,
+6. Summarize results  -  group by severity (`error` blockers, `warning` risks,
    `info` hygiene), cite ruleID + Apple guideline reference for each finding,
    suggest fixes from the rule catalog.