reis-mobile 0.10.0 → 1.0.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AI agents for mobile engineering",
-    "version": "0.10.0"
+    "version": "1.0.0"
   },
   "plugins": [
     {
       "name": "reis-mobile",
       "source": "./",
       "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development.",
-      "version": "0.10.0",
+      "version": "1.0.0",
       "author": {
         "name": "Warleson Reis"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "reis-mobile",
-  "version": "0.10.0",
+  "version": "1.0.0",
   "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development. Use /reis-mobile:doctor, /reis-mobile:review and /reis-mobile:test.",
   "author": {
     "name": "Warleson Reis"

package/CHANGELOG.md

@@ -4,6 +4,38 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The pr
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-11-04
+
+### Added
+
+- `reis-mobile mcp`, a stdio MCP server for editors that cannot load the Claude Code plugin, such as Cursor. Seven tools (`reis_mobile_route`, `reis_mobile_review`, `reis_mobile_debug`, `reis_mobile_test`, `reis_mobile_release`, `reis_mobile_detect` and `reis_mobile_doctor`) return the same JSON as the matching `--json` command, and `reis_mobile_read_instructions` serves the agent, skill and reference files a route points to.
+- Both MCP eras on one process: per-request `_meta` and `server/discover` from the 2026-07-28 revision, and the `initialize` handshake from 2025-11-25 back to 2024-11-05. Validated end to end with Claude Code 2.1.267; the Cursor and Codex configurations in the README follow each client's documented format.
+- `--dir` on `reis-mobile mcp` sets the app directory for tool calls that pass none, so a client can pass its workspace folder.
+- Every MCP tool is read-only and offline. `consult` and the commands that write are not exposed, and the instruction reader resolves symlinks and serves only `agents/`, `skills/` and `docs/agent-context.md`, up to 512 KB.
+- iOS Keychain token storage guide in `mobile-security` (`references/ios/keychain.md`): accessibility classes and backups, biometric access control, access groups, reinstall persistence, migration out of `UserDefaults`, and a Swift token store with `OSStatus` handling. Contributed by @jay23606 in #21.
+
+### Changed
+
+- 1.0.0 is the first stable release for Flutter, native Android, native iOS and React Native, as planned in the roadmap, and ships the MCP server previously planned for v0.11.0.
+- The read-only commands build their `--json` output in `core/commands/payloads.mjs`, shared by the CLI and the MCP server. The output itself is unchanged.
+
+## [0.10.1] - 2026-11-04
+
+### Added
+
+- `mobile-ui-ux-designer` agent and `mobile-ui-ux` topic skill for mobile journeys, wireframes, design tokens, component states and evidence-based interface reviews across all five stacks.
+- English and Portuguese `design` routing with platform skill selection and regression coverage for architecture, accessibility, tests and unrelated terms.
+- Apple design reading workflow linked to `dickwu/apple-design-skill` at a recorded revision and to official HIG topics. Upstream content is linked, not vendored, because the inspected revision declares no redistribution license.
+
+### Changed
+
+- The debate now invokes `lead-mobile` for participant selection before the rounds and again for final synthesis. The candidate table includes every specialist, including UI/UX, accessibility and release, with explicit participant validation and a persisted selection rationale.
+- All five platform skills now route design work and link the UI/UX workflow and Apple-target reference.
+
+### Fixed
+
+- `lead-mobile` now includes the UI/UX designer in its delegation table. A registry test requires every other registered agent, including manual specialists, to appear and rejects unknown agents or self-delegation.
+
 ## [0.10.0] - 2026-11-04
 
 ### Added

package/README.md

@@ -23,7 +23,7 @@ A mobile app is not a generic project. A code review that does not know about `B
 
 🔎 **Detects the stack on its own.** Flutter (app or plugin), React Native (including Expo), Kotlin Multiplatform, native Android and iOS, with languages and target platforms. A Flutter app with `android/` and `ios/` is still Flutter.
 
-👥 **21 agents and 26 mobile skills.** Architect, performance and test engineers for Flutter, native Android, native iOS, React Native and Kotlin Multiplatform, plus a staff engineer, a native plugin specialist, a code reviewer, an accessibility auditor, a release engineer and a lead. Topic skills cover the five stacks with focused references for debugging, tests, security, Firebase, accessibility, releases, performance budgets, offline sync, production observability, privacy, networking, authentication, notifications, in-app purchases, migrations, product analytics and device hardware.
+👥 **22 agents and 27 mobile skills.** Architect, performance and test engineers for Flutter, native Android, native iOS, React Native and Kotlin Multiplatform, plus a staff engineer, a native plugin specialist, a code reviewer, a UI/UX designer, an accessibility auditor, a release engineer and a lead. Topic skills cover the five stacks with focused references for debugging, tests, security, Firebase, accessibility, releases, performance budgets, offline sync, production observability, privacy, networking, authentication, notifications, in-app purchases, migrations, product analytics and device hardware.
 
 🧩 **Project-specific context.** `/reis-mobile:project` records real app symbols, owners, boundaries and validation commands in `.reis-mobile/project.md`; the team can add product rules that code cannot reveal. Refreshing the verified map preserves team-authored text.
 
@@ -37,6 +37,8 @@ A mobile app is not a generic project. A code review that does not know about `B
 
 🔒 **Secrets never reach the model.** The diff sent for review goes through a layer that masks API keys, tokens, JWTs, private keys and keystore passwords.
 
+🔌 **Works in any MCP client.** `reis-mobile mcp` serves stack detection, routing and the review, debug, test and release context to Cursor and other editors, with the agent and skill instructions behind them. See [MCP server](#mcp-server).
+
 🪶 **Two commands to install.** `npm install -g reis-mobile` and `reis-mobile init eng` set it up in Claude Code and Codex, with zero npm dependencies and no external provider.
 
 ---
@@ -44,25 +46,20 @@ A mobile app is not a generic project. A code review that does not know about `B
 ## What's new
 
 <!-- reis-mobile:latest-release:start -->
-### v0.10.0
+### v1.0.0
 
 #### Added
 
-- `mobile-ci` topic skill for deployment pipelines across all five stacks, with the setup, Match, beta, release and Snapshot guides plus Xcode Cloud documentation imported from `greenstevester/fastlane-skill` (MIT), attributed and pinned to their upstream revision.
-
-- Four topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: `mobile-privacy` for consent and data lifecycle, `mobile-networking` for API integration and request recovery, `mobile-auth` for identity/session flows, and `mobile-notifications` for push/local notification lifecycles.
-- English and Portuguese `privacy`, `networking`, `auth` and `notifications` intents, handled by the existing staff engineer, with five-stack routing, prompt discovery and explicit-override tests.
-- `mobile-billing`, `mobile-migration`, `mobile-analytics` and `mobile-hardware` topic skills, each with Flutter, Android, iOS, React Native and Kotlin Multiplatform references: in-app purchases verified by the backend before acknowledgement and recovered after process death; migrations planned as buildable steps, with on-device data that survives skipped releases and interrupted launches; tracking plans with typed events, identity reset on sign-out and consent-gated collection; device hardware from the availability check to the release of the resource, with real-device test matrices.
-- English and Portuguese `billing`, `analytics` and `hardware` intents, handled by `mobile-staff-engineer`. `mobile-migration` joins the existing `migration` route. Plain "analytics" still routes to observability.
+- `reis-mobile mcp`, a stdio MCP server for editors that cannot load the Claude Code plugin, such as Cursor. Seven tools (`reis_mobile_route`, `reis_mobile_review`, `reis_mobile_debug`, `reis_mobile_test`, `reis_mobile_release`, `reis_mobile_detect` and `reis_mobile_doctor`) return the same JSON as the matching `--json` command, and `reis_mobile_read_instructions` serves the agent, skill and reference files a route points to.
+- Both MCP eras on one process: per-request `_meta` and `server/discover` from the 2026-07-28 revision, and the `initialize` handshake from 2025-11-25 back to 2024-11-05. Validated end to end with Claude Code 2.1.267; the Cursor and Codex configurations in the README follow each client's documented format.
+- `--dir` on `reis-mobile mcp` sets the app directory for tool calls that pass none, so a client can pass its workspace folder.
+- Every MCP tool is read-only and offline. `consult` and the commands that write are not exposed, and the instruction reader resolves symlinks and serves only `agents/`, `skills/` and `docs/agent-context.md`, up to 512 KB.
+- iOS Keychain token storage guide in `mobile-security` (`references/ios/keychain.md`): accessibility classes and backups, biometric access control, access groups, reinstall persistence, migration out of `UserDefaults`, and a Swift token store with `OSStatus` handling. Contributed by @jay23606 in #21.
 
 #### Changed
 
-- Authentication requests now have a dedicated `auth` intent instead of relying on security vocabulary. Explicit security audits retain the security workflow.
-- `mobile-staff-engineer` serves the `billing`, `analytics` and `hardware` intents and loads `mobile-migration` for migration plans.
-
-#### Fixed
-
-- The router counted any word starting with "pr" as a review request, so prompts such as "implementar paywall premium" or "definir funil de conversão do produto" went to review. "PR" and "PRs" now count only as whole words.
+- 1.0.0 is the first stable release for Flutter, native Android, native iOS and React Native, as planned in the roadmap, and ships the MCP server previously planned for v0.11.0.
+- The read-only commands build their `--json` output in `core/commands/payloads.mjs`, shared by the CLI and the MCP server. The output itself is unchanged.
 
 <!-- reis-mobile:latest-release:end -->
 
@@ -200,7 +197,7 @@ reis-mobile route "review architecture" --json
 reis-mobile review --json
 ```
 
-You can also ask Codex: *"Run `reis-mobile review --json`, read the instructions in the returned files and review the changes using that context."* The CLI selects the instructions and gathers the context; Codex does the analysis.
+You can also ask Codex: *"Run `reis-mobile review --json`, read the instructions in the returned files and review the changes using that context."* The CLI selects the instructions and gathers the context; Codex does the analysis. To let Codex call these commands as tools instead, register the [MCP server](#mcp-server).
 </details>
 
 <details>
@@ -298,9 +295,9 @@ See the [readiness contract](skills/mobile-release/references/readiness.md) and
 
 ### Debate
 
-`/reis-mobile:debate` puts three specialists with conflicting priorities to defend positions on the same question. Round 1 is blind, so the first to answer does not anchor the others; in round 2 each one rebuts specific points from the others; at the end, `lead-mobile` decides and delivers the action plan. The rounds are stored in `.reis-mobile/debates/`.
+`/reis-mobile:debate` first asks `lead-mobile` to select three relevant specialists and explain each assignment. Every specialist is eligible, including UI/UX, accessibility and release; `--agents` supplies explicit choices for the lead to validate. Round 1 is blind, so the first to answer does not anchor the others; in round 2 each one rebuts specific points from the others; at the end, `lead-mobile` returns to analyze the rounds, resolve disagreements and deliver the decision with an action plan. The lead selects and moderates but does not debate. The rounds are stored in `.reis-mobile/debates/`.
 
-Participants vary along two axes at once. The **role** gives each one a different incentive: `flutter-architect` defends layer boundaries, `flutter-performance-engineer` is hostile to indirection, `flutter-test-engineer` wants injection seams the other two consider noise. The **model** keeps that disagreement from staying on the surface — the command spreads `opus` and `sonnet` across the participants, because three instances of the same model inherit the same blind spots and tend to converge for reasons that have nothing to do with your question. With `--external`, a third axis comes in: outside **providers**, in separate processes.
+Participants vary by role and model. The lead uses the command's `opus`/`sonnet` assignments and selects at least two models automatically; valid explicit `--agents` choices are preserved, with any same-model limitation disclosed. Model diversity does not guarantee independent reasoning: conclusions still require evidence. The command runs the selected participants and records the selection rationale with the context. With `--external`, outside providers join through the existing provider layer; the lead does not enable them on its own.
 
 It is expensive: several agents over two rounds. Use it for architecture decisions with a real trade-off — *migrate to Riverpod*, *offline-first with Firestore or a local cache*, *native plugin or an off-the-shelf package* — and not for questions with a single answer, where `/reis-mobile <request>` solves it for less.
 
@@ -369,6 +366,46 @@ The router never invents a specialist: if no agent serves the intent, it warns y
 
 ---
 
+## MCP server
+
+Editors that cannot load the Claude Code plugin, such as Cursor, can use reis-mobile through MCP. `reis-mobile mcp` is a stdio server shipped in the npm package, so install it with `npm install -g reis-mobile` first.
+
+| Client | Register the server |
+|---|---|
+| Cursor | `.cursor/mcp.json` in the project, or `~/.cursor/mcp.json` for every project, as below |
+| Claude Code | `claude mcp add reis-mobile -- reis-mobile mcp` |
+| Codex | `codex mcp add reis-mobile -- reis-mobile mcp` |
+
+```json
+{
+  "mcpServers": {
+    "reis-mobile": {
+      "command": "reis-mobile",
+      "args": ["mcp", "--dir", "${workspaceFolder}"]
+    }
+  }
+}
+```
+
+`--dir` is the app directory a tool uses when the call does not pass `dir`; Cursor replaces `${workspaceFolder}` with the project folder. In Claude Code the plugin already provides the agents and commands, so the server matters most in the other clients.
+
+| Tool | Returns |
+|---|---|
+| `reis_mobile_route` | Intent, stack, agent and skill paths for a request |
+| `reis_mobile_review` | The review route and the git diff, lock files out and secrets masked |
+| `reis_mobile_debug` | The debug route and the installed toolchain versions |
+| `reis_mobile_test` | The test route, the diff and the toolchain checks; runs no tests |
+| `reis_mobile_release` | Candidate release targets and references; builds and uploads nothing |
+| `reis_mobile_detect` | Stack, languages, platforms and the evidence for each |
+| `reis_mobile_doctor` | SDK and project file checks for the detected stack |
+| `reis_mobile_read_instructions` | The agent, skill or reference file a route points to |
+
+The model calls a routing tool, reads the instructions it returns and follows them, the same flow the slash commands use. Each tool returns the same JSON as its `--json` command. Every tool is read-only and offline, so `consult`, which sends context to a third party, is not exposed. The server speaks both MCP eras: the 2026-07-28 revision with per-request metadata, and the `initialize` handshake of 2025-11-25 back to 2024-11-05.
+
+Validated end to end with Claude Code 2.1.267. The Cursor and Codex entries follow each client's documented configuration but have not been run against those clients yet; if you try one, tell us in an issue.
+
+---
+
 ## Choose by goal
 
 | I want to... | Use | Status |
@@ -405,7 +442,7 @@ The router never invents a specialist: if no agent serves the intent, it warns y
 | **Project context** | You explain the stack | Deterministic detection of stack, platform and variant |
 | **Review** | Generic | Mobile checklists: lifecycle, `BuildContext`, MASVS, manifest, ATS |
 | **Secrets in the diff** | Sent as they are | Masked before reaching the model |
-| **Specialists** | None | 21 agents and 26 mobile skills |
+| **Specialists** | None | 22 agents and 27 mobile skills |
 | **Context cost** | Zero | ~5,500 fixed tokens (agent and skill descriptions), no hooks |
 | **Best for** | General tasks | Teams and developers working on mobile apps |
 
@@ -464,13 +501,25 @@ For domain knowledge that code cannot reveal, optionally commit `.reis-mobile/pr
 | `kmp-architect` | Kotlin Multiplatform | architecture, offline | Shared source-set ownership, Android/iOS callers and Swift-facing contracts |
 | `kmp-performance-engineer` | Kotlin Multiplatform | performance | Shared Kotlin cost versus Android/iOS host traces and bridge overhead |
 | `kmp-test-engineer` | Kotlin Multiplatform | test | `commonTest`, target tests and Android/iOS host coverage |
+| `mobile-ui-ux-designer` | all | design | Mobile journeys, wireframes, design tokens, adaptive layouts and evidence-based UI/UX reviews |
 | `mobile-accessibility-auditor` | all | accessibility | Screen reader labels, roles and states, touch targets, text scaling, focus and announcements, with fixes per platform |
 | `mobile-release-engineer` | all | release, deployment, observability | Go/no-go readiness, versions and signing, crash symbols, release notes and store copy, CI/CD, staged rollout, production crash and release-health signals |
 | `mobile-staff-engineer` | all | debug, architecture, performance, test, security, migration, dependency, build, offline, observability, privacy, networking, auth, notifications, billing, analytics, hardware | Cross-toolchain diagnosis, migrations and capability workflows when no stack specialist owns the intent |
 | `plugin-native-expert` | Flutter | on demand | MethodChannel, EventChannel, Pigeon and Kotlin/Swift bridges, threading and lifecycle |
 | `lead-mobile` | all | on demand | Coordinates the other agents and consolidates a single action plan |
 
-When more than one agent serves the intent, the stack-specific one wins. In a Flutter app, `performance` goes to `flutter-performance-engineer`; in a KMP app, to `kmp-performance-engineer`. `accessibility` goes to `mobile-accessibility-auditor`, `release`, `deployment` and `observability` to `mobile-release-engineer` on every stack, and `offline` to the stack's architect.  Other intents without a stack specialist, such as `debug`, go to `mobile-staff-engineer`.
+When more than one agent serves the intent, the stack-specific one wins. In a Flutter app, `performance` goes to `flutter-performance-engineer`; in a KMP app, to `kmp-performance-engineer`. `design` goes to `mobile-ui-ux-designer`, `accessibility` goes to `mobile-accessibility-auditor`, `release`, `deployment` and `observability` to `mobile-release-engineer` on every stack, and `offline` to the stack's architect.  Other intents without a stack specialist, such as `debug`, go to `mobile-staff-engineer`.
+
+### UI/UX design
+
+Ask Claude Code to "use reis-mobile:mobile-ui-ux-designer to redesign this screen", or use `mobile-ui-ux` in a skill-capable host such as Codex. From a mobile app directory, inspect routing with:
+
+```bash
+reis-mobile route "review the UI/UX of this screen"
+reis-mobile route "create a mobile design system"
+```
+
+The workflow covers journeys, wireframes, tokens, component states, adaptive layouts and implementation when requested. Existing platform skills link it too. Apple-target work includes a reading guide for [dickwu/apple-design-skill](https://github.com/dickwu/apple-design-skill) and official HIG pages. The upstream repository has no explicit redistribution license at the inspected revision, so its content is linked rather than bundled; the new guides are original project content. Current Apple claims require source verification, and Android retains its own conventions.
 
 ### Skills
 
@@ -482,7 +531,8 @@ Every skill starts with `mobile-`. **Topic** skills cover every stack with one r
 | `mobile-code-review` | Review process and checklists | review, performance | Flutter (PR review, widgets, project audit, static analysis), Android, iOS, React Native, KMP |
 | `mobile-debug` | Failing builds and runtime errors | debug, build, dependency, migration | Flutter (build, runtime, layout, packages), Android (Gradle, crashes, ANRs, memory leaks), iOS (Xcode, CocoaPods, crash logs), React Native (Metro, native modules), KMP, deep links |
 | `mobile-test` | Unit, UI, integration and end-to-end tests | test | Flutter (widget, integration, Patrol, mocks, coverage), Android, iOS, React Native, KMP |
-| `mobile-security` | OWASP MASVS security checks | review, security, release | Flutter (token storage), Android (intents), iOS, React Native, KMP, OAuth/OIDC and PKCE |
+| `mobile-security` | OWASP MASVS security checks | review, security, release | Flutter (token storage), Android (intents), iOS (Keychain token storage), React Native, KMP, OAuth/OIDC and PKCE |
+| `mobile-ui-ux` | Journeys, wireframes, visual hierarchy, tokens, component states and Apple HIG reference workflow | design | Flutter, Android, iOS, React Native, KMP and external Apple design reading |
 | `mobile-accessibility` | Screen readers, touch targets, text scaling, contrast, localization | accessibility | Flutter (Semantics), Android (Compose and Views), iOS (SwiftUI and UIKit), React Native, KMP, localization and RTL |
 | `mobile-release` | Release readiness, store copy, billing and CI/CD | release, deployment | Flutter, Android, iOS, React Native, KMP, release notes and store listing, in-app purchases, CI/CD |
 | `mobile-ci` | CI/CD and fastlane setup, Match, beta, release and Snapshot | deployment | Flutter, Android, iOS, React Native, KMP, imported fastlane guides and Xcode Cloud |
@@ -498,11 +548,11 @@ Every skill starts with `mobile-`. **Topic** skills cover every stack with one r
 | `mobile-analytics` | Tracking plans, typed events, funnels, analytics identity and consent-gated collection | analytics | Flutter, Android, iOS, React Native, KMP |
 | `mobile-hardware` | Camera, Bluetooth and BLE, NFC, location, sensors, scanning and haptics | hardware | Flutter, Android, iOS, React Native, KMP |
 | `mobile-firebase` | Firebase setup and 13 products | — | Flutter, Android, iOS, React Native, KMP; check installed SDK support |
-| `mobile-flutter` | Flutter and Dart specifics | review, performance, accessibility, migration | UI and navigation, data, native code, performance, accessibility and i18n, Dart, setup |
-| `mobile-android` | Native Android specifics, from the Android team | performance, release, migration, build, dependency | Compose UI, AGP 9 and R8, profiling, Google Play, identity, camera and media, on-device AI, Wear OS, TV, XR |
-| `mobile-ios` | Native iOS specifics | performance, release, accessibility | UI and navigation, data and networking, platform features, performance and release |
-| `mobile-rn` | React Native and Expo specifics | performance, release, accessibility | UI and navigation, data and networking, platform features, performance and release |
-| `mobile-kmp` | Kotlin Multiplatform shared and target boundaries | architecture, test, performance, review, debug and more | Source sets, Apple interop, shared Compose UI, build and profiling |
+| `mobile-flutter` | Flutter and Dart specifics | design, review, performance, accessibility, migration | UI and navigation, data, native code, performance, accessibility and i18n, Dart, setup |
+| `mobile-android` | Native Android specifics, from the Android team | design, performance, release, migration, build, dependency | Compose UI, AGP 9 and R8, profiling, Google Play, identity, camera and media, on-device AI, Wear OS, TV, XR |
+| `mobile-ios` | Native iOS specifics | design, performance, release, accessibility | UI and navigation, data and networking, platform features, performance and release |
+| `mobile-rn` | React Native and Expo specifics | design, performance, release, accessibility | UI and navigation, data and networking, platform features, performance and release |
+| `mobile-kmp` | Kotlin Multiplatform shared and target boundaries | design, architecture, test, performance, review, debug and more | Source sets, Apple interop, shared Compose UI, build and profiling |
 | `mobile-detect-stack` | Deterministic stack detection with the CLI | — | — |
 
 Skills marked — are triggered by Claude Code when the request matches their description, for example *"configure Firestore rules"* → `mobile-firebase`. Notification requests route to `mobile-notifications`, which links Firebase guidance when FCM is the installed provider.
@@ -529,15 +579,15 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 
 ## Trust, security and limits
 
-**Read-only CLI context.** `doctor`, `detect`, `route`, `review`, `test`, `release`, `providers` and `consult` do not modify your project. `/reis-mobile:release` inspects existing release evidence and remains read-only unless execution is explicitly requested. The `/reis-mobile:test` slash command can write or fix tests and execute runners when requested. `/reis-mobile:project` writes only the optional project profile. The `/reis-mobile:review` and `/reis-mobile:debate` commands instruct the model not to edit app code; the debate writes its rounds to `.reis-mobile/debates/` and a consult its briefing to `.reis-mobile/consults/`.
+**Read-only CLI context.** `doctor`, `detect`, `route`, `review`, `test`, `release`, `providers`, `consult` and the `mcp` server's tools do not modify your project. `/reis-mobile:release` inspects existing release evidence and remains read-only unless execution is explicitly requested. The `/reis-mobile:test` slash command can write or fix tests and execute runners when requested. `/reis-mobile:project` writes only the optional project profile. The `/reis-mobile:review` and `/reis-mobile:debate` commands instruct the model not to edit app code; the debate writes its rounds to `.reis-mobile/debates/` and a consult its briefing to `.reis-mobile/consults/`.
 
 **Secrets masked.** The diff goes through [`core/security/redact.mjs`](core/security/redact.mjs) before reaching the model. Lock files and generated code (`*.g.dart`, `*.freezed.dart`, `*.pbxproj`) stay out of the diff. Redaction is a protection layer, not a guarantee. See [SECURITY.md](SECURITY.md).
 
-**No telemetry.** `detect`, `doctor`, `route`, `review`, `debug`, `test` and `providers` make no network calls (`providers --models` and `consult` do, by request). The update hook and `update-check` request the public npm package metadata; they send no project files or identifiers. Installation downloads the package and registers the plugin. The Google Play policy guide in `mobile-android` runs Python scripts that download your app's public Google Play listing when the model uses it. The AI analysis uses the model of the session you are working in, such as Claude Code or Codex.
+**No telemetry.** `detect`, `doctor`, `route`, `review`, `debug`, `test`, `providers` and the `mcp` server make no network calls (`providers --models` and `consult` do, by request). The update hook and `update-check` request the public npm package metadata; they send no project files or identifiers. Installation downloads the package and registers the plugin. The Google Play policy guide in `mobile-android` runs Python scripts that download your app's public Google Play listing when the model uses it. The AI analysis uses the model of the session you are working in, such as Claude Code or Codex.
 
 **Exception: external providers.** Two workflows, and only these two, send project context to a third party: `/reis-mobile:debate --external` and `/reis-mobile:consult`. Both state which providers receive it, and both are opt-in — no other command calls a provider. What leaves is the briefing, including the code excerpts you include; each provider has its own data policy. The question and every answer pass through `redact.mjs`, which is a protection layer and not a guarantee: read the briefing before sending it. API keys are read from the environment by the CLI and never enter the conversation, and `providers:` in `.reis-mobile/config.yaml` lets a team restrict which providers a repository allows. CLI providers (`codex`, `gemini-cli`) are asked for an opinion, not for work: they run in read-only mode (`codex exec --sandbox read-only`, `gemini --approval-mode plan`) inside a temporary directory, never in your repository.
 
-**Context cost.** Claude Code loads the descriptions of 21 agents and 26 skills; the full content of each skill is loaded only when it is used. The exact description cost depends on the host and plugin version.
+**Context cost.** Claude Code loads the descriptions of 22 agents and 27 skills; the full content of each skill is loaded only when it is used. The exact description cost depends on the host and plugin version.
 
 **One session hook.** On session startup or resume, the plugin checks for a newer release and warns only when the installed plugin is outdated. It does not read the project or modify the plugin installation.
 
@@ -568,8 +618,7 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 | v0.8.0 | `mobile-performance`, `mobile-offline-sync` and `mobile-observability` topic skills with a reference per stack, plus background execution, OAuth/PKCE, billing lifecycle and localization references | ✅ |
 | v0.9.0 | Multi-provider layer (OpenAI, Gemini, OpenRouter, Ollama and the Codex/Gemini CLIs), `reis-mobile providers`, `reis-mobile consult` and `/reis-mobile:consult` — previously planned for v0.10.0 | ✅ |
 | v0.10.0 | `mobile-privacy`, `mobile-networking`, `mobile-auth` and `mobile-notifications` topic skills with a reference per stack, plus the `privacy`, `networking`, `auth` and `notifications` intents | ✅ |
-| v0.11.0 | MCP server | ⏳ |
-| v1.0.0 | First stable version: Flutter, Android, iOS and React Native | ⏳ |
+| v1.0.0 | First stable version: Flutter, Android, iOS and React Native, with the MCP server previously planned for v0.11.0 | ✅ |
 
 ---
 
@@ -597,10 +646,10 @@ Yes. Native Android, native iOS and React Native each have architect, performanc
 The plugin's skills live in the `reis-mobile:` namespace and do not conflict, but Claude Code loads both descriptions. To save context, remove the global copies the plugin already covers.
 
 **Does it work in Codex?**
-Yes: `reis-mobile init eng` installs the plugin in Codex too. See [installation](#install). Installation does not confirm parity with the Claude Code agents and commands; the `reis-mobile` CLI can also be run by Codex to get diagnostics and context.
+Yes: `reis-mobile init eng` installs the plugin in Codex too. See [installation](#install). Installation does not confirm parity with the Claude Code agents and commands; the `reis-mobile` CLI can also be run by Codex to get diagnostics and context, and the [MCP server](#mcp-server) exposes the same commands as tools.
 
 **Does it work in Cursor?**
-The Cursor integration has not been validated yet. The MCP server remains on the roadmap for v0.11.0.
+Through the [MCP server](#mcp-server): register `reis-mobile mcp` in `.cursor/mcp.json`. The configuration follows Cursor's documented format but has not been run against Cursor yet. Cursor gets the tools and the instructions, not the Claude Code agents, slash commands or hooks.
 
 **What does reis-mobile send outside my machine?**
 The project analysis commands do not make network requests. The update hook and `reis-mobile update-check` request the public npm package metadata without sending project files or identifiers. What the model reads during `/reis-mobile:review` follows the same rules as any Claude Code session.

package/THIRD_PARTY_NOTICES.md

@@ -353,3 +353,11 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    See the License for the specific language governing permissions and
    limitations under the License.
 ```
+
+## External Apple design reading (not redistributed)
+
+Source: https://github.com/dickwu/apple-design-skill
+
+Inspected revision: `ff4ebddf0488598723a82bfdce1afb04de0b1c44` on 2026-11-04. Referenced by `mobile-ui-ux` through `references/apple-design.md`.
+
+The inspected repository contains no LICENSE file or explicit redistribution license. Its README attributes the reproduced Human Interface Guidelines text to Apple Inc. No upstream skill text, scripts or HIG snapshots are included here. This is an external reference, not an MIT-licensed import; no third-party license text is available to reproduce. The local UI/UX workflow and platform references are original project content.

package/agents/lead-mobile.md

@@ -14,7 +14,7 @@ Read the [project brief](../docs/agent-context.md) once and build it for the act
 
 ## Assign bounded ownership
 
-Agents use the `reis-mobile:` prefix in the Agent tool. Choose by stack and deliverable:
+Every other agent shipped in this plugin is available for your delegation, including agents with manual routing. Keep the assignment table complete when specialists are added or renamed; do not delegate to yourself. Agents use the `reis-mobile:` prefix in the Agent tool. Choose by stack and deliverable:
 
 | Assignment | Specialist |
 |---|---|
@@ -34,6 +34,7 @@ Agents use the `reis-mobile:` prefix in the Agent tool. Choose by stack and deli
 | KMP common/target tests and host coverage | `reis-mobile:kmp-test-engineer` |
 | Shared Kotlin versus Android/iOS host performance cause | `reis-mobile:kmp-performance-engineer` |
 | Diff regression with concrete trigger and consequence | `reis-mobile:mobile-code-reviewer` |
+| User journeys, wireframes, visual hierarchy, design tokens and interface states | `reis-mobile:mobile-ui-ux-designer` |
 | Assistive-technology journey and control semantics | `reis-mobile:mobile-accessibility-auditor` |
 | Release identity, artifact gates, notes or pipeline | `reis-mobile:mobile-release-engineer` |
 | Production crash, error and release-health signals | `reis-mobile:mobile-release-engineer` |
@@ -50,7 +51,7 @@ Give every assignment the shared brief plus: question to resolve, owned paths/sy
 
 Examples of dependency ordering:
 
-- Feature: architecture contracts first, then implementation and test cases against those contracts.
+- Feature: involve the UI/UX designer when screens or journeys change, align the interaction design with architecture contracts, then implement and test against those contracts.
 - Native failure: bridge request/lifecycle trace plus platform stack investigation, then one coordinated correction.
 - Audit: split by distinct risk/path and merge overlapping evidence; do not commission duplicate whole-app checklists.
 
@@ -60,9 +61,19 @@ If delegation is unavailable, follow the same boundaries sequentially and state
 
 Require actual paths/symbols, a trigger or violated contract, evidence level and the next verification. Resolve conflicting claims by inspecting the decisive code or running the discriminating check. Merge findings with one root cause even when their wording differs. An unmeasured performance suspicion cannot outweigh a reproduced correctness regression without an explicit reason.
 
+## Debate selection
+
+When `/reis-mobile:debate` invokes you with `phase: selection`, choose who will debate before any rounds run. Use the supplied question, project evidence, stack/native targets, flags and complete candidate/model table from the command. Every other registered plugin agent is eligible, including UI/UX, accessibility, release and manual specialists; choose by the trade-off rather than always selecting architecture roles.
+
+Return a selection plan with each specialist's exact name, model from the supplied table, assigned question, rationale, evidence scope and any unresolved constraint. Automatically select three distinct relevant specialists spanning at least two models. Preserve valid explicit `--agents` choices and their table models; reject unknown names, duplicates, fewer than two distinct participants or yourself as a debater. Disclose an explicit same-model selection without overriding it. If no relevant automatic trio meets the model rule, report the limitation to the caller rather than inventing relevance.
+
+Do not argue a position or preselect the winning solution during selection: the first round must remain blind. Do not launch agents or providers, write round files or change app code in this phase. Return the plan to the command, which validates it and runs the rounds. If the caller reports invalid plan fields, correct the plan before any round starts.
+
 ## Debate moderation
 
-When `/reis-mobile:debate` invokes you, you do not delegate: the rounds already happened and sit in `.reis-mobile/debates/<id>/rounds/`. Read all of them before writing anything.
+When `/reis-mobile:debate` invokes you with `phase: synthesis`, return as moderator after the rounds. Read the original question/context, selection plan, all completed files in `.reis-mobile/debates/<id>/rounds/` and any missing/failed participant statuses before writing the decision. Do not delegate, select new participants, start rounds or change app code in this phase. Missing responses are gaps in evidence, not agreement.
+
+The two debate phases override the general delegation workflow above. You select at the beginning and decide at the end; you never submit a debating position.
 
 Your job is to decide, not to declare a tie:
 

package/agents/mobile-ui-ux-designer.md

@@ -0,0 +1,33 @@
+---
+name: mobile-ui-ux-designer
+description: Use this agent to design, critique or improve mobile UI/UX across Flutter, Android, iOS, React Native and Kotlin Multiplatform. It covers user journeys, wireframes, navigation, visual hierarchy, typography, semantic design tokens, component states and adaptive layouts. Typical requests include "review this design", "redesign this screen", "create a mobile design system" and Apple HIG reviews of screenshots, Figma exports or UI code. It produces evidence-based findings or an implementation-ready design and implements changes when requested.
+model: inherit
+color: purple
+tools: ["Read", "Grep", "Glob", "Bash", "Edit", "Write", "WebFetch", "WebSearch"]
+intents: [design]
+stacks: ["*"]
+---
+
+You own the experience of completing a mobile task, from entry through success and recovery. Design decisions must fit the product, the user's platform and the existing implementation.
+
+Read the [project brief](../docs/agent-context.md) once or reuse the caller's verified brief. Apply [mobile-ui-ux](../skills/mobile-ui-ux/SKILL.md), its actual stack reference and [mobile-accessibility](../skills/mobile-accessibility/SKILL.md) for the controls in scope. For Apple targets, load the [Apple design reference](../skills/mobile-ui-ux/references/apple-design.md). Do not assume a cross-platform renderer supplies native behavior automatically.
+
+## Establish the design boundary
+
+Inspect routes, shared components, theme tokens, content and supported targets. Identify the user's task, audience, entry and exit, primary action, constraints and existing brand. Label assumptions when the product brief leaves these open. For a new screen, describe proposed symbols as new rather than inventing existing paths.
+
+Use screenshots and Figma artifacts to examine visible hierarchy; use source to trace tokens and behavior; use a running app to confirm gestures, focus and transitions. State which evidence exists. A screenshot alone does not prove touch dimensions, contrast compliance, navigation behavior or screen-reader support.
+
+## Deliver the experience
+
+1. Trace the journey and remove unnecessary decisions or repeated input. Keep back, cancellation and recovery predictable.
+2. Specify the layout at compact and expanded widths, keyboard-visible behavior, long translated content and large text. Include loading, empty, error, success and disabled states where relevant.
+3. Reuse semantic color, type, spacing and component tokens. Explain any new visual direction using the product's content and audience. Keep platform controls recognizable and locate brand expression deliberately.
+4. Map each decision to the real component and platform API, checking the installed toolkit version before proposing implementation details. Separate Apple guidance from Android conventions.
+5. When implementation is requested, edit the responsible component and verify affected callers. When review alone is requested, return findings and concrete changes without changing files.
+
+## Evidence and handoff
+
+For a review, give prioritized findings with affected journey, `path:line` or artifact location, consequence, fix and verification. Distinguish measured defects, platform guidance and design judgment; do not manufacture a numerical UX score.
+
+For a design, deliver a journey map or wireframe, token changes, a component/state table and a verification matrix. For implementation, report changed files and actual checks. Include OS/device or viewport, appearance, text size, locale and assistive interaction where tested; mark remaining device checks unverified. Never claim usability validation without observing users or a relevant study.