refactor(installer): resolve architectural inconsistencies, pyyaml hard check, and migrate reports to tracked paths

.agents/INSTALL.md

@@ -92,4 +92,4 @@ $ bash .agents/skills/multi-agent-mux-stop/scripts/stop_session.sh \
 
 ## 🛡️ 협업 및 보안 가이드라인
 *   MAM을 사용할 때 모든 에이전트(개발자, 리뷰어)들은 루트의 `AGENTS.md` 지침을 우선 숙지하도록 설계해야 오탐과 무분별한 리팩토링 범람을 방지할 수 있습니다.
-*   각 에이전트 역할별로 리뷰 프로세스를 돌릴 시, 승인 결과 보고서(.md)는 `.mam/reports/<session_name>/` 하위에 생성 및 형상 커밋하는 규약(`.agents/MULTI_AGENT_RULES.md`)을 준수해 주세요.
+*   각 에이전트 역할별로 리뷰 프로세스를 돌릴 시, 최종 승인 결과 보고서(.md)는 형상 관리가 추적할 수 있도록 버전 관리 대상 경로(구체적으로 `.agents/reports/<session_name>/` 또는 `docs/reports/` 등) 하위로 이관 복사하여 커밋하는 규약(`.agents/MULTI_AGENT_RULES.md`)을 준수해 주세요.

.agents/MULTI_AGENT_RULES.ko.md

@@ -127,7 +127,7 @@ TMUX 환경에서 실행되는 에이전트가 화면 스크롤 한계로 인해
   - **디스크 정리 및 보존 정책 계약 (Cleanup & Retention)**:
     - `.mam/reports/` 폴더 아래의 파일들은 감사 이력(audit-trail) 산출물로 보존됩니다.
     - 해당 격리 디렉터리들은 `stop_session.sh` 등을 통해 세션이 정상적으로 종료되거나 파기(`--purge-conversation`)될 때 자동으로 함께 정리되어야 합니다.
-    - 버전 관리가 필요한 영구 보존용 주요 산출물(최종 설계 계획, 보안 감사 리포트 등)은 gitignore 대상인 `.mam/` 하위가 아닌, 버전 관리 대상 경로(예: `docs/` 또는 `artifacts/` 등)로 명시적으로 복사하여 기록을 이관 보존해야 합니다.
+    - 버전 관리가 필요한 영구 보존용 주요 산출물(최종 설계 계획, 최종 리뷰 보고서, 보안 감사 리포트 등)은 gitignore 대상인 `.mam/` 하위가 아닌, 버전 관리 대상 경로(구체적으로 `.agents/reports/<tmux_session_name>/` 또는 `docs/reports/` 등)로 명시적으로 복사하여 기록을 이관 보존해야 합니다.
 
 ### ⏱️ 타임아웃 구성 및 정렬 규칙
 - **잡 실행 제한 (`timeout_sec` & `idle_timeout_sec`)**: 각 잡은 전체 실행 만료 시간(`timeout_sec`, 기본 3600s)과 메세지 미수신 유휴 시간(`idle_timeout_sec`, 기본 120s)을 독립적으로 가집니다.

.agents/MULTI_AGENT_RULES.md

@@ -127,7 +127,7 @@ To ensure that agents running in TMUX environments do not lose debug logs or pre
   - **Cleanup & Retention Contract**:
     - Files under `.mam/reports/` are audit-trail artifacts.
     - These folders should be cleaned up automatically during `stop_session.sh` when a session is gracefully stopped or purged (`--purge-conversation`).
-    - Durable outcomes (such as final design plans or security audit reports) that require version control must be explicitly copied to tracked directory paths (e.g., `docs/` or `artifacts/`) instead of remaining in the gitignored `.mam/` runtime tree.
+    - Durable outcomes (such as final design plans, review verdicts, or security audit reports) that require version control must be explicitly copied to tracked directory paths (specifically under `.agents/reports/<tmux_session_name>/` or `docs/reports/`) to preserve collaborative audit trails in version history, instead of remaining in the gitignored `.mam/` runtime tree.
 
 ### ⏱️ Timeout Configuration & Alignment Rules
 - **Job Execution Limits (`timeout_sec` & `idle_timeout_sec`)**: Each job independently manages its overall execution timeout (`timeout_sec`, default 3600s) and idle timeout without receiving messages (`idle_timeout_sec`, default 120s).

.agents/reports/canary-projects-multi-agent-mux-creator-claude/brief-isolation-review.md

@@ -0,0 +1,28 @@
+# 📋 세션 ID 중복 충돌 해결 종합 설계안 리뷰 요청 지시서
+
+- **요청자**: Planner Agent (Antigravity)
+- **수신자**: Reviewer Agent (Claude)
+- **대상 세션**: `canary-projects-multi-agent-mux-creator-claude`
+- **검토 대상 파일**: [session_isolation_discussion.md](file:///home/godopu16/PuKi/laa/canary_projects/multi-agent-mux/session_isolation_discussion.md)
+
+---
+
+## 1. 개요 및 검토 요청 사항
+
+기존에 진행되었던 세션 ID 중복 충돌 해결 설계 토론 보고서에 Planner Agent가 새로 작성한 구체적 구현 계획(Rev.2)을 성공적으로 통합 및 단일화하였습니다.
+
+수신자(Claude) 에이전트님은 통합된 [session_isolation_discussion.md](file:///home/godopu16/PuKi/laa/canary_projects/multi-agent-mux/session_isolation_discussion.md) 문서를 검토하시어 아래 기준을 만족하는지 검사해 주시기 바랍니다.
+
+### 주요 검토 기준
+1. **의견 반영의 정합성**: Claude 에이전트 본인이 2차 토론 및 `implementation_plan.session_isolation.md`에서 개진했던 핵심 논지(3계층 하이브리드 격리 체계, Phase 0 검증 게이트, claimed-set resolver 필터 등)가 유실 없이 충실히 설계 및 구현 계획안에 녹아 들어가 있는지 검사하십시오.
+2. **논리적 정합성**: Phase 0 ~ Phase 4 로드맵이 논리적인 순서로 설계되어 있으며, Phase 0(실측 검증)의 게이트로서의 기능이 올바르게 설계되었는지 확인하십시오.
+3. **누락 확인**: 문제 해결을 위해 이전에 논의되었던 내용(예: RC-2 청소 계약, R1/R2 이중 안전장치 등)이 누락 없이 적절하게 기입되었는지 점검하십시오.
+
+---
+
+## 2. 작업 결과 보고 양식
+
+검토를 마친 후, 본인의 의견과 최종 승인 여부를 아래에 명시된 경로에 기록해 주십시오.
+
+*   **리포트 작성 경로**: `.mam/reports/canary-projects-multi-agent-mux-creator-claude/report-isolation-review.md`
+*   **승인 불변식**: 검토 결과 설계가 완벽하고 구현 계획으로 전환하는 데 이견이 없다면 리포트 및 최종 응답(Completed Event Detail)의 마지막에 반드시 **`"PASS"`** 문자열을 포함하여 응답해 주십시오. 만약 수정이나 보완이 필요하다면 구체적인 피드백을 전달해 주십시오.

.agents/reports/canary-projects-multi-agent-mux-creator-claude/report-isolation-review.md

@@ -0,0 +1,56 @@
+# 🔍 리뷰 리포트 — 세션 ID 격리 종합 설계/구현 계획서 검토
+
+- **리뷰어**: Claude (Reviewer A — 상위 논리/설계 정합성)
+- **검토 대상**: `session_isolation_discussion.md` (Planner 통합본, Rev.2 반영)
+- **대조 기준**: 본인 작성 `implementation_plan.session_isolation.md` (Rev.2) + 2차 토론 합의
+- **job_id**: 655fb695
+- **날짜**: 2026-07-10
+- **최종 판정**: **PASS** (경미한 비차단 권고 3건 동반)
+
+---
+
+## 1. 검토 기준별 결과
+
+### 기준 1 — 의견 반영의 정합성 ✅
+본인이 개진한 핵심 논지가 **유실 없이** 통합됨을 확인:
+| 원안 논지 | 통합본 위치 | 상태 |
+|---|---|---|
+| 3계층 하이브리드 (L1 인자주입 / L2 디렉터리 격리 / R1 불변식) | §2.1, mermaid 다이어그램 | ✅ 충실 |
+| L1: `uuidgen` 사전발급 → `--session-id` 주입 → `*_own` 즉시 기록 | L1 (line 36-37) | ✅ |
+| L2: env 격리 + `env_overrides` 영속화 + resume 재적용 | L2 (line 38-40), T6 | ✅ |
+| R1 claimed-set 필터 + R2 생성-시 유일성 assert | R1/R2 (line 41-43), T1/T2 | ✅ |
+| Phase 0 검증 게이트, 게이트 통과 전 구현 금지 | line 51, §Phase 0 | ✅ |
+| agent별 ID 발급 비대칭(claude UUID vs cline `epoch_rand`) | RK3 (line 104) | ✅ |
+
+### 기준 2 — 논리적 정합성 ✅
+- **Phase 0→(L1/L2 분기)→Phase 1→Phase 2/3→Phase 4** 로드맵이 인과적으로 타당.
+- **Phase 0가 게이트로서 올바르게 기능**: line 51에서 "Phase 0 통과 전 코드 구현 착수 금지"를 대전제로 명시하고, G1/G2 실측 매트릭스가 L1/L2 라우팅을 결정(line 55-56, 73) — 게이트 의미론 정확. cline 미지원 리스크가 코드 착수 전에 해소되는 구조라 사이드이펙트 예방 설계가 성립.
+- Phase 1(R1/R2)이 전략 무관 선행 가능하다는 원안 취지도 반영(line 58, "선행 가능").
+
+### 기준 3 — 누락 확인 ✅
+- **RC-2 청소 계약**: §2.1 RC-2(line 44-45) + T7(line 88) + RK4(line 105)로 3중 기입 — 누락 없음.
+- **R1/R2 이중 안전장치**: line 41-43에 defense-in-depth로 명확히 기입.
+- Phase별 DoD, Phase 4 회귀검증(V1~V3) 모두 존재.
+
+---
+
+## 2. 🟡 비차단 권고 (구현 계획 세련화용, PASS 조건 아님)
+
+- **A-1. Non-Goal 명시 부재**: 원안의 명시적 Non-Goal("CLI(claude/cline/agy/hermes) 자체 미수정 — 인자/환경변수 인터페이스만 사용")이 통합본엔 문장으로 빠져 있음(접근법상 내재되어 있으나 암묵적). 오해 방지 위해 1줄 명문화 권고.
+- **A-2. RK5 `--isolate-strict` 신규 요소**: 원안엔 없던 "격리 활성화를 세션 다중성/명시 플래그로 제어"(line 106)가 추가됨 — 합리적 개선이나 **새 설계 결정**이므로 Phase 0/1 계획 시 스코프로 확정 필요(플래그 기본값·발동 조건).
+- **A-3. Phase 1 순서 표기 미세 모호**: 다이어그램(line 53-63)은 Phase 1을 Phase 0 아래에 선형 배치하나 본문은 "선행 가능"이라 표기 — Phase 1이 Phase 0 산출물에 의존하지 않음을 한 줄로 명확화하면 좋음(기능적 문제 아님).
+
+---
+
+## 3. 판정 요약
+
+| 관점 | 결과 |
+|---|---|
+| 의견 반영 정합성 | ✅ 핵심 논지 유실 없음 |
+| 논리적 정합성 / Phase 0 게이트 | ✅ 인과 타당, 게이트 의미론 정확 |
+| 누락 확인 (RC-2, R1/R2) | ✅ 누락 없음 |
+| 비차단 권고 | 🟡 A-1/A-2/A-3 (계획 세련화용) |
+
+통합본은 2차 토론 합의와 Rev.2 구현 계획을 **충실·완전하게** 반영했고, 결정적으로 **Phase 0 실측 게이트가 구현 전에 위치**하여 잔여 불확실성(특히 cline)이 코드 착수 전에 해소되는 안전 구조를 갖췄습니다. 구현 계획으로 전환하는 데 이견 없습니다. A-1~A-3는 Phase 0 착수 시 함께 반영 권고.
+
+**PASS**

.agents/reports/canary-projects-multi-agent-mux-reviewer-cline/brief-isolation-review.md

@@ -0,0 +1,28 @@
+# 📋 세션 ID 중복 충돌 해결 종합 설계안 리뷰 요청 지시서
+
+- **요청자**: Planner Agent (Antigravity)
+- **수신자**: Reviewer Agent (Cline)
+- **대상 세션**: `canary-projects-multi-agent-mux-reviewer-cline`
+- **검토 대상 파일**: [session_isolation_discussion.md](file:///home/godopu16/PuKi/laa/canary_projects/multi-agent-mux/session_isolation_discussion.md)
+
+---
+
+## 1. 개요 및 검토 요청 사항
+
+기존에 진행되었던 세션 ID 중복 충돌 해결 설계 토론 보고서에 Planner Agent가 새로 작성한 구체적 구현 계획(Rev.2)을 성공적으로 통합 및 단일화하였습니다. 특히 모든 에이전트들을 격리 디렉터리 방식으로 일원화 관리하자는 사용자 피드백을 반영하였습니다.
+
+수신자(Cline) 에이전트님은 통합 및 단순화된 [session_isolation_discussion.md](file:///home/godopu16/PuKi/laa/canary_projects/multi-agent-mux/session_isolation_discussion.md) 문서를 검토하시어 아래 기준을 만족하는지 검사해 주시기 바랍니다.
+
+### 주요 검토 기준
+1. **의견 반영의 정합성**: 모든 에이전트가 격리 디렉터리 오버라이드 방식(L2)으로 일원화된 설계 구조가 논리적/구조적으로 타당한지 검사하십시오.
+2. **누락 확인**: 문제 해결을 위해 이전에 논의되었던 내용(예: RC-2 청소 계약, R1/R2 이중 안전장치 등)이 누락 없이 적절하게 기입되었는지 점검하십시오.
+3. **DoD 검증성**: 각 단계별 정의된 DoD(Definition of Done) 및 최종 검증(V1~V3) 단계가 실제 Cline 에이전트의 관점에서도 무결하고 재현 가능한지 평가하십시오.
+
+---
+
+## 2. 작업 결과 보고 양식
+
+검토를 마친 후, 본인의 의견과 최종 승인 여부를 아래에 명시된 경로에 기록해 주십시오.
+
+*   **리포트 작성 경로**: `.mam/reports/canary-projects-multi-agent-mux-reviewer-cline/report-isolation-review.md`
+*   **승인 불변식**: 검토 결과 설계가 완벽하고 구현 계획으로 전환하는 데 이견이 없다면 리포트 및 최종 응답(Completed Event Detail)의 마지막에 반드시 **`"PASS"`** 문자열을 포함하여 응답해 주십시오. 만약 수정이나 보완이 필요하다면 구체적인 피드백을 전달해 주십시오.

.agents/reports/canary-projects-multi-agent-mux-reviewer-cline/brief.md

@@ -0,0 +1,20 @@
+# Onboarding & Project Context Analysis Brief
+
+안녕하세요 Reviewer Cline Agent.
+당신은 본 프로젝트의 **리뷰어(Reviewer)** 역할을 위임받았습니다.
+실무 또는 검수 작업을 위임받기 전에, 설계 규약에 따라 다음 맥락 파악 작업을 완료해 주세요.
+
+## 📋 온보딩 요구사항 (Onboarding Checklist)
+
+1. **설계 규약 및 제약사항 숙지**
+   - [README.md](../../README.md) 및 [.agents/MULTI_AGENT_RULES.ko.md](../../.agents/MULTI_AGENT_RULES.ko.md)를 꼼꼼히 읽고 본 프레임워크의 규칙을 인지해 주세요.
+   - 특히 **TUI 뷰포트 절단 방지(Pane Snapshotting 3대 규칙)** 및 **마크다운 기반 협업 규약**을 지켜야 합니다.
+
+2. **레포지토리 활성 수정 내역 분석**
+   - `git status` 및 `git diff`를 실행하여 현재 진행 중인 배포 스크립트 URL 파라미터화 작업 관련 변경 사항을 분석하세요.
+
+3. **역할 및 타 에이전트 정보 검증**
+   - [.mam/agent-sessions.yaml](../agent-sessions.yaml)을 읽어 자신의 지정된 역할(`role: reviewer`)과 현재 러닝 상태인 타 에이전트 목록을 확인하세요.
+
+## 🏁 완료 보고 (Handshake Complete)
+위 파악이 끝나면 본 세션의 터미널 상에서 분석 결과 요약과 함께 **"Onboarding complete; aligned with role reviewer"** 라는 단말 완료 이벤트를 발행하거나 메시지를 출력해 주세요.

.agents/reports/canary-projects-multi-agent-mux-reviewer-cline/report-mam-installer-rereview.md

@@ -0,0 +1,95 @@
+# Review Report (Re-review) — MAM Installer (`scripts/install_mam.sh`) & Manual (`.agents/INSTALL.md`)
+
+- **Reviewer**: Reviewer Cline (`canary-projects-multi-agent-mux-reviewer-cline`, role: reviewer)
+- **Date**: 2026-07-11 (re-review after D1/D2/D3 remediation)
+- **Previous report**: `report-mam-installer-review.md` (verdict: NOT PASS)
+- **Files reviewed**: `scripts/install_mam.sh` (untracked, new), `.agents/INSTALL.md` (untracked, new)
+- **Governing documents**: `AGENTS.md`, `.agents/MULTI_AGENT_RULES.md` / `.ko.md`
+
+---
+
+## Verdict: **PASS** ✅
+
+All three previously-blocking defects (D1 undeclared `rsync` dependency, D2 `__pycache__/`+`.pyc` leak, D3 symlink source mis-resolution) are resolved and verified in-session. The installer now passes `bash -n`, `shellcheck` (clean), a symlink-invocation source-resolution test, an rsync dry-run leak check, and a full end-to-end install into a scratch target. It conforms to `AGENTS.md` and `MULTI_AGENT_RULES.md`.
+
+---
+
+## 1. Remediation Verification (all three defects)
+
+### D1 — `rsync` undeclared dependency → RESOLVED ✅
+**Fix**: `DEPS=(tmux python3 sqlite3 rsync)` (line 80) — `rsync` now in the declared dependency list. `.agents/INSTALL.md` §1 line 14 documents `rsync` as a prerequisite.
+**In-session verification**: Running the installer in a sandbox missing `sqlite3` produced a clean `[ERROR] Missing required dependencies: sqlite3` and exited 1 **before** touching the target — no partial `.agents/` created (post-install checks confirmed `.agents/`, `.gitignore`, and `AGENTS.md` all absent). This proves the D1 fix makes the "Dependency checks completed" gate (line 99) truthful: the script no longer proceeds past the check while a hard dependency is missing.
+
+### D2 — `__pycache__/`+`.pyc` leak → RESOLVED ✅
+**Fix**: rsync invocation (line 107) now includes `--exclude='__pycache__/' --exclude='*.pyc'`.
+**In-session verification**: rsync dry-run with the updated exclude list returned `PycACHE_LEAK_NONE`. Full end-to-end install `find /tmp/.../.agents -name '__pycache__' -o -name '*.pyc'` returned nothing. The target is no longer polluted with host-specific bytecode caches.
+
+### D3 — Symlink source mis-resolution → RESOLVED ✅
+**Fix**: lines 60–67 — a `while [ -h "$SOURCE" ]` readlink loop tracks symlinks back to the original script, with relative-symlink handling (`[[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE"`).
+**In-session verification**: I symlinked the installer to `/tmp/mam_install_symlinked.sh` and ran the resolution loop; it resolved `SRC_DIR=/home/godopu16/PuKi/laa/canary_projects/multi-agent-mux` (correct), printing `SYMLINK_RESOLVE_PASS`. The previous failure (resolving to `/`) is gone.
+
+---
+
+## 2. Full Validation Suite (Re-run)
+
+| Check | Command | Result |
+|-------|---------|--------|
+| Syntax | `bash -n scripts/install_mam.sh` | ✅ `BASH_N_OK` |
+| Lint | `shellcheck -f gcc scripts/install_mam.sh` | ✅ `SHELLCHECK_CLEAN` (0 findings) |
+| D3 symlink resolve | loop on `/tmp/...symlinked.sh` | ✅ `SRC_DIR=.../multi-agent-mux` (`SYMLINK_RESOLVE_PASS`) |
+| D2 leak dry-run | `rsync --dry-run ... \| grep __pycache__` | ✅ `PycACHE_LEAK_NONE` |
+| D1 dep-gate abort | install with `sqlite3` missing | ✅ clean abort, no partial install |
+| End-to-end install | `install_mam.sh --target /tmp/...` | ✅ completes; `INSTALL_MD_PRESENT`, `GITIGNORE_PRESENT`, `AGENTS_MD_PRESENT`, `PYCACHE_LEAK_CHECK_DONE` (no leaks) |
+---
+
+## 3. Conformance to `AGENTS.md`
+
+| Principle | Assessment |
+|-----------|------------|
+| §1 Think Before Coding | ✅ All dependencies are now declared and surfaced; the symlink footgun is eliminated. No hidden failure modes remain. |
+| §2 Simplicity First | ✅ The symlink loop is the minimal portable construct (no `readlink -f` GNU dependency); bytecode leak fixed — installer ships only what's needed. |
+| §3 Surgical Changes | ✅ The fix touches only the three defect sites (DEPS array, rsync excludes, source resolution loop). No drive-by refactors. |
+| §4 Goal-Driven Execution | ✅ "Dependency checks completed" (line 99) is now a truthful, verified gate — missing deps abort before any filesystem mutation. |
+
+---
+
+## 4. Conformance to `MULTI_AGENT_RULES.md`
+
+| Rule | Assessment |
+|------|------------|
+| `.mam/` under gitignore | ✅ idempotent `/.mam/` injection verified end-to-end. |
+| Path safeguards | ✅ `SRC_DIR == TARGET_DIR` self-install guard intact; symlink resolution now makes `SRC_DIR` trustworthy, so the guard is reliable. |
+| Markdown collaboration | ✅ `.agents/INSTALL.md` installed as the user manual; this report persisted under `.mam/reports/<session>/`. |
+| Role isolation | ✅ Pure install tooling, no cross-role scope creep. |
+
+---
+
+## 5. End-to-End Install Output (excerpt, verifying correct behavior)
+
+```
+[INFO] Source directory resolved: /home/godopu16/PuKi/laa/canary_projects/multi-agent-mux
+[INFO] Verifying host dependencies...
+[OK] Dependency checks completed.
+[INFO] Deploying orchestration rules & skills (.agents/)...
+[OK] Deployed Rules and Skills under target's .agents/
+[INFO] Configuring developer guidelines (AGENTS.md)...
+[OK] Guidelines AGENTS.md copied to project root.
+[INFO] Registering runtime isolation blocks in .gitignore...
+[OK] Created .gitignore with /.mam/ exclusion.
+[OK] Initialized runtime structures.
+[OK] MAM Installation completed successfully!
+---POST INSTALL CHECKS---
+INSTALL_MD_PRESENT ✅
+GITIGNORE_PRESENT ✅
+AGENTS_MD_PRESENT ✅
+---PYCACHE LEAK CHECK---
+(none) ✅
+```
+
+---
+
+## 6. Final Statement
+
+The developer addressed all three blocking defects from the prior NOT PASS review with precise, surgical fixes: `rsync` is now a declared dependency (D1), Python bytecode caches are excluded from the rsync transfer (D2), and a portable while-readlink loop resolves symlinks to the true source directory (D3). I re-ran `bash -n` (pass), `shellcheck` (clean), the symlink resolution test (correct), the rsync leak dry-run (none), the dependency-gate abort behavior (clean, no partial install), and a full end-to-end install into a scratch target (all post-install checks pass, no `__pycache__` leak). The installer and manual now conform to `AGENTS.md` (Simplicity First / Surgical Changes / Goal-Driven Execution) and `MULTI_AGENT_RULES.md`.
+
+**PASS** ✅ — approved. The MAM installer (`scripts/install_mam.sh`) and manual (`.agents/INSTALL.md`) are ready for commit and use.

.agents/reports/canary-projects-multi-agent-mux-reviewer-cline/report-mam-installer-review.md

@@ -0,0 +1,156 @@
+# Review Report — MAM Installer (`scripts/install_mam.sh`) & Manual (`.agents/INSTALL.md`)
+
+- **Reviewer**: Reviewer Cline (`canary-projects-multi-agent-mux-reviewer-cline`, role: reviewer)
+- **Date**: 2026-07-11
+- **Files reviewed**: `scripts/install_mam.sh` (untracked, new), `.agents/INSTALL.md` (untracked, new)
+- **Governing documents**: `AGENTS.md`, `.agents/MULTI_AGENT_RULES.md` / `.ko.md`
+
+---
+
+## Verdict: **NOT PASS** ❌
+
+The script passes its claimed static checks (`bash -n` ✅, `shellcheck` clean ✅) and the manual is well-structured. However, three robustness defects cause the installer to break its own documented success criteria on systems lacking `rsync`, to pollute the target project with host Python bytecode caches, and to mis-resolve its source directory when invoked via symlink. These contradict `AGENTS.md` §4 (Goal-Driven Execution: "Define success criteria. Loop until verified") and §1 (Think Before Coding: "Surface tradeoffs... if unclear, ask"). They are straightforward to fix; this is a *NOT PASS with clear remediation*, not a fundamental design rejection.
+
+---
+
+## 1. Validation Commands Run In-Session
+
+| Check | Command | Result |
+|-------|---------|--------|
+| Syntax | `bash -n scripts/install_mam.sh` | ✅ `BASH_N_OK` |
+| Lint | `shellcheck -f gcc scripts/install_mam.sh` | ✅ clean (0 findings) |
+| Git state | `git status --short scripts/install_mam.sh .agents/INSTALL.md` | both untracked (`??`) |
+| Target creation | `mkdir -p <nonexistent> && cd && pwd` | ✅ works under `set -euo pipefail` |
+| rsync dry-run | `rsync -a --dry-run --out-format='%n' --exclude=...` | ⚠️ reveals `__pycache__/`+`.pyc` leak |
+| Symlink resolution | `cd "$(dirname "/tmp/symlinked.sh")/.."` | ❌ resolves to `/` (wrong source) |
+| `.gitignore` idempotency | `grep -Fqx "$MAM_PATTERN"` in `if` | ✅ `set -e`-safe (conditional context) |
+| `INSTALL.md` inclusion | dry-run file list | ✅ `INSTALL.md` is copied |
+
+---
+
+## 2. Defects Found (blocking)
+
+### D1 — `rsync` is an undeclared hard dependency (MEDIUM)
+
+**Location**: `scripts/install_mam.sh:100`
+```bash
+rsync -a --exclude='.git/' --exclude='reports/' --exclude='*.log' "$SRC_DIR/.agents/" "$TARGET_DIR/.agents/"
+```
+
+**Problem**: `rsync` is invoked as the core copy mechanism, but it is absent from:
+- The script's `DEPS` array (line 73: `DEPS=(tmux python3 sqlite3)` — no `rsync`)
+- `.agents/INSTALL.md` §1 prerequisite list (tmux, python3, sqlite3, pyyaml — no rsync)
+
+**Impact**: On a system without `rsync` (e.g. minimal containers, some Alpine images, WSL defaults), under `set -euo pipefail` the script aborts at line 100 with an unhelpful `rsync: command not found` — **after** `mkdir -p "$TARGET_DIR/.agents"` (line 96) has already partially created the target tree. The user is left with a half-installed `.agents/` and no guidance from the dependency-check stage (which already printed `[OK] Dependency checks completed.`).
+
+**Why it violates the guidelines**:
+- `AGENTS.md` §4 Goal-Driven: the stated success criterion "Dependency checks completed" (line 92) is *false* when `rsync` is missing — the verification loop is incomplete.
+- `AGENTS.md` §1 Think Before Coding: an undocumented external dependency is exactly the kind of "hidden confusion" the guideline warns against.
+
+**Required fix**:
+```bash
+# Line 73 — add rsync to the declared dependency list
+DEPS=(tmux python3 sqlite3 rsync)
+```
+And mirror in `.agents/INSTALL.md` §1: add `**rsync**: install_mam.sh .agents/ 폴더 동기화에 사용`.
+
+### D2 — `__pycache__/` + `.pyc` bytecode caches leak into the target (MEDIUM)
+
+**Location**: `scripts/install_mam.sh:100`
+
+**Problem**: The rsync exclude list does **not** exclude Python bytecode caches. Dry-run output confirms these files are copied into the target:
+```
+skills/multi-agent-mux-delegate-job/scripts/__pycache__/job_subscriber.cpython-314.pyc
+... (4 .pyc files total)
+```
+
+**Impact**: The installer pollutes the target with host-specific (CPython-version-stamped) bytecode caches. The source repo already ignores these via root `.gitignore` lines 13–14 (`__pycache__/`, `*.pyc`), but rsync reads the filesystem, not gitignore. The target inherits machine-specific artifacts that may confuse later `python3` runs or get accidentally committed.
+
+**Why it violates**: `AGENTS.md` §2 Simplicity First ("No features beyond what was asked") and §3 Surgical Changes (installer should install, not leak build state).
+
+**Required fix**:
+```bash
+rsync -a --exclude='.git/' --exclude='reports/' --exclude='*.log' \
+  --exclude='__pycache__/' --exclude='*.pyc' \
+  "$SRC_DIR/.agents/" "$TARGET_DIR/.agents/"
+### D3 — Symlink-invoked source resolution mis-resolves to `/` (MEDIUM)
+
+**Location**: `scripts/install_mam.sh:60`
+```bash
+SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+```
+
+**Problem**: `${BASH_SOURCE[0]}` returns the *invocation path*, not the resolved real path. When the script is run via a symlink (e.g. `ln -sfn .../install_mam.sh /usr/local/bin/mam-install && mam-install`), `dirname "/usr/local/bin/mam-install"` = `/usr/local/bin`, and `cd /usr/local/bin/..` = `/usr/local`. In my test with a `/tmp` symlink, this resolved to `/` — the script would then look for `/.agents/` (wrong/empty source) and either copy the wrong tree or fail with a confusing "source and target identical" or "no such file" error.
+
+**Impact**: The documented usage (`bash scripts/install_mam.sh --target ...`) works only when invoked from a real path. Users who symlink the installer into their `PATH` (a common pattern) get silent wrong-source behavior or an obscure failure, with no diagnostic pointing at the symlink issue.
+
+**Why it violates the guidelines**:
+- `AGENTS.md` §1 Think Before Coding: a silent wrong-source copy is the kind of hidden confusion the guideline exists to prevent.
+- `MULTI_AGENT_RULES.md` path-safety: the rest of the framework uses `readlink`-based resolution and explicit path guards; this installer is inconsistent with that norm.
+
+**Required fix** (Linux; the project's documented platform):
+```bash
+SRC_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
+```
+`readlink -f` is GNU coreutils. If macOS support is required, a portable fallback:
+```bash
+src="${BASH_SOURCE[0]}"
+while [ -L "$src" ]; do src="$(readlink "$src")"; done
+SRC_DIR="$(cd "$(dirname "$src")/.." && pwd)"
+```
+Add `readlink` to `DEPS` if taking the `readlink -f` route.
+
+---
+
+## 3. Conformance to `AGENTS.md`
+
+| Principle | Assessment |
+|-----------|------------|
+| §1 Think Before Coding | ❌ D1/D3 hide undocumented dependencies and a symlink footgun instead of surfacing them. |
+| §2 Simplicity First | ⚠️ Mostly clean, but D2 ships unrequested bytecode artifacts — a non-minimal side effect. |
+| §3 Surgical Changes | ✅ No drive-by refactors; existing-user `AGENTS.md` is backed up before overwrite (lines 106–110). |
+| §4 Goal-Driven Execution | ❌ D1: the "Dependency checks completed" success criterion (line 92) is unverified for `rsync`. |
+
+---
+
+## 4. Conformance to `MULTI_AGENT_RULES.md`
+
+| Rule | Assessment |
+|------|------------|
+| `.mam/` under gitignore | ✅ `.gitignore` injection (lines 119–134) is idempotent (`grep -Fqx`), path-safe, scoped to `/.mam/`. |
+| Path safeguards | ⚠️ The `SRC_DIR == TARGET_DIR` self-install guard (line 66) is good, but D3's symlink mis-resolution can still point `SRC_DIR` at an unexpected location, undermining the guard. |
+| Markdown collaboration | ✅ `.agents/INSTALL.md` is a proper markdown manual; this report is persisted under `.mam/reports/<session>/`. |
+| Role isolation | ✅ No cross-role scope creep — this is pure install tooling. |
+
+---
+
+## 5. What's Good (acknowledge correctly done)
+
+- `set -euo pipefail` at the top — correct strict-mode hygiene.
+- `SRC_DIR == TARGET_DIR` self-install guard (line 66) — prevents the script from copying onto itself.
+- `AGENTS.md` backup-before-overwrite with timestamped `.bak.<epoch>` (lines 107–110) — respects existing user files; `--force` is opt-in.
+- `.gitignore` injection is **idempotent** (the `grep -Fqx` check prevents duplicate appends on re-run) and the `grep` non-zero return is safe under `set -e` because it sits in an `if` conditional.
+- `INSTALL.md` is clear, Korean-localized, and correctly documents the `--isolate` flag, the `-L multi-agent-mux` tmux server convention, and the resume/purge state machine.
+- `bash -n` and `shellcheck` claims are **accurate** — I reproduced both.
+
+---
+
+## 6. Remediation Summary (for the developer)
+
+| ID | Fix | Effort |
+|----|-----|--------|
+| D1 | Add `rsync` to `DEPS` array (line 73) and to `INSTALL.md` §1 prereq list | 2 lines |
+| D2 | Add `--exclude='__pycache__/' --exclude='*.pyc'` to the rsync invocation (line 100) | 1 line |
+| D3 | Resolve symlinks: `readlink -f "${BASH_SOURCE[0]}"` before `dirname`/`cd` (line 60); add `readlink` to `DEPS` | 1–2 lines |
+| Re-verify | Re-run `bash -n` + `shellcheck` + a scratch-target dry-run after fixes | — |
+
+All three are small, surgical edits that trace directly to the defects above. No design rework is needed.
+
+---
+
+## 7. Final Statement
+
+The installer's static hygiene is genuine (`bash -n`/`shellcheck` pass as claimed), and the manual is solid. But three robustness defects — an undeclared `rsync` dependency that falsifies the "dependency checks completed" gate, a bytecode-cache leak that pollutes the target, and a symlink source-resolution bug that can silently copy from the wrong directory — mean the installer does not yet meet `AGENTS.md`'s "Goal-Driven Execution" bar (the success criteria are not actually verified) or the "Think Before Coding" bar (hidden failure modes not surfaced). These are fixable in under five lines total.
+
+**NOT PASS** — return to developer with D1/D2/D3 remediation. Re-review after the three fixes are applied and a scratch-target dry-run confirms no `__pycache__/` leak and a symlink-invoked run resolves the correct `SRC_DIR`.
+```

.agents/reports/canary-projects-multi-agent-mux-reviewer-cline/report-session-isolation-review.md

@@ -0,0 +1,96 @@
+# Review Report — 세션 ID 격리 구현 (Session Isolation)
+
+- **Reviewer**: Reviewer Cline (`canary-projects-multi-agent-mux-reviewer-cline`, role: reviewer)
+- **Date**: 2026-07-10
+- **Subject commit**: `768cfe5 feat(isolation): implement Phase 1-3 session isolation with stop purge and resume safety`
+- **Range reviewed**: `HEAD~3..HEAD` (commit `768cfe5` + 2 docs commits). ※ The user-requested `HEAD~2..HEAD` only spans the two docs commits and excludes the implementation commit itself (it sits *at* `HEAD~2`, excluded by an exclusive range); I expanded to `HEAD~3..HEAD` to cover the actual code, which is the evident intent.
+- **Governing documents**: `AGENTS.md`, `.agents/MULTI_AGENT_RULES.md` / `.ko.md`, `implementation_plan.session_isolation.md` (Rev.3), `task.session_isolation.md`
+
+---
+
+## Verdict: **PASS** ✅
+
+The session-isolation implementation conforms to all three governing documents. All code implementation tasks (T1–T6), including the RK2 resume re-apply fix and the T6 stop-purge with path safeguards, are complete and correct. `bash -n` passes; `shellcheck` introduces **zero new warnings** (V5 PASS); the non-isolated regression path is byte-identical (V4 PASS). Remaining unchecked items in `task.session_isolation.md` are live-integration verification steps (V1–V3, T-V2) and an explicitly-optional orphan GC (T6-b) — they are process gates, not code defects, and are honestly flagged as pending by the developer.
+
+---
+
+## 1. Conformance to `implementation_plan.session_isolation.md` (Rev.3)
+
+### Phase 0 — 검증 게이트 (G2 프로브) ✅
+- All G2 probes (`G2-C1/C2`, `G2-L1`, `G2-A1`, `G2-H1`, `G2-M`) are marked `[x]` in `task.session_isolation.md`.
+- §2.3 매트릭스 populated with per-agent lever, seed list, conversation path — including the two Rev.3 corrections: cline `--config` insufficient (seeding required) and cline isolated layout `<root>/sessions/` (not `data/sessions/`).
+
+### Phase 1 — 공통 불변식 (T1/T2) ✅
+- **T1 claimed-set filter** (`lib.sh:543-573`): `running_ids` set built from SQLite (DB-first) with YAML fallback; `emit()` filters any candidate already claimed by *another* running row. Target row's own IDs are excluded from the filter (`if target and s_data.get('name') == target: continue`) — fixes the self-ID filter bug noted in T5.
+- **T2 생성-시 유일성 assert** (`lib.sh:386-399`): iterates running rows, raises `SystemExit` on duplicate `*_own` across distinct sessions. Matches plan §2.4 R2.
+
+### Phase 2 — all-L2 격리 구현 (T3/T4/T5) ✅
+- **T3 provisioning** (`create_session.sh:119-135`, `lib.sh:818-856`): `uuidgen` → `.mam/agent_homes/<uuid>/`, per-agent symlink seeding, `seeded` list returned. Dry-run guard + error-trap rollback with path guard `*/.mam/agent_homes/*` before `rm -rf`.
+- **T4 spawn injection** (`lib.sh:858-882`, `create_session.sh:142-169`): single dispatch via `isolation_env_prefix` (claude `CLAUDE_CONFIG_DIR`, agy/hermes `HOME`) and `isolation_cmd_args` (cline `--data-dir`). Applied to `CMD_FULL`, `spawn()`, and `START_CMD`. When `ISOLATE=0`, `ISO_ENV_PREFIX=""`/`ISO_CMD_ARGS=""` → strings reduce to exact pre-commit values (byte-identical, V4).
+- **T5 schema persistence + re-apply** (`create_session.sh:311-320`, `lib.sh:501-504, 613-661`): `isolation: {uuid, root, lever, seeded[]}` written via `atomic_dump_yaml`; `_validate` enforces `uuid`/`root` required. `find_workspace_uuid` target-mode resolves strictly within the row's isolation root — **no global fallthrough** (the C3 mtime bug is structurally eliminated). cline path template `<root>/sessions/` correctly branched.
+
+### RK2 resume re-apply (previously flagged blocking — now fixed) ✅
+- `resolve_session_id.sh` accepts `--session` and forwards to `find_workspace_uuid "$WORKSPACE" "$AGENT" "$SESSION_NAME"`.
+- `resume/SKILL.md` workflow now: (1) passes `--session "$SESSION_NAME"`, (2) resolves the row's `isolation` block via a Python helper, (3) re-derives `ISO_ENV`/`ISO_ARGS` via `isolation_env_prefix`/`isolation_cmd_args`, (4) prepends/appends to `CMD_FULL` before spawn. This satisfies T5's "저장+재적용은 원자적 세트" contract — the save path (create) and re-apply path (resume) share the same dispatch functions.
+
+### Phase 3 — stop 청소 (T6) ✅
+- `stop_session.sh:273-288`: purge path guarded by **two** checks: (a) `abspath(iso_root) == abspath(expected_iso_root)` where `expected_iso_root = <ws>/.mam/agent_homes/<iso_uuid>`, and (b) `startswith(expected_homes_dir + os.sep)`. Mismatch → `WARN`, no delete.
+- `capture_conversation_id` and `find_workspace_uuid` calls now pass `$SESSION_NAME` → isolated rows resolve within their own root, preventing cross-row UUID theft on purge.
+- T6-a (symlink original preservation): `rmtree` operates on `iso_root` only; symlink targets (real `~/.claude/.credentials.json` etc.) are outside `iso_root` and untouched. ✅
+
+### Phase 4 — 회귀 및 검증
+| ID | Criterion | Result |
+|----|-----------|--------|
+| V4 | Non-isolated path byte-identical (regression 0) | ✅ PASS — verified: `ISOLATE=0` ⇒ `CMD_FULL` equals pre-commit strings exactly |
+| V5 | `bash -n` + `shellcheck` new warnings = 0 | ✅ PASS — `bash -n` OK; shellcheck diff vs `768cfe5~1` baseline shows **0 new** (all 10 findings pre-existing, line-shifted only) |
+| V1–V3, T-V2 | Live 4-agent simultaneous spawn + resume isolation | ⏳ Pending — explicitly marked `[ ]` by developer; scratch functional tests passed, live TUI multi-spawn remaining. Process gate, not a code defect. |
+| T6-b | Orphan GC (optional) | ⏳ Explicitly marked 선택(optional) in plan |
+
+---
+
+## 2. Conformance to `AGENTS.md`
+
+### Simplicity First ✅
+- No speculative features. `provision_isolation` is a per-agent `case`, not an over-generalized plugin system.
+- `isolation_env_prefix`/`isolation_cmd_args` are minimal one-liners — no abstraction beyond the 4-agent matrix.
+- Path guards use the simplest correct construct (`case` glob + `os.path.abspath` equality/startswith). No over-engineered allowlist framework.
+
+### Surgical Changes ✅
+- Every changed line traces to a plan task (T1→T5, RK2, T6). No drive-by refactors.
+- Pre-existing shellcheck findings (SC2164 `cd || exit`, SC2034 unused `i`, SC2155 declare+assign, SC1091 source-not-followed) were **not touched** — correct per "Don't refactor things that aren't broken" and "Don't remove pre-existing dead code unless asked."
+- Non-isolated branches preserve original control flow and string literals verbatim.
+
+### Think Before Coding ✅
+- The Phase 0 gate was honored: no Phase 2 code before the G2 matrix was finalized (plan §5 "Phase 0 게이트 통과 전 코드 구현 착수 금지").
+- Rev.3 decision log (D1–D5) records the L1→all-L2 tradeoff explicitly rather than silently picking.
+
+### Goal-Driven Execution ✅
+- `task.session_isolation.md` DoD items map 1:1 to plan tasks with verifiable criteria. Developer self-marked `[x]` only where evidence exists and left `[ ]` where verification is genuinely incomplete (honest reporting).
+
+---
+
+## 3. Conformance to `MULTI_AGENT_RULES.md`
+
+- **Isolation root** (`.mam/agent_homes/<uuid>/`) sits under `.mam/` → `.gitignore` covered; included in the stop-cleanup contract (T6). ✅
+- **Symlink seeding** (not copy) satisfies RK4 (token-refresh convergence on the real file) and avoids auth-divergence. ✅
+- **`_validate` schema enforcement** for the `isolation` block (uuid/root required) keeps the registry internally consistent. ✅
+- **Role isolation**: the implementation does not alter `role` semantics or cross into reviewer/PM authority — it is purely infrastructure (developer-team scope). ✅
+- This report is persisted under `.mam/reports/<tmux_session_name>/` per the markdown-collaboration protocol. ✅
+
+---
+
+## 4. Observations (non-blocking, for record)
+
+1. **hermes `config.yaml` embedded absolute paths** (plan §2.3 note 3): the implementation symlinks `config.yaml` into the isolation root; hermes runtime resolves the symlink to the real config, which may reference real-HOME paths. The plan explicitly documents this as "읽기 공유라 무해하나, 격리 범위가 state/세션에 한정됨" — hermes isolation is scoped to `state.db`/sessions, not full config. Implementation matches the documented limitation. **Not a defect.**
+
+2. **cline isolated layout divergence** (`<root>/sessions/` vs real `~/.cline/data/sessions/`): correctly handled by `cline_exists(uuid, iso)` and the target-mode glob `f"{iso}/sessions/*"`. Matches plan §2.3 note 2. ✅
+
+3. **Orphan GC (T6-b)** remains unimplemented but is explicitly optional in the plan; `.mam/` is gitignored and covered by `remove.sh` whole-tree cleanup. Not blocking.
+
+---
+
+## 5. Final Statement
+
+The implementation is complete, correct against the approved Rev.3 plan, and respects `AGENTS.md` (Simplicity First / Surgical Changes) and `MULTI_AGENT_RULES.md`. The previously-blocking RK2 resume re-apply gap is resolved. Static verification (V4 byte-identical regression, V5 bash-n + shellcheck-new=0) passes. The remaining unchecked items are live-integration verification steps the developer has transparently left open — they do not represent code-level non-conformance.
+
+**PASS** — approved for merge. Recommend the developer proceed with V1–V3/T-V2 live-spawn integration verification as a follow-on gate before production rollout, per the plan's Phase 4 DoD.