kairos-chain 3.94.0 → 3.96.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05055bfa3f7c4377e2e88011754c85d8d87c690e07f19837c4dca5a0c1cd033c
-  data.tar.gz: 48b9c8a70d27304e21293440f121ec069cb0c7ec47ed41b01573cdd2e3c80505
+  metadata.gz: d9378e59ddbeb6127f907b009d5c74f362932d3ded7669e75975d9e4e000285b
+  data.tar.gz: f5153b3a2034f5ad9f68d1ee5d31f4a7295e8b4e1cdf48cf90283744886d0355
 SHA512:
-  metadata.gz: '08ee4ff5f61407bdcc390eb8c4cda6c286472672a6549ded81d5d0b1c7cf29f8203a472f9cfa5d4cfc811b1b8d923d4ee77ee6746decad1893a33c01187ecc1e'
-  data.tar.gz: 0b94dde53ddce2444defb9933515dda0d4e754bb0e6053129927d82032bdb9b73383b5d67234a9b57f3e003e82e1b004c17c94f6e551a45ba2fc5dca412bd340
+  metadata.gz: 2a9ca012c529a7523e68bb0dde4fd08b20bda1e08a540d98714ae169efc1268946faeb6d16ad1a0926382a480177c60c736a383f8747b2dbcf0225bac5ad522a
+  data.tar.gz: 9e39c4801fef0169431db7c23e6f1e45099b11b0a482b12254fef0a90cf7de7787f6d3b6414824fddb86c0f04c246a2b488cda4741e450366841ee7d2f706b52

data/CHANGELOG.md

@@ -6,6 +6,159 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.96.0] - 2026-10-21
+
+### Changed — multi_llm_review says what the roster was when a result is read (multi_llm_review 0.12.0, llm_client 0.4.0)
+
+A seat whose reviewer CLI was missing, logged out or refused by codex used to leave the count as `transport`, and
+an APPROVE carried no feedback at all, so a review decided by two Anthropic seats read like one decided by four
+seats from three makers. A Codex host's persona team was recorded as Claude's.
+
+- A failed seat's reason is the cause its CLI adapter established: `cli_missing` (the binary is not on the PATH the
+  server searched), `cli_unauthenticated` (the CLI, asked after the failure with its own status command, says it
+  holds no credential), `workspace_refused` (codex refused a working directory outside a git repository) or
+  `cli_timeout`. Anything else stays `transport`, which now means an error with no established cause. Nothing the
+  CLI printed is read for this: codex prints the prompt and the files it read.
+- `vote_tally.roster_health` states the seats, how many counted, each seat that did not count with its reason, and
+  each counted seat's maker with where it comes from (observed, configured, or declared by the caller). When a seat
+  did not count or maker diversity is not established, `feedback_text` starts with one line, on APPROVE too:
+  `Roster: 2 of 4 seats counted (1 caller-declared) — not counted: cli_missing: codex_gpt6-astra, cursor_composer2.5; maker diversity not established.`
+- INSUFFICIENT says how many seats counted and how many were needed, that a seat can be added in config, and the
+  action that restores each lost seat where one exists. The tool advises no strategy.
+- Every seat is dispatched with `no_fallback`: an API-key seat whose key is unset fails on its own provider instead
+  of being re-run on claude_code under its own name.
+- New optional argument `orchestrator_host` (`claude_code`, `codex_cli`, `cursor`, `other`). `claude_code` or none
+  keeps `claude_team_<model>`; `codex_cli` records the persona seat as `codex_team_<model>` with provider
+  `codex_cli_host`. Records carry `orchestrator_host` and the server's own `host_detected`.
+- `multi_llm_review_wait` reports answered and failed seats separately.
+- The verdict and the quorum are unchanged. VERDICT_SCHEMA_VERSION 3, feedback_text_schema_version 2;
+  multi_llm_review's min_core_version is 3.24.9.
+- config gains a commented second codex seat for a machine with only the codex CLI. Upgrades never rewrite an
+  instance's config; add it by hand.
+- llm_client 0.4.0: `ApiError` carries the `code`, and `CallRouter` and `llm_call` return it as `error['code']`.
+  After a failed CLI call one status command runs (never when the dispatcher ended the call; at most about 19 s).
+  The error message and its ErrorTaxonomy type are unchanged, so every other llm_client caller sees only the added
+  key and that pause.
+
+Design: `log/mlr_non_claude_host_design_v0.3.3_20261021.md`, frozen after four review rounds; implementation
+reviewed in two (records `log/mlr_non_claude_host_*`).
+
+### Changed — L1 `multi_llm_review_workflow` 3.17.0
+
+§ Auto Mode vs Manual Mode sent a missing CLI to a "Manual mode" the runbook never described. It is replaced by
+§ Execution Environment / Reduced rosters and non-Claude hosts: what each failure reason means and what restores
+the seat, the roster line, what a Claude-only, a non-Claude-host and a codex-only setup count under each strategy,
+and how a host's per-call time limit meets a long review call.
+
+### Fixed — `capability_status` reported installed reviewer CLIs as missing
+
+It searched PATH for files named `claude_cli`, `codex_cli` and `cursor_cli`. It now probes the binaries the
+adapters spawn (`claude`, `codex`, `agent`), runs `--version` without a shell, and names the binary it searched for.
+
+## [3.95.1] - 2026-10-21
+
+### Changed — the agent SkillSet ships a sample policy, `default_2026_10_20`, instead of `masa_2026_10_20` (agent 1.0.1)
+
+`masa_2026_10_20.rb` named its author and cited a record that exists only in the author's instance.
+`default_2026_10_20.rb` carries the same rules (the stand-in may answer from the operator's recorded words, from
+the instruction mode, and reversible questions no recorded word covers; review consent; no project exempt from the
+data check; 10 rounds per review; 300 stand-in calls), with comments that say what each rule does. The stand-in
+reads the policy file, comments included. Adopt it with `adopt policy default_2026_10_20 ac4ae89b`; adopting it
+consents to sending the run's artifacts to the reviewers configured in multi_llm_review.
+
+`masa_2026_10_20.rb` is no longer shipped and is not listed in `removed_files`, so upgrade leaves an installed copy
+and a forced reinstall keeps the installed copy: an instance that has it keeps it, and an adoption of it stays valid. It is another operator's sample with the same
+rules: an instance that never adopted it may delete it, and one that did may adopt `default_2026_10_20` instead. A
+shipped policy is never changed in place; a changed rule ships under a new policy name in a new file. Design:
+`log/agent_policy_default_and_proposal_design_v0.7.2_20261021.md`.
+
+### Changed — personal material out of the shipped agent tree
+
+Home paths, a person's project and course names, answers typed in a real course and a third party's name are
+replaced by synthetic ones in the agent SkillSet's tests and one code comment. The published 3.95.0 gem and the
+repository history keep them.
+
+### Added — `bin/agent_policy_report.rb`
+
+An operator-run script that reports, for each rule of the adopted policy, what the runs the chain records as ended
+hold against it: stand-in answers by class and their corrections, review rounds and cap hits, stand-in calls and
+grants, data checks, with counts, denominators and the operator's words. It moves no rule, evaluates no file
+from a run directory, and writes only its report, under `storage/agent/policy_reports/` (and
+`storage/agent/.gitignore` when absent; no report is written unless that file is a regular file holding exactly the line `*`). Every act it counts is recorded on the actor's reading of the
+operator's words, and the report says so. A policy changes only by the operator's own copy, edit and typed
+adoption.
+
+## [3.95.0] - 2026-10-21
+
+### Changed — the `agent` SkillSet is rebuilt (1.0): long runs in the host session, a stand-in instead of terminal approvals
+
+The 0.x agent could not carry the operator's ordinary request (design → design review → implement →
+implementation review): its act route wrote only `docs/drafts/draft_*`, could not reach multi-LLM review or
+tests, and counted only terminal-attested answers (0 counted pairs). Design:
+`log/agent_skillset_rebuild_design_v0.5.1_20261020.md` (five review rounds, frozen as the author's proposal)
+and its delta `log/agent_skillset_rebuild_design_v0.6.3_20261020.md`.
+
+- The host session (Claude Code) is the only body. The SkillSet supplies a plan from a Ruby-DSL template, a
+  stand-in (isolated `claude -p --safe-mode --tools ""`, Opus 5.5) that answers decision points from the
+  operator's own words and the instruction mode, a guard (host hooks: `PreToolUse` on every tool, fail-closed)
+  that lets through only what the run created or its worktree and branch hold, a hash-chained journal, and a
+  report check. Six tools: `agent_start`, `agent_status`, `agent_advance`, `agent_items`, `agent_finish`,
+  `agent_stop`.
+- Runs need an adopted policy (the operator's mandate, `config/policies/*.rb`), adopted by the operator's own
+  typed words naming its digest; the adoption is recorded on the chain.
+- Templates: `dev_cycle`, `impl_cycle`, `design_only`, `doc_cycle` (a document kept in git, revised in place,
+  optional build check), `survey` (versioned survey files from local sources), `general`.
+- A review closes only when no (a)/(b) P0 is open. Each review may take the policy's `review_rounds`
+  (10), counted for that review alone; at the cap it waits for the operator, who grants more rounds or
+  freezes it. Revisions follow L1 multi_llm_review_workflow § Revision
+  Discipline: each round says which new P0s the actor's last addition drew, and the next step is to undo it.
+  Design reviews stay at the design level; implementation-only findings are deferred to the implementation
+  review and are operator items at once.
+- Every run ends with a layered-deck report (`report_kit/`, the kit of L1 `layered_visual_pitch_deck`).
+- `bin/agent_harvest.rb` harvests the operator's own answers from host transcripts (hook output, peer
+  messages and pasted host output excluded).
+- Removed: the in-server OODA loop, act-route table and terminal rulings, shadow judge, distillation,
+  native body, `agent_execute`, `agent_step`, `agent_wait`, `operator_report`, the `agent-monitor` subagent.
+- `agent` is no longer installed automatically in new instances (it needs a policy and projects hooks).
+  An installed 0.x agent becomes 1.0 on upgrade. 1.0 needs `multi_llm_review` and `llm_client` >= 0.3.0 in
+  the same instance; upgrade does not install a missing one (`kairos-chain skillset install multi_llm_review`).
+
+### Added — `removed_files` in `skillset.json`; `system_upgrade` archives them
+
+`upgrade_apply` copied changed files and never deleted one, so a SkillSet that dropped files left them to be
+loaded. A template may now list `removed_files`; upgrade moves each from the installed copy to
+`storage/skillset_removed/<name>/<time>/`, and a forced reinstall no longer restores a retired config file.
+
+### Added — `llm_call` options `no_fallback` and `isolated`
+
+`no_fallback` makes an authentication failure on the configured provider a failure instead of a silent switch
+to `claude_code`. `isolated` (claude_code) runs `claude -p --safe-mode --tools ""` in an empty directory, so
+no CLAUDE.md, skills, plugins, hooks, memory or MCP servers reach the call. An isolated call's payload carries
+`isolation` (`safe_mode`, `tools`, `cwd`, as `claude -p` was spawned); llm_client is 0.3.0. The agent's
+stand-in refuses any reply without that evidence (and refuses to call an llm_client too old to isolate), and the
+agent SkillSet declares `llm_client >= 0.3.0`; upgrade both together.
+
+### Added — `user_level_conflicts` in `skillset.json`; install and upgrade report them
+
+A SkillSet may list files an earlier version left at user level that it cannot remove itself (e.g. a personal
+skill that shadows the project's). `install`, `upgrade_apply`, `system_upgrade` and `kairos-chain skillset
+install/upgrade` print the ones present as warnings, with a command that moves them to a timestamped backup.
+agent 1.0 lists the 0.x personal skill `~/.claude/skills/agent/SKILL.md` and `~/.claude/agents/agent-monitor.md`.
+
+### Changed — the shipped agent policy needs a new adoption
+
+`masa_2026_10_20.rb` sets `review_rounds` to 10 rounds for each review (counted apart, no longer shared by a
+run's reviews) and drops the lookup consent comment (runs never look things up on the web). Its digest
+changed: adopt it with `adopt policy masa_2026_10_20 8846b67e`.
+
+### Changed — L1 `multi_llm_review_workflow` 3.16.0 and `design_to_implementation_workflow` 1.3
+
+A new entry-level clause, § Provisional delegation under a mandate: under a pinned, journaled operator policy a
+named delegate — never the context whose work is judged — answers reserved judgments provisionally, and nothing
+resolves, closes, freezes or demotes beyond the run until the operator confirms it in their own words. Pointers
+from INV-U2, INV-U4, INV-U5, Step 0.25 and § Convergence Rules, and from the merge criteria of
+`design_to_implementation_workflow`. An instance's own L1 copy is not rewritten by upgrade.
+
 ## [3.94.0] - 2026-10-20
 
 ### Added — L0 changes proposed for later approval, L0 restores on the record, L1 body history

data/bin/kairos-chain

@@ -102,6 +102,7 @@ when 'skillset'
     result = manager.install(source, layer_override: layer_override, force: force)
     puts "Installed SkillSet '#{result[:name]}' v#{result[:version]} [#{result[:layer]}]"
     puts "Path: #{result[:path]}"
+    manager.user_level_conflicts(KairosMcp::Skillset.new(result[:path])).each { |w| puts "  [WARNING] #{w}" }
 
   when 'enable'
     name = ARGV.shift
@@ -162,6 +163,7 @@ when 'skillset'
       puts "## SkillSets"
       results.each do |r|
         puts "  [UPGRADED]  #{r[:name].ljust(22)} v#{r[:from]} -> v#{r[:to]} (#{r[:files_updated]} files)"
+        Array(r[:warnings]).each { |w| puts "    [WARNING] #{w}" }
       end
       checkable.reject { |ss| upgraded_names.include?(ss.name) }.each do |ss|
         puts "  [UNCHANGED] #{ss.name.ljust(22)} v#{ss.version}"

data/lib/kairos_mcp/capability.rb

@@ -98,11 +98,25 @@ module KairosMcp
           declaration_errors: errors }
       end
 
+      # The binary each declared external names: the one the llm_client
+      # adapter spawns for it (claude_code_adapter, codex_adapter,
+      # cursor_adapter). Probing the symbol itself searched PATH for a file
+      # called "codex_cli" and reported every installed CLI as missing.
+      EXTERNAL_BINARIES = {
+        claude_cli: 'claude',
+        codex_cli:  'codex',
+        cursor_cli: 'agent'
+      }.freeze
+
+      def binary_for(name)
+        EXTERNAL_BINARIES.fetch(name.to_s.to_sym, name.to_s)
+      end
+
       # which-style PATH check using only filesystem (no subprocess).
       # Returns true/false.
       def cli_in_path?(name)
         return false unless name.is_a?(Symbol) || name.is_a?(String)
-        bin = name.to_s
+        bin = binary_for(name)
         ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? do |dir|
           full = File.join(dir, bin)
           File.executable?(full) && !File.directory?(full)
@@ -110,11 +124,13 @@ module KairosMcp
       end
 
       # Get version of a CLI by spawning subprocess (only when probe_versions: true).
-      # Returns nil on any failure (Honest unknown).
+      # Returns nil on any failure (Honest unknown). Spawned as an argv, not
+      # through a shell.
       def cli_version(name)
         return nil unless cli_in_path?(name)
-        out = `#{name} --version 2>&1`.strip
-        $?.success? ? out.lines.first&.strip : nil
+        require 'open3'
+        out, status = Open3.capture2e(binary_for(name), '--version')
+        status.success? ? out.strip.lines.first&.strip : nil
       rescue StandardError
         nil
       end

data/lib/kairos_mcp/skillset.rb

@@ -87,6 +87,27 @@ module KairosMcp
       @metadata['config_files'] || []
     end
 
+    # Files a release takes out of an installed copy (relative paths). An
+    # upgrade copies changed files and never deletes; a SkillSet that drops
+    # files names them here so system_upgrade archives them instead of
+    # leaving them to be loaded (Skillset#load requires every tools/*.rb).
+    def removed_files
+      Array(@metadata['removed_files']).select do |rel|
+        rel.is_a?(String) && !rel.empty? && !rel.start_with?('/') && !rel.split('/').include?('..')
+      end
+    end
+
+    # Files outside the instance that an earlier version left at user level
+    # and that this version cannot remove itself (e.g. a personal skill that
+    # shadows the project's): each { "path": "~/...", "pattern": "regex",
+    # "note": "..." }. Upgrade reports the ones present; the operator moves
+    # them.
+    def user_level_conflicts
+      Array(@metadata['user_level_conflicts']).select do |c|
+        c.is_a?(Hash) && c['path'].is_a?(String) && c['path'].start_with?('~/') && !c['path'].split('/').include?('..')
+      end
+    end
+
     # Optional fail-closed activation hook: a fully-qualified class name
     # whose `activate_on_load!` runs at skillset-load time, independent of
     # whether any of the SkillSet's tools are instantiated. Used by

data/lib/kairos_mcp/skillset_manager.rb

@@ -89,12 +89,14 @@ module KairosMcp
       dest = File.join(@skillsets_dir, temp_skillset.name)
       if File.directory?(dest)
         if force
-          # Preserve user config files before replacing
+          # Preserve user config files (subdirectories included) before replacing
           config_dir = File.join(dest, 'config')
           saved_configs = {}
           if File.directory?(config_dir)
-            Dir.glob(File.join(config_dir, '*')).each do |f|
-              saved_configs[File.basename(f)] = File.read(f)
+            Dir.glob(File.join(config_dir, '**', '*')).each do |f|
+              next unless File.file?(f)
+
+              saved_configs[f.sub("#{config_dir}/", '')] = File.read(f)
             end
           end
 
@@ -103,12 +105,13 @@ module KairosMcp
           # Copy new version
           FileUtils.cp_r(source_path, dest)
 
-          # Restore user configs
-          unless saved_configs.empty?
-            FileUtils.mkdir_p(File.join(dest, 'config'))
-            saved_configs.each do |name, content|
-              File.write(File.join(dest, 'config', name), content)
-            end
+          # Restore user configs, except those the new version retired
+          retired = temp_skillset.removed_files.select { |r| r.start_with?('config/') }.map { |r| r.sub('config/', '') }
+          saved_configs.reject! { |rel, _| retired.include?(rel) }
+          saved_configs.each do |rel, content|
+            path = File.join(dest, 'config', rel)
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, content)
           end
         else
           raise ArgumentError, "SkillSet '#{temp_skillset.name}' already installed at #{dest}. Use --force to reinstall."
@@ -154,14 +157,16 @@ module KairosMcp
         template_ver = Gem::Version.new(template_ss.version)
 
         changed_files = diff_files(template_path, installed.path)
+        removals = template_ss.removed_files.select { |rel| File.exist?(File.join(installed.path, rel)) }
 
-        if template_ver > installed_ver || changed_files.any?
+        if template_ver > installed_ver || changed_files.any? || removals.any?
           results << {
             name: installed.name,
             installed_version: installed.version,
             available_version: template_ss.version,
             version_bump: template_ver > installed_ver,
             changed_files: changed_files,
+            removed_files: removals,
             new_skillset: false
           }
         end
@@ -194,7 +199,7 @@ module KairosMcp
     # Others (multiuser, service_grant, hestia, mmp, skillset_exchange, mcp_client)
     # require PostgreSQL or networking and must be installed explicitly.
     CORE_SKILLSETS = %w[
-      plugin_projector agent llm_client autoexec autonomos
+      plugin_projector llm_client autoexec autonomos
       skillset_creator knowledge_creator introspection dream
       document_authoring synoptis
     ].freeze
@@ -223,7 +228,8 @@ module KairosMcp
           # Install new SkillSet from template
           result = install(template_path)
           results << { name: info[:name], from: nil, to: info[:available_version],
-                       action: 'installed', files_updated: 0 }
+                       action: 'installed', files_updated: 0,
+                       warnings: user_level_conflicts(Skillset.new(File.join(@skillsets_dir, info[:name]))) }.reject { |_, v| v == [] }
         else
           # Upgrade existing: copy changed files
           dest = File.join(@skillsets_dir, info[:name])
@@ -233,11 +239,13 @@ module KairosMcp
             FileUtils.mkdir_p(File.dirname(dst))
             FileUtils.cp(src, dst) if File.exist?(src)
           end
+          archived = archive_removed_files(info[:name], dest, Array(info[:removed_files]))
 
           installed = Skillset.new(dest)
           record_skillset_event(installed, 'upgrade')
           results << { name: info[:name], from: info[:installed_version], to: info[:available_version],
-                       action: 'upgraded', files_updated: info[:changed_files].size }
+                       action: 'upgraded', files_updated: info[:changed_files].size, files_archived: archived.size,
+                       warnings: user_level_conflicts(installed) }.reject { |_, v| v == [] }
         end
       end
 
@@ -445,8 +453,45 @@ module KairosMcp
       all_skillsets.find { |ss| ss.name == name.to_s }
     end
 
+    # The user-level leftovers a SkillSet declares that are present now, as
+    # warnings with the command that moves them aside (a timestamped backup,
+    # so a second move never overwrites the first).
+    def user_level_conflicts(skillset)
+      skillset.user_level_conflicts.filter_map do |c|
+        path = File.expand_path(c['path'])
+        next unless File.exist?(path)
+        next if c['pattern'] && !File.read(path, encoding: 'UTF-8').match?(Regexp.new(c['pattern']))
+
+        backup = File.expand_path("~/.claude/#{skillset.name}_previous_version_backup/#{Time.now.strftime('%Y%m%d_%H%M%S')}")
+        "#{path}: #{c['note'] || 'left by an earlier version'} (move it aside: mkdir -p #{backup} && mv #{path} #{backup}/)"
+      end
+    rescue StandardError
+      []
+    end
+
     private
 
+    # Move files a release dropped out of the installed copy, into
+    # storage/skillset_removed/<name>/<time>/ (kept, not deleted, so the
+    # operator can read back what the upgrade took out). Paths are checked to
+    # stay inside the installed SkillSet.
+    def archive_removed_files(name, dest, rels)
+      return [] if rels.empty?
+
+      root = File.realpath(dest)
+      stamp = Time.now.utc.strftime('%Y%m%dT%H%M%SZ')
+      archive = File.join(KairosMcp.storage_dir, 'skillset_removed', name.to_s, stamp)
+      rels.filter_map do |rel|
+        src = File.join(root, rel)
+        next unless File.exist?(src) && File.expand_path(src).start_with?("#{root}/")
+
+        to = File.join(archive, rel)
+        FileUtils.mkdir_p(File.dirname(to))
+        FileUtils.mv(src, to)
+        rel
+      end
+    end
+
     # Compare files between template and installed SkillSet
     def diff_files(template_path, installed_path)
       changed = []

data/lib/kairos_mcp/tools/capability_status.rb

@@ -152,7 +152,9 @@ module KairosMcp
 
         externals.each do |ext|
           present = Capability.cli_in_path?(ext)
-          entry = { available: present }
+          # The binary searched for, so a reader can tell which file was
+          # missing (claude_cli is the `claude` binary, and so on).
+          entry = { available: present, binary: Capability.binary_for(ext) }
           entry[:reason] = 'not found in PATH' unless present
           if present && probe_versions
             ver = Capability.cli_version(ext)

data/lib/kairos_mcp/tools/system_upgrade.rb

@@ -361,6 +361,7 @@ module KairosMcp
                 actions[:skillsets_upgraded] = (actions[:skillsets_upgraded] || []) << r[:name]
                 output += "  [UPGRADED] #{r[:name]} v#{r[:from]} → v#{r[:to]} (#{r[:files_updated]} files)\n"
               end
+              Array(r[:warnings]).each { |w| output += "    [WARNING] #{w}\n" }
             end
           end
         rescue => e
@@ -487,6 +488,7 @@ module KairosMcp
           else
             output += "  [UPGRADED] #{r[:name]} v#{r[:from]} → v#{r[:to]} (#{r[:files_updated]} files)\n"
           end
+          Array(r[:warnings]).each { |w| output += "    [WARNING] #{w}\n" }
         end
         output += "\nNo L0 template changes needed.\n"
         output += "Restart the MCP server to load new SkillSet tools.\n"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.94.0"
+  VERSION = "3.96.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/design_to_implementation_workflow/design_to_implementation_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: design_to_implementation_workflow
 description: "Full-lifecycle workflow for complex features: design review, self-review, implementation review, and final merge gate. Derived from Service Grant + Attestation Nudge experiments."
-version: "1.2"
+version: "1.3"
 tags:
   - workflow
   - implementation
@@ -157,6 +157,9 @@ Claude Persona Assembly (4 personas):
 - NOT for intermediate rounds (diminishing returns)
 
 **Merge criteria**: new (a)+(b) P0 = 0, with the freeze declared by the operator.
+Inside an agent run a review closes provisionally (`multi_llm_review_workflow`
+§ Provisional delegation under a mandate) and only the operator freezes one; the
+operator's word at merge settles the merge and confirms only the closures it names.
 A Codex APPROVE is the strongest *reference* signal (see
 `multi_llm_reviewer_evaluation`), and it is not a gate: Codex went 24 of 24
 reviews without reaching APPROVE on one design loop, so a merge waiting on it