kairos-chain 3.56.0 → 3.57.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 185d6af51fd316124bc72eabbfc3f6b280fee6a2beeda91ed2b690781bb6c26f
-  data.tar.gz: 83951da8550d67d22b67a62153c71a923c4d016a59e94c86d07062a5aac4fedb
+  metadata.gz: 8439763123a17e68d238ebc46369dcc36e6379172752809dd6736fa18f3c5ec4
+  data.tar.gz: 76fe818c7261e464411f54bee9a114bc7eb0ecc025042ef264f15bd591f2ca36
 SHA512:
-  metadata.gz: 14288ed7e74a7a276f68c94292935804830f1d302272ac5ff2e1ba11865ac00cf99acb3d8d93382a2fa0c878e3c0df1ddb4f2b9dfbc742f387386d32c0a6e1da
-  data.tar.gz: cdc967af9cd5962d175787d22cdfd63c881be35aefd6d2dcfba0afd14714482674465cf11df138f646214c37b2800163b982546da5381367c8826d9a74b3b7f4
+  metadata.gz: 2385335588b313d3910519459a79a1325f921fa1f6d1a2b215f0b75144c383b14b90a95f1d9edf97999df6cdc58d95155e653f13007217299f35df097891f38a
+  data.tar.gz: 160f831a399a60089d217e2fe198dfe60692797649b55c2d8b4fbd0d0649512c6f601a75dfc41de713b9bf946be83485f01c289252018c87d33dbbb06221c1ec

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.56.0"
+  VERSION = "3.57.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/test/test_agent_complexity_review.rb

@@ -689,6 +689,65 @@ assert "missing feedback_text_schema_version → reject" do
   msg && msg.include?('feedback_text_schema_version missing')
 end
 
+# v0.7 record schema: the consumer reads reference_verdict from v2 records
+# and still reads verdict from v1 records. Held here because reverting the
+# read (parsed['verdict'] only) would leave every v2 review verdict-less
+# with the rest of the suite green.
+section "v0.7 reference_verdict consumption"
+
+def drive_review_with(step, record)
+  fake_session = Object.new
+  def fake_session.cycle_number = 1
+  def fake_session.session_id = 'testsess'
+  ctx = Object.new
+  def ctx.derive(**_k) = nil
+  fake_session.define_singleton_method(:invocation_context) { ctx }
+  step.define_singleton_method(:invoke_tool) do |*_a, **_k|
+    [{ text: JSON.generate(record) }]
+  end
+  step.send(:run_multi_llm_review, fake_session,
+            { 'summary' => 's', 'task_json' => { 'steps' => [] } },
+            { level: 'high', signals: [] }, {})
+end
+
+assert "v2 record (reference_verdict, no top-level verdict) → verdict read" do
+  out = drive_review_with(step.dup, {
+    'status' => 'ok', 'verdict_schema_version' => 2,
+    'feedback_text_schema_version' => 1,
+    'reference_verdict' => 'REVISE', 'convergence' => {},
+    'aggregated_findings' => [], 'llm_calls' => 3, 'reviews' => [],
+    'feedback_text' => 'x'
+  })
+  out[:verdict] == 'REVISE'
+end
+
+assert "v1 record (verdict) → still read" do
+  out = drive_review_with(step.dup, {
+    'status' => 'ok', 'verdict_schema_version' => 1,
+    'feedback_text_schema_version' => 1,
+    'verdict' => 'APPROVE', 'convergence' => {},
+    'aggregated_findings' => [], 'llm_calls' => 3, 'reviews' => [],
+    'feedback_text' => nil
+  })
+  out[:verdict] == 'APPROVE'
+end
+
+# v0.7 record schema (2026-08-01): the boundary is max and max+1, not max
+# and 99 — a probe of 99 cannot tell SUPPORTED=1 from SUPPORTED=2, which is
+# exactly the revert these tests exist to catch.
+assert "v0.7 schema (v=2) → accepted at the boundary" do
+  step.send(:schema_version_check, {
+    'verdict_schema_version' => 2, 'feedback_text_schema_version' => 1
+  }).nil?
+end
+
+assert "v=3 (max+1) → reject (fail-closed at the boundary)" do
+  msg = step.send(:schema_version_check, {
+    'verdict_schema_version' => 3, 'feedback_text_schema_version' => 1
+  })
+  msg && msg.include?('newer than supported')
+end
+
 assert "newer verdict_schema_version → reject (fail-closed)" do
   msg = step.send(:schema_version_check, {
     'verdict_schema_version' => 99, 'feedback_text_schema_version' => 1
@@ -696,6 +755,13 @@ assert "newer verdict_schema_version → reject (fail-closed)" do
   msg && msg.include?('newer than supported')
 end
 
+assert "feedback_text v=2 (max+1) → reject (boundary, not v99)" do
+  msg = step.send(:schema_version_check, {
+    'verdict_schema_version' => 2, 'feedback_text_schema_version' => 2
+  })
+  msg && msg.include?('newer than supported')
+end
+
 assert "newer feedback_text_schema_version → reject" do
   msg = step.send(:schema_version_check, {
     'verdict_schema_version' => 1, 'feedback_text_schema_version' => 99

data/templates/skillsets/agent/tools/agent_step.rb

@@ -1696,7 +1696,12 @@ module KairosMcp
                 aggregated_findings: [], feedback_text: nil }
             else
               {
-                verdict: parsed['verdict'],
+                # v0.7 record schema (verdict_schema_version 2) renamed the
+                # top-level conclusion column to reference_verdict (INV-R2: a
+                # recorded reference value, not the run's conclusion). v1
+                # records still carry 'verdict'; read whichever the record
+                # speaks.
+                verdict: parsed['reference_verdict'] || parsed['verdict'],
                 convergence: parsed['convergence'],
                 aggregated_findings: (parsed['aggregated_findings'] || []).map { |f|
                   f.transform_keys(&:to_sym)
@@ -1718,7 +1723,9 @@ module KairosMcp
 
           # Phase 12 §3.10 fail-closed schema versioning.
           # Returns nil if response schema is acceptable, else a string reason.
-          SUPPORTED_VERDICT_SCHEMA_VERSION = 1
+          # 2 = v0.7 record schema (2026-08-01): top-level verdict became
+          # reference_verdict; the read above handles both generations.
+          SUPPORTED_VERDICT_SCHEMA_VERSION = 2
           SUPPORTED_FEEDBACK_TEXT_SCHEMA_VERSION = 1
 
           def schema_version_check(parsed)

data/templates/skillsets/llm_client/lib/llm_client/claude_code_adapter.rb

@@ -186,12 +186,15 @@ module KairosMcp
           model_usage = data['modelUsage'] || {}
 
           # The answering model is the entry that produced the output tokens,
-          # not the first hash key. `keys.first` read whichever entry the CLI
-          # inserted first, so if the envelope ever carries a second model
-          # beside the main call, the reply could be attributed to the wrong
-          # one. Every envelope probed so far carries exactly one key, so the
-          # two readings have not yet disagreed — this is defence, not a
-          # reproduced defect.
+          # not the first hash key. The CLI places a small internal call
+          # (claude-haiku, ~18 output tokens) beside the main call unless
+          # CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC suppresses it, so under
+          # the worker's stripped environment the envelope carries two keys,
+          # and `keys.first` attributed the reply to whichever entry the CLI
+          # inserted first. Reproduced 2/2 with byte-identical prompts
+          # (2026-07-31); this misread was the root cause of every model
+          # divergence this transport had recorded. See L2
+          # mlr_v07_design_inputs_and_haiku_root_cause_20260731.
           observed = model_usage.max_by { |_m, u| (u || {})['outputTokens'].to_i }&.first
 
           {
@@ -202,12 +205,14 @@ module KairosMcp
             # What the CLI reports as having answered, when it reports it.
             # Kept separate from 'model' (which echoes the request) so callers
             # can tell a request from an observation and notice when the two
-            # disagree — the CLI may serve a different model than the one
-            # asked for. That is not hypothetical: four times in the
-            # multi_llm_review loop (R6/R8/R10/R13, 2026-07) a slot requesting
-            # claude-opus-4-6 was answered by claude-haiku-4-5, and the R13
-            # reply's content confirmed the observation (it cited identifiers
-            # that exist nowhere in the reviewed code).
+            # disagree. The four divergences recorded before the fix above
+            # (R6/R8/R10/R13, 2026-07) were all keys.first misreads — the main
+            # call was claude-opus-4-6 every time, and the R13 reply's odd
+            # content (identifiers that exist nowhere in the reviewed code) is
+            # explained by the sandboxed slot reading no repository, not by a
+            # different model answering. A divergence observed after the
+            # 2026-07-31 fix has no known benign explanation and is worth
+            # investigating.
             'model_observed' => observed,
             # Diagnostic envelope, previously discarded. All four divergence
             # incidents above were undiagnosable from the record because the

data/templates/skillsets/llm_client/test/test_claude_code_adapter_parse.rb

@@ -3,15 +3,16 @@
 # What parse_response reads from the CLI envelope, pinned after the
 # claude_cli_opus4.6 divergence investigation (2026-07-31).
 #
-# Four times in the multi_llm_review loop (R6/R8/R10/R13) a slot requesting
-# claude-opus-4-6 was answered by claude-haiku-4-5. The record could not say
-# why, because this method discarded every diagnostic field the envelope
-# carries (modelUsage breakdown, api_error_status, fast_mode_state,
-# terminal_reason). The R13 reply's own content settled the observation side
-# — it cited identifiers that exist nowhere in the reviewed code — but the
-# cause remains open precisely because nothing was kept. These tests hold the
-# two fixes: the answering model is chosen by output tokens rather than hash
-# order, and the diagnostic fields survive into the response.
+# Four times in the multi_llm_review loop (R6/R8/R10/R13) the record showed a
+# slot requesting claude-opus-4-6 answered by claude-haiku-4-5. The 2026-07-31
+# investigation reproduced the cause 2/2: the CLI places a small internal call
+# beside the main one, the envelope carries two keys, and the old `keys.first`
+# read attributed the reply to the internal call — the main call was
+# claude-opus-4-6 every time. The record could not say so, because this method
+# also discarded every diagnostic field the envelope carries (modelUsage
+# breakdown, api_error_status, fast_mode_state, terminal_reason). These tests
+# hold the two fixes: the answering model is chosen by output tokens rather
+# than hash order, and the diagnostic fields survive into the response.
 
 require 'minitest/autorun'
 require_relative '../lib/llm_client/adapter'
@@ -46,9 +47,10 @@ module KairosMcp
           assert_equal 'claude-opus-4-6', out['model_observed']
         end
 
-        # The regression the old `keys.first` invited: if the envelope ever
-        # carries a second model beside the main call, insertion order must
-        # not decide which one "answered". The output tokens do.
+        # The regression the old `keys.first` invited: when the envelope
+        # carries a second model beside the main call (reproduced 2/2 under
+        # the worker's environment), insertion order must not decide which
+        # one "answered". The output tokens do.
         def test_the_answering_model_is_the_one_that_wrote_the_output
           out = parse(envelope(model_usage: {
             'claude-haiku-4-5-20251001' => { 'outputTokens' => 12 },

data/templates/skillsets/multi_llm_review/lib/multi_llm_review/build_review_bundle.rb

@@ -23,7 +23,14 @@ module KairosMcp
         # the verdict shape itself (separate from feedback_text_schema_version,
         # which lives in FeedbackFormatter). Bumped independently when verdict
         # JSON contract changes (e.g., new field, semantic redefinition).
-        VERDICT_SCHEMA_VERSION = 1
+        #
+        # 2 = v0.7 record schema (design frozen 2026-08-01): the top-level
+        # conclusion column is gone — `verdict` became `reference_verdict`
+        # (INV-R2), the composition rows carry seat marks, refusals and
+        # transport diagnostics travel with the record. Readers tell old
+        # records from new by this number; old records are not rewritten
+        # (design §4, no retroactivity).
+        VERDICT_SCHEMA_VERSION = 2
 
         # @param artifact_content [String] sanitized at boundary; raw passthrough is caller responsibility
         # @param artifact_name [String]
@@ -161,11 +168,32 @@ module KairosMcp
           }
         end
 
+        # INV-R7 by_reference delivery: the same canonical framing with a
+        # reference manifest where the artifact body would be. The system
+        # prompt is identical to the inline one — only the user message
+        # differs, and only in the artifact block. sha256 is computed by the
+        # caller over the raw submitted content, so a seat that reads the file
+        # can check it is reviewing what was submitted.
+        def self.build_reference_prompts(artifact_path:, artifact_sha256:,
+                                         artifact_name:, review_type:,
+                                         review_context: 'independent',
+                                         review_round: 1, prior_findings: nil)
+          system_prompt = PromptBuilder.build_system_prompt(review_type, review_context: review_context)
+          messages = PromptBuilder.build_messages(
+            artifact_name: artifact_name,
+            review_type: review_type,
+            review_round: review_round,
+            prior_findings: prior_findings,
+            artifact_reference: { path: artifact_path, sha256: artifact_sha256 }
+          )
+          { system_prompt: system_prompt, messages: messages }
+        end
+
         def self.aggregation_instructions(review_type, review_round)
           <<~INST.strip
             After collecting all reviewer responses, aggregate as follows:
             1. Parse each response for verdict {APPROVE, REVISE, REJECT}.
-            2. Apply convergence rule (e.g., 3/N APPROVE → APPROVE; otherwise REVISE).
+            2. Compute the reference tally (e.g., 3/N APPROVE → reference APPROVE; any REJECT → REVISE; below quorum → INSUFFICIENT). It is a recorded reference value, not the run's conclusion.
             3. Merge findings, sorted by severity (P0 first), de-dup by issue text.
             4. For round #{review_round} #{review_type} reviews, prior findings should be verified as CLOSED/NEEDS_MORE_WORK/REOPENED.
           INST

data/templates/skillsets/multi_llm_review/lib/multi_llm_review/consensus.rb

@@ -59,11 +59,14 @@ module KairosMcp
         # reason of its own. Distinct from `transport`, which asserts a call
         # was attempted and failed.
         SKIP_REASON_NOT_DISPATCHED = 'not_dispatched'
-        # A submission that stated SKIP for itself and gave no reason.
-        SKIP_REASON_DECLINED = 'declined'
 
         # Verdicts a submission may state for itself, bypassing text parsing.
-        PARSED_VERDICTS = %w[APPROVE REVISE REJECT SKIP].freeze
+        # v0.7 INV-R1: SKIP is not in the vocabulary — no word is special. A
+        # row leaves the denominator through what happened to it (:status,
+        # substance, no verdict), never by declaring a verdict-shaped word.
+        # The declared-SKIP branch this list used to admit was unreachable
+        # through shipping writers (measured in round 12) and is gone.
+        PARSED_VERDICTS = %w[APPROVE REVISE REJECT].freeze
         # Phase 12 §3.7.2 / PR3 hardening: hard cap on aggregated_findings.
         # FeedbackFormatter also caps the *displayed* slice at 50, but the API
         # contract returns aggregated_findings as a separate array which would
@@ -125,7 +128,7 @@ module KairosMcp
         # @param reviews [Array<Hash>] from Dispatcher, each with :status, :raw_text, :role_label, etc.
         # @param rule_str [String] e.g., "3/4 APPROVE"
         # @param min_quorum [Integer] minimum successful reviews needed
-        # @return [Hash] with :verdict, :convergence, :reviews, :aggregated_findings
+        # @return [Hash] with :reference_verdict, :convergence, :reviews, :aggregated_findings
         def self.aggregate(reviews, rule_str = '3/4 APPROVE', min_quorum: 2,
                            excluded_slots: [], escalation: nil)
           # Parsing a verdict and deciding whether the reply belongs in the
@@ -141,6 +144,10 @@ module KairosMcp
 
           threshold = parse_threshold(rule_str, successful.size)
 
+          # v0.7 INV-R2: this value is a recorded reference, not the run's
+          # conclusion. The run is closed by the operator's declaration, which
+          # lives outside this record (L2 / handoff); the record presents the
+          # observation. The computation is unchanged — only its seat moved.
           overall = if successful.size < min_quorum
                       'INSUFFICIENT'
                     elsif reject_n > 0
@@ -151,9 +158,16 @@ module KairosMcp
                       'REVISE'
                     end
 
+          # INV-R5: a seat whose transport reported a different model than the
+          # slot asked for stays in the denominator — removing it would tangle
+          # the detection record with a vanished vote — and the tally without
+          # those seats is carried beside the main one. Both are reference
+          # values.
+          non_divergent = successful.reject { |p| p[:model_divergence] }
+
           findings = aggregate_findings(parsed)
           {
-            verdict: overall,
+            reference_verdict: overall,
             convergence: {
               approve_count: approve_n,
               reject_count: reject_n,
@@ -171,6 +185,12 @@ module KairosMcp
               threshold: threshold,
               min_quorum: min_quorum,
               rule: rule_str,
+              excluding_divergent: {
+                approve_count: non_divergent.count { |p| p[:verdict] == 'APPROVE' },
+                reject_count: non_divergent.count { |p| p[:verdict] == 'REJECT' },
+                successful_count: non_divergent.size,
+                threshold: parse_threshold(rule_str, non_divergent.size)
+              },
               # INV-E4: how this denominator came to be, readable from the
               # record alone. Without it a later reader cannot tell a 3/4 that
               # lost a slot to transport failure from one that lost it to an
@@ -222,25 +242,13 @@ module KairosMcp
             # spelling. Without the merge, a declared `approve` passes this
             # gate unaltered and then misses every `== 'APPROVE'` count
             # downstream — a row in the denominator that cannot contribute to
-            # consensus, the shape INV-E2 exists to remove — and a declared
-            # `skip` is worse: not 'SKIP', so it stays in the denominator its
-            # author asked to leave. Round 12 measured the approve shape on a
-            # hand-built row (successful_count 1, approve_count 0) and found
-            # it unreachable through shipping writers, since
-            # PersonaAssembly.assemble is the only writer of this field and
-            # always emits canonical case; the round-13 review re-verified
-            # that bound. The normalization is defensive: it keeps the gate
-            # and the row from drifting apart if a second writer ever
-            # appears.
-            #
-            # A submission may declare SKIP for itself. Why it did is its own
-            # business and this system does not know it, so the row says that
-            # rather than defaulting — as it used to — to `transport`, which
-            # asserts a call was attempted and failed.
-            return review.merge(verdict: declared) if declared != 'SKIP'
-
-            return review.merge(verdict: declared,
-                                skip_reason: review[:skip_reason] || SKIP_REASON_DECLINED)
+            # consensus, the shape INV-E2 exists to remove. Round 12 measured
+            # that shape on a hand-built row and found it unreachable through
+            # shipping writers, since PersonaAssembly.assemble is the only
+            # writer of this field and always emits canonical case. The
+            # normalization is defensive: it keeps the gate and the row from
+            # drifting apart if a second writer ever appears.
+            return review.merge(verdict: declared)
           end
 
           text = review[:raw_text].to_s
@@ -250,8 +258,17 @@ module KairosMcp
           # containing one. A header further down is not read at all: it may be
           # the reviewer's, or it may be a sample it is discussing, and nothing
           # in the text says which.
-          if (m = text.match(VERDICT_HEADER_RE)) && (stated = VerdictVocabulary.stated(m[1]))
-            return review.merge(verdict: stated)
+          #
+          # v0.7 INV-R1: when the header offered a value the vocabulary
+          # refuses, the written word itself goes into the record (stated_text)
+          # beside the closed no_verdict token. The reason column stays a
+          # token; the word form is its own column.
+          offered = nil
+          if (m = text.match(VERDICT_HEADER_RE))
+            offered = m[1]
+            if (stated = VerdictVocabulary.stated(offered))
+              return review.merge(verdict: stated)
+            end
           end
 
           # Same, for a reply that is a JSON document rather than markdown.
@@ -259,9 +276,11 @@ module KairosMcp
           # part of the prose, and only a reply that *is* the document states
           # a verdict through it.
           structured = parse_structured(text)
-          if structured && structured['overall_verdict'] &&
-             (stated = VerdictVocabulary.stated(structured['overall_verdict']))
-            return review.merge(verdict: stated)
+          if structured && structured['overall_verdict']
+            if (stated = VerdictVocabulary.stated(structured['overall_verdict']))
+              return review.merge(verdict: stated)
+            end
+            offered ||= structured['overall_verdict'].to_s
           end
 
           # There is no fourth path. A reply that did not state its verdict in
@@ -293,7 +312,9 @@ module KairosMcp
           # was worse than it looked: an opening sentence with no judgement in
           # it — the exact shape that retired one roster occupant — blocked
           # convergence on a verdict its author never gave.
-          review.merge(verdict: 'SKIP', skip_reason: SKIP_REASON_NO_VERDICT)
+          skip = { verdict: 'SKIP', skip_reason: SKIP_REASON_NO_VERDICT }
+          skip[:stated_text] = offered.to_s[0, 120] unless offered.to_s.strip.empty?
+          review.merge(skip)
         end
 
         # Why a slot that never produced a reply left the denominator. Two
@@ -326,16 +347,38 @@ module KairosMcp
         end
 
 
+        # A duplicated key makes a JSON document say two things under one name,
+        # and JSON.parse keeps whichever came last — silently. A reply whose
+        # `overall_verdict` appears twice would then state whichever verdict
+        # was written second, which is not a statement anyone can be held to.
+        # Raised at insertion so the whole document is refused, at any depth:
+        # fail-closed, like every other reading rule here (R12 P1).
+        class DuplicateKeyError < StandardError; end
+
+        class DuplicateRefusingHash < Hash
+          def []=(key, value)
+            raise DuplicateKeyError, "duplicate key: #{key}" if key?(key)
+
+            super
+          end
+        end
+
         # A reply that is itself a JSON document, or nil when it is not.
         # Deliberately strict: no scanning for an object embedded in prose,
-        # because prose quoting an object is prose.
+        # because prose quoting an object is prose — and no document with a
+        # repeated key, because such a document does not state one thing.
         def self.parse_structured(text)
           stripped = text.to_s.strip
           return nil unless stripped.start_with?('{')
 
-          parsed = JSON.parse(stripped)
-          parsed.is_a?(Hash) ? parsed : nil
-        rescue JSON::ParserError
+          parsed = JSON.parse(stripped, object_class: DuplicateRefusingHash)
+          # The TOP LEVEL is converted to a plain Hash; nested values keep the
+          # refusing subclass. That is enough for every current reader — only
+          # overall_verdict is read, and structural_substance reads without
+          # writing — but writing into a nested value would raise. A consumer
+          # that needs to mutate nested values must deep-convert first.
+          parsed.is_a?(Hash) ? {}.merge(parsed) : nil
+        rescue JSON::ParserError, DuplicateKeyError
           nil
         end
 
@@ -440,6 +483,9 @@ module KairosMcp
 
         # INV-E4. Every observer that could have counted appears here exactly
         # once, whether it counted or not, with the reason it did not.
+        # v0.7 INV-R3/R4: the unit of this list is the seat, and each row says
+        # so (`seat: true` — one boolean column, so that if row-level records
+        # are ever interleaved here, the seat column stays reconstructible).
         def self.denominator_composition(parsed, excluded_slots, escalation)
           counted = parsed.map do |p|
             {
@@ -457,12 +503,20 @@ module KairosMcp
               # separate them: an executed slot on a silent transport carries
               # exactly that value too.
               synthetic: p[:synthetic] || false,
+              seat: true,
               counted: p[:verdict] != 'SKIP',
               # Every route to SKIP now names its own reason, so there is
               # nothing left to default to. A row that somehow arrives without
               # one omits the field — silence, which a reader can see, rather
               # than `transport`, which a reader cannot tell from a fact.
               reason: (p[:skip_reason] if p[:verdict] == 'SKIP'),
+              # INV-R1: the word a final submission offered as its verdict and
+              # the vocabulary refused. The reason stays a closed token; the
+              # written form is its own column.
+              stated_text: p[:stated_text],
+              # INV-R7: how the artifact reached this seat, when distribution
+              # was an act the system performed for it.
+              artifact_delivery: p[:artifact_delivery],
               model_divergence: p[:model_divergence]
             }.compact
           end
@@ -471,8 +525,13 @@ module KairosMcp
             {
               role_label: slot[:role_label] || slot['role_label'],
               model: slot[:model] || slot['model'],
+              seat: true,
               counted: false,
               reason: slot[:reason] || slot['reason'],
+              # INV-R7: an undelivered seat's delivery form is a per-seat
+              # attribute of the record, not something to dig out of the
+              # reason string.
+              artifact_delivery: slot[:artifact_delivery] || slot['artifact_delivery'],
               replaced_by: slot[:replaced_by] || slot['replaced_by']
             }.compact
           end

data/templates/skillsets/multi_llm_review/lib/multi_llm_review/dispatcher.rb

@@ -23,7 +23,13 @@ module KairosMcp
         # Dispatch review prompts to all configured reviewers in parallel.
         #
         # @param reviewers [Array<Hash>] each with :provider, :model, :role_label
-        # @param messages [Array<Hash>] prompt messages for llm_call
+        #   and optionally :artifact_delivery ('inline' | 'by_reference')
+        # @param messages [Array<Hash>, Hash] prompt messages for llm_call.
+        #   An Array is one set of messages for every reviewer (every seat
+        #   inline — the pre-v0.7 shape, still valid). A Hash maps a delivery
+        #   form to its messages ({'inline' => [...], 'by_reference' => [...]})
+        #   and each reviewer receives the set its :artifact_delivery names
+        #   (INV-R7); a form absent from the map falls back to 'inline'.
         # @param system_prompt [String] system prompt for llm_call
         # @param context [InvocationContext] for invoke_tool
         # @param review_context [String] 'independent' or 'project_aware'
@@ -149,8 +155,16 @@ module KairosMcp
           provider = reviewer[:provider] || reviewer['provider']
           model = reviewer[:model] || reviewer['model']
 
+          delivery = reviewer[:artifact_delivery] || reviewer['artifact_delivery']
+          per_seat_messages =
+            if messages.is_a?(Hash)
+              messages[delivery || 'inline'] || messages['inline']
+            else
+              messages
+            end
+
           args = {
-            'messages' => messages,
+            'messages' => per_seat_messages,
             'system' => system_prompt,
             'provider_override' => provider
           }
@@ -192,6 +206,12 @@ module KairosMcp
             model_observed: observed,
             model_source: observed ? 'observed' : 'declared',
             model_divergence: observed && declared && observed != declared,
+            # INV-R6: the transport's own account of the call, as state tags.
+            # The adapter has returned these since the 2026-07-31 divergence
+            # diagnosis; this is where they used to be dropped.
+            api_error_status: llm_response.dig('response', 'api_error_status'),
+            fast_mode_state: llm_response.dig('response', 'fast_mode_state'),
+            artifact_delivery: delivery_of(reviewer),
             raw_text: llm_response.dig('response', 'content') || '',
             elapsed_seconds: elapsed.round(1),
             error: nil,
@@ -214,6 +234,7 @@ module KairosMcp
             model: reviewer[:model] || reviewer['model'],
             model_declared: reviewer[:model] || reviewer['model'],
             model_source: 'declared',
+            artifact_delivery: delivery_of(reviewer),
             elapsed_seconds: elapsed.round(1),
             error: err,
             status: :error
@@ -227,12 +248,20 @@ module KairosMcp
             model: reviewer[:model] || reviewer['model'],
             model_declared: reviewer[:model] || reviewer['model'],
             model_source: 'declared',
+            artifact_delivery: delivery_of(reviewer),
             elapsed_seconds: 0,
             error: { 'type' => 'skip', 'message' => reason },
             status: :skip
           }
         end
 
+        # INV-R7: what a dispatched seat's record says about its delivery. A
+        # seat with no declaration was delivered inline — that has been the
+        # only form there was, and it is the default the roster inherits.
+        def delivery_of(reviewer)
+          reviewer[:artifact_delivery] || reviewer['artifact_delivery'] || 'inline'
+        end
+
         def kill_dispatch_pids(dispatch_id)
           if defined?(KairosMcp::SkillSets::LlmClient::SafeSubprocess)
             KairosMcp::SkillSets::LlmClient::SafeSubprocess.kill_pids_for_dispatch(dispatch_id)