@akagilnc/pi-workflow-roles 0.1.4403 → 0.1.4419

package/dist/public-cli/option-definitions.js

@@ -430,18 +430,32 @@ const REVIEWER_OPTIONS = [
             zh: "必填；钉住审查目标的 fixed-point revision。",
         },
     },
+    {
+        id: "lens",
+        owner: "reviewer",
+        canonical: "--lens",
+        aliases: [],
+        valueMetavar: "completeness|correctness",
+        required: true,
+        repeatable: false,
+        form: "option",
+        description: {
+            en: "Required single review lens: completeness or correctness (no default).",
+            zh: "必填单 lens：completeness 或 correctness（无默认值）。",
+        },
+    },
     {
         id: "authority-ref",
         owner: "reviewer",
         canonical: "--authority-ref",
         aliases: [],
         valueMetavar: "ref",
-        required: false,
+        required: true,
         repeatable: true,
         form: "option",
         description: {
-            en: "Durable authority reference/URL (repeatable; refs only, not inline prose).",
-            zh: "持久 authority 引用/URL（可重复；仅 ref，非内联散文）。",
+            en: "Required durable authority reference/URL (repeatable; refs only, not inline prose).",
+            zh: "必填持久 authority 引用/URL（可重复；仅 ref，非内联散文）。",
         },
     },
 ];
@@ -983,10 +997,13 @@ const ROLE_COMMAND_HELP = {
     },
     reviewer: {
         command: "reviewer",
-        summary: "Fixed-target two-axis review (Standards + Spec).",
-        usage: ["ak-role reviewer --base <revision> [options] <instruction>"],
+        summary: "Fixed-target single-lens review (completeness or correctness).",
+        usage: [
+            "ak-role reviewer --base <revision> --lens completeness|correctness --authority-ref <ref> [options] <instruction>",
+        ],
         examples: [
-            'ak-role reviewer --base main "Review the branch against the governing issue and repository authority."',
+            'ak-role reviewer --base main --lens completeness --authority-ref docs/adr/0001.md "Review the branch."',
+            'ak-role reviewer --base main --lens correctness --authority-ref CLAUDE.md --authority-ref docs/adr/0001.md',
         ],
     },
     collector: {

package/dist/public-cli/post-admission.js

@@ -38,7 +38,6 @@ import { projectHostTransitionPriorNative } from "../host-transition-prior-nativ
 import { missingCredentialPreDispatchFailure, postRunMissingCredentialFailure, } from "./public-run-credentials.js";
 import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
-import { clearReviewerDispatchRejection } from "./reviewer-dispatch-rejection.js";
 import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, } from "./settlement.js";
 import {} from "./terminal.js";
 import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
@@ -345,9 +344,6 @@ export async function dispatchPostAdmissionTurn(input) {
             };
         }
         await clearTypedProviderHttpObservation(admitted.runDirectory);
-        // Per-attempt hygiene: stale Reviewer rejection pages must not ride into
-        // auto-resume. ENOENT-safe for every seat.
-        await clearReviewerDispatchRejection(admitted.runDirectory);
         // The authoritative host write (markRunRunning) is delayed to just before
         // executeTurn — not merely past beforeDispatch (#840 r9 判词 class 2). Any
         // pre-turn retry (beforeDispatch, dossier projection, continuation

package/dist/public-cli/run-lifecycle.js

@@ -16,7 +16,7 @@ export { clearTypedProviderHttpObservation, recordTypedProviderHttpStatus, readL
 import { parseCollectorRepository } from "../collector-config.js";
 import { interpretDurableCourtTicketNumbers, sameCourtTicketNumbers, } from "../diarist-contracts.js";
 import { appendEngineSessionMaterial, engineSessionMaterialFromOptions, pickEngineAxis, } from "../package-resources/engine-material.js";
-import { recordEffectiveInvocationModel, requireAuthorityRef, } from "./invocation.js";
+import { recordEffectiveInvocationModel, requireAuthorityRef, isReviewerLens, } from "./invocation.js";
 /** Providers eligible for v1 typed-429 resume (Codex / xAI only).
  * @deprecated v1 429-only gate removed by #416 (owner 2026-08-22: "根本不要有限制"). Kept for compatibility; do not use for new branching.
  */
@@ -970,6 +970,7 @@ async function loadResumableRunRecord(home, runId, authority) {
     let prerequisitesPath;
     let prerequisites;
     let baseRevision;
+    let lens;
     let authorityRefs;
     let mergerInputPath;
     let derived;
@@ -1023,6 +1024,9 @@ async function loadResumableRunRecord(home, runId, authority) {
                 record.baseRevision.trim() !== "") {
                 baseRevision = record.baseRevision;
             }
+            if (isReviewerLens(record.lens)) {
+                lens = record.lens;
+            }
             // Collector — admitted repository/PR identity (#633 resume).
             if (typeof record.prNumber === "number" && Number.isSafeInteger(record.prNumber) && record.prNumber >= 1) {
                 prNumber = record.prNumber;
@@ -1189,6 +1193,7 @@ async function loadResumableRunRecord(home, runId, authority) {
             ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
             ...(prerequisites === undefined ? {} : { prerequisites }),
             ...(baseRevision === undefined ? {} : { baseRevision }),
+            ...(lens === undefined ? {} : { lens }),
             ...(authorityRefs === undefined ? {} : { authorityRefs }),
             ...(mergerInputPath === undefined ? {} : { mergerInputPath }),
             ...(derived === undefined ? {} : { derived }),
@@ -1332,15 +1337,31 @@ export async function loadResumableReviewerRun(home, runId, authority) {
     if (loaded.run.role !== "reviewer") {
         throw new CliUsageError(`role run ${runId} belongs to ${loaded.run.role}, not reviewer`);
     }
-    const baseRevision = loaded.admittedFields.baseRevision;
-    if (baseRevision === undefined || baseRevision.trim() === "") {
+    // Durable restore keeps run identity — never rebrand record damage as fresh --base/--lens.
+    const rawBase = loaded.admittedFields.baseRevision;
+    if (rawBase === undefined || rawBase.trim() === "") {
         throw new CliUsageError(`role run admitted reviewer base revision is missing: ${runId}`);
     }
+    if (/\s/.test(rawBase) || rawBase.startsWith("-")) {
+        throw new CliUsageError(`role run admitted reviewer base revision is damaged: ${runId}`);
+    }
+    const baseRevision = rawBase;
+    const lens = loaded.admittedFields.lens;
+    if (!isReviewerLens(lens)) {
+        throw new CliUsageError(`role run admitted reviewer lens is missing: ${runId}`);
+    }
+    const authorityRefs = Object.freeze([
+        ...(loaded.admittedFields.authorityRefs ?? []),
+    ]);
+    if (authorityRefs.length === 0) {
+        throw new CliUsageError(`role run admitted reviewer authority refs are missing: ${runId}`);
+    }
     const admitted = {
         role: "reviewer",
         ...resumedBaseAdmitted(loaded),
         baseRevision,
-        authorityRefs: Object.freeze([...(loaded.admittedFields.authorityRefs ?? [])]),
+        lens,
+        authorityRefs,
     };
     return seatLoadedResult(loaded, admitted);
 }

package/dist/public-cli/settlement.js

@@ -14,7 +14,6 @@ import { AUDITOR_SOUL_ROLES } from "../auditor-soul.js";
 import { DOCTOR_AUDIT_TOOL_NAME } from "../doctor-auditor.js";
 import { JUDGE_AUDIT_TOOL_NAME } from "../judge-auditor.js";
 import { knownFailureFromProviderStop } from "../pi/known-failure.js";
-import { readReviewerDispatchRejection } from "./reviewer-dispatch-rejection.js";
 import { isV1ResumableProvider, readLatestTypedProviderHttpObservation, readTypedHttp429Observation, } from "./run-lifecycle.js";
 import { AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE, AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, COMPLIANCE_RESPONSE_ENTRY_TYPE, readComplianceCandidate, } from "../compliance-transport.js";
 // COMPLIANCE_RESPONSE_ENTRY_TYPE remains for boundRetainedAuditResponse (call/result
@@ -566,7 +565,7 @@ export function extractSessionProviderStop(entries) {
         const message = entry.message;
         if (message?.role !== "assistant")
             continue;
-        // Latest assistant in the current attempt only (reviewer-child-executor lastAssistant pattern).
+        // Latest assistant in the current attempt only.
         return sessionProviderStopFromAssistant(message);
     }
     return undefined;
@@ -619,47 +618,6 @@ export async function readSessionProviderStop(sessionFile) {
         return undefined;
     }
 }
-/**
- * Recover a provider stop from Reviewer fixed-axis evidence children bound to this parent.
- * Dispatch runs during activation before the parent model turn; leg failures leave durable
- * stops under session/evidence-children/ and must not wash into generic activation.
- */
-export async function readBoundEvidenceChildKnownFailure(sessionFile) {
-    const childDirectory = join(dirname(sessionFile), "evidence-children");
-    let names;
-    try {
-        names = await readdir(childDirectory);
-    }
-    catch (error) {
-        if (isMissingPathError(error))
-            return undefined;
-        throw sessionReadFailure(error, "failed to read bound evidence-child session directory");
-    }
-    for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
-        let entries;
-        try {
-            entries = await readBoundSessionEntries(join(childDirectory, file));
-        }
-        catch (error) {
-            throw sessionReadFailure(error, "failed to read discovered evidence-child session");
-        }
-        const header = entries.find((entry) => entry.type === "session");
-        if (!isRecord(header) || header.parentSession !== sessionFile)
-            continue;
-        const stop = extractSessionProviderStop(entries);
-        if (stop === undefined)
-            continue;
-        const primary = knownFailureFromProviderStop(stop);
-        return {
-            ...primary,
-            details: {
-                ...(primary.details ?? {}),
-                secondaryEvidence: "evidence-child",
-            },
-        };
-    }
-    return undefined;
-}
 async function loadBoundAuditorVolumes(sessionFile) {
     let parentEntries;
     try {
@@ -865,21 +823,6 @@ function resolutionOf(knownFailure, typedHttp = { settled: false }) {
 export async function resolveAuditedRunnerFailureResolution(input) {
     if (input.runner !== undefined)
         return resolutionOf(input.runner);
-    if (input.runDirectory !== undefined) {
-        try {
-            const rejection = await readReviewerDispatchRejection(input.runDirectory);
-            if (rejection !== undefined)
-                return resolutionOf(rejection);
-        }
-        catch (error) {
-            const failure = error instanceof Error ? error : new Error(String(error));
-            return resolutionOf({
-                cause: "activation",
-                identity: thrownIdentity(failure),
-                diagnostic: failure.message || failure.name,
-            });
-        }
-    }
     // Bound auditor compliance-failure retention outranks a parent failure that the
     // auditor path itself caused (retention EISDIR race). A typed terminating-tool
     // host failure is next — it outranks weaker auditor provider-stop fallback so
@@ -925,22 +868,7 @@ export async function resolveAuditedRunnerFailureResolution(input) {
             diagnostic: failure.message || failure.name,
         });
     }
-    // Reviewer axis evidence-children are next: fixed two-axis dispatch fails
-    // during activation with only child stops durable. Parent stop remains the
-    // fallback; credential is last.
-    try {
-        const evidenceChildFailure = await readBoundEvidenceChildKnownFailure(input.sessionFile);
-        if (evidenceChildFailure !== undefined)
-            return resolutionOf(evidenceChildFailure);
-    }
-    catch (error) {
-        const failure = sessionReadFailure(error, "failed to recover bound evidence-child failure");
-        return resolutionOf({
-            cause: "session",
-            identity: thrownIdentity(failure),
-            diagnostic: failure.message || failure.name,
-        });
-    }
+    // Parent session provider-stop is next; credential is last.
     const parentStop = await readSessionProviderStop(input.sessionFile);
     // Typed HTTP observation: ENOENT=absence; other read/parse/shape failures keep real cause.
     // This is the single sidecar read for both knownFailure projection and v1 resume.
@@ -2369,7 +2297,7 @@ export async function trySettleFixerTerminalResult(admitted, authority, options,
     return settleLawfulFixerTerminalResult(admitted, authority, options, scope);
 }
 /**
- * Observe forced Reviewer code-review Skill expansions from the session.
+ * Observe forced Reviewer ak-cross-m-review Skill expansions from the session.
  * Expansion evidence is package-path only; ambient home locations never count.
  */
 export function extractReviewerMethodInvocations(entries, options) {
@@ -2384,7 +2312,7 @@ export function extractReviewerMethodInvocations(entries, options) {
         if (text.length === 0)
             continue;
         const hit = observePackagedMethodSkillInvocation(text, {
-            name: "code-review",
+            name: "ak-cross-m-review",
             allowedLocations: options.allowedLocations,
         });
         if (hit !== undefined)
@@ -2394,7 +2322,7 @@ export function extractReviewerMethodInvocations(entries, options) {
 }
 /**
  * Publish lawful Reviewer success Artifacts on the shared #106 success interface.
- * Evidence records package code-review provenance and typed expansion
+ * Evidence records package ak-cross-m-review provenance and typed expansion
  * observation without ambient home Skill paths.
  */
 export async function publishReviewerArtifacts(admitted, roleOutcome, coordinates, options) {
@@ -2414,6 +2342,7 @@ export async function publishReviewerArtifacts(admitted, roleOutcome, coordinate
         sessionFile: coordinates.sessionFile,
         admittedRequestPath: admitted.admittedRequestPath,
         baseRevision: admitted.baseRevision,
+        lens: admitted.lens,
         authorityRefs: [...admitted.authorityRefs],
         ...(admitted.instructionEmpty
             ? {}

package/dist/role-activation-flags.js

@@ -25,6 +25,7 @@ export function projectActivationFlags(request) {
     }
     if (activation.role === "reviewer") {
         flags.set("ak-review-base", activation.baseRevision);
+        flags.set("ak-review-lens", activation.lens);
         flags.set("ak-review-authority-refs", JSON.stringify(activation.authorityRefs));
         if (activation.ticketNumber !== undefined) {
             flags.set("ak-review-ticket-number", String(activation.ticketNumber));

package/extensions/role-runtime.ts

@@ -15,7 +15,6 @@ import {
 import type { Message } from "@earendil-works/pi-ai";
 
 import { createGhCollectorGitHubTransport } from "../src/collector-github.ts";
-import { createReviewerPinnedGitReader } from "../src/reviewer-dispatch.ts";
 import { createPiDoctorAuditor } from "../src/doctor-auditor.ts";
 import {
   createNativeNavigatorSessionFactory,
@@ -118,7 +117,6 @@ export default function roleRuntime(pi: ExtensionAPI): void {
     loadCoderSoul: () => loadMainRoleSessionMaterials("coder"),
     loadCoderTask: (path) => readFile(path, "utf8"),
     loadReviewerSoul: () => loadMainRoleSessionMaterials("reviewer"),
-    createReviewerPinnedGitReader: () => createReviewerPinnedGitReader(),
     loadCollectorSoul: () => loadMainRoleSessionMaterials("collector"),
     loadCollectorHandbookSeed: () => readFile(collectorHandbookSeedPath, "utf8"),
     createCollectorTransport: () => createGhCollectorGitHubTransport(),
@@ -159,13 +157,13 @@ export default function roleRuntime(pi: ExtensionAPI): void {
     loadMergerSoul: () => loadMainRoleSessionMaterials("merger"),
     loadMergerInput: async (path) => JSON.parse(await readFile(path, "utf8")),
     async loadCanonicalSkillBinding(name) {
-      // Coder TDD (#109) and Reviewer code-review (#111) are package-owned.
+      // Coder TDD (#109) and Reviewer ak-cross-m-review (#917) are package-owned.
       // Optional Fixer diagnosing-bugs is available via --skill without this binding.
       if (name === "tdd") {
         return loadPackagedCanonicalSkillBinding(packageRoot, "tdd");
       }
-      if (name === "code-review") {
-        return loadPackagedCanonicalSkillBinding(packageRoot, "code-review");
+      if (name === "ak-cross-m-review") {
+        return loadPackagedCanonicalSkillBinding(packageRoot, "ak-cross-m-review");
       }
       return loadHomeCanonicalSkillBinding(name);
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4403",
+  "version": "0.1.4419",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/resources/836-deleted-machine-instruction-inventory.md

@@ -9,7 +9,7 @@
 | `compliance-transport.ts` `AUDITOR_DOSSIER_PROMPT` | `本 run 卷宗已就绪。` | 改为台院同形路径指针。 |
 | `doctor-role.ts` case catalog | `provenance: "由留存 session 字节推导，封入受理回执。"` | 删。catalog 只留 cost 与证据指针。 |
 | `collector-role.ts` bounceInfrastructure | `请省略该字段后重新提交。` | 代码打回推翻自报已删。 |
-| `reviewer-role.ts` output description | `Standards/Spec 评审腿由 runtime 以取证子会话代跑…` | 改为「本席自调 code-review skill」。方法步骤在 `resources/methods/code-review/SKILL.md`。 |
+| `reviewer-role.ts` output description | `Standards/Spec 评审腿由 runtime 以取证子会话代跑…` | #836 改为「本席自调 code-review skill」。#917 后随包方法为 `ak-cross-m-review`；`resources/methods/code-review/` 已删，现役指针见 `resources/methods/ak-cross-m-review/SKILL.md`。 |
 | `run-lifecycle.ts` A4.1 | `[ak-role:resume-continue]` | 生产码不再含此字面量。结算只跳过空轮与引擎指针续跑。 |
 | `run-lifecycle.ts` A4.2 | `重新读 <path>` | 前轮已删改写。 |
 | `submission-correctable-error.ts` A4.5 | `终局交卷并非本轮唯一工具调用。` | 删。Pi/ACP `deliverSubmissionRejection` 不再注入该句。 |

package/resources/methods/ak-cross-m-review/CONTEXT.md

@@ -0,0 +1,48 @@
+# ak-cross-m-review
+
+Local, pre-PR review gate: two independent lenses against a pinned diff, one verdict each; a single lens runs in the invoking session, `all` runs both as parallel sub-agent legs. `SKILL.md` plus the selected lens prompt is the complete active authority; this file is vocabulary only.
+
+## Language
+
+**Fixed target**:
+The pinned base-to-HEAD snapshot under review, resolved to two literal SHAs
+before anything is dispatched.
+_Avoid_: range, worktree diff, working changes
+
+**Authority set**:
+The ordered sources that govern the review — user decisions first, then
+ratified ADRs / specs, then repository contracts.
+_Avoid_: spec (alone), reference docs
+
+**Lens**:
+One review question with its own prompt file — `completeness` (was the
+authority delivered?) or `correctness` (is what exists right?).
+_Avoid_: axis, gate, mode, pass
+
+**Leg**:
+One independent sub-agent running exactly one lens inside an independent copy of the target at `PRE_HEAD`, dispatched only by `all`; the copy is provided by the harness when it can, otherwise created by the caller. A single-lens invocation has no leg: the invoking session applies the lens itself.
+_Avoid_: panel, member, reviewer squad, vendor leg
+
+**Candidate**:
+An evidence-backed claim a leg submits for judgment; never a verdict.
+_Avoid_: finding (before judgment), vote
+
+**Judge**:
+The invoking session, which verifies each candidate against the fixed target
+and authority set and disposes it as live or refuted.
+_Avoid_: orchestrator, runner, merger
+
+**Verdict**:
+The single terminal line a lens ends with, labelled by lens
+(`CMR-VERDICT: completeness=…` / `CMR-VERDICT: correctness=…`).
+_Avoid_: gate result, concur, convergence
+
+**Preset**:
+A named wrapper skill that invokes the engine with one lens and returns its
+report unchanged.
+_Avoid_: gate skill, entry point
+
+**Review only**:
+The outcome boundary — the invocation reports and stops; the caller owns every
+repair, commit, retry, and later review.
+_Avoid_: read-only (that is a filesystem property, not this boundary)

package/resources/methods/ak-cross-m-review/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Akagi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/resources/methods/ak-cross-m-review/SKILL.md

@@ -0,0 +1,170 @@
+---
+name: ak-cross-m-review
+description: Use when the user requests CMR (cross-model review) of a fixed target, or a CMR preset delegates here.
+allowed-tools:
+  - Agent
+  - Bash
+  - Read
+  - Grep
+  - Glob
+---
+
+# /ak-cross-m-review — fixed-target review engine
+
+This file plus each selected prompt is the complete active authority. See `CONTEXT.md` for vocabulary.
+
+**REVIEW ONLY.** Pin one fixed target and authority set, run the selected
+lenses, judge their candidates independently, report, and stop. The caller owns
+every repair, commit, retry, and later review.
+
+Model composition is the caller's: a single lens runs in the invoking session; `all` runs each lens as one leg on whatever the harness supplies.
+
+## Invocation
+
+Direct invocation must provide every required input; these are agent-chat
+arguments, not a shell CLI:
+
+```text
+/ak-cross-m-review --base FIXED_POINT --lens completeness|correctness|all
+  --authority SOURCE [--authority SOURCE ...]
+```
+
+- `--base` supplies the fixed point compared with committed `HEAD`.
+- `--lens` is required and has no default.
+- `--authority` names a governing repository path or labelled user source.
+
+## Step 1 — Pin the fixed target
+
+Run from the target repository:
+
+1. Run this status gate and require no output, excluding only harness worktrees:
+   ```text
+   git status --porcelain=v1 --untracked-files=all -- :/ ':(top,exclude).claude/worktrees/**'
+   ```
+2. Resolve literal `PRE_HEAD` with `git rev-parse --verify 'HEAD^{commit}'`,
+   `BASE_SHA` with `git rev-parse --verify '<base>^{commit}'`, and `TARGET_ROOT`
+   with `git rev-parse --show-toplevel`.
+3. Substitute those SHAs and freeze these commands exactly:
+
+   ```text
+   git log --oneline BASE_SHA..PRE_HEAD
+   git diff --binary BASE_SHA...PRE_HEAD
+   ```
+
+4. Run the frozen log command and require the frozen diff command to produce a
+   non-empty diff.
+
+A dirty tree, unresolved required ref, unexpected failed command, or empty diff is a `hard-stop`. Record the exact failing command and its native output in one sentence.
+
+Completion criterion: clean status, literal pin values, and one non-empty diff represented by the two frozen commands.
+
+## Step 2 — Pin the authority set
+
+Freeze one ordered authority set before dispatch:
+
+1. user decisions and supplied sources;
+2. ratified ADRs, acceptance text, PRD/spec, and originating issue;
+3. repository contracts such as AGENTS/CLAUDE/CONTRIBUTING, public APIs, and
+   behavior tests;
+4. surrounding code as evidence of an established contract only.
+
+Follow references named by higher authority; lower authority cannot override
+higher authority. List repository authority by relative path. Put exact
+user-supplied text in the brief under a stable label such as
+`user-authority-1`, with stable line addresses.
+
+Completeness, alone or inside `all`, requires clause authority addressable as
+repository `path:line` or brief `source-label:line`. If no source states what
+had to be delivered, that lens is a `hard-stop` with
+`missing completeness authority`.
+Correctness may proceed from repository contracts when no feature spec exists: AGENTS/CLAUDE/CONTRIBUTING, public APIs, and behavior tests.
+
+Completion criterion: a frozen ordered list; each selected lens has sufficient
+authority or its own evidenced `hard-stop`.
+
+## Step 3 — Select lenses
+
+`--lens completeness|correctness|all` is required; omission is a usage error (report it; no verdict line).
+
+- `completeness` loads `prompts/cmr-completeness.md` and applies
+  Clause–Wire–Exercise.
+- `correctness` loads `prompts/cmr-reviewer.md` and applies
+  Trace–Break–Prove.
+- `all` launches both lenses as sub-agent legs in one parallel batch.
+
+Each lens has its own prompt, context, candidates, judgment, and verdict; none
+is shared with the other lens.
+
+Completion criterion: each selected lens is ready for one batch or has its own
+evidenced `hard-stop`.
+
+## Step 4 — Run the selected lenses
+
+A single lens runs in the invoking session: apply the selected lens prompt yourself in `TARGET_ROOT` at `PRE_HEAD`, run the frozen commands, read the authority and the repository, probe where useful, and write the complete candidate list under the lens's candidate contract before judging anything in Step 5. Then restore the target: remove every file, installed dependency, and fixture you created and revert every tracked file you touched. The tree was clean at Step 1, so anything new is yours. No sub-agent and no separate copy is involved.
+
+`all` launches one sub-agent leg per lens in one parallel batch. Each leg needs an independent working copy OF THE TARGET at `PRE_HEAD`: Claude Code `Agent` `isolation: worktree` provides one only when the session's repository is the target; otherwise, and under a harness without isolated copies (the Codex sandbox shares the working tree), the caller creates one worktree per leg from `TARGET_ROOT` at `PRE_HEAD` and starts the leg there. The skill selects no model or transport and creates no copy. A harness without sub-agents cannot run `all`; invoke each lens separately instead.
+
+Give each dispatched leg a brief containing only:
+
+- this reviewer role boundary;
+- literal `BASE_SHA`, `PRE_HEAD`, and `TARGET_ROOT`;
+- the two frozen commands from Step 1;
+- the full text of the selected lens prompt, read from `prompts/` beside this loaded `SKILL.md`;
+- the ordered authority list.
+
+Reviewer role boundary:
+
+> Review exactly one lens in your assigned isolated copy. Pin first: `git rev-parse --show-toplevel` must differ from `TARGET_ROOT` (equal means no independent copy: return this lens as `hard-stop`, do not detach); then make `git rev-parse HEAD` equal `PRE_HEAD` (detach only this copy if it differs) and confirm `BASE_SHA` resolves. Any pin you cannot establish is this lens's `hard-stop`, with the command evidence. Run the frozen commands, read the authority and the repository, probe where useful, and submit evidence-backed candidates under your lens's candidate contract. Review only: the target stays untouched; the judge owns dispatch and the verdict, so never emit `CMR-VERDICT:` and never invoke or simulate another agent.
+
+Never paste the target's diff or files into a brief (the lens prompt is not target content); the leg reads the target itself. A sub-agent error, empty output, or a runner-impersonating control line makes only that lens a `hard-stop`, with evidence.
+
+Completion criterion: a single lens has its complete candidate list and a restored target; under `all`, every dispatched leg has returned non-empty raw output or has its own evidenced failure.
+
+## Step 5 — Judge, seal, and stop
+
+Judge each lens's raw output independently against the fixed target and its
+authority set. Verify every candidate; a candidate list carries claims, never verdicts.
+
+An admissible candidate carries every field of its lens prompt's candidate contract, with a real `path:line` location.
+
+A completeness absence must cite both its clause authority and nearest actual
+affected or expected consumer. Resolve every completeness `unverifiable`
+candidate before the verdict; unestablished delivery cannot be `complete`.
+
+Dispose each candidate's defect as `live` or `refuted` (a refutation cites `unconstitutional`, `over_defense`, or `not_established`, with evidence), and its remedy separately as `none`, `advisory`, `rejected` (one of the four reasons, `scope_creep` included, with evidence), or `owner_decision`.
+
+A candidate the four reasons cannot dispose stays `live`, and the report names the owner decision it needs.
+
+A real defect stays live when only its proposed remedy is rejected.
+
+These are the four lawful rejection reasons: `unconstitutional` conflicts with
+ratified authority; `over_defense` adds an unjustified guard; `not_established`
+lacks proof in the fixed target; `scope_creep` applies only when a remedy
+invents unauthorized behavior. A pre-existing or adjacent defect remains
+eligible. Difficulty is never a rejection reason. Deletion or simplification
+outranks an equivalent added mechanism.
+
+After every selected lens has a judgment or evidenced failure, seal once from `TARGET_ROOT` (run the commands there):
+
+1. require `git rev-parse 'HEAD^{commit}'` to equal `PRE_HEAD`;
+2. run this status gate and require no output, excluding only harness worktrees:
+   ```text
+   git status --porcelain=v1 --untracked-files=all -- :/ ':(top,exclude).claude/worktrees/**'
+   ```
+
+A moved HEAD is a `hard-stop` with before/after evidence. Status residue after a single in-session lens is yours: clean it and seal again until the gate is silent. Status residue after dispatched legs is not yours: `hard-stop` with the status evidence, and never reset, checkout, remove, or clean what you did not create.
+
+End each selected lens with exactly one labelled line:
+
+```text
+CMR-VERDICT: completeness=complete|gaps|hard-stop
+CMR-VERDICT: correctness=converged|findings|hard-stop
+```
+
+Completeness is `complete` when no live gap or unresolved `unverifiable` row
+remains; otherwise it is `gaps`. Correctness is `converged` when no live defect
+remains; otherwise it is `findings`.
+`hard-stop` means a prerequisite, seal, or leg failure as defined above; Step 1 pin and seal failures apply to every selected lens, while Step 2 and leg failures apply only to that lens. A `--lens` usage error emits no verdict line.
+
+Completion criterion: after the single successful seal, every selected lens has an independent judgment or evidenced failure and exactly one labelled verdict;
+or, on an evidenced pin or seal failure, every selected lens carries its labelled `hard-stop`. Stop unconditionally.