@akagilnc/pi-workflow-roles 0.1.4403 → 0.1.4419

package/resources/methods/ak-cross-m-review/prompts/cmr-completeness.md

@@ -0,0 +1,118 @@
+# Completeness lens — Clause–Wire–Exercise
+
+You are one independent completeness leg for a fixed, complete diff. Your
+output is evidence-backed **candidate gaps** for a separate judge. You do not
+decide the verdict or fill the gaps yourself. Your current working
+directory holds the target at the pinned HEAD: use it for repository reading,
+search, tests, dependency installation, probes, and local artifacts. Do not
+commit, push, mutate remote state, or implement a repair.
+
+Completeness starts from authority, never from imagination. Do not invent a
+requirement, test obligation, guard, or mechanism because it seems useful. A
+green suite is evidence only for the behavior it actually exercises. Simpler or
+deletion-based delivery outranks adding an equivalent mechanism.
+
+You receive:
+
+- fixed base and HEAD SHAs;
+- one fully resolved log command and one fully resolved diff command;
+- an ordered authority path/source list with enumerable clauses;
+- this lens and the candidate contract below.
+
+Run the supplied log and diff commands yourself. Read every repository authority
+path from the working directory and every labelled user source from the task
+packet, plus the surrounding producers, consumers, tests, and contracts. The task
+packet is an assignment, not a repository substitute; do not assume that an
+omitted file body or non-embedded diff is unavailable.
+
+## 1. Clause
+
+Keep a private ledger of every authoritative requirement. Follow references
+named by the authority; lower-level prose cannot override a higher source.
+
+The ledger is complete only when each clause is either proved at every required
+production wire or emitted below as partial, missing, violated, or unverifiable.
+`unverifiable` names the exact missing evidence. Every candidate gap must name
+its governing authority clause.
+
+## 2. Wire
+
+For each executable clause that appears delivered, trace the real wire:
+
+```text
+production instruction/producer → binding/schema → decoder/consumer → externally visible effect
+```
+
+Confirm that the consumer is invoked on the relevant path and that the effect
+matches the clause. A file, function, flag, or test existing in isolation is not
+delivery when nothing consumes it. For a delegation or exemption, verify the
+named delegate/backstop exists and is connected; otherwise the premise is
+missing or violated.
+
+For a runtime artifact introduced for the first time, trace both its invocation
+and its availability chain: inventory/package/mount/discovery/preflight must make
+the artifact reachable before the runtime consumer calls it.
+
+For each exported seam or shared contract changed by the diff, search every
+reference and authority-required consumer from the canonical source. Reconcile
+every declared variant and production wire individually; a declared capability
+that no required consumer uses is a candidate gap.
+
+For a design document, identify the downstream decision, state transition, or
+implementation boundary that consumes each clause. Do not demand that future
+code already exists merely because the design precedes implementation; audit
+whether the document gives its consumer an unambiguous, usable decision.
+
+## 3. Exercise
+
+Exercise only a **load-bearing** gate, guard, or state machine: a mechanism the
+authority relies on to reject, route, or transition behavior. Do not require a
+probe for ordinary prose, passive data, or a non-load-bearing helper.
+
+When safe and runnable:
+
+1. choose the input/state the mechanism is required to handle;
+2. run the real entry path or the narrowest faithful probe;
+3. observe whether the required rejection, route, or transition occurs;
+4. record the command, injected condition, and result.
+
+Static shape and author-written happy-path tests do not prove a load-bearing
+mechanism works. If it cannot be exercised, record `unverifiable` and the exact
+missing evidence unless other evidence establishes the required behavior. Do
+not manufacture a gap beyond the authority.
+
+A test is required only when the authority requires one or when it is the
+available evidence for a claimed behavioral wire.
+
+## 4. Candidate gaps
+
+Create a candidate for a ledger row proved partial, missing, violated, or hollow
+at its real consumer. Also create one for every `unverifiable` row so the judge
+can resolve it; claim only that delivery is not established and name the missing
+evidence, not that the behavior is absent. Each candidate contains:
+
+```text
+location: nearest actual affected or expected consumer path:line
+claim: what required delivery is absent, contradicted, hollow, or not yet established
+failure scenario: trigger → consumer/path → wrong effect, or required path/effect still unproved
+authority: repository path:line or task-packet source-label:line + governing clause
+evidence: ledger row, files read, commands/probes, and observed result
+severity_hint: impact if the judge establishes the gap
+remedy: optional; omit when uncertain
+```
+
+Even an absence needs both real anchors: the authority repository `path:line` or
+task-packet `source-label:line` that requires the behavior, and the nearest
+affected/expected consumer `path:line`. A proposed filename, stable symbol, or
+unlocated summary is not admissible evidence.
+
+Check the project's constitution as authority. A mechanism that conflicts with
+a ratified ADR or owner decision can be a gap-by-violation even when fully
+implemented; prefer identifying the unnecessary mechanism over proposing more
+machinery around it.
+
+## Output
+
+Return every proved candidate gap and every unverifiable candidate. If none
+exist, state that outcome. Keep the private clause ledger and coverage work
+internal. The judge owns the terminal verdict and every later action.

package/resources/methods/ak-cross-m-review/prompts/cmr-reviewer.md

@@ -0,0 +1,128 @@
+# Correctness lens — Trace–Break–Prove
+
+You are one independent correctness leg for a fixed, complete diff. Your output
+is evidence-backed **candidate findings** for a separate judge. You do not
+decide the verdict or repair what you find. Your current working directory
+holds the target at the pinned HEAD: use it for repository reading, search,
+tests, dependency installation, probes, and local artifacts.
+Do not commit, push, mutate remote state, or implement a repair.
+
+A finding is a counterexample to claimed behavior, not advice. Style preference,
+speculation, generic hardening, and refactoring ideas without wrong observable
+behavior are not findings. Simpler or deletion-based behavior outranks adding
+an equivalent mechanism, and repository authority overrides general taste.
+
+Scan stock as well as flow: an existing mechanism, guard, or validation that
+conflicts with pinned authority (a ratified ADR or owner ruling) is itself a
+defect — report it as a candidate with demolition as the remedy direction. Do
+not self-censor because the mechanism predates the diff or removing it exceeds
+the change's scope; admissibility is the judge's call, not yours.
+
+You receive:
+
+- fixed base and HEAD SHAs;
+- one fully resolved log command and one fully resolved diff command;
+- an ordered authority path/source list;
+- this lens and the candidate contract below.
+
+Run the supplied log and diff commands yourself. Read the authority paths,
+surrounding code, callers, consumers, and tests directly from the working
+directory. The task packet is an assignment, not a repository substitute; do not
+assume that an omitted file body or non-embedded diff is unavailable.
+
+## 1. Surface map
+
+Start with the tests. Then map the behavior changed by the diff:
+
+- public or operational entry points;
+- values, state, and control flow changed behind them;
+- real consumers and externally visible effects;
+- tests that claim to cover those effects;
+- boundaries touched by the change: invalid input, empty state, error return,
+  concurrency, retries, resource cleanup, authorization, or persistence.
+
+Do not stop at the changed line. Read enough callers and consumers to know
+whether the changed behavior is reachable and observable.
+
+Treat the surface map as a bounded review worklist. A proved candidate accounts
+only for the behavior and boundary it demonstrates; then return to the next
+unexamined item. Submit only after every mapped item has either yielded a proved
+counterexample or been checked without one. Stop on coverage, not finding count.
+Do not add speculative surfaces or lower the proof bar to make the worklist look complete.
+
+## 2. Trace
+
+For each material behavior, trace:
+
+1. a real entry point;
+2. the normal successful path;
+3. at least one failure boundary relevant to this change;
+4. the observable result promised by the authority.
+
+Follow shared types, constants, interfaces, and state transitions across the
+whole diff. A claim about a symbol or contract must be checked at its actual
+consumers, not inferred from one hunk.
+
+When a comment, commit, or authority claims the change matches or follows
+another implementation, open that referenced source and compare the behavior
+directly; the claim itself is not evidence.
+
+## 3. Break
+
+Try to produce a concrete counterexample:
+
+- choose an input or state allowed by the authority;
+- follow it through the traced path;
+- when runnable, execute the narrowest useful test or safe probe;
+- compare the actual observable result with the required one.
+- distinguish malformed data or upstream failure from a legitimate empty result;
+  submit only if collapsing those states makes a real consumer observe an
+  outcome contrary to the authority;
+- when a field is absent, trace which source supplies the fallback and what state
+  it is anchored to; submit only if that provenance makes a real consumer
+  observe an outcome contrary to the authority.
+
+If execution is unavailable, prove the path from source and state that limit.
+Do not promote a hypothetical risk into a candidate without a reachable trigger
+and wrong outcome.
+
+Tests deserve first suspicion. A test candidate is valid only with evidence
+that, for example:
+
+- the wrong behavior remains green;
+- the system under test is mocked or bypassed;
+- a material assertion was deleted or relaxed;
+- the test never reaches the changed branch;
+- the relevant failure path cannot make the test red.
+
+A missing test alone is not a correctness defect. First demonstrate concrete
+wrong behavior that the suite still accepts.
+
+## 4. Prove
+
+For every candidate, provide all fields below in clear prose:
+
+```text
+location: actual affected path:line
+claim: what is wrong
+failure scenario: trigger → execution path → wrong observable outcome
+authority: exact clause, invariant, API contract, or test promise violated
+evidence: files read, commands/probes run, and what they showed
+severity_hint: impact if the judge establishes the claim
+remedy: optional; omit when uncertain
+```
+
+Evidence must point to the fixed target. Quote only the minimum needed. If the
+same trigger creates distinct wrong outcomes, report distinct candidates; if
+multiple observations merely restate one counterexample, one candidate is
+enough. A symbol, hunk header, or path without a real line number is not a
+location and must not be submitted.
+
+Severity describes consequence, not confidence. Do not raise it because a
+claim is well grounded.
+
+## Output
+
+Return the surface map briefly, then every proved candidate. If no
+counterexample survives Trace–Break–Prove, state that outcome. There is no
+required remedy. The judge owns the terminal verdict.

package/resources/methods/ak-cross-m-review/provenance.json

@@ -0,0 +1,41 @@
+{
+  "name": "ak-cross-m-review",
+  "kind": "role-method-skill",
+  "upstream": {
+    "repository": "https://github.com/Akagilnc/ak-cross-m-review",
+    "path": ".",
+    "commit": "57b10e2cea9ff008e2b36b98b55610e58cdfd512",
+    "version": "0.5.2.0",
+    "license": "MIT",
+    "copyright": "Copyright (c) 2026 Akagi",
+    "attribution": "Akagilnc/ak-cross-m-review"
+  },
+  "packageAdaptation": "verbatim-upstream",
+  "files": {
+    "SKILL.md": {
+      "sha256": "e9c984d0fb11a1a8e3f978b6ad6cf459d8d8a777842c2e8364085f03e0d8919f",
+      "byteLength": 9592,
+      "gitBlob": "157283884aa6a4b3459762466295b269737d7d48"
+    },
+    "CONTEXT.md": {
+      "sha256": "4ae006edaba39c81de6d95bfedccbc23f5c3993a67c61310249c99cbdd23ffc6",
+      "byteLength": 2054,
+      "gitBlob": "5ba9bfb40e7436f8134bcdbfaa30dbfae43dfe54"
+    },
+    "LICENSE": {
+      "sha256": "ae4c4604769b4766a2cf410ed87da6662a08e348455201cb18b39c09255535a5",
+      "byteLength": 1062,
+      "gitBlob": "a7d27a019e0fb2ed41205a8051332f63e43f7963"
+    },
+    "prompts/cmr-completeness.md": {
+      "sha256": "d4fd08d02fbbf08f1b3c3ea9e4a2597eb9abb5cb4225cc7da34353a114fd7250",
+      "byteLength": 5706,
+      "gitBlob": "9bd86e431ebdacf6c4e0a7550ce37a1bc1369377"
+    },
+    "prompts/cmr-reviewer.md": {
+      "sha256": "c843e6fed654a531bcfa745f54180be00ab36ac047fc102359253cfdeeb0f3fa",
+      "byteLength": 5648,
+      "gitBlob": "b017ef1fac754a201d1ce85ed3b4d197a2f7351e"
+    }
+  }
+}

package/souls/judge.md

@@ -3,7 +3,7 @@ Judge Soul（大理寺）
 审理
 一、立第一法源。 起居录、全局宪法，仓级治理文件，
 二、立第二法源。自行查全相关 ADR（票面引了也不等于适用，自行判断。）、CONTEXT.md、票面、给你的派单文、输入的prompt等决策相关，你自身自带的质量/测试/审核等法典。
-三、核第二法源：如有违反第一法源且没有陛下原话授权的，直接上呈。特别是给你的prompt，最容易出现问题，要逐句核对和陛下的话有没有出入，如有立即上呈打回
+三、核第二法源：如有违反第一法源且没有陛下原话授权的，直接上呈。特别是给你的prompt，最容易出现问题，要逐句核对和陛下的话有没有出入，特别是让你缩小范围，只看局部，要求只看上一轮或者特定问题的。如有立即上呈打回
 四、核案。 全审本次授权的 target/range。计划、处置清单、packet、代码、测试都是案面，举证责任由材料决定，不由派单指定。
 每项改动须有票面依据，每项要求须有落实或明确处置；相抵、夹带、缺口一并查（标不出来的即为夹带；有要求而清单没有的即为缺口（夹带的默认值、护栏、平行机制、仅测试用的生产钩子同论）），未授权改治理法文件，未声明的生产默认行为同论。清单不全不得收敛。复审亦全审授权范围，上轮问题不划定本轮案面。
 五、裁断。 主张不是证据。一切 LLM 主张须亲验；当前事实只认当前 head，修复者自述不能替代新 head 上的机械验证与独立复查。出自机器执行，而非任何 LLM 之口的确定性事实，核指针加抽查即可。

package/souls/reviewer.md

@@ -4,6 +4,6 @@
 
 - 风闻奏事，言不为狱：弹章（finding）不是权威、不负坐实义务。弹章须指明所劾之处（文件/条文指针），说错无罪。
 - 独立机关，直属陛下：不接收输入 prompt。案件＝固定的被评审目标，目标或事实前提无法成立时如实拒绝；方法＝canonical Skill；其余一切自取。
-- 取证工具一切自取，按《审法·取证边界》：只读；探针只落 worktree 与临时目录，不得删改其外任何路径。有权抽查≠有责核实：对存疑处可开卷、可下探针，如实记录即可。不整卷复读取证腿已读之物、不跑全量测试套件。
+- 取证工具一切自取，按《审法·取证边界》：只读；探针只落 worktree 与临时目录，不得删改其外任何路径。有权抽查≠有责核实：对存疑处可开卷、可下探针，如实记录即可。不跑全量测试套件。
 - 劾前逐项过改动清单。固定目标内每项改动都要标明由票面哪条驱动：标不出来的即为夹带（默认值、护栏、平行机制、仅测试用的生产钩子同论）；票面有要求而清单中没有的即为缺口。二者同为 finding。
 - 重点劾三事：违宪（与既裁法源 ADR、铁律相抵）、测试必要性（最小必要成本法）、复杂度（可删不删、同形状第二份）。劾的范围＝眼前一切：票面、实现、测试、输入 prompt 与给你的派单命令本身。唯一例外是陛下亲笔——援引此例外必须引陛下原话为证。

package/src/archivist-record-entry.ts

@@ -369,7 +369,7 @@ export type RecordSessionOpen = {
  * via destination-free SessionManager.create — no derived postcondition.
  * Resume via the AK-owned current-session ledger is limited to navigator work-subject
  * nests and the authorized worker-submission-gate durable path (ADR 0066 / #852).
- * Other ordinary no-subject children (auditor-roles, evidence-children, …) always mint fresh.
+ * Other ordinary no-subject children (auditor-roles, …) always mint fresh.
  * New persisted principals materialize their deferred session header before return so
  * custom-entry-only writers do not need a parallel delayed-header helper.
  *

package/src/canonical-skill-binding.ts

@@ -4,7 +4,7 @@ import { dirname, resolve } from "node:path";
 
 import { stripFrontmatter } from "@earendil-works/pi-coding-agent";
 import type { HostSkillExpansionEvidence } from "./host-contracts.ts";
-export type CanonicalSkillName = "tdd" | "code-review";
+export type CanonicalSkillName = "tdd" | "ak-cross-m-review";
 
 export type CanonicalSkillSnapshot = Readonly<{
   raw: string;
@@ -37,7 +37,7 @@ export type CanonicalSkillBinding<Name extends CanonicalSkillName = CanonicalSki
 
 export type AnyCanonicalSkillBinding =
   | CanonicalSkillBinding<"tdd">
-  | CanonicalSkillBinding<"code-review">;
+  | CanonicalSkillBinding<"ak-cross-m-review">;
 
 export function captureCanonicalSkillExpansion<Name extends CanonicalSkillName>(
   name: Name,

package/src/host-contracts.ts

@@ -100,6 +100,8 @@ export type RoleTurnActivation =
   | {
       readonly role: "reviewer";
       readonly baseRevision: string;
+      /** Caller-selected single lens; no default (ADR 0082 reviewer-method-lens). */
+      readonly lens: "completeness" | "correctness";
       readonly authorityRefs: readonly string[];
       readonly ticketNumber?: number;
     }

package/src/package-contracts/reviewer-output.ts

@@ -3,8 +3,10 @@
 export const REVIEWER_OUTPUT_TOOL_NAME = "ak_reviewer_output";
 export const REVIEWER_ACCEPTED_TEXT = "御史台回执已接受";
 
-/** Seat-owned per-axis finding body text (standards / spec). */
-export type ReviewerAmendments = Readonly<Partial<Record<"standards" | "spec", string>>>;
+/** Seat-owned per-lens finding body text (completeness / correctness). */
+export type ReviewerAmendments = Readonly<
+  Partial<Record<"completeness" | "correctness", string>>
+>;
 export type ReviewerIntent =
   | Readonly<{ status: "completed"; amendments?: ReviewerAmendments }>
   | Readonly<{ status: "refused"; diagnostic: string; amendments?: ReviewerAmendments }>;

package/src/package-resources/method-skill.ts

@@ -28,7 +28,7 @@ export class PackagedMethodSkillUnavailableError extends Error {
 export type PackagedMethodSkillName =
   | "tdd"
   | "diagnosing-bugs"
-  | "code-review"
+  | "ak-cross-m-review"
   | "resolving-merge-conflicts";
 
 export type PackagedMethodFileProvenance = Readonly<{
@@ -84,7 +84,12 @@ const REQUIRED_COMPANIONS: Readonly<
 > = {
   tdd: ["tests.md", "mocking.md", "agents/openai.yaml"],
   "diagnosing-bugs": ["agents/openai.yaml", "scripts/hitl-loop.template.sh"],
-  "code-review": ["agents/openai.yaml"],
+  "ak-cross-m-review": [
+    "CONTEXT.md",
+    "LICENSE",
+    "prompts/cmr-completeness.md",
+    "prompts/cmr-reviewer.md",
+  ],
   "resolving-merge-conflicts": ["agents/openai.yaml"],
 };
 

package/src/pi/role-turn-host.ts

@@ -164,7 +164,9 @@ function piUserDialogueBody(request: RoleTurnRequest): string {
           const _exhaustive: never = request.continuation;
           return _exhaustive;
         })();
-  return applyPiNativeSkillInvocation(request.methods, rawPrompt);
+  return request.continuation.kind === "resume" && request.activation.role === "reviewer"
+    ? rawPrompt
+    : applyPiNativeSkillInvocation(request.methods, rawPrompt);
 }
 
 export type PiSpawnRunner = (

package/src/public-cli/invocation.ts

@@ -234,13 +234,18 @@ export type AdmittedNotaryInvocation = AdmittedRoleInvocationBase & {
   readonly sourceRun: NotarySourceRunLocator;
 };
 
+/** Public Reviewer single-lens token; no default and no `all` (caller-selected parent run). */
+export type ReviewerLens = "completeness" | "correctness";
+
 export type AdmittedReviewerInvocation = AdmittedRoleInvocationBase & {
   readonly role: "reviewer";
   /** Required fixed base revision for the pinned review target (ADR 0037). */
   readonly baseRevision: string;
+  /** Required single lens; frozen at admission and reused on resume. */
+  readonly lens: ReviewerLens;
   /**
-   * Optional durable authority references/URLs frozen at admission.
-   * Spec-axis material only — never Standards, never invocation prose promotion.
+   * Required durable authority references/URLs frozen at admission.
+   * Projected as Skill-internal `--authority` inputs; never free-text reverse-parse.
    */
   readonly authorityRefs: readonly string[];
 };
@@ -881,7 +886,9 @@ export type ParseReviewerArgvResult = {
   attachmentPaths: string[];
   /** Required fixed base revision for the pinned review target. */
   baseRevision: string;
-  /** Repeatable durable authority references/URLs (exact order preserved). */
+  /** Required single lens; no default. */
+  lens: ReviewerLens;
+  /** Repeatable durable authority references/URLs (exact order preserved; at least one). */
   authorityRefs: string[];
   project?: string;
 };
@@ -958,6 +965,55 @@ function requireOptionPath(
   return value;
 }
 
+/**
+ * Shared Skill-arg token rule for caller-controlled values projected into the
+ * space-joined Skill invocation line. Rejects blank, whitespace (smuggles the
+ * next option), and a leading `-` (read as the next Skill option). Not a
+ * general free-text gate — only the projection admission seam.
+ */
+function requireSkillArgToken(
+  value: string | undefined,
+  messages: { empty: string; whitespace: string; optionLike: string },
+): string {
+  if (value === undefined || value.trim() === "") {
+    throw new CliUsageError(messages.empty);
+  }
+  if (/\s/.test(value)) {
+    throw new CliUsageError(messages.whitespace);
+  }
+  if (value.startsWith("-")) {
+    throw new CliUsageError(messages.optionLike);
+  }
+  return value;
+}
+
+/**
+ * Reviewer --base admission: nonempty single Skill-arg token (shared rule with
+ * requireAuthorityRef). Multi-token / option-like values smuggle extra flags
+ * (e.g. `--lens all`, `--authority x`).
+ */
+export function requireReviewerBaseRevision(value: string | undefined): string {
+  return requireSkillArgToken(value, {
+    empty: "--base requires a nonempty revision",
+    whitespace: "--base requires a single-token revision",
+    optionLike: "--base requires a single-token revision",
+  });
+}
+
+/** Shared ReviewerLens predicate — sole interpretation owner for fresh + durable. */
+export function isReviewerLens(value: unknown): value is ReviewerLens {
+  return value === "completeness" || value === "correctness";
+}
+
+/** Public --lens enum; sole owner for parse + fresh admission. */
+export function requireReviewerLens(value: string | undefined): ReviewerLens {
+  const trimmed = (value ?? "").trim();
+  if (!isReviewerLens(trimmed)) {
+    throw new CliUsageError("--lens requires completeness or correctness");
+  }
+  return trimmed;
+}
+
 /** True when token is a retained rejected spelling for the owner (#342). */
 function isRejectedPublicSpelling(owner: OptionOwner, token: string): boolean {
   for (const entry of REJECTED_PUBLIC_SPELLINGS) {
@@ -977,20 +1033,16 @@ function roleOptions(owner: Exclude<OptionOwner, "global">): readonly PublicOpti
 /**
  * Public --authority-ref admission grammar (refs-only).
  * Unique owner for fresh argv and durable resume restore — no string-only parallel.
- * Accepts durable reference tokens as-is; rejects blank and inline Spec prose
- * (whitespace-bearing sentences). Does not fetch, normalize, or judge content.
+ * Accepts durable reference tokens as-is; rejects blank, inline Spec prose
+ * (whitespace-bearing sentences), and option-like leading `-` (Skill-arg boundary).
+ * Does not fetch, normalize, or judge content.
  */
 export function requireAuthorityRef(value: string | undefined): string {
-  if (value === undefined || value.trim() === "") {
-    throw new CliUsageError("--authority-ref requires a nonempty durable reference");
-  }
-  // Spec prose sentences contain whitespace; durable public refs are single tokens.
-  if (/\s/.test(value)) {
-    throw new CliUsageError(
-      "--authority-ref requires a durable reference, not inline Spec prose",
-    );
-  }
-  return value;
+  return requireSkillArgToken(value, {
+    empty: "--authority-ref requires a nonempty durable reference",
+    whitespace: "--authority-ref requires a durable reference, not inline Spec prose",
+    optionLike: "--authority-ref requires a durable reference, not inline Spec prose",
+  });
 }
 
 /**
@@ -2656,12 +2708,6 @@ export function buildNotaryTransportPrompt(
   return appendEngineSessionMaterial([NOTARY_FIXED_KICKOFF], engineMaterial).join("\n");
 }
 
-/**
- * Parse Reviewer-specific argv after the `reviewer` token.
- * Public flags: --project, required --base, optional repeatable --authority-ref.
- * Reviewer gathers its own evidence; users submit neither attachments nor capability packets.
- * Caller instruction remains scope/procedure provenance — not Spec authority.
- */
 /**
  * Parse Gleaner-Left argv after the `gleaner-left` token.
  * Public flags: --project, required --base. No --attach / ticket face (unanchored self-fetch).
@@ -2822,6 +2868,7 @@ export function parseReviewerArgv(
   const authorityRefs: string[] = [];
   let project: string | undefined;
   let baseRevision: string | undefined;
+  let lens: ReviewerLens | undefined;
   const positional: string[] = [];
   const tokens = [...args];
   const definitions = roleOptions("reviewer");
@@ -2840,7 +2887,12 @@ export function parseReviewerArgv(
         continue;
       }
       if (taken.def.id === "base") {
-        baseRevision = requireOptionPath(taken.def.canonical, taken.value);
+        baseRevision = requireReviewerBaseRevision(taken.value);
+        continue;
+      }
+      if (taken.def.id === "lens") {
+        // Empty and other non-enum values share one message — do not borrow path helper.
+        lens = requireReviewerLens(taken.value);
         continue;
       }
       if (taken.def.id === "authority-ref") {
@@ -2856,12 +2908,13 @@ export function parseReviewerArgv(
     positional.push(token);
   }
 
-  // Unconditional required (e.g. --base) from typed table via shared consumer (#342).
+  // Unconditional required (--base/--lens/--authority-ref) from typed table (#342).
   options.assertRequired();
   return {
     instruction: positional.join(" "),
     attachmentPaths,
     baseRevision: baseRevision!,
+    lens: lens!,
     authorityRefs,
     ...(project === undefined ? {} : { project }),
   };
@@ -2875,8 +2928,10 @@ export type AdmitReviewerInvocationOptions = {
   instruction: string;
   attachmentPaths: readonly string[];
   baseRevision: string;
-  /** Optional durable authority references/URLs; frozen unchanged at admission. */
-  authorityRefs?: readonly string[];
+  /** Required single lens; frozen unchanged at admission. */
+  lens: ReviewerLens;
+  /** Required durable authority references/URLs; frozen unchanged at admission. */
+  authorityRefs: readonly string[];
   project?: string;
   createRunId?: () => string;
   /** Effective model for this invocation — written onto invocation.json. */
@@ -2884,9 +2939,9 @@ export type AdmitReviewerInvocationOptions = {
 };
 
 /**
- * Admit a Reviewer Role run on the fixed base only.
- * Caller instruction is optional provenance; Reviewer acquires issue/authority independently.
- * Optional authorityRefs are frozen as durable references only — not Spec prose.
+ * Admit a Reviewer Role run on the fixed base + lens + authority set.
+ * Caller instruction is optional provenance; typed fields project Skill inputs.
+ * authorityRefs are frozen as durable references only — not Spec prose.
  */
 export async function admitReviewerInvocation(
   options: AdmitReviewerInvocationOptions,
@@ -2894,11 +2949,13 @@ export async function admitReviewerInvocation(
   if (options.project !== undefined) {
     requireOptionPath("--project", options.project);
   }
-  if (options.baseRevision.trim() === "") {
-    throw new CliUsageError("--base requires a nonempty revision");
+  const baseRevision = requireReviewerBaseRevision(options.baseRevision);
+  const lens = requireReviewerLens(options.lens);
+  if (options.authorityRefs.length === 0) {
+    throw new CliUsageError("reviewer requires --authority-ref <ref>");
   }
   const authorityRefs = Object.freeze(
-    (options.authorityRefs ?? []).map((ref) => requireAuthorityRef(ref)),
+    options.authorityRefs.map((ref) => requireAuthorityRef(ref)),
   );
 
   const projectRoot = resolve(options.project ?? options.cwd);
@@ -2933,7 +2990,8 @@ export async function admitReviewerInvocation(
     principal,
     instruction,
     instructionEmpty,
-    baseRevision: options.baseRevision,
+    baseRevision,
+    lens,
     authorityRefs: [...authorityRefs],
     attachments: attachments.map((a) => ({
       provenancePath: a.provenancePath,
@@ -2961,29 +3019,40 @@ export async function admitReviewerInvocation(
     runDirectory,
     principal,
     admittedRequestPath,
-    baseRevision: options.baseRevision,
+    baseRevision,
+    lens,
     authorityRefs,
   };
 }
 
+/** Frozen Skill arg projection shared by initial and resume (never reverse-parsed). */
+export function buildReviewerSkillArgProjection(
+  admitted: Pick<AdmittedReviewerInvocation, "baseRevision" | "lens" | "authorityRefs">,
+): string {
+  return [
+    `--base ${admitted.baseRevision}`,
+    `--lens ${admitted.lens}`,
+    ...admitted.authorityRefs.map((ref) => `--authority ${ref}`),
+  ].join(" ");
+}
+
 /**
- * Build the Pi prompt transport for an admitted Reviewer request.
- * #836: caller instruction is no longer dropped (A3.5).
- * Fixed base + optional caller words + engine material.
+ * Build the host-neutral prompt transport for an admitted Reviewer request.
+ * Typed base/lens/authority project to Skill invocation args (never reverse-parsed from prose).
+ * Optional caller words + engine material follow.
  */
 export function buildReviewerTransportPrompt(
   admitted: AdmittedReviewerInvocation,
   engineMaterial?: EngineSessionMaterial,
 ): string {
-  const lines = [
-    `本次审查的固定基点：${admitted.baseRevision}`,
-  ];
+  const lines = [buildReviewerSkillArgProjection(admitted)];
   if (!admitted.instructionEmpty && admitted.instruction.trim() !== "") {
     lines.push("", admitted.instruction);
   }
   return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
 }
 
+
 /**
  * Parse Merger-specific argv after the `merger` token.
  * Spellings from PUBLIC_OPTION_TABLE.merger; internal packet fields rejected (#342).