@azure-id/orc 1.9.1 → 2.0.2

package/templates/skills/_shared/return-validation.md

@@ -4,22 +4,20 @@ Canonical procedure for validating a spawned agent's return. Every ORC lane
 (full, mini, fast, wiki, diy) runs this on EVERY return; a malformed return is
 a failure (requeue/re-dispatch with reason — lane sets the retry cap).
 
+**Read the SECTION, not the file.** Every return: §1–§3. Then ONLY the § of
+each field the slice carried — §4 `pattern`, §5 `tdd_spec`, §5b wiki, §5b.1
+graph cards, §5c the rules card, §5d `repro`. §2b only for a foreign return. §0
+only before a re-dispatch. §6 only after a wave. §7 only on a repair loop. The §
+numbers are anchors: never renumber or rename a § heading.
+
 ## 0. Is the previous attempt still ALIVE? (v1.2.0) — BEFORE anything else
 
 > **`a lane that re-dispatches over a live attempt` has broken this contract.**
 
 **A Task error does not kill the agent behind it.** Claude Code's tool call can
 fail, time out, or be cut off mid-turn while the subagent it started keeps
-running — and keeps writing files. Every rule below this line ends in
-"re-dispatch", and every one of them silently assumed a failed call meant a dead
-agent. It does not.
-
-What that costs, measured: one graded `/orc-quick` entry put THREE
-`orc-executor-opus-5-low` agents on the SAME task — 50m19s, 115m22s and
-100m53s, **266 minutes of Opus 5 for one authorised dispatch**, all editing the
-same files, inside a 2h04m window. The second was dispatched 4m19s after the
-first, while the first was still working. The hook had recorded all three; no
-lane had ever read that record.
+running — and keeps writing files. Every rule below ends in "re-dispatch";
+none of them may assume that a failed call means a dead agent.
 
 ### The rule
 
@@ -49,8 +47,7 @@ A usage limit, an API error, a dropped connection or a `Ctrl+C` between a
 dispatch and its return says **nothing** about the agent. Treat it as §0 exit 2
 and ask. A lane that classifies an interruption as a failure re-dispatches into
 a live agent, gets interrupted again sooner because it is now paying twice, and
-the loop tightens on itself — which is exactly how the 266-minute entry
-happened.
+the loop tightens on itself.
 
 ### What refusing looks like
 
@@ -102,64 +99,14 @@ is on the wrong model.)
 
 ## 2b. A FOREIGN return — the SUBSTITUTION check (v0.50.0)
 
-A foreign worker (`orc extra dispatch`, `_shared/extra-dispatch.md`) is not a
-Claude subagent. It has no injected system-prompt model-id line, so **it cannot
-carry `actual_model`** — and §2 must not be faked for it. A foreign return that
-claimed an `actual_model` would be claiming evidence that does not exist.
-
-It carries instead, and every one of these is quoted from the wire rather than
-assumed:
-
-- `engine` (`api` | `claude-shim` | `cli`), `provider`, `profile`
-- `model_requested` — what the route row asked for
-- **`model_reported`** — the `model` field the endpoint echoed back
-- `usage` — the four token kinds, never blended, **or `null`**
-
-**`model_reported != model_requested` is ⛔ SUBSTITUTION**, surfaced to the user
-exactly as ⛔ DOWNGRADE is today and never silently accepted. It is the only
-defence against an aggregator quietly serving something else. `unknown` is a
-valid, honest value and is reported as `unknown` — **never as a match**.
-
-**A clean model check is not a clean answer.** An aggregator's *provider-level*
-fallback is on by default and it PRESERVES the model id, so the substitution
-check reads clean while the code went to a different company. Engine `api`
-records the response's `provider` echo and reports **⚠ REROUTE**; the other two
-engines cannot see it at all, and their `served_by_note` says so. An absent
-measurement is never a pass.
-
-**`usage: null` is not four zeros.** A worker that reported no token counts
-(engine `cli` frequently) returns `null` plus a note. `{0,0,0,0}` would tell
-`/orc-budget` the run was free. Engine `api`'s `cache_write: 0` is the opposite
-case — a real measurement — so the two must never be normalised together.
-
-**The fence is per-engine, and the return says which one it had.** Engine `api`
-ENFORCES `declared_files`; engines `claude-shim` and `cli` ASK. A return
-carrying `fence: {declared_files: false}` means the list was an instruction, not
-a rule — treat §6 below as the only real check, and say so to the user rather
-than reporting a constraint that was never applied.
-
-**A RESUMED foreign dispatch owes three more fields** (v0.54.0). The dispatch
-return sets `resume_expected: true`, so the obligation is never inferred:
-
-- **`resume_state`** — `continued` · `restarted` · `no-op`. Absent on a slice
-  with no `resumed_from` is correct; **absent on a resume slice is MALFORMED.**
-  A return claiming `restarted` while `preexisting[]` was non-empty is a
-  FINDING, not a failure — it is how `/orc-retro` learns which providers ignore
-  a resume preamble, so surface it rather than treating it as a bad return.
-- **`preexisting_read[]`** — which pre-existing files the worker actually
-  opened. Quoted like `wiki_used`: **what it did, never what the dispatcher
-  assumed.** An EMPTY list on a resume whose `preexisting[]` was not empty is an
-  honest and informative return — it says the worker ignored the preamble — and
-  it must be surfaced, never dropped.
-- **`journal_fidelity`** — relayed from the dispatch return (`per-turn` |
-  `streamed-opaque`), so a validator never reports `streamed-opaque` evidence as
-  if it had per-turn tool attribution.
-
-Everything else in this file applies to a foreign return unchanged: the
-honest-status rules, the pattern attestation, the TDD attestation, the wiki
-attestation, and above all **§6, the worktree delta** — which is engine-blind
-because it reads the worktree rather than the return, and is therefore what
-makes a foreign executor safe at all.
+Read this § only when `extra_enabled` and the return came from `orc extra
+dispatch`. A foreign worker has no system-prompt model-id line, so **it cannot
+carry `actual_model`** — never fake §2 for it. **`model_reported !=
+model_requested` is ⛔ SUBSTITUTION**, surfaced exactly as ⛔ DOWNGRADE. A
+RESUMED foreign dispatch also owes `resume_state`, `preexisting_read[]` and
+`journal_fidelity`. The full check — the wire fields, ⚠ REROUTE, `usage: null`,
+the per-engine fence and the resume fields — is `extra-dispatch.md`
+§The return contract delta. Every other § of this file applies unchanged.
 
 ## 3. Honest-status rules (executor returns)
 

package/templates/skills/_shared/review-slice.md

@@ -0,0 +1,79 @@
+# The review slice — the ONE shape every lane uses
+
+> **On demand.** Read this file ONLY when a review dispatch is about to be built
+> (`/orc` Phase 5 and its composed DIY layer, `orc-review-verify/core.md`, the
+> `/orc-quick` review offer, the `/orc-mini` risk-high option, the `/orc-pr-driver`
+> per-layer gate, `/orc-ultra` gate 3). One slice, so a review in quick is the
+> same review as in `/orc`. The procedure and the return live in the agent file
+> (`.claude/agents/orc-reviewer-opus-5-med.md`), never here.
+
+Slice fields: changed_files[] · diff_ranges[] · acceptance_criteria[] · constraints[] · code_pattern · invariants[] · validation_gate[] · fe_rules[] · security_checklist[] · graph_changes · tool_findings[] · gotcha_card · rules_card · previous_findings[] · mode
+
+## §1 R1 — the free check (before ANY review dispatch)
+
+The free check always runs before the paid one. On the changed files only:
+
+1. Run the project's OWN lint and type check. Take the commands from
+   `wiki-meta.json` `commands`; else the `package.json` scripts named `lint` /
+   `typecheck`; else the `pyproject` / `Makefile` targets of those names; else
+   `sonar-scanner` when the project already has it. **Never invent a command.
+   Never install tooling.** No command found → `tool_findings[]` is empty; say so
+   in one line.
+2. Run `orc rules lint --diff` (free, zero tokens).
+3. Keep only the output lines that land on a changed file → `tool_findings[]`
+   (`{tool, location, message}`). **The reviewer must not re-report them.**
+
+`/orc-ultra` gate 3 reuses this step (it does not run a second copy); a fix wave
+that changed files re-runs it first.
+
+## §2 The fields
+
+| Field | Source |
+|---|---|
+| `changed_files[]`, `diff_ranges[]` | git — `diff_ranges` are the changed line ranges per file (R2) |
+| `acceptance_criteria[]`, `constraints[]` | the plan / the quick entry |
+| `code_pattern`, `invariants[]`, `validation_gate[]` | the pattern cache (or null / empty) |
+| `fe_rules[]`, `security_checklist[]` | FE diffs / `mode: security` only, else empty |
+| `graph_changes` | `orc graph changes --if-enabled --json` — **keeps its rows: no `--brief` here** |
+| `tool_findings[]` | §1 |
+| `gotcha_card` | `orc gotcha card --files <changed csv> --lane <lane> --json` → `text` |
+| `rules_card` | `orc rules slice --lane <lane> --json` → `text` (a lane with no rules → null) |
+| `previous_findings[]` | the checkpoint, on a re-review ONLY (R9), each with its outcome |
+| `mode` | `review` · `disprove` · `security` |
+
+- **`graph_changes`** (`code-graph.md` §7): the symbols THIS diff's hunks overlap,
+  each with its callers, its tests and a risk word that carries its own reason.
+  The reviewer is handed `symbols[].caller_files` and reads them.
+It replaces a whole-file `orc graph impact` here: a file card reports every symbol in
+a touched file, and a symbol nobody edited is not a finding. An unchanged caller of
+a changed signature is a finding candidate, anchored like any other.
+- **`gotcha_card` is ALWAYS built** when anything matches — no switch removes it
+  (`gotcha_card_budget` is only its size). Exit 1 (no match) → null, the normal
+  case. Its header counts what the budget dropped; never cut it silently.
+  The session hook ALSO hands it to every `orc-reviewer-*`, `orc-verifier-*` and
+  `orc-judge-*` at `SubagentStart` (v2.0.2), so a slice that forgot it still has it.
+  Before the card, run `orc gotcha sync --json` (it is due at most once per
+  `gotcha_sync_hours`); exit 2 (a CLI that has no `sync`) or any failure → go on.
+- **`mode: disprove`** carries only the P0/P1 findings to test and their files.
+
+## §3 After the return — the after-filter (R10)
+
+The reviewer reports EVERY finding. Then, before the ladder acts:
+
+1. Pipe the findings to `orc gotcha filter --findings - --json`. It drops P2/P3
+   that a `suppress` gotcha names, folds P3 above 5 into `+N similar`, and applies
+   the category noise budget. **It never removes a P0 or P1.** Keep its `kept`;
+   list its `removed[]` (each with the `by` id) in the run summary — a count is
+   not consent.
+2. `pre_existing: true` findings (on a line outside `diff_ranges`) go to their own
+   bucket. They never gate.
+3. A P0/P1 with no `scenario`, or with `confidence: low`, becomes P2.
+4. Findings that share a `group` are ONE fix: the P0 fix, the P1 ask and the P2
+   batch are made per group (R7).
+
+5. At review close, record one observation per finding and emit the
+   `FINDING-OUTCOME` line — `gotchas.md` §10 "Review close" (`/orc` Phase 7,
+   `/orc-mini` after its risk option, `/orc-quick` after the review offer).
+
+**Superpowers path** (DE-13): after the Superpowers review skill returns, run
+this §3 on its findings too, outcomes included — never a second reviewer dispatch.

package/templates/skills/_shared/smoke-gate.md

@@ -1,28 +1,46 @@
-# Smoke gate (read-only build + test ship gate)
-
-Canonical procedure for the smoke gate run by orc-mini (Phase M) and orc-fast
-(Phase F3). The gate is the orchestrator's INDEPENDENT check — the executor's
-`evidence` is a claim; your run is the verification (when they disagree, say
-so). Running build+test is read-only and is NOT implementation: you still
-never write code.
-
-## Procedure
-
-1. Discover the commands: prefer the wiki manifest's `commands` block when it
-   exists (recorded at scan time — don't rediscover tooling); otherwise detect
-   the stack's build + test runner once and say which you chose.
-2. Run build, then the fast test suite, once each.
-3. Verdict (emit the `VERDICT pass|fail` trace line):
-   - **GREEN** → proceed to the lane's next step (test-ask / ship).
-   - **RED** → **never offer commit/ship.** Surface the failure verbatim, then
-     ONE repair round: re-dispatch the SAME executor with the failing output
-     as `failure_reason`, and re-run this gate. A second RED → STOP and
-     surface; the lane names its escalation options (mini: stop; fast:
-     escalate to orc-mini / switch to full `/orc` / stop).
-   - **No runnable build/test** (docs-only repo) → say so explicitly; the
-     gate is N/A — never silently skip it.
-
-## What it is not
-
-Smoke, not verification: no findings classification, no criteria matrix, no
-severity ladder. A run that needs that depth belongs in the full lane.
+# Smoke gate (read-only build + test ship gate)
+
+Canonical procedure for the smoke gate run by orc-mini (Phase M) and orc-fast
+(Phase F3). The gate is the orchestrator's INDEPENDENT check — the executor's
+`evidence` is a claim; your run is the verification (when they disagree, say
+so). Running build+test is read-only and is NOT implementation: you still
+never write code.
+
+## Procedure
+
+1. Discover the commands: prefer the wiki manifest's `commands` block when it
+   exists (recorded at scan time — don't rediscover tooling); otherwise detect
+   the stack's build + test runner once and say which you chose.
+2. Run build, then the fast test suite, once each.
+3. Verdict (emit the `VERDICT pass|fail` trace line):
+   - **GREEN** → proceed to the lane's next step (test-ask / ship).
+   - **RED** → **never offer commit/ship.** Run the flaky check first
+     (§Flaky). Still red → surface the failure verbatim, then
+     ONE repair round: re-dispatch the SAME executor with the failing output
+     as `failure_reason`, and re-run this gate. A second RED → STOP and
+     surface; the lane names its escalation options (mini: stop; fast:
+     escalate to orc-mini / switch to full `/orc` / stop).
+   - **No runnable build/test** (docs-only repo) → say so explicitly; the
+     gate is N/A — never silently skip it.
+
+## Flaky — before any repair round
+
+**Everywhere a test runs** (this gate, `/orc-quick` §3.2, `/orc` verify's TDD
+gate, every repair loop): a RED test run gets ONE identical re-run of ONLY the
+failing tests, before any repair. Save both outputs, then ask the CLI — never
+judge it yourself:
+
+`orc ci flaky --first <log> --rerun <log> [--rerun-exit <n>] --json`
+
+- `--first` alone names the failing tests to re-run (`tests_failed[]`).
+- Exit 0 = **FLAKY**: every failing test passed on the re-run. Emit its
+  `gate_line` (`GATE flaky :: <tests>`), report the tests, and do NOT start a
+  repair round. A flaky run is not red and does not use a round.
+- Exit 1 = red (a test failed again, did not run, or the re-run exited ≠ 0) →
+  the repair round as usual. Exit 3 = no test name in the log → red.
+- One re-run only. Never re-run until green.
+
+## What it is not
+
+Smoke, not verification: no findings classification, no criteria matrix, no
+severity ladder. A run that needs that depth belongs in the full lane.

package/templates/skills/context-combiner/SKILL.md

@@ -1,20 +1,10 @@
 ---
 name: context-combiner
 description: >
-  Combines 2+ RELATED, already-confirmed ORC analyses (from orc-analyze) into
-  ONE merged, deduped, conflict-resolved requirement context before build. Use
-  when the user analyzed multiple related documents within the same scope and
-  chose "pass to context-combiner" at orc-analyze's Phase F. Verifies the source
-  analyses actually overlap (shared files/requirements/scope) and challenges the
-  user if they look unrelated; pools ALL source requirements into one table and
-  reconciles them (exact/semantic duplicates, partial overlaps split — never
-  collapsed, conflicts, ordering) one issue at a time; proves NOTHING WAS LOST
-  via a source coverage matrix and a 100% coverage gate before handoff;
-  spot-checks inherited evidence and marks stale anchors; writes
-  combined-report.md + combined-requirement-spec.md, which reuse the
-  requirement-spec schema, so the planner/build pipeline is unchanged. Full
-  lane only. The orchestrator DISPATCHES this to a subagent — it never
-  combines itself, and the combiner never spawns subagents.
+  Internal to /orc: merges 2+ RELATED, confirmed orc-analyze analyses into ONE
+  deduped, conflict-resolved requirement context. Dispatched when the user picks
+  "pass to context-combiner" at orc-analyze's Phase F.
+disable-model-invocation: true
 ---
 
 # CONTEXT-COMBINER
@@ -31,7 +21,7 @@ it were a single analysis — with PROOF that no source requirement was lost.
 ## Hard rules
 
 1. **Dispatched, not self-run.** The orchestrator coordinates; the Combiner
-   subagent (Opus 5 high) reads the specs and reconciles them against each
+   subagent (Opus 5.5 high) reads the specs and reconciles them against each
    other. The combiner NEVER builds and NEVER spawns subagents.
 2. **Related only — verify + challenge.** The user asserted relatedness at the
    Phase F gate, but the combiner MUST verify real overlap (shared files,
@@ -80,11 +70,9 @@ it were a single analysis — with PROOF that no source requirement was lost.
 
 ## Phases
 
-`orc lane phases context-combiner --json` is this lane's pipeline: the ordered list, where
-each phase lives, and how much of it to read. **The CLI owns the order** — never
-derive it from the headings below, and never renumber or rename one without the
-manifest, because a `read: section` pointer names a HEADING and a renamed heading
-is a pointer into nothing.
+`orc lane phases context-combiner --json` is this lane's pipeline. **The CLI owns the order**:
+never derive it from the headings below, and never rename or renumber one
+without the manifest (`../_shared/lane-contract.md` §Phases).
 
 ## Phase A — Load sources
 Read every source `requirement-spec.md` (2+) the orchestrator hands you, plus
@@ -194,29 +182,12 @@ withheld until the open conflict is resolved and coverage is complete.
 ## No mini variant
 Full lane only. `orc-analyze-mini` / `orc-mini` do not use the combiner.
 
-## Config
+## Lane contract (`../_shared/lane-contract.md` — read it ONLY when a call exits ≠ 0)
 
-Resolve with `orc lane config context-combiner --json` and obey `effective`. Never merge
-`.claude/orc.config.yaml` yourself, and never re-derive a precedence. Exit ≠ 0 →
-say so and use `../_shared/config-precedence.md`'s documented defaults, out
-loud. Nothing this lane reads is contested, gated or a stop, so it owes no
-preflight line and has no gate to honour.
-
-## Calls
-
-**ONE catalogue, and it is not you:** `orc lane calls context-combiner --json` names every
-CLI call this lane makes, each with its exit-code contract, its cost, when to run
-it, and what an EMPTY answer means. Never invent a spelling, never re-word an
-exit code, and never re-derive a state word — the CLI's state words are the only
-state words, and **an exit code is an ANSWER wherever that contract says so, not
-a failure**. A call the answer does not name is a call this lane does not make.
-Exit ≠ 0 from the catalogue itself → say the CLI is unavailable and name the
-command you are about to run, out loud, before running it.
-
-## Rules — the anti-slop card (`../_shared/phases/rules.md`)
-
-`orc rules slice --lane context-combiner --json` is the ONLY assembler; never build
-the card here. It rides under the house rules and above the task —
-**house rules > your project's rules > ORC's own packs** — and its `line` prints
-VERBATIM at preflight. Returns gain `rules_applied[]`, `rules_conflicts[]` (a gap,
-never a silent choice) and `rules_overridden[]`.
+- **Calls:** `orc lane calls context-combiner --json` names every call and its exit codes.
+  **An exit code is an ANSWER where it says so, not a failure.** Make no other call.
+- **Config:** `orc lane config context-combiner --json`. Obey `effective`. Never merge
+  `.claude/orc.config.yaml` yourself (`../_shared/config-precedence.md`). Nothing
+  here is contested, gated or a stop: no preflight line, no gate to honour.
+- **Rules:** `orc rules slice --lane context-combiner --json` is the ONLY assembler
+  (`../_shared/phases/rules.md`). Its `line` prints VERBATIM at preflight.

package/templates/skills/context-combiner/schemas/combined-report.md

@@ -1,78 +1,78 @@
-# Template — Combined Analysis Report
-
-Human-readable source of truth for a MERGE of 2+ related analyses. Written to
-orc/analyzer/combined-{name}/combined-report.md. Copied OUT to
-{report_out_dir}/combined-{name}/ on "stop here".
-
-```markdown
-# Combined Analysis Report — {combined-name}
-kind: combined
-combined_from: [analysis-A, analysis-B, ...]   # source analysis names
-scope: <the shared scope X these analyses live in>
-combined_at: DDMMYY HH:MM:SS
-combined_against: <git HEAD short sha the evidence spot-check ran against>
-model: opus-5-high        # the RESOLVED model of the combiner that produced
-                          #   this — never copied from here
-
-## Relatedness check
-How the source analyses overlap — shared files, overlapping requirements,
-shared scope. If overlap was weak, the user was challenged and their decision
-is recorded here.
-- Shared files: web/reports/x (analysis-A R1, analysis-B R2)
-- Overlapping requirement: both add export to the reports module
-- Verdict: related (confirmed) | combined-anyway (user override) | ...
-
-## Merged requirements (deduped, ordered)
-Every row carries file:line evidence inherited from the source spec (the
-combiner trusts confirmed specs; it does not re-derive the code) — spot-checked
-against `combined_against`; anchors that no longer match are marked STALE and
-were challenged, never silently carried. SEMANTIC-DUPLICATE merges quote both
-original statements. PARTIAL-OVERLAP rows are split (shared + residue), never
-collapsed. `Depth` is shown when sources differ in depth.
-
-| # | Requirement (merged) | From | Depth | Code reality | Evidence (file:line) | Files/modules | Status |
-|---|----------------------|------|-------|--------------|----------------------|---------------|--------|
-| 1 | "add CSV export"     | A.R1 | deep | HTML only    | web/reports/view.x:30 | web/reports/x | buildable |
-| 2 | "reuse report auth"  | A.R2, B.R3 (dedup) | standard | guard present | web/reports/routes.x:12 (STALE — user chose proceed) | web/reports/x | exists |
-
-## Source coverage matrix (conservation proof)
-EVERY source requirement ID appears exactly once with exactly one Outcome.
-`dropped` requires a recorded user decision in combine-decisions.md. The gate
-below must show coverage_pct: 100 before this report can hand off to build.
-
-| Source ID | Outcome | Merged as | Decision ref |
-|-----------|---------|-----------|--------------|
-| A.R1 | merged | #1 | — |
-| A.R2 | deduped-into | #2 | — |
-| B.R2 | conflict-resolved | #3 | combine-decisions.md #2 |
-| B.R3 | deduped-into | #2 | — |
-| B.R4 | dropped | — | combine-decisions.md #4 (user: superseded by A.R1) |
-
-- source requirements total: {N} · accounted: {N} · coverage_pct: 100
-
-## Additional context (do not build)
-Anchored, non-actionable context merged from the sources — each item re-pointed at
-the merged requirement it serves. Dedupe ONLY when the evidence anchor is the same
-file:line AND the notes convey the same constraint — near-identical notes are kept,
-both, with their own From tags. Read for understanding; never a task. Omit this
-whole section if no source carried context.
-| Anchor (merged #) | From | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|-------------------|------|-----------|------------|-----------------------|----------------------|
-| 1 (CSV export) | A.ctx | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
-
-## Cross-scope conflicts & decisions
-Every conflict/duplicate/partial-overlap/ordering issue found across sources
-(including contradictory resolved assumptions), each raised as a
-recommended-option challenge and resolved. Decisions are also checkpointed
-eagerly in combine-decisions.md.
-- CONFLICT (resolved): A.R4 wants offset paging, B.R2 wants cursor — user chose cursor.
-- DUPLICATE (merged): A.R2 and B.R3 both reuse auth — merged into #2.
-- PARTIAL-OVERLAP (split): A.R5 subsumes B.R1 — shared row #4, A-only residue row #5.
-- ORDERING (structured): before: #1 (A export) → after: #6 (B schedule).
-
-## Open questions (block handoff until resolved)
-- (none) | UNRESOLVED: ... — combiner refuses build handoff while any remain.
-
-## Handoff readiness
-- complete: yes/no   (coverage_pct == 100, all conflicts resolved, no open UNRESOLVED)
-```
+# Template — Combined Analysis Report
+
+Human-readable source of truth for a MERGE of 2+ related analyses. Written to
+orc/analyzer/combined-{name}/combined-report.md. Copied OUT to
+{report_out_dir}/combined-{name}/ on "stop here".
+
+```markdown
+# Combined Analysis Report — {combined-name}
+kind: combined
+combined_from: [analysis-A, analysis-B, ...]   # source analysis names
+scope: <the shared scope X these analyses live in>
+combined_at: DDMMYY HH:MM:SS
+combined_against: <git HEAD short sha the evidence spot-check ran against>
+model: opus-5-5-high      # the RESOLVED model of the combiner that produced
+                          #   this — never copied from here
+
+## Relatedness check
+How the source analyses overlap — shared files, overlapping requirements,
+shared scope. If overlap was weak, the user was challenged and their decision
+is recorded here.
+- Shared files: web/reports/x (analysis-A R1, analysis-B R2)
+- Overlapping requirement: both add export to the reports module
+- Verdict: related (confirmed) | combined-anyway (user override) | ...
+
+## Merged requirements (deduped, ordered)
+Every row carries file:line evidence inherited from the source spec (the
+combiner trusts confirmed specs; it does not re-derive the code) — spot-checked
+against `combined_against`; anchors that no longer match are marked STALE and
+were challenged, never silently carried. SEMANTIC-DUPLICATE merges quote both
+original statements. PARTIAL-OVERLAP rows are split (shared + residue), never
+collapsed. `Depth` is shown when sources differ in depth.
+
+| # | Requirement (merged) | From | Depth | Code reality | Evidence (file:line) | Files/modules | Status |
+|---|----------------------|------|-------|--------------|----------------------|---------------|--------|
+| 1 | "add CSV export"     | A.R1 | deep | HTML only    | web/reports/view.x:30 | web/reports/x | buildable |
+| 2 | "reuse report auth"  | A.R2, B.R3 (dedup) | standard | guard present | web/reports/routes.x:12 (STALE — user chose proceed) | web/reports/x | exists |
+
+## Source coverage matrix (conservation proof)
+EVERY source requirement ID appears exactly once with exactly one Outcome.
+`dropped` requires a recorded user decision in combine-decisions.md. The gate
+below must show coverage_pct: 100 before this report can hand off to build.
+
+| Source ID | Outcome | Merged as | Decision ref |
+|-----------|---------|-----------|--------------|
+| A.R1 | merged | #1 | — |
+| A.R2 | deduped-into | #2 | — |
+| B.R2 | conflict-resolved | #3 | combine-decisions.md #2 |
+| B.R3 | deduped-into | #2 | — |
+| B.R4 | dropped | — | combine-decisions.md #4 (user: superseded by A.R1) |
+
+- source requirements total: {N} · accounted: {N} · coverage_pct: 100
+
+## Additional context (do not build)
+Anchored, non-actionable context merged from the sources — each item re-pointed at
+the merged requirement it serves. Dedupe ONLY when the evidence anchor is the same
+file:line AND the notes convey the same constraint — near-identical notes are kept,
+both, with their own From tags. Read for understanding; never a task. Omit this
+whole section if no source carried context.
+| Anchor (merged #) | From | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|-------------------|------|-----------|------------|-----------------------|----------------------|
+| 1 (CSV export) | A.ctx | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
+
+## Cross-scope conflicts & decisions
+Every conflict/duplicate/partial-overlap/ordering issue found across sources
+(including contradictory resolved assumptions), each raised as a
+recommended-option challenge and resolved. Decisions are also checkpointed
+eagerly in combine-decisions.md.
+- CONFLICT (resolved): A.R4 wants offset paging, B.R2 wants cursor — user chose cursor.
+- DUPLICATE (merged): A.R2 and B.R3 both reuse auth — merged into #2.
+- PARTIAL-OVERLAP (split): A.R5 subsumes B.R1 — shared row #4, A-only residue row #5.
+- ORDERING (structured): before: #1 (A export) → after: #6 (B schedule).
+
+## Open questions (block handoff until resolved)
+- (none) | UNRESOLVED: ... — combiner refuses build handoff while any remain.
+
+## Handoff readiness
+- complete: yes/no   (coverage_pct == 100, all conflicts resolved, no open UNRESOLVED)
+```

package/templates/skills/orc/README.md

@@ -94,11 +94,11 @@ codifier: 9 language playbooks + a11y/perf rule packs), `context-combiner`
 ## Key behaviors to know
 
 - **The orchestrator NEVER implements — it always spawns scored subagents,
-  even for tiny tasks.** Orchestrator (Opus 4.8 high, or Opus 5 / Fable 5 at
+  even for tiny tasks.** Orchestrator (Opus 4.8 high, or Opus 5.5 / Fable 5 at
   medium+) only coordinates; each task's 0–100 score (computed arithmetically
   from the planner's per-task `facets`) maps to a named executor agent via the
   single 6-band table in `config.md` (`rubric_bands` = report granularity only),
-  Haiku 4.5 [0,30) → Opus 5 low [65,90) → Opus 5 medium [90,100].
+  Haiku 4.5 [0,30) → Opus 5.5 low [65,90) → Opus 5.5 medium [90,100].
 - **Every executor slice carries** the intent-spec constraints, the task's
   sliced acceptance criteria, the standing
   house-rules card, and — when a code-pattern is resolved — your project's