@azure-id/orc 1.9.2 → 2.0.2

package/templates/skills/orc/subskills/orc-execution/subagent.md

@@ -1,13 +1,14 @@
-# orc-execution — Subagent wrapper (orchestrator prepends this at spawn)
-
-You are an isolated execution worker. You have no memory of the wider run
-beyond the slice below. Do exactly one task.
-
-- Work only within your slice's declared_files and worktree_path (if set).
-- Do not touch the checkpoint, state-of-play, or the raw decision log — your
-  log_entries are returned, and the orchestrator appends them.
-- Emit milestone pings as you progress.
-- When done (or blocked), emit the return structure from `core.md` and STOP.
-  Do not continue past your task.
-
-[Orchestrator: append the input slice here at spawn time.]
+# orc-execution — Subagent wrapper (orchestrator prepends this at spawn)
+
+You are an isolated execution worker. You have no memory of the wider run
+beyond the slice below. Do exactly one task.
+
+- Work only within your slice's declared_files and worktree_path (if set).
+- Do not touch the checkpoint, state-of-play, or the raw decision log — your
+  log_entries are returned, and the orchestrator appends them.
+- Emit milestone pings as you progress.
+- When done (or blocked), emit the return structure your agent file defines
+  and STOP.
+  Do not continue past your task.
+
+[Orchestrator: append the input slice here at spawn time.]

package/templates/skills/orc/subskills/orc-review-verify/SKILL.md

@@ -17,58 +17,17 @@ description: >
 
 # orc-review-verify
 
-One entry point: spawned via the Task tool with `subagent.md` framing + the
-slice, which points to `core.md`. `core.md` is the AUTHORITATIVE spec (full input
-slice, both procedures, return contract); the summary below orients — on any
-conflict, `core.md` wins.
-
-## What the worker does (summary)
-
-- **phase=review:** examine `changed_files[]` against `code_pattern` + `constraints[]`;
-  create/update tests for the changed surface; independently re-check each
-  `invariants[]` rule AND each enforceable `validation_gate[]` line against the
-  diff (a violation is P0), plus any `fe_rules[]` pack rules on FE diffs
-  (file:line findings, P1–P3 by impact, never auto-P0); classify EVERY
-  finding on the ladder — **P0** (failing tests/build, unmet acceptance
-  criteria, runtime errors, invariant violations — caller auto-fixes, no ask),
-  **P1** (correctness/security risk, constraint violations — caller asks the
-  user before fixing), **P2** (maintainability — advisory fix-batch offer),
-  **P3** (cosmetic — advisory, counted). Never fix P2/P3; P0/P1 fixes are the
-  caller's call. **Evidence-or-advisory:** every P0–P2 finding carries
-  `file:line` + the offending line(s) quoted VERBATIM; an unanchored finding is
-  AUTO-P3 (never gates, never triggers a fix) — the caller spot-checks quotes
-  before acting on P0/P1.
-- **phase=verify (two halves, v0.33.0):** FIRST the **TDD gate** — run the
-  plan's TDD suite (`tdd_suite[]` in the slice) plus the build + full test
-  suite; green is the definition-of-done for non-exempt requirements, and each
-  red TDD test is a P0 tied to its requirement (the caller owns the
-  `tdd_loop_max` repair loop). THEN the **adversarial review** — attack the
-  green implementation: edge cases the spec missed, error paths, contract
-  violations, race/ordering, workflow breaks (dead wiring, broken commands) —
-  findings on the same P0–P3 ladder. Also fold the enforceable
-  `validation_gate[]` lines into the criteria set, then check EACH criterion
-  individually (pass/fail, nothing invented; an unmet gate line = unmet
-  criterion = P0), each with per-criterion `evidence` (the test/output line or
-  file:line that proves it); report failures precisely. You don't fix — the
-  caller owns the auto-fix-once loop.
-- **phase=security (opt-in):** sweep only `changed_files[]` against the supplied
-  `security_checklist[]` (wrap Semgrep if installed, never install it); findings
-  on the same ladder (exploitable-in-diff = P0, hardening gap = P1,
-  defense-in-depth = P2/P3). Report-only, no `result` verdict.
-
-## Return shape (summary — full contract in `core.md`)
-
-`{ phase, findings[]{severity: P0|P1|P2|P3, location "file:line", quote (verbatim,
-required P0–P2; unanchored ⇒ AUTO-P3), description, criterion},
-criteria[] (verify only){criterion, result, evidence}, tests{added,updated,passing},
-result (verify only): passed|failed, actual_model, actual_effort, failure_reason }`
-
-**Validation checkpoint before returning:** every finding carries a `severity`
-from the P0–P3 ladder; every P0–P2 finding carries `file:line` + a VERBATIM
-`quote` (else downgrade it to P3 yourself);
-verify sets `result` + per-criterion `evidence`; `actual_model` is quoted
-VERBATIM (never inferred). A
-malformed return is treated as failure by the caller.
+A pointer. The orchestrator spawns the agent via the Task tool, prepending
+`subagent.md` framing + the input slice. The worker reports; the orchestrator
+owns the auto-fix-once loop.
+
+- **Input slice** (the orchestrator builds it): `core.md`.
+- **Procedure + return contract** (the ONE source): the agent file —
+  `phase=review` and `phase=security` → `.claude/agents/orc-reviewer-opus-5-med.md`;
+  `phase=verify` → `.claude/agents/orc-verifier-opus-5-med.md`.
+- **Validator** (the caller checks every return against it):
+  `../../../_shared/return-validation.md`. A malformed return is treated as
+  failure by the caller.
 
 Fixed models (from `../../references/effort-and-mode.md`): review on the OpenSpec/self
 path = Opus 5.5 medium; review on the Superpowers path is delegated to the

package/templates/skills/orc/subskills/orc-review-verify/core.md

@@ -1,135 +1,52 @@
-# orc-review-verify — Core (mode-neutral)
-
-## Input slice
-
-- phase: review | verify | security
-- acceptance_criteria[]   — the intent-spec's definition-of-done, verbatim
-                            (verify checks EXACTLY these; nothing invented)
-- code_pattern            — resolved/user-provided style guide, or null (review bare)
-- invariants[]            — BLOCKING code-pattern rules to re-check, or empty
-                            (a violation is a P0 finding)
-- validation_gate[]       — the pattern's enforceable acceptance checks (already
-                            measurability-filtered at reconciliation), or empty.
-                            Verify treats each line as an acceptance criterion;
-                            review re-checks them against the diff.
-- fe_rules[]              — impact-ordered FE rule-pack rules (a11y/perf) when the
-                            diff touches FE files, else empty. Findings from these
-                            are P1–P3 by impact (never automatic P0), always with
-                            file:line.
-- security_checklist[]    — OWASP/STRIDE checklist items (phase=security only),
-                            else empty
-- tdd_suite[]             — (phase=verify, v0.33.0) the plan's materialized TDD
-                            acceptance tests: {requirement, test_path} per
-                            non-exempt requirement, plus the run's exemptions
-                            (`tdd: exempt — <reason>` lines). Empty on a
-                            whole-run exemption or a pre-v0.33.0 plan.
-- gotchas[]               — 0–3 repair-memory entries whose `scope` glob matches
-                            `changed_files`, or empty. A CHECKLIST, not a rule
-                            set: "has this change reintroduced a failure this
-                            project already paid for?" A confirmed hit is a
-                            normal finding, anchored and severity-classified like
-                            any other — never an automatic P0 because a gotcha
-                            named it. Empty is the normal case. Canonical:
-                            `.claude/skills/_shared/gotchas.md`.
-- changed_files[]         — the surface to examine
-- constraints[]           — intent-spec hard rules (a violation is a P1 finding)
-- model, effort           — informational
-
-## Review procedure (phase=review)
-
-1. Examine changed_files against code_pattern (if given) and constraints.
-2. Create/update test files and test cases for the changed surface.
-3. Re-check each `invariants[]` rule against the diff independently (don't trust the
-   executor's self-attestation) — any violation is a P0 finding. Re-check each
-   `validation_gate[]` line the same way — an unmet enforceable line is P0.
-4. Re-check each `fe_rules[]` rule against the FE parts of the diff; emit
-   findings with file:line, classified P1–P3 by real impact (a rule-pack hit is
-   never automatically P0 — invariants and the gate own that severity).
-5. **Evidence-or-advisory (anti-phantom rule):** every P0–P2 finding MUST carry
-   `location` as `file:line` plus `quote` — the offending line(s) copied
-   VERBATIM from the file (like `actual_model`: quoted, never reconstructed).
-   A finding you cannot anchor to a real line you read this session is
-   AUTO-P3 (advisory — it never gates ship and never triggers a fix dispatch).
-   The caller spot-checks quotes before acting on P0/P1.
-6. Classify EVERY finding on the P0–P3 ladder:
-   - P0 — objective breakage: failing tests, broken build, unmet acceptance
-     criteria, runtime errors, invariant violations. Gates ship; the caller
-     auto-fixes immediately (no ask).
-   - P1 — correctness or security risk, constraint violations (judgment-level
-     blockers that don't break the build). Gates ship; the caller asks the user
-     before fixing.
-   - P2 — maintainability: duplication, missing tests for a changed path,
-     unclear structure. Advisory; itemized in the summary as an optional fix-batch.
-   - P3 — cosmetic: naming, formatting, length, style. Advisory; counted only.
-7. Never fix P2/P3. P0/P1 fixes are the caller's decision, not yours.
-
-## Verify procedure (phase=verify — two halves, v0.33.0)
-
-**Half 1 — TDD gate (deterministic):**
-1. Run the build and full test suite — INCLUDING every `tdd_suite[]` test.
-2. Per non-exempt requirement: its TDD test green = that requirement's
-   definition-of-done met; red = a P0 finding tied to that requirement
-   (`criterion` = the requirement id). Report `tdd: {green: n, red: n,
-   exempt: n}` — the caller owns the `tdd_loop_max` repair loop; you never fix.
-   An empty `tdd_suite[]` (whole-run exemption / older plan) → skip this half
-   and SAY so in the return; never invent tests here.
-
-**Half 2 — adversarial review (attack the green implementation):**
-3. Hunt what the spec missed: edge cases (empty/zero/max inputs, unicode,
-   pagination edges), error paths (failure of each external call, partial
-   writes), contract violations (response shapes, status codes, event
-   payloads vs consumers), race/ordering hazards on shared state, and
-   workflow breaks — dead wiring (a route/handler/command nothing reaches),
-   broken commands, config keys read by nothing. Findings on the P0–P3
-   ladder with the same evidence-or-advisory rule (verbatim quote or AUTO-P3).
-
-**Criteria sweep (unchanged):**
-4. Fold every `validation_gate[]` line into the criteria set (each enforceable
-   line IS an acceptance criterion; the slice only carries enforceable ones —
-   measurability was decided at reconciliation, don't re-litigate it).
-5. Check each criterion individually — pass/fail per criterion, each with
-   `evidence`: the test name/output line that proves it, or the `file:line`
-   that satisfies it (quoted, never asserted from memory). An unmet gate
-   line is an unmet criterion (P0).
-6. Report failures precisely (which criterion, what observed). You do not fix;
-   the caller owns the auto-fix-once loop.
-
-## Security procedure (phase=security — opt-in, config `security_review`)
-
-1. Sweep ONLY `changed_files[]` against each `security_checklist[]` item
-   (OWASP/STRIDE-derived; supplied in the slice, never invented).
-2. If Semgrep is installed in the environment (`semgrep --version` succeeds),
-   run it scoped to the changed files and fold its results in; skip silently
-   otherwise — never install tooling.
-3. Findings on the same P0–P3 ladder: a directly exploitable flaw introduced by
-   the diff (injection, authz bypass, secret in code) is P0; a hardening gap or
-   risky-but-guarded path is P1; defense-in-depth suggestions are P2/P3.
-4. Report only; you never fix. Same return contract (no `result` field —
-   security is a findings pass, not a verdict).
-
-## Return contract (emit EXACTLY this)
-
-- phase
-- findings[]: { severity: P0|P1|P2|P3, location ("file:line" — REQUIRED for
-               P0–P2), quote (offending line(s) VERBATIM — REQUIRED for P0–P2;
-               missing/unanchored ⇒ the finding is AUTO-P3), description,
-               criterion|null }
-- criteria[] (verify only): { criterion, result: pass|fail, evidence — the test
-               name/output line or file:line that proves it }
-- tdd (verify only): { green: int, red: int, exempt: int } — the TDD-gate tally
-               (omit only when the slice carried no tdd_suite[])
-- tests: { added: int, updated: int, passing: "x/y" }
-- result (verify only): passed | failed
-- actual_model — the model id quoted VERBATIM from your system prompt ("The exact
-                 model ID is …"); NEVER inferred; `unknown` if absent
-- actual_effort — the value of $CLAUDE_EFFORT (read via Bash)
-- failure_reason — required if the pass itself could not run; else null
-- gotcha_recorded — REQUIRED only when a repair loop CLOSED inside this same run
-                 and you re-checked it (a P0/P1 you raised and that was fixed; a
-                 verify criterion that was unmet and is now met): the entry body
-                 {trigger, symptom, cause, fix, scope}, or `none` + a one-line
-                 reason. Not required otherwise. A finding left OPEN returns
-                 `none` — an unsolved failure is not a gotcha. You RETURN it;
-                 the caller writes the file (`_shared/return-validation.md` §7)
-
-Malformed returns are treated as failure by the caller.
+# orc-review-verify — Core (the input slice)
+
+The INPUT SLICE the orchestrator builds for ONE review, verify or security
+dispatch. The procedure and the return contract live in ONE place, the agent
+file: `phase=review` and `phase=security` → `.claude/agents/orc-reviewer-opus-5-med.md`;
+`phase=verify` → `.claude/agents/orc-verifier-opus-5-med.md`. The caller owns
+the auto-fix-once loop and the `tdd_loop_max` repair loop, and validates the
+return against `../../../_shared/return-validation.md`.
+
+## Input slice
+
+Canonical shape + how to build it: `../../../_shared/review-slice.md` (read it at
+the dispatch). The verifier gets the same `gotcha_card` + `tool_findings[]`.
+
+Slice fields: changed_files[] · diff_ranges[] · acceptance_criteria[] · constraints[] · code_pattern · invariants[] · validation_gate[] · fe_rules[] · security_checklist[] · graph_changes · tool_findings[] · gotcha_card · rules_card · previous_findings[] · mode
+
+- phase: review | verify | security
+- acceptance_criteria[]   — the intent-spec's definition-of-done, verbatim
+                            (verify checks EXACTLY these; nothing invented)
+- code_pattern            — resolved/user-provided style guide, or null (review bare)
+- invariants[]            — BLOCKING code-pattern rules to re-check, or empty
+                            (a violation is a P0 finding)
+- validation_gate[]       — the pattern's enforceable acceptance checks (already
+                            measurability-filtered at reconciliation), or empty.
+                            Verify treats each line as an acceptance criterion;
+                            review re-checks them against the diff.
+- fe_rules[]              — impact-ordered FE rule-pack rules (a11y/perf) when the
+                            diff touches FE files, else empty. Findings from these
+                            are P1–P3 by impact (never automatic P0), always with
+                            file:line.
+- security_checklist[]    — OWASP/STRIDE checklist items (phase=security only),
+                            else empty
+- tdd_suite[]             — (phase=verify, v0.33.0) the plan's materialized TDD
+                            acceptance tests: {requirement, test_path} per
+                            non-exempt requirement, plus the run's exemptions
+                            (`tdd: exempt — <reason>` lines). Empty on a
+                            whole-run exemption or a pre-v0.33.0 plan.
+- gotcha_card             — the gotcha card's `text` (slice §2), or null (no
+                            match is the normal case). ALWAYS built when anything
+                            matches. A CHECKLIST, not a rule set: a confirmed hit
+                            is a normal finding, never an automatic P0.
+- tool_findings[]         — the free check's lines on changed files (never
+                            re-reported), or empty
+- diff_ranges[], rules_card, graph_changes, previous_findings[] (re-review
+  only), mode (review · disprove · security) — as the canonical slice defines them
+- changed_files[]         — the surface to examine
+- constraints[]           — intent-spec hard rules (a violation is a P1 finding)
+- model, effort           — informational
+
+The P0–P3 ladder and the AUTO-P3 evidence rule (an unanchored finding never
+gates) are defined in the agent files. Malformed returns are treated as failure
+by the caller.

package/templates/skills/orc/subskills/orc-review-verify/subagent.md

@@ -1,7 +1,7 @@
-# orc-review-verify — Subagent wrapper (orchestrator prepends at spawn)
-
-You are an isolated review/verify worker. Examine only what the slice gives
-you. You do not fix anything — you classify, test, and report. Emit the return
-structure from core.md and STOP.
-
-[Orchestrator: append the input slice here at spawn time.]
+# orc-review-verify — Subagent wrapper (orchestrator prepends at spawn)
+
+You are an isolated review/verify worker. Examine only what the slice gives
+you. You do not fix anything — you classify, test, and report. Emit the return
+structure your agent file defines and STOP.
+
+[Orchestrator: append the input slice here at spawn time.]

package/templates/skills/orc/subskills/orc-testgen/SKILL.md

@@ -12,29 +12,18 @@ description: >
 
 # orc-testgen
 
-One entry point: spawned via the Task tool with `subagent.md` framing + the
-slice, which points to `core.md` — the AUTHORITATIVE procedure + return contract;
-the summary below orients.
+A pointer. The orchestrator spawns `orc-test-author-opus-5-med` via the Task
+tool, prepending `subagent.md` framing + the input slice. It WRITES test cases;
+it never runs them and never gates the ship.
 
-## What the worker does (summary)
-
-1. Take the slice: changed surface (`actual_files`), the intent-spec's
-   definition-of-done (acceptance criteria), touched flows, constraints, detected stack.
-2. Write **automated test files** in the project's framework, covering the changed surface.
-3. Write a manual **TEST-PLAN.md** with two separated sections — "run the automated
-   suite" (exact CLI command) and "exercise the real running service" (manual/curl steps).
-4. For an HTTP/API backend, write a Postman-importable **test-cases.http** curl bundle
-   (env-var placeholders — never real secrets).
-5. Run NOTHING. Advisory `notes[]` may flag a case the code likely won't satisfy.
-
-The manual deliverables (TEST-PLAN.md + test-cases.http) are pinned to
-**`test-generator/<change-slug>/` at the project root** — a visible user
-deliverable, never inside `.claude/` or the run folder (see `core.md`).
-
-**Validation checkpoint before returning:** confirm each promised deliverable
-actually exists on disk **at the pinned path** (test files in the project's
-conventions; TEST-PLAN.md and — when the stack exposes HTTP — test-cases.http
-under `test-generator/<change-slug>/`) before emitting the return contract in `core.md`.
+- **Input slice** (the orchestrator builds it): `core.md`.
+- **Procedure + return contract** (the ONE source): the agent file,
+  `.claude/agents/orc-test-author-opus-5-med.md`. The manual deliverables
+  (TEST-PLAN.md + test-cases.http) are pinned to
+  **`test-generator/<change-slug>/` at the project root** — a visible user
+  deliverable, never inside `.claude/` or the run folder.
+- **Validator** (the caller checks every return against it):
+  `../../../_shared/return-validation.md`.
 
 Fixed model: `orc-test-author-opus-5-med` (Opus 5.5 medium — authoring good
 integration tests is a judgment task). Opt-in: the orchestrator dispatches this

package/templates/skills/orc/subskills/orc-testgen/core.md

@@ -1,59 +1,20 @@
-# orc-testgen — Core (mode-neutral)
-
-A procedure specification: inputs, steps, outputs. Executed by a spawned
-`orc-test-author-opus-5-med` subagent; the orchestrator never runs this
-itself. **Authoring only — RUN NOTHING, GATE NOTHING.** The user tests manually.
-
-## Input slice (you receive exactly this)
-
-- changed_files[]        — the surface the change touched (from the run's actual_files)
-- acceptance_criteria[]  — the intent-spec's definition-of-done (the "new behaviour")
-- touched_flows[]        — user journeys through the changed code (may be empty)
-- constraints[]          — intent-spec hard rules
-- stack                  — {language, test_framework, is_http_api}; detect if absent
-- test_types[]           — subset of {new_behaviour, flow, change, regression}; default all
-- output_conventions     — where tests live in this repo
-
-## Procedure
-
-1. Detect stack: test framework + conventions, and whether the project exposes
-   HTTP endpoints (→ `is_http_api`).
-2. Derive a **test matrix** from changed_files + acceptance_criteria + flows —
-   one row per case {id, type, target, asserts, external_deps}. Bound regression
-   to the diff's blast radius; never test the whole app.
-3. Author **automated test files** in the project's framework/conventions where
-   feasible. Match existing test style. These stay in the project's own test
-   conventions (`output_conventions`) — do NOT move them.
-4. **Pin the manual-QA output folder.** The two manual deliverables below are
-   USER deliverables, not run state — write BOTH to
-   **`test-generator/<change-slug>/` at the PROJECT ROOT** (create the folder if
-   absent). `<change-slug>` = the run's existing kebab-case run-folder slug (e.g.
-   `post-users`). NEVER write them inside `.claude/`, and NEVER inside the run
-   folder — a hidden path is invisible for self-QA.
-5. Write **`test-generator/<change-slug>/TEST-PLAN.md`** (manual cases: scenario,
-   setup, steps, expected) with two CLEARLY SEPARATED sections:
-   - "Run the automated test suite" — the exact CLI command(s), pasted.
-   - "Exercise the real running service" — manual steps / curl.
-6. If `is_http_api`: write **`test-generator/<change-slug>/test-cases.http`** —
-   one Postman-importable `curl` per endpoint/flow (env-var placeholders for base
-   URL + auth; NEVER real secrets). Reference it from TEST-PLAN.md.
-7. Advisory only: note (do not gate) any case the code likely won't satisfy.
-
-## Return contract (emit EXACTLY this; the caller validates)
-
-- test_matrix[]         — the rows above (or counts by type)
-- files_authored[]      — automated test files created/updated
-- test_plan_path        — path to TEST-PLAN.md; MUST be inside
-                          `test-generator/<change-slug>/` (any other location is
-                          a malformed return)
-- curl_bundle_path      — path to test-cases.http (also inside
-                          `test-generator/<change-slug>/`), or null (non-API projects)
-- run_command           — exact CLI command(s) to run the authored tests
-- notes[]               — advisory gaps noticed while authoring (non-blocking); else []
-- actual_model          — model id quoted VERBATIM from your system prompt ("The
-                          exact model ID is …"); NEVER inferred; `unknown` if absent
-- actual_effort         — the value of $CLAUDE_EFFORT (read via Bash)
-- failure_reason        — required if you could not author; else null
-
-Malformed returns are treated as failure by the caller. Never run tests; never
-spawn subagents.
+# orc-testgen — Core (the input slice)
+
+The INPUT SLICE the orchestrator builds for ONE `orc-test-author-opus-5-med`
+dispatch. The procedure and the return contract live in ONE place: the agent
+file, `.claude/agents/orc-test-author-opus-5-med.md`. The orchestrator never
+runs this itself. **Authoring only — RUN NOTHING, GATE NOTHING.** The user tests manually.
+
+## Input slice (you receive exactly this)
+
+- changed_files[]        — the surface the change touched (from the run's actual_files)
+- acceptance_criteria[]  — the intent-spec's definition-of-done (the "new behaviour")
+- touched_flows[]        — user journeys through the changed code (may be empty)
+- constraints[]          — intent-spec hard rules
+- stack                  — {language, test_framework, is_http_api}; detect if absent
+- test_types[]           — subset of {new_behaviour, flow, change, regression}; default all
+- output_conventions     — where tests live in this repo
+
+The manual deliverables go to `test-generator/<change-slug>/` at the PROJECT
+ROOT (`<change-slug>` = the run's kebab-case run-folder slug). Malformed returns
+are treated as failure by the caller.

package/templates/skills/orc/subskills/orc-testgen/subagent.md

@@ -1,7 +1,7 @@
-# orc-testgen — Subagent wrapper (orchestrator prepends at spawn)
-
-You are an isolated test-authoring worker. You WRITE test cases from the slice
-below; you never run them, never fix code, never gate the ship. Make manual
-testing easy for the user. Emit the return structure from core.md and STOP.
-
-[Orchestrator: append the input slice here at spawn time.]
+# orc-testgen — Subagent wrapper (orchestrator prepends at spawn)
+
+You are an isolated test-authoring worker. You WRITE test cases from the slice
+below; you never run them, never fix code, never gate the ship. Make manual
+testing easy for the user. Emit the return structure your agent file defines and STOP.
+
+[Orchestrator: append the input slice here at spawn time.]

package/templates/skills/orc-advisor/SKILL.md

@@ -1,60 +1,56 @@
----
-name: orc-advisor
-description: >
-  Pre-analysis Advisor for the ORC ultra lane. Runs ONCE at ultra Phase U0
-  (after intake, before the analyst) to produce a code-grounded advisory
-  brief: domain risks, alternatives, a mandatory security-risk section, a
-  request-specific rubric the ultra judges score against, open questions
-  (relayed to the user in one batch), and the seed of the run's assumption
-  ledger. Dispatched only from /orc-ultra — no slash command of its own, never
-  in orc or orc-mini. The orchestrator dispatches the advisor subagent — it
-  never advises itself.
----
-
-# ORC-ADVISOR (ultra-lane advisory brief)
-
-Ultra-complex tasks fail on wrong interpretation, silent assumptions, and
-generic quality bars. The Advisor front-loads the fix: one max-effort pass
-that frames the request against the REAL codebase and hands every downstream
-role — analyst, planner, judges, executors — the same request-specific brief.
-
-Ultra lane ONLY. There is no `/orc-advisor` command; the orchestrator
-dispatches `orc-advisor-opus-5-xhigh` at Phase U0 of an `/orc-ultra` run.
-Cost is accepted by definition of the lane — no consent prompt.
-
-## Hard rules
-
-1. **The orchestrator never advises — it spawns.** Dispatch
-   `orc-advisor-opus-5-xhigh` with the slice below; the advisor writes the
-   brief; the orchestrator relays and injects.
-2. **The advisor is read-only on the project** (Read/Glob/Grep + Bash for
-   git introspection). It never edits code, never spawns subagents.
-3. **One dispatch per run.** The advisor is never re-dispatched for
-   revisions — post-brief quality is the judges' job.
-4. **The brief is injected LITERALLY** (never a file pointer) into the
-   analyst slice, the planner slice, all three judge slices, and — as
-   advisory notes — the executor slices.
-5. **The security section may not be skipped.** "No security surface" is a
-   legitimate conclusion but must be stated with reasoning.
-
-## Dispatch slice (orchestrator → advisor)
-
-- The user's request verbatim (plus the doc path when one exists).
-- The run-folder path for `advisory-brief.md`.
-- Detected stack summary (from intake — never re-detected).
-
-## Brief contents (see the agent file for the full section spec)
-
-Risks & pitfalls (anchored) · alternatives + trade-offs · security risks
-(mandatory) · the three-part RUBRIC (correct analysis / correct plan /
-faithful implementation) · open questions with proposed defaults · seed
-assumption-ledger entries.
-
-## Return contract
-
-`brief_path`, `open_questions[]`, `assumptions[]`, `actual_model` (verbatim
-from the agent's system-prompt model-id line), `actual_effort`
-($CLAUDE_EFFORT). The orchestrator validates the return, emits the `ADVISE`
-trace line when logging, relays the open questions to the user in ONE batched
-round, folds the answers into the intent-spec, and records unanswered
-defaults as UNCONFIRMED in the assumption ledger.
+---
+name: orc-advisor
+description: >
+  Internal to /orc-ultra: the pre-analysis Advisor. Runs ONCE at Phase U0 and
+  writes the advisory brief, the security-risk section and the rubric the ultra
+  judges score against. No slash command of its own.
+disable-model-invocation: true
+---
+
+# ORC-ADVISOR (ultra-lane advisory brief)
+
+Ultra-complex tasks fail on wrong interpretation, silent assumptions, and
+generic quality bars. The Advisor front-loads the fix: one max-effort pass
+that frames the request against the REAL codebase and hands every downstream
+role — analyst, planner, judges, executors — the same request-specific brief.
+
+Ultra lane ONLY. There is no `/orc-advisor` command; the orchestrator
+dispatches `orc-advisor-opus-5-xhigh` at Phase U0 of an `/orc-ultra` run.
+Cost is accepted by definition of the lane — no consent prompt.
+
+## Hard rules
+
+1. **The orchestrator never advises — it spawns.** Dispatch
+   `orc-advisor-opus-5-xhigh` with the slice below; the advisor writes the
+   brief; the orchestrator relays and injects.
+2. **The advisor is read-only on the project** (Read/Glob/Grep + Bash for
+   git introspection). It never edits code, never spawns subagents.
+3. **One dispatch per run.** The advisor is never re-dispatched for
+   revisions — post-brief quality is the judges' job.
+4. **The brief is injected LITERALLY** (never a file pointer) into the
+   analyst slice, the planner slice, all three judge slices, and — as
+   advisory notes — the executor slices.
+5. **The security section may not be skipped.** "No security surface" is a
+   legitimate conclusion but must be stated with reasoning.
+
+## Dispatch slice (orchestrator → advisor)
+
+- The user's request verbatim (plus the doc path when one exists).
+- The run-folder path for `advisory-brief.md`.
+- Detected stack summary (from intake — never re-detected).
+
+## Brief contents (see the agent file for the full section spec)
+
+Risks & pitfalls (anchored) · alternatives + trade-offs · security risks
+(mandatory) · the three-part RUBRIC (correct analysis / correct plan /
+faithful implementation) · open questions with proposed defaults · seed
+assumption-ledger entries.
+
+## Return contract
+
+`brief_path`, `open_questions[]`, `assumptions[]`, `actual_model` (verbatim
+from the agent's system-prompt model-id line), `actual_effort`
+($CLAUDE_EFFORT). The orchestrator validates the return, emits the `ADVISE`
+trace line when logging, relays the open questions to the user in ONE batched
+round, folds the answers into the intent-spec, and records unanswered
+defaults as UNCONFIRMED in the assumption ledger.