@azure-id/orc 1.9.2 → 2.1.0

package/templates/skills/orc/schemas/checkpoint.md

@@ -1,122 +1,122 @@
-# Schema — Durable Checkpoint + State-of-Play
-
-Two files, two jobs:
-- `run/{run-slug}/checkpoint.json` — machine truth. Orchestrator-only writes.
-  Survives pause, compaction, crash, fresh sessions. KEPT after success (audit).
-- `run/{run-slug}/state-of-play.md` — 10-line human-readable re-anchor. Read FIRST on any
-  resume, then the checkpoint for detail.
-
-## run/{run-slug}/checkpoint.json
-
-```jsonc
-{
-  "run_id": "run-020726-1422",
-  "schema_version": "0.2",
-  "phase": "execution",        // intake|planning|scoring|execution|integration|review|verify|summary|ship|done
-  "planner": "openspec",
-  "effort": "medium",
-  "execution_model": "parallel",   // sequential | parallel | parallel_worktrees
-  "source_branch": "feat/notifications",
-  "intent_spec": "run/merchant-notifications/intent-spec.md",
-  "batch_pause_every": 2,
-  "pause_schedule": [2],           // wave indices where a MANDATORY batch stop fires
-                                   // (computed from the Phase 2 answer; last wave never included) —
-                                   // a resumed session enforces the same hard boundaries
-  "logging_enabled": true,         // logging is PERMANENT (always on) — re-anchor the behavior trace on resume
-  "trace_path": null,              // "<log_dir>/run-<lane>-<slug>-<DDMMYY>-<HHMMSS>.txt" — the run's trace file
-  "ultra_mode": false,             // true only on /orc-ultra runs; gates the "ultra" block below
-  "ultra": null,                   /* when ultra_mode — a resumed run continues mid-gate/mid-loop:
-    { "brief_path": "run/…/ultra/advisory-brief.md",
-      "ledger_path": "run/…/ultra/assumption-ledger.md",
-      "matrix_path": null,                    // set before gate 3
-      "gates": {                              // per-gate judgment state
-        "analysis":       { "verdict": "approve", "round": 1, "loops_used": 0 },
-        "plan":           { "verdict": "revise",  "round": 2, "loops_used": 1 },
-        "implementation": { "verdict": null,      "round": 0, "loops_used": 0 } } } */
-  "current_wave": 2,
-  "paused": true,
-  "pause_trigger": "batch_pause",  // batch_pause | token_limit | phase_transition | crash_guard
-
-  "plan": { /* full planning-output object */ },
-
-  // fast-resume mirror; kept in sync on every task state change
-  "task_state": {
-    "T1": { "status": "done", "retry_count": 0, "context_requests": 0,
-            "failure_reason": null, "progress": null,
-            "actual_files": ["db/migrations/0001.sql", "models/notification.x", "models/notification.test.x"] },
-    "T3": { "status": "partial", "retry_count": 0, "context_requests": 1,
-            "failure_reason": null,
-            "progress": { "percent": 60, "files_written": ["services/email_digest/scheduler.x"],
-                          "notes": "daily path done; weekly cron pending" } }
-  },
-
-  // every spawn, for the usage report + rubric audit
-  "dispatch_log": [
-    { "task_id": "T1", "computed_score": 72, "override_score": null,
-      "override_reason": null, "model": "sonnet-5", "effort": "medium",
-      "spawned_at": "020726 14:24:01.100",
-      // claimed-vs-actual (only when logging_enabled): what the worker reported
-      "actual_model": "claude-sonnet-5", "actual_effort": "medium",
-      "verify": "match" },      // match | downgrade
-
-    { "task_id": "T6", "computed_score": 88, "override_score": 62,
-      "override_reason": "rubric over-weighted file count; isolated leaf UI",
-      "model": "sonnet-5", "effort": "high", "spawned_at": "020726 15:01:22.040" }
-  ],
-
-  "worktrees": { /* subagent_worktrees mode: agent → {path, branch, merged} */ },
-  "merge_state": null,           // null | pending_verify | merged | conflict_resolving
-
-  "escalations": [
-    { "id": "E1", "agent": "Agent-C", "task": "T3",
-      "question": "Digest send time?", "answer": "07:00 fixed",
-      "at": "020726 14:28:41.507",
-      "affected_tasks": [], "downstream_flagged": [] }
-  ],
-
-  "review":  { "ran": false },   // when ran: p0[], p1[], p2[], p3[], model, effort
-                                 // (v1 checkpoints used blocking[]/nits[] — on resume
-                                 //  map blocking→p1, nits→p3; never rewrite the old file.
-                                 //  v0.7.0+: each recorded P0–P2 finding keeps its
-                                 //  file:line + verbatim quote so a resumed run can
-                                 //  re-run the quote spot-check before acting)
-  "verify":  { "ran": false },   // result, autofix_used, autofix_remaining (starts 1)
-  "ship":    { "commit": null, "push": null, "create_pr": null,
-               "ticket": null, "pr_title": null, "target_branch": null, "pr_file": null },
-
-  "decision_log": "run/merchant-notifications/decision-log.md",
-  "created_at": "020726 14:22:01.000",
-  "updated_at": "020726 15:02:00.331"
-}
-```
-
-## run/{run-slug}/state-of-play.md (regenerated at every checkpoint write)
-
-```markdown
-# State of Play — run-020726-1422
-Phase: execution · Wave 2 of 3 · PAUSED (batch)
-Done: T1 T2 T4 · Partial: T3 (60%, weekly cron pending) · Pending: T5 T6
-Mode: subagent · Planner: openspec · Branch: feat/notifications
-Last decision: digest send 07:00 fixed (user, via Agent-C)
-Next action on resume: finish T3 from milestone, then dispatch wave 3
-Intent: merchant notifications (in-app + email digest + prefs) — no push, no admin
-```
-
-## Write discipline
-
-- Orchestrator-only. Atomic write (temp file + rename). `updated_at` bumped to
-  ms on every write.
-- Write EAGERLY: after every wave, escalation answer, phase transition, and
-  before any risky operation — so surprise compaction never catches
-  conversation-only state.
-- A failed/malformed checkpoint write is a FAILURE: do not stop the session on
-  it; surface it.
-
-## Resume contract
-
-1. Read state-of-play (orientation) → newest checkpoint (`updated_at` wins).
-2. Fresh session: one-line intent reconfirm from the Intent line.
-3. task_state: done stays done · partial resumes from progress.files_written ·
-   pending awaits wave · requeued/failed re-dispatch reading failure_reason ·
-   stale_review gets a review pass.
-4. Re-attach decision log, regenerate digest, continue from `phase`.
+# Schema — Durable Checkpoint + State-of-Play
+
+Two files, two jobs:
+- `run/{run-slug}/checkpoint.json` — machine truth. Orchestrator-only writes.
+  Survives pause, compaction, crash, fresh sessions. KEPT after success (audit).
+- `run/{run-slug}/state-of-play.md` — 10-line human-readable re-anchor. Read FIRST on any
+  resume, then the checkpoint for detail.
+
+## run/{run-slug}/checkpoint.json
+
+```jsonc
+{
+  "run_id": "run-020726-1422",
+  "schema_version": "0.2",
+  "phase": "execution",        // intake|planning|scoring|execution|integration|review|verify|summary|ship|done
+  "planner": "openspec",
+  "effort": "medium",
+  "execution_model": "parallel",   // sequential | parallel | parallel_worktrees
+  "source_branch": "feat/notifications",
+  "intent_spec": "run/merchant-notifications/intent-spec.md",
+  "batch_pause_every": 2,
+  "pause_schedule": [2],           // wave indices where a MANDATORY batch stop fires
+                                   // (computed from the Phase 2 answer; last wave never included) —
+                                   // a resumed session enforces the same hard boundaries
+  "logging_enabled": true,         // logging is PERMANENT (always on) — re-anchor the behavior trace on resume
+  "trace_path": null,              // "<log_dir>/run-<lane>-<slug>-<DDMMYY>-<HHMMSS>.txt" — the run's trace file
+  "ultra_mode": false,             // true only on /orc-ultra runs; gates the "ultra" block below
+  "ultra": null,                   /* when ultra_mode — a resumed run continues mid-gate/mid-loop:
+    { "brief_path": "run/…/ultra/advisory-brief.md",
+      "ledger_path": "run/…/ultra/assumption-ledger.md",
+      "matrix_path": null,                    // set before gate 3
+      "gates": {                              // per-gate judgment state
+        "analysis":       { "verdict": "approve", "round": 1, "loops_used": 0 },
+        "plan":           { "verdict": "revise",  "round": 2, "loops_used": 1 },
+        "implementation": { "verdict": null,      "round": 0, "loops_used": 0 } } } */
+  "current_wave": 2,
+  "paused": true,
+  "pause_trigger": "batch_pause",  // batch_pause | token_limit | phase_transition | crash_guard
+
+  "plan": { /* full planning-output object */ },
+
+  // fast-resume mirror; kept in sync on every task state change
+  "task_state": {
+    "T1": { "status": "done", "retry_count": 0, "context_requests": 0,
+            "failure_reason": null, "progress": null,
+            "actual_files": ["db/migrations/0001.sql", "models/notification.x", "models/notification.test.x"] },
+    "T3": { "status": "partial", "retry_count": 0, "context_requests": 1,
+            "failure_reason": null,
+            "progress": { "percent": 60, "files_written": ["services/email_digest/scheduler.x"],
+                          "notes": "daily path done; weekly cron pending" } }
+  },
+
+  // every spawn, for the usage report + rubric audit
+  "dispatch_log": [
+    { "task_id": "T1", "computed_score": 72, "override_score": null,
+      "override_reason": null, "model": "sonnet-5", "effort": "medium",
+      "spawned_at": "020726 14:24:01.100",
+      // claimed-vs-actual (only when logging_enabled): what the worker reported
+      "actual_model": "claude-sonnet-5-5", "actual_effort": "medium",
+      "verify": "match" },      // match | downgrade
+
+    { "task_id": "T6", "computed_score": 88, "override_score": 62,
+      "override_reason": "rubric over-weighted file count; isolated leaf UI",
+      "model": "sonnet-5", "effort": "high", "spawned_at": "020726 15:01:22.040" }
+  ],
+
+  "worktrees": { /* subagent_worktrees mode: agent → {path, branch, merged} */ },
+  "merge_state": null,           // null | pending_verify | merged | conflict_resolving
+
+  "escalations": [
+    { "id": "E1", "agent": "Agent-C", "task": "T3",
+      "question": "Digest send time?", "answer": "07:00 fixed",
+      "at": "020726 14:28:41.507",
+      "affected_tasks": [], "downstream_flagged": [] }
+  ],
+
+  "review":  { "ran": false },   // when ran: p0[], p1[], p2[], p3[], model, effort
+                                 // (v1 checkpoints used blocking[]/nits[] — on resume
+                                 //  map blocking→p1, nits→p3; never rewrite the old file.
+                                 //  v0.7.0+: each recorded P0–P2 finding keeps its
+                                 //  file:line + verbatim quote so a resumed run can
+                                 //  re-run the quote spot-check before acting)
+  "verify":  { "ran": false },   // result, autofix_used, autofix_remaining (starts 1)
+  "ship":    { "commit": null, "push": null, "create_pr": null,
+               "ticket": null, "pr_title": null, "target_branch": null, "pr_file": null },
+
+  "decision_log": "run/merchant-notifications/decision-log.md",
+  "created_at": "020726 14:22:01.000",
+  "updated_at": "020726 15:02:00.331"
+}
+```
+
+## run/{run-slug}/state-of-play.md (regenerated at every checkpoint write)
+
+```markdown
+# State of Play — run-020726-1422
+Phase: execution · Wave 2 of 3 · PAUSED (batch)
+Done: T1 T2 T4 · Partial: T3 (60%, weekly cron pending) · Pending: T5 T6
+Mode: subagent · Planner: openspec · Branch: feat/notifications
+Last decision: digest send 07:00 fixed (user, via Agent-C)
+Next action on resume: finish T3 from milestone, then dispatch wave 3
+Intent: merchant notifications (in-app + email digest + prefs) — no push, no admin
+```
+
+## Write discipline
+
+- Orchestrator-only. Atomic write (temp file + rename). `updated_at` bumped to
+  ms on every write.
+- Write EAGERLY: after every wave, escalation answer, phase transition, and
+  before any risky operation — so surprise compaction never catches
+  conversation-only state.
+- A failed/malformed checkpoint write is a FAILURE: do not stop the session on
+  it; surface it.
+
+## Resume contract
+
+1. Read state-of-play (orientation) → newest checkpoint (`updated_at` wins).
+2. Fresh session: one-line intent reconfirm from the Intent line.
+3. task_state: done stays done · partial resumes from progress.files_written ·
+   pending awaits wave · requeued/failed re-dispatch reading failure_reason ·
+   stale_review gets a review pass.
+4. Re-attach decision log, regenerate digest, continue from `phase`.

package/templates/skills/orc/subskills/orc-execution/SKILL.md

@@ -1,73 +1,27 @@
----
-name: orc-execution
-description: >
-  Executor worker for ORC — the single-task implementer. Given one task slice
-  (task_id, declared_files, constraints, spec_ref, log_digest), it implements
-  EXACTLY that task within its declared files, honors every hard-rule constraint,
-  creates/updates tests, emits milestone progress pings, and returns a strict
-  contract (status done|failed|partial|needs_context, actual_files, log_entries,
-  and claimed-vs-actual model/effort so the caller can catch a silent tier
-  downgrade). Dispatched once per task in an execution wave, on the scored model
-  pinned by its executor agent. Distinct from the review/verify/test-author
-  workers — this one writes the implementation. ALWAYS a spawned subagent; the
-  orchestrator never implements. Not for direct user invocation.
----
-
-# orc-execution
-
-One entry point: the orchestrator spawns a subagent via the Task tool,
-prepending `subagent.md` framing + the input slice, which points to `core.md`.
-`core.md` is the AUTHORITATIVE spec (full input slice, procedure, and return
-contract); the summary below orients — on any conflict, `core.md` wins.
-
-## What the worker does (summary)
-
-1. Absorb `log_digest` (prior DECISIONs/INTERFACEs/ANSWERs bind you); read `spec_ref`.
-2. Implement EXACTLY the task in the slice, touching only `declared_files[]`,
-   honoring every `constraints[]` hard rule AND the standing `house_rules` card
-   (surgical changes, simplicity-first, no unrequested scope, never claim
-   unobserved results, honest partial over false done), then the `rules_card`
-   under it (project rules beat ORC rules; return the three `rules_*` fields); create/update
-   tests for what you build.
-3. Run the proof: build/test for your changes, capturing `evidence`
-   {command, exit_code, tail} VERBATIM (no runner → `no_runner_detected: true`);
-   self-check the diff against the slice's `acceptance[]` + `constraints[]` —
-   anything unsatisfied goes in `unmet[]` (non-empty = partial/failed, never done).
-4. Emit milestone pings ({percent, files_written[], notes}) as you go.
-5. Stay in your slice — need outside context? emit `needs_context`, don't fetch it.
-
-## Return shape (summary — full contract in `core.md`)
-
-`{ task_id, actual_model, actual_effort, status: done|failed|partial|needs_context,
-actual_files[], evidence, no_runner_detected, unmet[], log_entries[],
-failure_reason, progress, context_request,
-pattern_version, invariants_checked, tdd_state }`
-
-When the slice carries a `pattern`, MATCH its conventions, satisfy every BLOCKING
-invariant AND every enforceable `validation_gate[]` line (advisory gate lines are
-informational); echo the `pattern_version` and set `invariants_checked: true` only after
-re-checking your diff. A pattern task that returns false/absent here is malformed.
-
-When the slice carries a `tdd_spec` (v0.33.0), run its materialized tests and
-implement to green — implement→test→repair, capped at the slice's
-`tdd_loop_max`; never edit a TDD test to make it pass (a wrong-looking test is
-a spec bug — return it). Return `tdd_state: green|red` (green needs the passing
-run in `evidence`; `done` with red is malformed).
-
-**Crosslink injection (orchestrator-side, advisory).** At slice assembly, if a
-task's declared files include a call site that matches an entry in
-`.claude/orc/crosslink/needs.json`, prepend the cached tag contract (from
-`.claude/orc/crosslink/cache/`) to the slice as `crosslink`, labeled with its
-effective cross-repo tier + "hints, not verified". The executor MATCHES the
-stated field names/types but never lets it override local code — it is advisory,
-so there is NO return field and nothing to attest (unlike `pattern`). A task with
-no boundary carries no `crosslink`.
-On a UI task, if the environment ships a `frontend-design` skill, read and apply
-it (skip silently when absent).
-
-**Validation checkpoint before returning:** `status=failed` REQUIRES a
-`failure_reason`; `needs_context` REQUIRES a `context_request` (capped at 2/task);
-`actual_model` is quoted VERBATIM from your system prompt, never inferred;
-`status=done` REQUIRES `evidence` when a runner exists (else
-`no_runner_detected: true`) and an EMPTY `unmet[]`. A
-malformed return is treated as failure by the caller.
+---
+name: orc-execution
+description: >
+  Executor worker for ORC — the single-task implementer. Given one task slice
+  (task_id, declared_files, constraints, spec_ref, log_digest), it implements
+  EXACTLY that task within its declared files, honors every hard-rule constraint,
+  creates/updates tests, emits milestone progress pings, and returns a strict
+  contract (status done|failed|partial|needs_context, actual_files, log_entries,
+  and claimed-vs-actual model/effort so the caller can catch a silent tier
+  downgrade). Dispatched once per task in an execution wave, on the scored model
+  pinned by its executor agent. Distinct from the review/verify/test-author
+  workers — this one writes the implementation. ALWAYS a spawned subagent; the
+  orchestrator never implements. Not for direct user invocation.
+---
+
+# orc-execution
+
+A pointer. The orchestrator spawns the scored executor agent via the Task tool,
+prepending `subagent.md` framing + the input slice. The orchestrator never
+implements.
+
+- **Input slice** (the orchestrator builds it): `core.md`.
+- **Procedure + return contract** (the ONE source): the executor agent file,
+  `.claude/agents/orc-executor-*.md`.
+- **Validator** (the caller checks every return against it):
+  `../../../_shared/return-validation.md`. A malformed return is treated as
+  failure by the caller.

package/templates/skills/orc/subskills/orc-execution/core.md

@@ -1,7 +1,9 @@
-# orc-execution — Core (mode-neutral)
+# orc-execution — Core (the input slice)
 
-A procedure specification: inputs, steps, outputs. Executed by a spawned
-subagent; the orchestrator never runs this itself.
+The INPUT SLICE the orchestrator builds for ONE executor dispatch. The
+procedure and the return contract live in ONE place: the executor agent file
+(`.claude/agents/orc-executor-*.md`). The caller validates the return against
+`../../../_shared/return-validation.md`. The orchestrator never implements.
 
 ## Input slice (you receive exactly this; you cannot pull more)
 
@@ -31,9 +33,11 @@ subagent; the orchestrator never runs this itself.
 - crosslink               — the cross-repo boundary contract for a call site in
                             this task, or null. Present ONLY when a declared file
                             touches a boundary the orchestrator resolved from
-                            `.claude/orc/crosslink/needs.json` + cache. It is
+                            `.claude/orc/crosslink/needs.json` + the cached tag
+                            contract in `.claude/orc/crosslink/cache/`. It is
                             ADVISORY hints ("cross-repo fresh/aging/stale wiki")
-                            labeled with an effective tier — MATCH the field
+                            labeled with an effective tier + "hints, not
+                            verified" — MATCH the field
                             names/types/errors it states, but it never overrides
                             local code and there is nothing to attest (no return
                             field). Absent on any task with no boundary.
@@ -75,97 +79,6 @@ subagent; the orchestrator never runs this itself.
 - worktree_path           — null unless worktrees mode
 - model, effort           — informational (already applied by the caller)
 
-## Procedure
-
-1. Absorb log_digest — prior DECISIONs/INTERFACEs/ANSWERs bind you.
-2. Read spec_ref if provided.
-2a. **Read on the ladder** (`../../../_shared/read-ladder.md`): locate
-   (Grep/Glob) → outline → the ±40 lines around the anchor → full. Stop at the
-   step that answers the question; two full reads with no answer is
-   `needs_context`, not a third. TWO EXCEPTIONS — every `declared_files` path is
-   a FULL read before you edit it (an `old_string` rebuilt from an outline is a
-   corruption bug), and build/test output is always read whole.
-3. Perform the task within `worktree_path` (or the current tree if null).
-   Obey every `house_rules` line, then every `rules_card` rule (two rules that
-   disagree go in `rules_conflicts[]`, never a silent choice). Follow every constraint. If `pattern` is present, MATCH its conventions,
-   satisfy every BLOCKING invariant, and satisfy every enforceable
-   `validation_gate[]` line (re-read your diff to confirm before returning;
-   advisory gate lines are informational — never add tooling to meet one);
-   if `pattern` is null but carries invariants (agnostic), still satisfy them and
-   imitate the neighboring files you read. Create/update tests for what you build.
-   **UI task + a `frontend-design` skill present in the environment** (check
-   `.claude/skills/frontend-design/` or the plugin dir): read its SKILL.md and
-   apply its guidance to the UI work — skip silently when absent.
-4. **Run the proof, capture the evidence:** if the project has a runnable build
-   or test setup, run it for your changes and capture {command, exit_code, the
-   last ~5 output lines} — QUOTED VERBATIM, never paraphrased, never predicted.
-   No runner → set `no_runner_detected: true` instead. Never claim green you
-   did not observe. With a `tdd_spec`: run ITS tests too — implement → test →
-   repair up to `tdd_loop_max` iterations; still red at the cap → stop and
-   return `tdd_state: red` honestly (the failing tests listed in unmet[]).
-5. **Self-check before returning:** re-read your diff against every
-   `acceptance[]` line and every `constraints[]` rule. Anything you could not
-   satisfy goes in `unmet[]` — and a non-empty `unmet[]` means status `partial`
-   (or `failed`), never `done`. An honest partial beats a false done.
-6. **Milestone pings:** after each declared file completed or logical subtask
-   done, emit a brief progress ping: {percent, files_written[], notes}. These
-   bound what a mid-wave stop can save — do not skip them.
-7. Stay within your task. Discovering needed context outside your slice →
-   emit the needs_context return (below). Do NOT fetch it yourself.
-
-## Return contract (emit EXACTLY this structure; the caller validates)
-
-- task_id
-- actual_model            — the model id quoted VERBATIM from your system prompt
-                            ("The exact model ID is …"); NEVER inferred from priors;
-                            `unknown` if no such line exists. Lets the caller catch
-                            a silent tier downgrade (claimed-vs-actual model check)
-- actual_effort           — the value of $CLAUDE_EFFORT (read via Bash at start)
-- status: done | failed | partial | needs_context
-- actual_files[]          — every file you truly touched (audited vs declared)
-- evidence                — {command, exit_code, tail} of the build/test you ran,
-                            quoted VERBATIM (like actual_model — never invented).
-                            REQUIRED when status=done and the project has a
-                            runnable build/test; null when it has none
-- no_runner_detected      — true ONLY when the project exposes no runnable
-                            build/test (explains a null evidence); else absent
-- unmet[]                 — acceptance[]/constraints[] lines you could NOT
-                            satisfy. MUST be empty when status=done — a
-                            non-empty unmet[] forces partial/failed
-- log_entries[]           — cross-cutting decisions for the decision log,
-                            tagged DECISION | CONSTRAINT | INTERFACE
-- failure_reason          — REQUIRED when status=failed (the why); else null
-- progress                — {percent, files_written[], notes} when partial; else null
-- context_request         — REQUIRED when status=needs_context: what you need
-                            and why (e.g. "needs T1's type enum interface");
-                            else null
-- pattern_version         — the `pattern.pattern_version` you applied; null if no
-                            pattern was supplied
-- invariants_checked      — true ONLY if you verified every BLOCKING invariant in
-                            `pattern` against your diff; false/null if no invariants
-                            were supplied. A pattern task returning false/absent here
-                            is a malformed return
-- tdd_state               — green | red | null. REQUIRED when the slice carried a
-                            `tdd_spec`: green ONLY after its tests pass (run quoted
-                            in `evidence`); red = cap hit/unresolved (failing tests
-                            in unmet[]); null only without a tdd_spec. status=done
-                            with red is malformed
-- repro                   — REQUIRED when the slice carried
-                            `repro.required: true`; else absent. {command, before:
-                            {exit_code, tail}, after: {exit_code, tail}} quoted
-                            VERBATIM, or `none` + a one-line reason. status=done
-                            with before.exit_code 0 (never red) or a non-zero
-                            after.exit_code (still red) is malformed. Canonical:
-                            `.claude/skills/_shared/return-validation.md` §5d
-- gotcha_recorded         — REQUIRED when this return CLOSES a repair loop (you
-                            drove a tdd_spec test red → green): the entry body
-                            {trigger, symptom, cause, fix, scope}, or `none` + a
-                            one-line reason. Absent on a repair-closing return is
-                            malformed; not required when nothing was repaired. A
-                            loop that hit `tdd_loop_max` and STOPPED returns
-                            `none` — an unsolved failure is not a gotcha. You
-                            RETURN it; the caller writes the file
-
-Malformed returns are treated as failure by the caller. needs_context is
-capped at 2 per task — a third means the slice or plan is wrong and escalates
-to the user.
+A task with no boundary carries no `crosslink`. Malformed returns are treated
+as failure by the caller. needs_context is capped at 2 per task — a third means
+the slice or plan is wrong and escalates to the user.

package/templates/skills/orc/subskills/orc-execution/subagent.md

@@ -1,13 +1,14 @@
-# orc-execution — Subagent wrapper (orchestrator prepends this at spawn)
-
-You are an isolated execution worker. You have no memory of the wider run
-beyond the slice below. Do exactly one task.
-
-- Work only within your slice's declared_files and worktree_path (if set).
-- Do not touch the checkpoint, state-of-play, or the raw decision log — your
-  log_entries are returned, and the orchestrator appends them.
-- Emit milestone pings as you progress.
-- When done (or blocked), emit the return structure from `core.md` and STOP.
-  Do not continue past your task.
-
-[Orchestrator: append the input slice here at spawn time.]
+# orc-execution — Subagent wrapper (orchestrator prepends this at spawn)
+
+You are an isolated execution worker. You have no memory of the wider run
+beyond the slice below. Do exactly one task.
+
+- Work only within your slice's declared_files and worktree_path (if set).
+- Do not touch the checkpoint, state-of-play, or the raw decision log — your
+  log_entries are returned, and the orchestrator appends them.
+- Emit milestone pings as you progress.
+- When done (or blocked), emit the return structure your agent file defines
+  and STOP.
+  Do not continue past your task.
+
+[Orchestrator: append the input slice here at spawn time.]

package/templates/skills/orc/subskills/orc-review-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: orc-review-verify
 description: >
-  Review/verify worker for ORC Phases 5–6 (Opus 5.5 medium). Two modes: a REVIEW
+  Review/verify worker for ORC Phases 5–6 (review Opus 5.5 low, verify medium). Two modes: a REVIEW
   pass — examine the changed files against the code pattern + constraints,
   create/update tests, and classify EVERY finding on the P0–P3 severity
   ladder (P0/P1 gate ship, P2/P3 advisory); a VERIFY
@@ -17,60 +17,19 @@ description: >
 
 # orc-review-verify
 
-One entry point: spawned via the Task tool with `subagent.md` framing + the
-slice, which points to `core.md`. `core.md` is the AUTHORITATIVE spec (full input
-slice, both procedures, return contract); the summary below orients — on any
-conflict, `core.md` wins.
+A pointer. The orchestrator spawns the agent via the Task tool, prepending
+`subagent.md` framing + the input slice. The worker reports; the orchestrator
+owns the auto-fix-once loop.
 
-## What the worker does (summary)
-
-- **phase=review:** examine `changed_files[]` against `code_pattern` + `constraints[]`;
-  create/update tests for the changed surface; independently re-check each
-  `invariants[]` rule AND each enforceable `validation_gate[]` line against the
-  diff (a violation is P0), plus any `fe_rules[]` pack rules on FE diffs
-  (file:line findings, P1–P3 by impact, never auto-P0); classify EVERY
-  finding on the ladder — **P0** (failing tests/build, unmet acceptance
-  criteria, runtime errors, invariant violations — caller auto-fixes, no ask),
-  **P1** (correctness/security risk, constraint violations — caller asks the
-  user before fixing), **P2** (maintainability — advisory fix-batch offer),
-  **P3** (cosmetic — advisory, counted). Never fix P2/P3; P0/P1 fixes are the
-  caller's call. **Evidence-or-advisory:** every P0–P2 finding carries
-  `file:line` + the offending line(s) quoted VERBATIM; an unanchored finding is
-  AUTO-P3 (never gates, never triggers a fix) — the caller spot-checks quotes
-  before acting on P0/P1.
-- **phase=verify (two halves, v0.33.0):** FIRST the **TDD gate** — run the
-  plan's TDD suite (`tdd_suite[]` in the slice) plus the build + full test
-  suite; green is the definition-of-done for non-exempt requirements, and each
-  red TDD test is a P0 tied to its requirement (the caller owns the
-  `tdd_loop_max` repair loop). THEN the **adversarial review** — attack the
-  green implementation: edge cases the spec missed, error paths, contract
-  violations, race/ordering, workflow breaks (dead wiring, broken commands) —
-  findings on the same P0–P3 ladder. Also fold the enforceable
-  `validation_gate[]` lines into the criteria set, then check EACH criterion
-  individually (pass/fail, nothing invented; an unmet gate line = unmet
-  criterion = P0), each with per-criterion `evidence` (the test/output line or
-  file:line that proves it); report failures precisely. You don't fix — the
-  caller owns the auto-fix-once loop.
-- **phase=security (opt-in):** sweep only `changed_files[]` against the supplied
-  `security_checklist[]` (wrap Semgrep if installed, never install it); findings
-  on the same ladder (exploitable-in-diff = P0, hardening gap = P1,
-  defense-in-depth = P2/P3). Report-only, no `result` verdict.
-
-## Return shape (summary — full contract in `core.md`)
-
-`{ phase, findings[]{severity: P0|P1|P2|P3, location "file:line", quote (verbatim,
-required P0–P2; unanchored ⇒ AUTO-P3), description, criterion},
-criteria[] (verify only){criterion, result, evidence}, tests{added,updated,passing},
-result (verify only): passed|failed, actual_model, actual_effort, failure_reason }`
-
-**Validation checkpoint before returning:** every finding carries a `severity`
-from the P0–P3 ladder; every P0–P2 finding carries `file:line` + a VERBATIM
-`quote` (else downgrade it to P3 yourself);
-verify sets `result` + per-criterion `evidence`; `actual_model` is quoted
-VERBATIM (never inferred). A
-malformed return is treated as failure by the caller.
+- **Input slice** (the orchestrator builds it): `core.md`.
+- **Procedure + return contract** (the ONE source): the agent file —
+  `phase=review` and `phase=security` → `.claude/agents/orc-reviewer-opus-5-low.md`;
+  `phase=verify` → `.claude/agents/orc-verifier-opus-5-med.md`.
+- **Validator** (the caller checks every return against it):
+  `../../../_shared/return-validation.md`. A malformed return is treated as
+  failure by the caller.
 
 Fixed models (from `../../references/effort-and-mode.md`): review on the OpenSpec/self
-path = Opus 5.5 medium; review on the Superpowers path is delegated to the
+path = Opus 5.5 low; review on the Superpowers path is delegated to the
 Superpowers review skill instead (Sonnet 4.6 medium). Verify = Opus 5.5 medium,
 always this subskill.