@bastani/atomic 0.9.6 → 0.9.7

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [0.9.7] - 2026-07-12
+
+### Fixed
+
+- Fixed subagent model fallback to classify provider usage-limit exhaustion (for example `Codex error: The usage limit has been reached`, plus `usage_limit`/`usage_limit_reached`/`usage_limit_exceeded`/`insufficient_quota` codes) as a retryable quota/rate-limit failure, so configured `fallbackModels` advance to the next candidate provider/model instead of failing the run. The message matcher tolerates the same space/underscore/hyphen/joined separators as the code path, so provider errors that flatten the token into free text (for example `usage_limit_reached` or `usage-limit`) also advance the chain. Nested cause/diagnostic and session-shaped errors classify the same way, while cancellations, safety refusals, task/tool failures, and unrelated errors remain non-retryable; the shared conformance corpus keeps this rule in lockstep with the workflows classifier.
+
+## [0.9.7-alpha.1] - 2026-07-12
+
+### Fixed
+
+- Fixed subagent model fallback to classify provider usage-limit exhaustion (for example `Codex error: The usage limit has been reached`, plus `usage_limit`/`usage_limit_reached`/`usage_limit_exceeded`/`insufficient_quota` codes) as a retryable quota/rate-limit failure, so configured `fallbackModels` advance to the next candidate provider/model instead of failing the run. The message matcher tolerates the same space/underscore/hyphen/joined separators as the code path, so provider errors that flatten the token into free text (for example `usage_limit_reached` or `usage-limit`) also advance the chain. Nested cause/diagnostic and session-shaped errors classify the same way, while cancellations, safety refusals, task/tool failures, and unrelated errors remain non-retryable; the shared conformance corpus keeps this rule in lockstep with the workflows classifier.
+
 ## [0.9.6] - 2026-07-12
 
 ### Changed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with chains, parallel execution, and background runs. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/skills/subagent/SKILL.md

@@ -745,7 +745,9 @@ subagent({ action: "doctor" })
 **Intercom "Already waiting for a reply"**
 
 ```typescript
-// Resolve the current outbound ask before starting another one.
+// Only one blocking intercom request (ask or contact_supervisor) can wait per
+// session. Concurrent attempts lose the reservation with this normal tool
+// error; resolve or await the current outbound ask, then retry or use send.
 ```
 
 **Parallel output-path conflict**

package/dist/builtin/subagents/src/runs/shared/model-fallback.ts

@@ -67,6 +67,7 @@ const RETRYABLE_MODEL_FAILURE_PATTERNS: readonly RegExp[] = [
 	/too many requests/i,
 	/\b429\b/,
 	/quota/i,
+	/usage[\s_-]*limit/i, // usage-limit exhaustion is a quota condition (accept space/underscore/hyphen/joined forms); next candidate may have headroom
 	/billing/i,
 	/credit/i,
 	/auth(?:entication)?/i,
@@ -275,7 +276,7 @@ function refusalKindFromCode(code: string | number | undefined): ModelFallbackFa
 const CODE_KINDS_BY_KIND: ReadonlyArray<readonly [ModelFallbackFailureKind, ReadonlySet<string>]> = [
 	["auth_on_candidate_provider", new Set(["auth", "auth_required", "authentication_required", "unauthorized", "forbidden", "invalid_api_key", "missing_api_key", "invalid_key"])],
 	["network_timeout", new Set(["etimedout", "econnreset", "econnrefused", "enotfound", "eai_again", "fetch_failed", "network_error", "timeout", "timeout_error", "und_err_connect_timeout"])],
-	["rate_limit", new Set(["rate_limit", "rate_limit_exceeded", "too_many_requests", "quota_exceeded"])],
+	["rate_limit", new Set(["rate_limit", "rate_limit_exceeded", "too_many_requests", "quota_exceeded", "insufficient_quota", "usage_limit", "usage_limit_reached", "usage_limit_exceeded"])],
 	["cancelled", new Set(["aborterror", "aborted", "cancelled", "canceled"])],
 	["model_unavailable", new Set(["model_not_found", "model_unavailable", "model_disabled", "unknown_model"])],
 	["provider_unavailable", new Set(["provider_error", "api_error", "service_unavailable", "temporarily_unavailable", "overloaded"])],
@@ -326,7 +327,7 @@ function fallbackKindFromMessage(message: string, name: string | undefined): Mod
 	const nameKind = kindFromCode(name);
 	if (nameKind !== undefined) return nameKind;
 	if (!RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(message))) return undefined;
-	if (/rate\s*limit|too many requests|\b429\b|quota|billing|credit/i.test(message)) return "rate_limit";
+	if (/rate\s*limit|too many requests|\b429\b|quota|usage[\s_-]*limit|billing|credit/i.test(message)) return "rate_limit";
 	if (/auth|unauthori[sz]ed|\b40[13]\b|api key|token expired|forbidden|invalid key/i.test(message)) return "auth_on_candidate_provider";
 	if (/model.*(?:unavailable|disabled|not found|unknown)|(?:unavailable|disabled|not found|unknown).*model/i.test(message)) return "model_unavailable";
 	if (/network|fetch failed|socket|connection refused|timeout|timed? out/i.test(message)) return "network_timeout";

package/dist/builtin/web-access/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.7] - 2026-07-12
+
+### Changed
+
+- Published the stable Atomic 0.9.7 release for the web-access extension; no functional web-access changes were made after 0.9.6.
+
+## [0.9.7-alpha.1] - 2026-07-12
+
+### Changed
+
+- Published a synchronized Atomic 0.9.7-alpha.1 prerelease for the web-access extension; no functional web-access changes were made after 0.9.6.
+
 ## [0.9.6] - 2026-07-12
 
 ### Changed

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.7] - 2026-07-12
+
+### Added
+
+- Added a shared convergence contract for the builtin `goal` and `ralph` workflows (`builtin/shared-prompts.ts` + deterministic gates in `builtin/review-convergence.ts`): workers/orchestrators must derive an observable acceptance/contract matrix from the literal objective/acceptance criteria before implementing (one row per clause mapped to the concrete check that proves it) and must model states, transitions, and invariants explicitly for stateful work; reviewers must independently derive adversarial checks (boundary/edge/negative and state/transition/invariant probes) from the literal contract before relying on the worker receipt, implementation notes, or worker-authored tests; reproduced findings require durable regression evidence (a persisted test or exact re-runnable check) before they count as resolved; and the evidence-closure policy is stated to both roles so approval semantics are visible in-prompt. All contracts inherit the literal-contract scope controls, so no behavior beyond the objective/acceptance criteria is required.
+- Added deduplicated cross-reviewer `consolidated_findings` batches to the Goal and Ralph `review-round-latest.json` artifacts (`consolidateFindingsBatch` in `builtin/review-convergence.ts`), with blocking entries sorted first and reviewer attribution merged per finding. Goal's next worker turn reads the round artifact first and is instructed to plan and repair the whole batch — grouped by root cause, with regression evidence — instead of fixing one finding per turn; Ralph's research/orchestrator stages receive the same batch through the round artifact.
+
+### Changed
+
+- Changed the built-in `goal` and `ralph` reviewer model defaults for GPT-5.6 Sol from the `:max` reasoning suffix to `:xhigh` across every provider form (`openai-codex`, `github-copilot`, `openai`, `cursor`, and `openrouter/openai`), including Ralph's `reviewer-b` primary model (`openai-codex/gpt-5.6-sol:xhigh`).
+- Aligned all built-in Goal reviewer stages with Ralph's clean, non-forked reviewer context behavior and exact `reviewer-a` model configuration, making Claude Fable 5 the shared primary reviewer while keeping one canonical fallback chain.
+- Changed builtin `goal` completion to evidence closure rather than reviewer agreement alone: the deterministic reducer now completes only when reviewer quorum is met AND no objective-relevant blocking finding from any reviewer in the current round remains unresolved. A quorum-met round with unresolved findings continues with an inspectable decision reason listing the findings, and the bounded loop still stops at `max_turns` as `needs_human` (with the closure gap recorded) so vetoes cannot drift indefinitely.
+- Changed the shared Goal/Ralph review gate so severity labels alone can no longer dismiss objective-relevant findings: `required_by_objective` findings now block at any priority (P3 included) via the shared `findingBlocksClosure` predicate, while `consistent_with_objective` P3 nice-to-haves remain non-blocking (preserving the dummy-finding anti-spin behavior) and `beyond_objective`/`contradicts_objective` findings remain non-blocking scope controls. Goal's `reviewApproved` and Ralph's `isBlockingFinding`/`reviewDecisionApproved` now share this single deterministic predicate.
+- Slimmed the builtin `goal`, `ralph`, and `open-claude-design` stage prompts to remove context-mode bloat: prompts no longer describe the stage's own context window ("previous conversation context", "previous workflow reasoning", or sibling parallel passes that a fresh stage cannot see), and forked continuation prompts now send only the per-iteration delta. Goal's forked worker turns send just the ledger pointer, latest receipts, and latest review artifacts; Ralph's forked orchestrator sends the rewritten research path and notes reminder; and Ralph's forked research-prompt-refinement and research continuations reference the skill, request, and contracts already present in their forked histories instead of re-injecting them (new `renderForkedResearchPromptRefinementPrompt`/`renderForkedResearchPrompt`). Each forked prompt carries a one-line pointer that previously established guidance still applies unchanged.
+
+### Fixed
+
+- Fixed workflow stage model fallback to classify provider usage-limit exhaustion (for example `Codex error: The usage limit has been reached`, plus `usage_limit`/`usage_limit_reached`/`usage_limit_exceeded`/`insufficient_quota` codes) as a retryable quota/rate-limit failure, so configured `fallbackModels` advance to the next candidate provider/model instead of failing the stage. The message matcher tolerates the same space/underscore/hyphen/joined separators as the code path, so provider errors that flatten the token into free text (for example `usage_limit_reached` or `usage-limit`) also advance the chain. Nested cause/diagnostic and session-shaped errors classify the same way, while cancellations, safety refusals, task/tool failures, and unrelated errors remain non-retryable.
+- Fixed model orchestration guidance so every workflow launch from interactive chat stays in the background: named runs remain automatically detached, direct `task`/`tasks`/`chain` launches require top-level `async: true`, inspection and control calls are excluded, and foreground launches require an explicit user request or technical necessity plus advance notice ([#1765](https://github.com/bastani-inc/atomic/issues/1765)).
+
+## [0.9.7-alpha.1] - 2026-07-12
+
+### Added
+
+- Added a shared convergence contract for the builtin `goal` and `ralph` workflows (`builtin/shared-prompts.ts` + deterministic gates in `builtin/review-convergence.ts`): workers/orchestrators must derive an observable acceptance/contract matrix from the literal objective/acceptance criteria before implementing (one row per clause mapped to the concrete check that proves it) and must model states, transitions, and invariants explicitly for stateful work; reviewers must independently derive adversarial checks (boundary/edge/negative and state/transition/invariant probes) from the literal contract before relying on the worker receipt, implementation notes, or worker-authored tests; reproduced findings require durable regression evidence (a persisted test or exact re-runnable check) before they count as resolved; and the evidence-closure policy is stated to both roles so approval semantics are visible in-prompt. All contracts inherit the literal-contract scope controls, so no behavior beyond the objective/acceptance criteria is required.
+- Added deduplicated cross-reviewer `consolidated_findings` batches to the Goal and Ralph `review-round-latest.json` artifacts (`consolidateFindingsBatch` in `builtin/review-convergence.ts`), with blocking entries sorted first and reviewer attribution merged per finding. Goal's next worker turn reads the round artifact first and is instructed to plan and repair the whole batch — grouped by root cause, with regression evidence — instead of fixing one finding per turn; Ralph's research/orchestrator stages receive the same batch through the round artifact.
+
+### Changed
+
+- Changed the built-in `goal` and `ralph` reviewer model defaults for GPT-5.6 Sol from the `:max` reasoning suffix to `:xhigh` across every provider form (`openai-codex`, `github-copilot`, `openai`, `cursor`, and `openrouter/openai`), including Ralph's `reviewer-b` primary model (`openai-codex/gpt-5.6-sol:xhigh`).
+- Aligned all built-in Goal reviewer stages with Ralph's clean, non-forked reviewer context behavior and exact `reviewer-a` model configuration, making Claude Fable 5 the shared primary reviewer while keeping one canonical fallback chain.
+- Changed builtin `goal` completion to evidence closure rather than reviewer agreement alone: the deterministic reducer now completes only when reviewer quorum is met AND no objective-relevant blocking finding from any reviewer in the current round remains unresolved. A quorum-met round with unresolved findings continues with an inspectable decision reason listing the findings, and the bounded loop still stops at `max_turns` as `needs_human` (with the closure gap recorded) so vetoes cannot drift indefinitely.
+- Changed the shared Goal/Ralph review gate so severity labels alone can no longer dismiss objective-relevant findings: `required_by_objective` findings now block at any priority (P3 included) via the shared `findingBlocksClosure` predicate, while `consistent_with_objective` P3 nice-to-haves remain non-blocking (preserving the dummy-finding anti-spin behavior) and `beyond_objective`/`contradicts_objective` findings remain non-blocking scope controls. Goal's `reviewApproved` and Ralph's `isBlockingFinding`/`reviewDecisionApproved` now share this single deterministic predicate.
+- Slimmed the builtin `goal`, `ralph`, and `open-claude-design` stage prompts to remove context-mode bloat: prompts no longer describe the stage's own context window ("previous conversation context", "previous workflow reasoning", or sibling parallel passes that a fresh stage cannot see), and forked continuation prompts now send only the per-iteration delta. Goal's forked worker turns send just the ledger pointer, latest receipts, and latest review artifacts; Ralph's forked orchestrator sends the rewritten research path and notes reminder; and Ralph's forked research-prompt-refinement and research continuations reference the skill, request, and contracts already present in their forked histories instead of re-injecting them (new `renderForkedResearchPromptRefinementPrompt`/`renderForkedResearchPrompt`). Each forked prompt carries a one-line pointer that previously established guidance still applies unchanged.
+
+### Fixed
+
+- Fixed workflow stage model fallback to classify provider usage-limit exhaustion (for example `Codex error: The usage limit has been reached`, plus `usage_limit`/`usage_limit_reached`/`usage_limit_exceeded`/`insufficient_quota` codes) as a retryable quota/rate-limit failure, so configured `fallbackModels` advance to the next candidate provider/model instead of failing the stage. The message matcher tolerates the same space/underscore/hyphen/joined separators as the code path, so provider errors that flatten the token into free text (for example `usage_limit_reached` or `usage-limit`) also advance the chain. Nested cause/diagnostic and session-shaped errors classify the same way, while cancellations, safety refusals, task/tool failures, and unrelated errors remain non-retryable.
+- Fixed model orchestration guidance so every workflow launch from interactive chat stays in the background: named runs remain automatically detached, direct `task`/`tasks`/`chain` launches require top-level `async: true`, inspection and control calls are excluded, and foreground launches require an explicit user request or technical necessity plus advance notice ([#1765](https://github.com/bastani-inc/atomic/issues/1765)).
+
 ## [0.9.6] - 2026-07-12
 
 ### Changed

package/dist/builtin/workflows/README.md

@@ -326,7 +326,7 @@ Atomic registers the canonical `structured_output` tool only for schema-enabled
 
 ### Model fallbacks
 
-Stages and high-level task helpers can retry transient provider/model failures with an ordered `fallbackModels` list. The primary `model` is tried first, then each fallback, and finally the current Atomic-selected model when available. Fallbacks are only used for retryable model/provider failures such as rate limits, quota/auth/provider outages, unavailable models, network timeouts, context-window overflows that Atomic's auto-compaction cannot resolve on the current model, and 5xx errors — ordinary tool, shell, validation, cancellation, and workflow-code failures are not retried.
+Stages and high-level task helpers can retry transient provider/model failures with an ordered `fallbackModels` list. The primary `model` is tried first, then each fallback, and finally the current Atomic-selected model when available. Fallbacks are only used for retryable model/provider failures such as rate limits, quota/usage-limit exhaustion (provider messages such as `The usage limit has been reached` and codes such as `usage_limit_reached`/`insufficient_quota` classify as retryable rate-limit failures so the chain advances to a candidate with remaining headroom), auth/provider outages, unavailable models, network timeouts, context-window overflows that Atomic's auto-compaction cannot resolve on the current model, and 5xx errors — ordinary tool, shell, validation, cancellation, and workflow-code failures are not retried.
 
 ```typescript
 import { workflow } from "@bastani/workflows";
@@ -542,7 +542,7 @@ Tradeoff: `Type.Unsafe<T>()` does not deeply validate at runtime — it trusts t
 
 Input overrides are bare `key=value` tokens (no leading `--`). Values are JSON-parsed when possible, so numbers, booleans, and quoted strings work as expected (e.g. `count=3`, `flag=true`, `prompt="multi word value"`). A whole-object override can be passed as a single JSON token (e.g. `{"prompt":"...","count":3}`). Runtime validation is strict: unknown input keys, missing required values, type mismatches, and invalid `select` choices fail before a named workflow run starts.
 
-Workflows always run as **background tasks** in interactive sessions — the chat editor stays free while a run executes. Press **F2** (or `/workflow connect <run-id>`) to attach to the live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+d` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
+Named workflow launches always run as **background tasks** in interactive sessions. Model-launched direct `task`, `tasks`, and `chain` calls must set top-level `async: true` so the chat editor stays free; inspection and control calls are unaffected. Foreground launches are reserved for explicit user requests or technical requirements, with notice before launch. Press **F2** (or `/workflow connect <run-id>`) to attach to the live graph viewer; HIL prompts (`ctx.ui.input/confirm/select/editor/custom`) appear as awaiting-input graph nodes. Press Enter on a focused node, or click a visible graph node directly, to open that stage and answer locally, never as a modal dialog over the chat. Attached stage chats capture mouse/trackpad wheel events by default so scrolling stays inside the active stage transcript or prompt instead of falling through to terminal/main-chat scrollback. Press `ctrl+t` to toggle **copy mode**: copy mode disables workflow-chat mouse reporting so normal terminal/tmux text selection can work; press `ctrl+t` again to leave copy mode and restore workflow-chat scrolling. Archived read-only stage transcripts show the same copy-mode footer/status, allowing their transcript text to be selected and copied while preserving `esc` close and `ctrl+d` graph navigation. While copy mode is on, wheel/trackpad gestures are handled by the terminal/tmux and may scroll terminal scrollback, so leave copy mode before using the wheel again. Human input is detected when those runtime `ctx.ui.*` calls execute; workflows no longer have a declaration-time HIL flag.
 
 Durable resume preserves the original completed-stage shape: replayed stage/task/parallel/child checkpoints retain summaries, durations, session/model metadata, and parallel branch parentage in the graph instead of flattening fanout branches into a sequential replay chain.
 
@@ -662,7 +662,7 @@ Child workflow outputs: `result`, `findings`, `research_doc_path`, `artifact_dir
 
 ### `goal`
 
-Goal Runner workflow: initialize a persisted goal ledger with a per-run goal id, immutable `acceptance_criteria`, and lifecycle events, render goal-continuation context, run bounded worker LM turns, append receipts, run three independent reviewers with objective-alignment findings and clause-by-clause requirements traceability, let a TypeScript reducer decide `complete`, `continue`, `blocked`, or `needs_human`, and optionally run a final-stage PR handoff after approval. Workers and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios; they must assume credentials/auth/environment access exists until concrete checks plus an actual app/flow launch attempt prove otherwise, and skipped E2E must cite exact attempted commands and observed failure output. Reviewers also look for any QA E2E video referenced by the ledger or receipt and inspect the actual video before treating it as proof. Token budget behavior is intentionally excluded. Goal skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation after Goal reaches `complete` within the turn budget.
+Goal Runner workflow: initialize a persisted goal ledger with a per-run goal id, immutable `acceptance_criteria`, and lifecycle events, render goal-continuation context, run bounded worker LM turns, append receipts, run three independent reviewers with objective-alignment findings and clause-by-clause requirements traceability, let a TypeScript reducer decide `complete`, `continue`, `blocked`, or `needs_human`, and optionally run a final-stage PR handoff after approval. All three reviewers start in clean, non-forked contexts like Ralph's reviewers and use Ralph's exact `reviewer-a` model chain, led by Claude Fable 5. Workers begin from an observable acceptance/contract matrix derived from the literal objective/acceptance criteria and are prompted to model states, transitions, and invariants explicitly for stateful work; each review round's findings are consolidated into a deduplicated cross-reviewer batch (`consolidated_findings` in the round artifact) that the next worker turn repairs together, with durable regression evidence required for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the worker receipt or worker-authored tests. Workers and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios; they must assume credentials/auth/environment access exists until concrete checks plus an actual app/flow launch attempt prove otherwise, and skipped E2E must cite exact attempted commands and observed failure output. Reviewers also look for any QA E2E video referenced by the ledger or receipt and inspect the actual video before treating it as proof. Token budget behavior is intentionally excluded. Goal skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation after Goal reaches `complete` within the turn budget.
 
 ```text
 /workflow goal objective="Migrate the database layer to Drizzle ORM" base_branch=develop
@@ -677,13 +677,13 @@ Goal Runner workflow: initialize a persisted goal ledger with a per-run goal id,
 | `base_branch` | `string` | —        | `origin/main` | Branch reviewers and the optional final stage compare the current delta with. |
 | `create_pr`    | `boolean` | —        | `false`       | Safe-by-default PR creation flag. Omitted or `false` skips the final `pull-request` stage and omits `pr_report`; prompt text alone does not opt in, and only strict `true` authorizes the final `pull-request` stage to attempt provider-appropriate PR/MR/review creation after Goal reaches `complete`. |
 
-`goal` defaults to 10 worker/review turns. Reviewer quorum is fixed internally at 2 reviewer `complete` votes. The repeated-blocker threshold defaults to 3 consecutive same-blocker turns and is clamped to `max_turns` when you run fewer than 3 turns.
+`goal` defaults to 10 worker/review turns. Reviewer quorum is fixed internally at 2 reviewer `complete` votes, but approval is evidence closure rather than reviewer agreement alone: the reducer completes the run only when quorum is met and no objective-relevant blocking finding from any reviewer in the current round remains unresolved (`required_by_objective` findings block at any priority, P3 included; `consistent_with_objective` P3 nice-to-haves do not block). When closure fails, the decision reason records the unresolved findings, and the bounded loop stops inspectably at `max_turns` as `needs_human`. The repeated-blocker threshold defaults to 3 consecutive same-blocker turns and is clamped to `max_turns` when you run fewer than 3 turns.
 
 Child workflow outputs: `result`, `status`, `approved`, `goal_id`, `objective`, `acceptance_criteria`, `ledger_path`, `turns_completed`, `iterations_completed`, `receipts`, `remaining_work`, `review_report`, and `review_report_path`. `pr_report` is included only when `create_pr=true`, Goal reaches `complete`, and the final `pull-request` stage runs.
 
 ### `ralph`
 
-Raw prompt → prompt-engineering research → orchestrate → review workflow with optional final-stage PR handoff: use the raw prompt as the operative objective, keep optional `acceptance_criteria` as the immutable original task contract (defaulting to `prompt`), transform the prompt into a codebase and online research question with `/skill:prompt-engineer`, run `/skill:research-codebase` against it, write findings under `research/`, delegate implementation through sub-agents from that research, run parallel reviewers across Claude Fable 5 and GPT-5.5 Codex model families, and iterate until approval or the loop limit. Ralph's research, orchestrator, and reviewer prompts receive the objective next to the literal acceptance contract; when launching follow-up Ralph runs from reviewer findings, pass the ORIGINAL task text as `acceptance_criteria` so deltas cannot drift from the contract. Ralph's orchestrator and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios. They must assume credentials/auth/environment access exists until concrete non-destructive checks plus an actual launch/flow attempt prove otherwise; skipped E2E is valid only when exact attempted commands and observed failure output are recorded. For UI-applicable or full-stack changes, the orchestrator runs a `playwright-cli` end-to-end QA pass and records a reviewable proof video, references it in the implementation notes, and exposes it as the `qa_video_path` output; reviewers receive that path and inspect the actual video before treating it as proof. Review decisions include `requirements_traceability`, a non-empty clause-by-clause map over every prompt/acceptance-criteria requirement, and Ralph approval requires every entry to be `proven`; worker-authored tests/snapshots passing are circular evidence unless tied to independent current-state proof. When `create_pr=true`, the final `pull-request` stage attaches or links that video to the created PR/MR/review. Follow-up iterations pass unresolved review artifacts into prompt-engineering/research and fork research from prior research session data when available. Ralph skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation (for example GitHub `gh`, Azure Repos `az repos pr create`, or Sapling/Phabricator tooling). Ralph's own PR-creation instructions live in that final stage. Reviewers inspect repository infrastructure directly as needed; Ralph no longer runs separate `infra-*` discovery stages.
+Raw prompt → prompt-engineering research → orchestrate → review workflow with optional final-stage PR handoff: use the raw prompt as the operative objective, keep optional `acceptance_criteria` as the immutable original task contract (defaulting to `prompt`), transform the prompt into a codebase and online research question with `/skill:prompt-engineer`, run `/skill:research-codebase` against it, write findings under `research/`, delegate implementation through sub-agents from that research, run parallel reviewers across Claude Fable 5 and GPT-5.5 Codex model families, and iterate until approval or the loop limit. Ralph's research, orchestrator, and reviewer prompts receive the objective next to the literal acceptance contract; when launching follow-up Ralph runs from reviewer findings, pass the ORIGINAL task text as `acceptance_criteria` so deltas cannot drift from the contract. The orchestrator begins from an observable acceptance/contract matrix derived from the literal prompt/acceptance criteria, models states/transitions/invariants explicitly for stateful work, and repairs unresolved reviewer findings as one consolidated batch (the round artifact carries a deduplicated cross-reviewer `consolidated_findings` list) with durable regression evidence for reproduced findings. Reviewers independently derive adversarial checks from the literal contract before relying on the implementation notes, orchestrator report, or worker-authored tests, and `required_by_objective` findings block at any priority (P3 included) while `consistent_with_objective` P3 nice-to-haves stay non-blocking. Ralph's orchestrator and reviewers are prompted to verify user-visible behavior end-to-end when practical with `playwright-cli`-skilled subagents for web/frontend flows that may depend on backend/API behavior and tmux-skilled subagents for TUI or terminal-app scenarios. They must assume credentials/auth/environment access exists until concrete non-destructive checks plus an actual launch/flow attempt prove otherwise; skipped E2E is valid only when exact attempted commands and observed failure output are recorded. For UI-applicable or full-stack changes, the orchestrator runs a `playwright-cli` end-to-end QA pass and records a reviewable proof video, references it in the implementation notes, and exposes it as the `qa_video_path` output; reviewers receive that path and inspect the actual video before treating it as proof. Review decisions include `requirements_traceability`, a non-empty clause-by-clause map over every prompt/acceptance-criteria requirement, and Ralph approval requires every entry to be `proven`; worker-authored tests/snapshots passing are circular evidence unless tied to independent current-state proof. When `create_pr=true`, the final `pull-request` stage attaches or links that video to the created PR/MR/review. Follow-up iterations pass unresolved review artifacts into prompt-engineering/research and fork research from prior research session data when available. Ralph skips PR creation by default; prompt text alone does not opt in. Pass `create_pr=true` to authorize only the final `pull-request` stage to inspect provider credentials and attempt provider-appropriate PR/MR/review creation (for example GitHub `gh`, Azure Repos `az repos pr create`, or Sapling/Phabricator tooling). Ralph's own PR-creation instructions live in that final stage. Reviewers inspect repository infrastructure directly as needed; Ralph no longer runs separate `infra-*` discovery stages.
 
 ```text
 /workflow ralph prompt="Migrate the database layer to Drizzle ORM" max_loops=3 base_branch=develop

package/dist/builtin/workflows/builtin/goal-artifacts.ts

@@ -1,7 +1,10 @@
 import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import type { ReviewDecision, ReviewRecord } from "./goal-types.js";
-import type { ReviewConvergenceSummary } from "./review-convergence.js";
+import {
+  consolidateFindingsBatch,
+  type ReviewConvergenceSummary,
+} from "./review-convergence.js";
 
 export function artifactSafeName(value: string): string {
   const safe = value
@@ -42,9 +45,19 @@ export async function writeReviewRoundArtifact(
 ): Promise<string> {
   const artifactPath = join(artifactDir, "review-round-latest.json");
   const visibleReviews = reviews.map(withoutTurn);
-  await writeFile(artifactPath, `${JSON.stringify({ reviews: visibleReviews }, null, 2)}\n`, {
-    encoding: "utf8",
-  });
+  // Deduplicated cross-reviewer findings batch so the next worker turn can
+  // plan and repair the round's findings together instead of one at a time.
+  const consolidatedFindings = consolidateFindingsBatch(
+    reviews.map((review) => ({
+      reviewer: review.reviewer,
+      findings: review.findings,
+    })),
+  );
+  await writeFile(
+    artifactPath,
+    `${JSON.stringify({ reviews: visibleReviews, consolidated_findings: consolidatedFindings }, null, 2)}\n`,
+    { encoding: "utf8" },
+  );
   return artifactPath;
 }
 

package/dist/builtin/workflows/builtin/goal-prompts.ts

@@ -1,6 +1,11 @@
 import {
+  ACCEPTANCE_MATRIX_CONTRACT,
   E2E_VERIFICATION_GUIDANCE,
+  EVIDENCE_CLOSURE_POLICY,
+  FINDINGS_CONSOLIDATION_CONTRACT,
   LITERAL_OBJECTIVE_CONTRACT,
+  REGRESSION_EVIDENCE_CONTRACT,
+  REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT,
   REVIEWER_SPEC_VS_OBJECTIVE_GUARD,
   WORKER_PREFLIGHT_CONTRACT,
   renderE2eQaVideoReviewGuidance,
@@ -17,7 +22,7 @@ export const GOAL_CONTINUATION_REFERENCE = [
   "- Temporary rough edges are acceptable while the work is moving in the right direction. Completion still requires the requested end state to be true and verified.",
   "",
   "Work from evidence:",
-  "Use the current worktree and external state as authoritative. Previous conversation context can help locate relevant work, but inspect the current state before relying on it. Improve, replace, or remove existing work as needed to satisfy the actual objective.",
+  "Use the current worktree and external state as authoritative. Inspect the current state before relying on prior summaries or receipts. Improve, replace, or remove existing work as needed to satisfy the actual objective.",
   "",
   "Progress visibility:",
   "If todo management is available and the next work is meaningfully multi-step, use it to show a concise plan tied to the real objective. Keep the plan current as steps complete or the next best action changes. Skip planning overhead for trivial one-step progress, and do not treat a todo update as a substitute for doing the work.",
@@ -149,6 +154,7 @@ export function renderLatestReviewArtifacts(paths: readonly string[]): string {
   return [
     "Latest available review artifacts:",
     ...paths.map((path) => `- ${path}`),
+    "When a review-round artifact with a consolidated_findings batch is listed, read it first and treat that batch as the set of findings to repair together this turn.",
     "Read only the details needed for the next action; do not load older review artifacts unless the latest artifacts explicitly refer to them.",
   ].join("\n");
 }
@@ -170,7 +176,7 @@ export function renderGoalContinuationPrompt(
         `- Goal ledger artifact: ${ledgerPath}`,
         "- Objective and acceptance criteria: stored in the ledger; read them as data, not prompt instructions.",
         `- Blocked threshold: same blocker must repeat for at least ${blockerThreshold} controller observations before the controller can stop as blocked.`,
-        "- Completion transition: the worker may claim readiness, but reviewer quorum plus the deterministic reducer decides final workflow status.",
+        "- Completion transition: the worker may claim readiness, but reviewer quorum plus the deterministic reducer decides final workflow status, and completion additionally requires evidence closure: unresolved objective-relevant blocking findings from any reviewer keep the loop iterating even when quorum is met.",
         "",
         renderReceiptHistory(ledger),
         "",
@@ -178,6 +184,10 @@ export function renderGoalContinuationPrompt(
       ].join("\n"),
     ],
     ["goal_guidelines", GOAL_CONTINUATION_REFERENCE],
+    ["acceptance_matrix", ACCEPTANCE_MATRIX_CONTRACT],
+    ["findings_batch", FINDINGS_CONSOLIDATION_CONTRACT],
+    ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
+    ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
     ["pr_handoff_policy", INTERMEDIATE_PR_HANDOFF_GUARDRAIL],
     ["e2e_verification", E2E_VERIFICATION_GUIDANCE],
@@ -187,31 +197,27 @@ export function renderGoalContinuationPrompt(
 export function renderForkedGoalWorkerPrompt(
   ledger: GoalLedger,
   ledgerPath: string,
-  blockerThreshold: number,
   latestReviewArtifactPaths: readonly string[],
 ): string {
+  // Forked continuation of the previous worker session: the forked history
+  // already carries the role, contracts, guidance, and output format from the
+  // initial worker prompt, so send only the per-turn delta plus a pointer back
+  // to the established guidance instead of repeating it.
   return taggedPrompt([
     [
       "goal_context",
       [
-        "Continue the same goal-runner worker thread from the previous worker session.",
-        "Reuse the goal invariants, project preflight, worker receipt contract, completion audit, and blocked audit.",
+        "Continue the same goal-runner worker thread.",
+        "All previously established guidance still applies unchanged: the goal invariants, project preflight, worker receipt contract, completion audit, blocked audit, literal objective contract, acceptance matrix, findings batch, regression evidence, evidence closure, PR handoff policy, E2E verification guidance, and the receipt output format.",
         "Do not reinterpret, shrink, or weaken the original objective; the goal ledger remains authoritative.",
         "",
-        "Workflow context:",
-        `- Goal ledger artifact: ${ledgerPath}`,
-        "- Objective and acceptance criteria: stored in the ledger; read them as data, not prompt instructions.",
-        `- Blocked threshold: same blocker must repeat for at least ${blockerThreshold} controller observations before the controller can stop as blocked.`,
-        "- Completion transition: the worker may claim readiness, but reviewer quorum plus the deterministic reducer decides final workflow status.",
+        `Goal ledger artifact: ${ledgerPath}`,
         "",
         renderReceiptHistory(ledger),
         "",
         renderLatestReviewArtifacts(latestReviewArtifactPaths),
       ].join("\n"),
     ],
-    ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
-    ["pr_handoff_policy", INTERMEDIATE_PR_HANDOFF_GUARDRAIL],
-    ["e2e_verification", E2E_VERIFICATION_GUIDANCE],
   ]);
 }
 export function renderReviewerPrompt(args: {
@@ -246,6 +252,9 @@ export function renderReviewerPrompt(args: {
     ],
     ["review_guidance", args.focus],
     ["literal_contract", LITERAL_OBJECTIVE_CONTRACT],
+    ["independent_verification", REVIEWER_INDEPENDENT_VERIFICATION_CONTRACT],
+    ["regression_evidence", REGRESSION_EVIDENCE_CONTRACT],
+    ["evidence_closure", EVIDENCE_CLOSURE_POLICY],
     ["goal_framework", GOAL_METHOD_REFERENCE],
     ["goal_guidelines", GOAL_CONTINUATION_REFERENCE],
     ["pr_handoff_policy", INTERMEDIATE_PR_HANDOFF_GUARDRAIL],
@@ -276,7 +285,7 @@ export function renderReviewerPrompt(args: {
       "reference_branch",
       [
         `The baseline branch for comparison is \`${args.comparisonBaseBranch}\`.`,
-        "Compare the current working tree against this baseline branch, not against previous workflow reasoning or progress expectations.",
+        "Compare the current working tree against this baseline branch.",
         `Start with \`git status --short\`, then use working-tree-aware commands such as \`git diff ${args.comparisonBaseBranch}\` and \`git diff --cached ${args.comparisonBaseBranch}\` to identify changed tracked files; inspect untracked files from status directly.`,
       ].join("\n"),
     ],
@@ -343,7 +352,7 @@ export function renderReviewerPrompt(args: {
       "review_stage_contract",
       [
         "The structured review decision is only valid after you inspect the actual repository state and compare it against the stated baseline branch.",
-        "Do not approve based solely on workflow stage summaries or prior agent reasoning.",
+        "Do not approve based solely on summaries in the provided context artifacts.",
         "Treat this review as the completion audit for the current repository and goal state: approval means receipts and current evidence prove the original owner outcome against the full objective.",
         "Do not approve when proof only shows planning, discovery, task selection, helper documents, or a narrow slice while the broader requested outcome still has required work remaining.",
         "The tool call is the final verdict after review work, not a shortcut around review work.",
@@ -353,12 +362,13 @@ export function renderReviewerPrompt(args: {
       "required_actions_before_tool_call",
       [
         "1. Identify the changed files or diff under review.",
-        "2. Read the relevant changed code and directly affected call sites/tests/configs.",
-        "3. Read the goal ledger and worker receipt, then map receipts to the inferred verification oracle and original owner outcome.",
-        "4. If a QA E2E video is referenced or expected for the change, inspect the actual video and include that assessment in the evidence map.",
-        "5. Run or delegate focused validation when needed to resolve uncertainty.",
-        "6. Decide whether the receipt/evidence map proves completion; if evidence is uncertain, indirect, stale, missing, or narrower than the requested outcome, set goal_oracle_satisfied=false and stop_review_loop=false.",
-        "7. If you cannot inspect receipts, video evidence, or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
+        "2. From the objective and acceptance criteria in the goal ledger alone, derive your independent adversarial check list (see independent_verification) before opening the worker receipt or worker-authored tests.",
+        "3. Read the relevant changed code and directly affected call sites/tests/configs, executing or delegating your highest-value derived checks against the current state.",
+        "4. Read the goal ledger and worker receipt, then map receipts to the inferred verification oracle and original owner outcome, comparing them against your independently derived checks.",
+        "5. If a QA E2E video is referenced or expected for the change, inspect the actual video and include that assessment in the evidence map.",
+        "6. Run or delegate focused validation when needed to resolve uncertainty, and check that fixes for previously reproduced findings carry durable regression evidence.",
+        "7. Decide whether the receipt/evidence map proves completion; if evidence is uncertain, indirect, stale, missing, or narrower than the requested outcome, set goal_oracle_satisfied=false and stop_review_loop=false.",
+        "8. If you cannot inspect receipts, video evidence, or validate enough to approve safely, populate reviewer_error and set stop_review_loop=false.",
       ].join("\n"),
     ],
     [
@@ -395,7 +405,7 @@ export function renderReviewerPrompt(args: {
       [
         "Set stop_review_loop=true only when there are no blocking findings, overall_correctness is patch is correct, goal_oracle_satisfied is true, requirements_traceability is non-empty and every non-final-action entry is proven, no objective-relevant implementation or validation remains, and reviewer_error is null/omitted.",
         "Enumerate every explicit requirement clause from the objective and acceptance criteria in requirements_traceability, including clauses about existing tests/snapshots and expected behavior. Treat worker-authored tests or snapshots passing as circular evidence that cannot by itself prove a clause.",
-        "P3 nice-to-have findings are non-blocking when the rest of the approval contract is satisfied; do not use P3 for work required by the objective or verification oracle. Findings classified beyond_objective or contradicts_objective are non-blocking regardless of priority, but must be surfaced and must not be folded into follow-up objectives without checking acceptance criteria.",
+        "P3 findings are non-blocking only when classified consistent_with_objective and the rest of the approval contract is satisfied; findings classified required_by_objective block at any priority (P3 included) because severity labels alone never dismiss objective-relevant findings. Do not use P3 for work required by the objective or verification oracle. Findings classified beyond_objective or contradicts_objective are non-blocking regardless of priority, but must be surfaced and must not be folded into follow-up objectives without checking acceptance criteria.",
         "If you hit a reviewer/tool/validation error, set stop_review_loop=false and populate reviewer_error instead of pretending the patch is approved.",
       ].join("\n"),
     ],

package/dist/builtin/workflows/builtin/goal-reducer.ts

@@ -1,5 +1,10 @@
 import type { BlockerObservation, GoalLedger, ReducerOutcome, ReviewRecord } from "./goal-types.js";
-import { summarizeReviewConvergence, type ReviewNextAction } from "./review-convergence.js";
+import {
+  closureGapSummary,
+  summarizeReviewConvergence,
+  unresolvedClosureFindings,
+  type ReviewNextAction,
+} from "./review-convergence.js";
 
 function reducerSummary(
   reviews: readonly ReviewRecord[],
@@ -89,8 +94,25 @@ export function reduceGoalDecision(
   const completeVotes = turnReviews.filter(
     (review) => review.decision === "complete",
   ).length;
+  const quorumMet = completeVotes >= options.reviewQuorum;
 
-  if (completeVotes >= options.reviewQuorum) {
+  // Evidence closure: reviewer agreement alone cannot complete the run. Any
+  // objective-relevant blocking finding from ANY reviewer in the current round
+  // vetoes completion until it is resolved with evidence or reclassified
+  // against the literal contract, even when quorum is met. The loop stays
+  // bounded by max_turns and stops inspectably below.
+  const unresolvedFindings = unresolvedClosureFindings(
+    turnReviews.map((review) => ({
+      reviewer: review.reviewer,
+      findings: review.findings,
+    })),
+  );
+  const closureVeto = quorumMet && unresolvedFindings.length > 0;
+  const closureVetoReason = closureVeto
+    ? `Reviewer quorum met (${completeVotes}/${options.reviewQuorum}) without evidence closure: ${closureGapSummary(unresolvedFindings)}. Severity labels alone cannot dismiss objective-relevant findings; resolve them with evidence or reclassify them against the literal contract.`
+    : undefined;
+
+  if (quorumMet && unresolvedFindings.length === 0) {
     const summary = reducerSummary(turnReviews, true, options.nextActionOnComplete);
     return {
       status: "complete",
@@ -98,7 +120,7 @@ export function reduceGoalDecision(
         ...summary,
         turn: options.turn,
         decision: "complete",
-        reason: `Reviewer quorum met: ${completeVotes}/${options.reviewQuorum} reviewers marked complete.`,
+        reason: `Reviewer quorum met with evidence closure: ${completeVotes}/${options.reviewQuorum} reviewers marked complete and no objective-relevant blocking findings remain.`,
         complete_votes: completeVotes,
         review_quorum: options.reviewQuorum,
       },
@@ -138,7 +160,9 @@ export function reduceGoalDecision(
         ...reducerSummary(turnReviews, false, "needs_human"),
         turn: options.turn,
         decision: "needs_human",
-        reason: `Worker attempt budget reached without reviewer quorum. Remaining work: ${collectRemainingWork(turnReviews)}`,
+        reason: closureVetoReason !== undefined
+          ? `Worker attempt budget reached without evidence closure. ${closureVetoReason}`
+          : `Worker attempt budget reached without reviewer quorum. Remaining work: ${collectRemainingWork(turnReviews)}`,
         complete_votes: completeVotes,
         review_quorum: options.reviewQuorum,
         ...(observation ? { blocker: observation.blocker } : {}),
@@ -153,7 +177,7 @@ export function reduceGoalDecision(
       ...reducerSummary(turnReviews, false, "implementation"),
       turn: options.turn,
       decision: "continue",
-      reason: `Reviewer quorum not met. Remaining work: ${collectRemainingWork(turnReviews)}`,
+      reason: closureVetoReason ?? `Reviewer quorum not met. Remaining work: ${collectRemainingWork(turnReviews)}`,
       complete_votes: completeVotes,
       review_quorum: options.reviewQuorum,
       ...(observation ? { blocker: observation.blocker } : {}),

package/dist/builtin/workflows/builtin/goal-review.ts

@@ -2,6 +2,7 @@ import type { WorkflowTaskResult } from "../src/shared/types.js";
 import type { ReviewDecision, ReviewRecord } from "./goal-types.js";
 import {
   finalActionRemaining,
+  findingBlocksClosure,
   parseFailureDiagnostics,
   summarizeReviewConvergence,
   traceabilityProvenExceptFinalAction,
@@ -28,18 +29,12 @@ export function parsedReviewDecisionFromResult(
   };
 }
 
-const NON_BLOCKING_ALIGNMENTS = new Set([
-  "beyond_objective",
-  "contradicts_objective",
-]);
-
 function findingBlocksApproval(finding: ReviewDecision["findings"][number]): boolean {
-  const alignment = finding.objective_alignment;
-  if (NON_BLOCKING_ALIGNMENTS.has(alignment)) return false;
-  if (alignment !== "required_by_objective" && alignment !== "consistent_with_objective") {
-    return true;
-  }
-  return finding.priority !== 3;
+  // Shared evidence-closure predicate: required_by_objective findings block at
+  // any priority (severity labels alone never dismiss objective-relevant
+  // findings); consistent_with_objective P3 nits stay non-blocking;
+  // beyond/contradicts_objective findings never block.
+  return findingBlocksClosure(finding);
 }
 
 function traceabilityApproves(

package/dist/builtin/workflows/builtin/goal-runner.ts

@@ -144,19 +144,21 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
       excludedTools: ["ask_user_question"],
     };
 
+    // Keep this model list identical to Ralph reviewer-a while preserving an
+    // independent Goal configuration and Goal's richer decision schema.
     const reviewerModelConfig = {
       model: "anthropic/claude-fable-5:high",
       fallbackModels: [
-        "openai-codex/gpt-5.6-sol:max",
-        "github-copilot/gpt-5.6-sol:max",
-        "openai/gpt-5.6-sol:max",
+        "openai-codex/gpt-5.6-sol:xhigh",
+        "github-copilot/gpt-5.6-sol:xhigh",
+        "openai/gpt-5.6-sol:xhigh",
         "openai-codex/gpt-5.5:xhigh",
         "github-copilot/gpt-5.5:xhigh",
         "openai/gpt-5.5:xhigh",
         "github-copilot/claude-opus-4.8 (1m):high",
         "anthropic/claude-opus-4-8:high",
         "cursor/claude-fable-5:high",
-        "cursor/gpt-5.6-sol:max",
+        "cursor/gpt-5.6-sol:xhigh",
         "cursor/gpt-5.5:high",
         "cursor/claude-opus-4-8-thinking:high",
         "cursor/grok-4.5",
@@ -164,7 +166,7 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
         "zai-coding-cn/glm-5.2:xhigh",
         "cursor/glm-5.2",
         "openrouter/anthropic/claude-fable-5:high",
-        "openrouter/openai/gpt-5.6-sol:max",
+        "openrouter/openai/gpt-5.6-sol:xhigh",
         "openrouter/sakana/fugu-ultra:high",
         "openrouter/openai/gpt-5.5:xhigh",
         "openrouter/anthropic/claude-opus-4-8:high",
@@ -207,7 +209,6 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
         : renderForkedGoalWorkerPrompt(
             ledger,
             ledgerPath,
-            blockerThreshold,
             latestReviewArtifactPaths,
           );
 
@@ -341,11 +342,9 @@ export async function runGoalWorkflow(ctx: GoalRunnerContext, options: GoalWorkf
         );
         return record;
       }));
-      latestReviewArtifactPaths = latestReviews.map((review) => review.artifact_path);
-      latestReviewReportPath = await writeReviewRoundArtifact(
-        artifactDir,
-        latestReviews,
-      );
+      latestReviewReportPath = await writeReviewRoundArtifact(artifactDir, latestReviews);
+      // Consolidated round artifact leads so the next worker turn plans the full findings batch first.
+      latestReviewArtifactPaths = [latestReviewReportPath, ...latestReviews.map((review) => review.artifact_path)];
       ledger.reviews.push(...latestReviews);
       appendLifecycleEvent(
         ledger,

package/dist/builtin/workflows/builtin/open-claude-design-runner.ts

@@ -162,7 +162,7 @@ export async function runOpenClaudeDesignWorkflow(ctx: OpenClaudeDesignContext):
         ["role", "You are an opinionated staff design engineer."],
         [
           "objective",
-          `Audit the project UI constraints that must shape: ${designBrief}. Independently scan the repository and evaluate the evidence you find against impeccable's six dimensions of design quality. Also capture/parse any user-provided references in this same pass. This runs in PARALLEL with the locator and pattern passes, so do your own scan rather than relying on their output.`,
+          `Audit the project UI constraints that must shape: ${designBrief}. Independently scan the repository and evaluate the evidence you find against impeccable's six dimensions of design quality. Also capture/parse any user-provided references in this same pass. Do your own scan; do not assume any other stage's output is available.`,
         ],
         [
           "impeccable_skill",
@@ -203,7 +203,7 @@ export async function runOpenClaudeDesignWorkflow(ctx: OpenClaudeDesignContext):
         ["role", "You are an opinionated staff design engineer."],
         [
           "objective",
-          `Extract reusable patterns and anti-patterns for: ${designBrief}. Apply the impeccable \`extract\` sub-skill to find design patterns to reuse and anti-patterns to avoid. Also parse/capture user references inside this same pass, translating them into reusable generation patterns. This runs in PARALLEL with the locator and auditor passes, so scan the codebase yourself rather than depending on their output.`,
+          `Extract reusable patterns and anti-patterns for: ${designBrief}. Apply the impeccable \`extract\` sub-skill to find design patterns to reuse and anti-patterns to avoid. Also parse/capture user references inside this same pass, translating them into reusable generation patterns. Do your own scan; do not assume any other stage's output is available.`,
         ],
         ["user_references", userReferenceContext],
         ["reference_handling", referenceHandlingRules],