@chllming/wave-orchestration 0.5.4 → 0.6.1

package/scripts/wave-orchestrator/config.mjs

@@ -11,19 +11,23 @@ const REPO_ROOT = WORKSPACE_ROOT;
 
 export const DEFAULT_WAVE_CONFIG_PATH = path.join(REPO_ROOT, "wave.config.json");
 export const DEFAULT_WAVE_LANE = "main";
-export const DEFAULT_EVALUATOR_AGENT_ID = "A0";
+export const DEFAULT_CONT_QA_AGENT_ID = "A0";
+export const DEFAULT_CONT_EVAL_AGENT_ID = "E0";
 export const DEFAULT_INTEGRATION_AGENT_ID = "A8";
 export const DEFAULT_DOCUMENTATION_AGENT_ID = "A9";
 export const DEFAULT_ROLE_PROMPT_DIR = "docs/agents";
-export const DEFAULT_EVALUATOR_ROLE_PROMPT_PATH = "docs/agents/wave-evaluator-role.md";
+export const DEFAULT_CONT_QA_ROLE_PROMPT_PATH = "docs/agents/wave-cont-qa-role.md";
+export const DEFAULT_CONT_EVAL_ROLE_PROMPT_PATH = "docs/agents/wave-cont-eval-role.md";
 export const DEFAULT_INTEGRATION_ROLE_PROMPT_PATH = "docs/agents/wave-integration-role.md";
 export const DEFAULT_DOCUMENTATION_ROLE_PROMPT_PATH =
   "docs/agents/wave-documentation-role.md";
+export const DEFAULT_SECURITY_ROLE_PROMPT_PATH = "docs/agents/wave-security-role.md";
 export const DEFAULT_TERMINALS_PATH = ".vscode/terminals.json";
 export const DEFAULT_DOCS_DIR = "docs";
 export const DEFAULT_STATE_ROOT = ".tmp";
 export const DEFAULT_ORCHESTRATOR_STATE_DIR = ".tmp/wave-orchestrator";
 export const DEFAULT_CONTEXT7_BUNDLE_INDEX_PATH = "docs/context7/bundles.json";
+export const DEFAULT_BENCHMARK_CATALOG_PATH = "docs/evals/benchmark-catalog.json";
 export const DEFAULT_COMPONENT_CUTOVER_MATRIX_DOC_PATH = "docs/plans/component-cutover-matrix.md";
 export const DEFAULT_COMPONENT_CUTOVER_MATRIX_JSON_PATH = "docs/plans/component-cutover-matrix.json";
 export const DEFAULT_REQUIRED_PROMPT_REFERENCES = [
@@ -37,6 +41,10 @@ export const DEFAULT_CODEX_SANDBOX_MODE = "danger-full-access";
 export const CODEX_SANDBOX_MODES = ["read-only", "workspace-write", "danger-full-access"];
 export const DEFAULT_CLAUDE_COMMAND = "claude";
 export const DEFAULT_OPENCODE_COMMAND = "opencode";
+const LEGACY_EVALUATOR_ROLE_KEYS = new Map([
+  ["evaluatorAgentId", "contQaAgentId"],
+  ["evaluatorRolePromptPath", "contQaRolePromptPath"],
+]);
 
 export function normalizeExecutorMode(value, label = "executor") {
   const normalized = String(value || "")
@@ -138,7 +146,7 @@ function normalizeOptionalPositiveInt(value, label, fallback = null) {
 }
 
 function normalizeOptionalBoolean(value, fallback = false) {
-  if (value === undefined) {
+  if (value === undefined || value === null || value === "") {
     return fallback;
   }
   if (typeof value === "boolean") {
@@ -253,20 +261,30 @@ function defaultSharedPlanDocs(plansDir) {
 }
 
 function normalizeRoles(rawRoles = {}) {
+  for (const [legacyKey, replacementKey] of LEGACY_EVALUATOR_ROLE_KEYS.entries()) {
+    if (Object.prototype.hasOwnProperty.call(rawRoles, legacyKey)) {
+      throw new Error(`roles.${legacyKey} was renamed to roles.${replacementKey}`);
+    }
+  }
   const rolePromptDir = normalizeRepoRelativePath(
     rawRoles.rolePromptDir || DEFAULT_ROLE_PROMPT_DIR,
     "roles.rolePromptDir",
   );
   return {
     rolePromptDir,
-    evaluatorAgentId: String(rawRoles.evaluatorAgentId || DEFAULT_EVALUATOR_AGENT_ID).trim(),
+    contQaAgentId: String(rawRoles.contQaAgentId || DEFAULT_CONT_QA_AGENT_ID).trim(),
+    contEvalAgentId: String(rawRoles.contEvalAgentId || DEFAULT_CONT_EVAL_AGENT_ID).trim(),
     integrationAgentId: String(rawRoles.integrationAgentId || DEFAULT_INTEGRATION_AGENT_ID).trim(),
     documentationAgentId: String(
       rawRoles.documentationAgentId || DEFAULT_DOCUMENTATION_AGENT_ID,
     ).trim(),
-    evaluatorRolePromptPath: normalizeRepoRelativePath(
-      rawRoles.evaluatorRolePromptPath || DEFAULT_EVALUATOR_ROLE_PROMPT_PATH,
-      "roles.evaluatorRolePromptPath",
+    contQaRolePromptPath: normalizeRepoRelativePath(
+      rawRoles.contQaRolePromptPath || DEFAULT_CONT_QA_ROLE_PROMPT_PATH,
+      "roles.contQaRolePromptPath",
+    ),
+    contEvalRolePromptPath: normalizeRepoRelativePath(
+      rawRoles.contEvalRolePromptPath || DEFAULT_CONT_EVAL_ROLE_PROMPT_PATH,
+      "roles.contEvalRolePromptPath",
     ),
     integrationRolePromptPath: normalizeRepoRelativePath(
       rawRoles.integrationRolePromptPath || DEFAULT_INTEGRATION_ROLE_PROMPT_PATH,
@@ -276,6 +294,10 @@ function normalizeRoles(rawRoles = {}) {
       rawRoles.documentationRolePromptPath || DEFAULT_DOCUMENTATION_ROLE_PROMPT_PATH,
       "roles.documentationRolePromptPath",
     ),
+    securityRolePromptPath: normalizeRepoRelativePath(
+      rawRoles.securityRolePromptPath || DEFAULT_SECURITY_ROLE_PROMPT_PATH,
+      "roles.securityRolePromptPath",
+    ),
   };
 }
 
@@ -367,12 +389,18 @@ function normalizeDefaultExecutorByRole(rawDefaultExecutorByRole = {}) {
     return {};
   }
   return Object.fromEntries(
-    Object.entries(rawDefaultExecutorByRole).map(([role, executorId]) => [
-      String(role || "")
+    Object.entries(rawDefaultExecutorByRole).map(([role, executorId]) => {
+      const normalizedRole = String(role || "")
         .trim()
-        .toLowerCase(),
-      normalizeExecutorMode(executorId, `defaultExecutorByRole.${role}`),
-    ]),
+        .toLowerCase();
+      if (normalizedRole === "evaluator") {
+        throw new Error("defaultExecutorByRole.evaluator was renamed to defaultExecutorByRole.cont-qa");
+      }
+      return [
+        normalizedRole,
+        normalizeExecutorMode(executorId, `defaultExecutorByRole.${role}`),
+      ];
+    }),
   );
 }
 
@@ -732,6 +760,10 @@ export function loadWaveConfig(configPath = DEFAULT_WAVE_CONFIG_PATH) {
       rawConfig.paths?.context7BundleIndexPath || DEFAULT_CONTEXT7_BUNDLE_INDEX_PATH,
       "paths.context7BundleIndexPath",
     ),
+    benchmarkCatalogPath: normalizeRepoRelativePath(
+      rawConfig.paths?.benchmarkCatalogPath || DEFAULT_BENCHMARK_CATALOG_PATH,
+      "paths.benchmarkCatalogPath",
+    ),
     componentCutoverMatrixDocPath: normalizeRepoRelativePath(
       rawConfig.paths?.componentCutoverMatrixDocPath ||
         defaultComponentCutoverMatrixDocPath(defaultPlansDir(rawConfig.paths?.docsDir || DEFAULT_DOCS_DIR)),
@@ -848,6 +880,10 @@ export function resolveLaneProfile(config, laneInput = config.defaultLane) {
         laneConfig.context7BundleIndexPath || config.paths.context7BundleIndexPath,
         `${lane}.context7BundleIndexPath`,
       ),
+      benchmarkCatalogPath: normalizeRepoRelativePath(
+        laneConfig.benchmarkCatalogPath || config.paths.benchmarkCatalogPath,
+        `${lane}.benchmarkCatalogPath`,
+      ),
       componentCutoverMatrixDocPath: normalizeRepoRelativePath(
         laneConfig.componentCutoverMatrixDocPath ||
           config.paths.componentCutoverMatrixDocPath ||

package/scripts/wave-orchestrator/context7.mjs

@@ -218,6 +218,8 @@ export function buildAgentPromptFingerprintSource(agent) {
     prompt: String(agent?.prompt || ""),
     context7SelectionHash: String(agent?.context7Resolved?.selectionHash || ""),
     exitContract: agent?.exitContract || null,
+    deliverables: agent?.deliverables || [],
+    proofArtifacts: agent?.proofArtifacts || [],
     components: agent?.components || [],
     componentTargets: agent?.componentTargets || null,
     executorResolved: agent?.executorResolved || null,

package/scripts/wave-orchestrator/coord-cli.mjs

@@ -18,7 +18,15 @@ import {
   writeCoordinationBoardProjection,
   writeJsonArtifact,
 } from "./coordination-store.mjs";
-import { buildLanePaths, ensureDirectory, parseNonNegativeInt } from "./shared.mjs";
+import { writeAssignmentSnapshot, writeDependencySnapshot } from "./artifact-schemas.mjs";
+import {
+  buildLanePaths,
+  ensureDirectory,
+  parseNonNegativeInt,
+  readJsonOrNull,
+  REPO_ROOT,
+  sanitizeAdhocRunId,
+} from "./shared.mjs";
 import { parseWaveFiles } from "./wave-files.mjs";
 
 function printUsage() {
@@ -27,6 +35,7 @@ function printUsage() {
   wave coord show --lane <lane> --wave <n> [--dry-run] [--json]
   wave coord render --lane <lane> --wave <n> [--dry-run]
   wave coord inbox --lane <lane> --wave <n> --agent <id> [--dry-run]
+  wave coord <subcommand> --run <id> [--wave 0] ...
 `);
 }
 
@@ -36,6 +45,7 @@ function parseArgs(argv) {
   const options = {
     lane: "main",
     wave: null,
+    runId: "",
     dryRun: false,
     agent: "",
     kind: "",
@@ -52,6 +62,8 @@ function parseArgs(argv) {
     const arg = args[i];
     if (arg === "--lane") {
       options.lane = String(args[++i] || "").trim();
+    } else if (arg === "--run") {
+      options.runId = sanitizeAdhocRunId(args[++i]);
     } else if (arg === "--wave") {
       options.wave = parseNonNegativeInt(args[++i], "--wave");
     } else if (arg === "--agent") {
@@ -86,6 +98,11 @@ function parseArgs(argv) {
   return { subcommand, options };
 }
 
+function resolveLaneForRun(runId, fallbackLane) {
+  const resultPath = path.join(REPO_ROOT, ".wave", "adhoc", "runs", runId, "result.json");
+  return readJsonOrNull(resultPath)?.lane || fallbackLane;
+}
+
 function loadWave(lanePaths, waveNumber) {
   const waves = parseWaveFiles(lanePaths.wavesDir, { laneProfile: lanePaths.laneProfile });
   const wave = waves.find((item) => item.wave === waveNumber);
@@ -133,9 +150,32 @@ export async function runCoordinationCli(argv) {
     return;
   }
   const { subcommand, options } = parseArgs(argv);
+  if (options.runId) {
+    options.lane = resolveLaneForRun(options.runId, options.lane);
+  }
   const lanePaths = buildLanePaths(options.lane, {
     runVariant: options.dryRun ? "dry-run" : undefined,
+    adhocRunId: options.runId || null,
   });
+  if (options.wave === null && options.runId) {
+    options.wave = 0;
+  }
+  if (options.wave === null) {
+    throw new Error("--wave is required");
+  }
+  const wave = loadWave(lanePaths, options.wave);
+  const logPath = coordinationLogPath(lanePaths, wave.wave);
+  if (subcommand === "show") {
+    const state = readMaterializedCoordinationState(logPath);
+    if (options.json) {
+      console.log(JSON.stringify(serializeCoordinationState(state), null, 2));
+    } else {
+      for (const record of state.latestRecords) {
+        console.log(`${record.updatedAt} ${record.agentId} ${record.kind}/${record.status} ${record.summary}`);
+      }
+    }
+    return;
+  }
   ensureDirectory(lanePaths.coordinationDir);
   ensureDirectory(lanePaths.assignmentsDir);
   ensureDirectory(lanePaths.inboxesDir);
@@ -144,18 +184,14 @@ export async function runCoordinationCli(argv) {
   ensureDirectory(lanePaths.ledgerDir);
   ensureDirectory(lanePaths.integrationDir);
   ensureDirectory(lanePaths.dependencySnapshotsDir);
-  if (options.wave === null) {
-    throw new Error("--wave is required");
-  }
-  const wave = loadWave(lanePaths, options.wave);
-  const logPath = coordinationLogPath(lanePaths, wave.wave);
   updateSeedRecords(logPath, {
     lane: lanePaths.lane,
     wave: wave.wave,
     agents: wave.agents,
     componentPromotions: wave.componentPromotions,
     sharedPlanDocs: lanePaths.sharedPlanDocs,
-    evaluatorAgentId: lanePaths.evaluatorAgentId,
+    contQaAgentId: lanePaths.contQaAgentId,
+    contEvalAgentId: lanePaths.contEvalAgentId,
     integrationAgentId: lanePaths.integrationAgentId,
     documentationAgentId: lanePaths.documentationAgentId,
     feedbackRequests: [],
@@ -214,22 +250,18 @@ export async function runCoordinationCli(argv) {
     ledger,
     capabilityRouting: lanePaths.capabilityRouting,
   });
-  writeJsonArtifact(assignmentsPath(lanePaths, wave.wave), capabilityAssignments);
-  writeJsonArtifact(dependencySnapshotPath(lanePaths, wave.wave), dependencySnapshot);
+  writeAssignmentSnapshot(assignmentsPath(lanePaths, wave.wave), capabilityAssignments, {
+    lane: lanePaths.lane,
+    wave: wave.wave,
+  });
+  writeDependencySnapshot(dependencySnapshotPath(lanePaths, wave.wave), dependencySnapshot, {
+    lane: lanePaths.lane,
+    wave: wave.wave,
+  });
   writeDependencySnapshotMarkdown(
     dependencySnapshotMarkdownPath(lanePaths, wave.wave),
     dependencySnapshot,
   );
-  if (subcommand === "show") {
-    if (options.json) {
-      console.log(JSON.stringify(serializeCoordinationState(state), null, 2));
-    } else {
-      for (const record of state.latestRecords) {
-        console.log(`${record.updatedAt} ${record.agentId} ${record.kind}/${record.status} ${record.summary}`);
-      }
-    }
-    return;
-  }
   if (subcommand === "render") {
     const boardPath = messageBoardPath(lanePaths, wave.wave);
     writeCoordinationBoardProjection(boardPath, {

package/scripts/wave-orchestrator/coordination-store.mjs

@@ -489,6 +489,9 @@ export function compileSharedSummary({
           `- Integration proof gaps: ${(integrationSummary.proofGaps || []).length}`,
           `- Integration deploy risks: ${(integrationSummary.deployRisks || []).length}`,
           `- Integration doc gaps: ${(integrationSummary.docGaps || []).length}`,
+          `- Security review: ${integrationSummary.securityState || "not-applicable"}`,
+          `- Security findings: ${(integrationSummary.securityFindings || []).length}`,
+          `- Security approvals: ${(integrationSummary.securityApprovals || []).length}`,
         ]
       : []),
     ...(ledger ? [`- Ledger phase: ${ledger.phase || "n/a"}`] : []),
@@ -545,6 +548,10 @@ export function compileSharedSummary({
           "",
           ...renderIntegrationItems("## Deploy risks", integrationSummary.deployRisks),
           "",
+          ...renderIntegrationItems("## Security findings", integrationSummary.securityFindings),
+          "",
+          ...renderIntegrationItems("## Security approvals", integrationSummary.securityApprovals),
+          "",
           ...renderIntegrationItems("## Documentation gaps", integrationSummary.docGaps),
         ]
       : []),
@@ -695,6 +702,9 @@ export function compileAgentInbox({
           `- Proof gaps: ${(integrationSummary.proofGaps || []).length}`,
           `- Deploy risks: ${(integrationSummary.deployRisks || []).length}`,
           `- Documentation gaps: ${(integrationSummary.docGaps || []).length}`,
+          `- Security review: ${integrationSummary.securityState || "not-applicable"}`,
+          `- Security findings: ${(integrationSummary.securityFindings || []).length}`,
+          `- Security approvals: ${(integrationSummary.securityApprovals || []).length}`,
           ...renderIntegrationItems(
             "- Changed interfaces",
             integrationSummary.changedInterfaces,
@@ -711,6 +721,12 @@ export function compileAgentInbox({
           ...renderIntegrationItems("- Deploy risks", integrationSummary.deployRisks, {
             maxItems: 3,
           }),
+          ...renderIntegrationItems("- Security findings", integrationSummary.securityFindings, {
+            maxItems: 3,
+          }),
+          ...renderIntegrationItems("- Security approvals", integrationSummary.securityApprovals, {
+            maxItems: 3,
+          }),
           ...renderIntegrationItems("- Documentation gaps", integrationSummary.docGaps, {
             maxItems: 3,
           }),
@@ -782,7 +798,8 @@ export function buildSeedCoordinationRecords({
   agents,
   componentPromotions = [],
   sharedPlanDocs = [],
-  evaluatorAgentId = "A0",
+  contQaAgentId = "A0",
+  contEvalAgentId = "E0",
   integrationAgentId = "A8",
   documentationAgentId = "A9",
   feedbackRequests = [],
@@ -790,7 +807,10 @@ export function buildSeedCoordinationRecords({
   const records = [];
   for (const agent of agents) {
     const targets =
-      agent.agentId === evaluatorAgentId || agent.agentId === documentationAgentId || agent.agentId === integrationAgentId
+      agent.agentId === contQaAgentId ||
+      agent.agentId === contEvalAgentId ||
+      agent.agentId === documentationAgentId ||
+      agent.agentId === integrationAgentId
         ? []
         : [`agent:${agent.agentId}`];
     records.push(
@@ -802,7 +822,9 @@ export function buildSeedCoordinationRecords({
         agentId: "launcher",
         targets,
         priority:
-          agent.agentId === evaluatorAgentId || agent.agentId === documentationAgentId
+          agent.agentId === contQaAgentId ||
+          agent.agentId === contEvalAgentId ||
+          agent.agentId === documentationAgentId
             ? "high"
             : "normal",
         summary: `Wave ${wave} assigned to ${agent.agentId}: ${agent.title}`,
@@ -853,7 +875,7 @@ export function buildSeedCoordinationRecords({
         agentId: "launcher",
         targets: [`agent:${integrationAgentId}`],
         priority: "high",
-        summary: `Synthesize wave ${wave} before documentation and evaluator closure`,
+        summary: `Synthesize wave ${wave} before documentation and cont-QA closure`,
         detail: "Integration steward must reconcile open claims, blockers, interfaces, and release risk.",
       }),
     );

package/scripts/wave-orchestrator/coordination.mjs

@@ -14,6 +14,11 @@ import {
   sleepSync,
   toIsoTimestamp,
 } from "./shared.mjs";
+import { resolveEvalTargetsAgainstCatalog } from "./evals.mjs";
+import {
+  isContEvalImplementationOwningAgent,
+  isSecurityReviewAgent,
+} from "./role-helpers.mjs";
 
 export const ENTRY_HEADER_REGEX = /^##\s+(.+?)\s+\|\s+Agent\s+([A-Za-z0-9.]+)\s*$/;
 export const PLACEHOLDER_TIMESTAMP_REGEX = /\$\{(?:ts|TS)\}/;
@@ -191,8 +196,11 @@ export function buildExecutionPrompt({
   inboxText = "",
   context7 = null,
   componentPromotions = null,
+  evalTargets = null,
+  benchmarkCatalogPath = null,
   sharedPlanDocs = null,
-  evaluatorAgentId = "A0",
+  contQaAgentId = "A0",
+  contEvalAgentId = "E0",
   integrationAgentId = "A8",
   documentationAgentId = "A9",
 }) {
@@ -211,16 +219,39 @@ export function buildExecutionPrompt({
           `${lanePlansDir}/migration.md`,
         ];
   const sharedPlanDocList = resolvedSharedPlanDocs.map((docPath) => `\`${docPath}\``).join(", ");
-  const evaluatorRequirements =
-    agent.agentId === evaluatorAgentId
+  const contEvalImplementationOwning = isContEvalImplementationOwningAgent(agent, {
+    contEvalAgentId,
+  });
+  const resolvedEvalTargets = (() => {
+    try {
+      return resolveEvalTargetsAgainstCatalog(evalTargets, { benchmarkCatalogPath }).targets;
+    } catch {
+      return Array.isArray(evalTargets) ? evalTargets : [];
+    }
+  })();
+  const contQaRequirements =
+    agent.agentId === contQaAgentId
       ? [
-          `- Because you are Agent ${evaluatorAgentId}, your evaluator report must end with exactly one standalone line in the form \`Verdict: PASS\`, \`Verdict: CONCERNS\`, or \`Verdict: BLOCKED\`.`,
+          `- Because you are Agent ${contQaAgentId}, your cont-QA report must end with exactly one standalone line in the form \`Verdict: PASS\`, \`Verdict: CONCERNS\`, or \`Verdict: BLOCKED\`.`,
           "- Also emit one matching structured marker in your terminal output: `[wave-verdict] pass`, `[wave-verdict] concerns`, or `[wave-verdict] blocked`.",
           "- Emit one final structured gate marker: `[wave-gate] architecture=<pass|concerns|blocked> integration=<pass|concerns|blocked> durability=<pass|concerns|blocked> live=<pass|concerns|blocked> docs=<pass|concerns|blocked> detail=<short-note>`.",
           "- Only use `Verdict: PASS` when the wave is coherent enough to unblock the next wave.",
           `- Do not declare PASS until the documentation gate is closed: impacted implementation-owned docs must exist, ${sharedPlanDocList} must reflect plan-affecting outcomes, and no unresolved architecture-versus-plans drift remains.`,
           "- If shared-plan reconciliation is still active inside the wave, require the exact remaining doc delta and an explicit `closed` or `no-change` note from the documentation steward or named owner before finalizing. Do not treat ownership handoff alone as the blocker.",
-          "- Treat the last evaluator section and last structured gate marker as authoritative. Earlier concerns may remain in the append-only report history but do not control final completion if the closure sweep resolves them.",
+          "- Treat the last cont-QA section and last structured gate marker as authoritative. Earlier concerns may remain in the append-only report history but do not control final completion if the closure sweep resolves them.",
+        ]
+      : [];
+  const contEvalRequirements =
+    agent.agentId === contEvalAgentId
+      ? [
+          `- Because you are Agent ${contEvalAgentId}, you own the wave's iterative eval tuning loop.`,
+          contEvalImplementationOwning
+            ? "- You also own explicit non-report files in this wave. For those files, satisfy the same proof, doc-delta, and component-marker obligations as an implementation owner."
+            : "- You are report-only in this wave unless the prompt explicitly assigns additional non-report files. Do not edit product code outside explicit ownership; route exact follow-up work to the owning role.",
+          "- Read the wave's declared eval targets before selecting benchmarks or making tuning changes.",
+          "- Leave an append-only cont-EVAL report that records the selected benchmarks, commands run, observed gaps, regressions, and final disposition.",
+          "- Emit one final structured eval marker: `[wave-eval] state=<satisfied|needs-more-work|blocked> targets=<n> benchmarks=<n> regressions=<n> target_ids=<csv> benchmark_ids=<csv> detail=<short-note>`.",
+          "- Use `satisfied` only when observed outputs or benchmark results meet the declared target, not when the code merely looks better.",
         ]
       : [];
   const docStewardRequirements =
@@ -230,8 +261,18 @@ export function buildExecutionPrompt({
           "- If implementation work is still landing, any early closure note is provisional. Your final closure marker must reflect the post-implementation state seen during the closure sweep.",
         ]
       : [];
+  const securityRequirements = isSecurityReviewAgent(agent)
+    ? [
+        "- You are the wave's security reviewer. Default to report-only work and route fixes to the owning agent instead of editing product code.",
+        "- Leave a security review report with these sections in order: `Threat Model`, `Risky Surfaces`, `Findings`, `Required Approvals`, `Requested Fixes`, and `Final Disposition`.",
+        "- Emit one final structured security marker: `[wave-security] state=<clear|concerns|blocked> findings=<n> approvals=<n> detail=<short-note>`.",
+        "- Use `clear` only when no unresolved findings or approvals remain. Use `blocked` only when the wave must stop before integration.",
+      ]
+    : [];
   const implementationRequirements =
-    ![evaluatorAgentId, documentationAgentId].includes(agent.agentId)
+    ![contQaAgentId, documentationAgentId].includes(agent.agentId) &&
+    !isSecurityReviewAgent(agent) &&
+    (agent.agentId !== contEvalAgentId || contEvalImplementationOwning)
       ? [
           "- Emit one final structured proof marker: `[wave-proof] completion=<contract|integrated|authoritative|live> durability=<none|ephemeral|durable> proof=<unit|integration|live> state=<met|gap> detail=<short-note>`.",
           "- Emit one final structured documentation marker: `[wave-doc-delta] state=<none|owned|shared-plan> paths=<comma-separated-paths> detail=<short-note>`.",
@@ -328,8 +369,22 @@ export function buildExecutionPrompt({
           "",
         ]
       : [];
+  const evalTargetLines =
+    resolvedEvalTargets.length > 0
+      ? [
+          "Eval targets for this wave:",
+          ...(benchmarkCatalogPath ? [`- Benchmark catalog: ${benchmarkCatalogPath}`] : []),
+          ...resolvedEvalTargets.map((target) =>
+            target.selection === "delegated"
+              ? `- ${target.id}: delegated family=${target.benchmarkFamily} allowed-benchmarks=${(target.allowedBenchmarks || []).join(", ")} objective=${target.objective} threshold=${target.threshold}`
+              : `- ${target.id}: pinned benchmarks=${(target.benchmarks || []).join(", ")} objective=${target.objective} threshold=${target.threshold}`,
+          ),
+          "",
+        ]
+      : [];
   const ownedComponentLines =
-    ![evaluatorAgentId, documentationAgentId].includes(agent.agentId) &&
+    ![contQaAgentId, documentationAgentId].includes(agent.agentId) &&
+    (agent.agentId !== contEvalAgentId || contEvalImplementationOwning) &&
     Array.isArray(agent.components) &&
     agent.components.length > 0
       ? [
@@ -349,6 +404,20 @@ export function buildExecutionPrompt({
           "",
         ]
       : [];
+  const proofArtifactLines =
+    Array.isArray(agent.proofArtifacts) && agent.proofArtifacts.length > 0
+      ? [
+          "Proof artifacts required for this agent:",
+          ...agent.proofArtifacts.map((artifact) => {
+            const requiredFor =
+              Array.isArray(artifact.requiredFor) && artifact.requiredFor.length > 0
+                ? ` required-for=${artifact.requiredFor.join(",")}`
+                : "";
+            return `- ${artifact.path}${artifact.kind ? ` kind=${artifact.kind}` : ""}${requiredFor}`;
+          }),
+          "",
+        ]
+      : [];
   const skillLines =
     Array.isArray(agent.skillsResolved?.ids) && agent.skillsResolved.ids.length > 0
       ? [
@@ -371,7 +440,8 @@ export function buildExecutionPrompt({
     "Role model for this run:",
     "- Wave Orchestrator role: create wave files, initiate wave runs, and manage execution end-to-end.",
     "- WAVE Executor role (you): deliver the assigned outcome end-to-end within your scope and coordinate through the Wave coordination log every turn.",
-    `- Evaluator agent id: ${evaluatorAgentId}`,
+    `- cont-QA agent id: ${contQaAgentId}`,
+    `- cont-EVAL agent id: ${contEvalAgentId}`,
     `- Integration steward agent id: ${integrationAgentId}`,
     `- Documentation steward agent id: ${documentationAgentId}`,
     `- Resolved executor: ${executorId}`,
@@ -397,8 +467,10 @@ export function buildExecutionPrompt({
     "- Emit explicit progress markers in your output: `[wave-phase] coding`, `[wave-phase] validating`, `[wave-phase] deploying`, `[wave-phase] finalizing`.",
     "- During deployment checks, emit structured deployment markers: `[deploy-status] service=<service-name> state=<deploying|healthy|failed|rolledover> detail=<short-note>`.",
     "- If your task touches machine validation, workload identity, node admission, deployment bootstrap, or approved machine actions, emit structured infra markers: `[infra-status] kind=<conformance|role-drift|dependency|identity|admission|action> target=<machine-or-surface> state=<checking|setup-required|setup-in-progress|conformant|drift|blocked|failed|action-required|action-approved|action-complete> detail=<short-note>`.",
-    ...evaluatorRequirements,
+    ...contQaRequirements,
+    ...contEvalRequirements,
     ...docStewardRequirements,
+    ...securityRequirements,
     ...implementationRequirements,
     `- Update docs impacted by your implementation. If your work changes status, sequencing, ownership, or explicit proof expectations, update the relevant docs. If shared plan docs need changes outside your owned files, post the exact doc paths and exact delta needed for ${sharedPlanDocList} as a coordination record instead of leaving documentation drift for later cleanup.`,
     "- If the wave defines a documentation steward or other explicit owner for shared plan docs, coordinate those updates through that owner, notify them as soon as the delta is known, and stay engaged until they confirm `closed` or `no-change`. Do not treat the ownership boundary as the definition of done.",
@@ -426,8 +498,10 @@ export function buildExecutionPrompt({
       : []),
     ...exitContractLines,
     ...promotedComponentLines,
+    ...evalTargetLines,
     ...ownedComponentLines,
     ...deliverableLines,
+    ...proofArtifactLines,
     ...skillLines,
     ...context7PromptLines,
     "Assigned implementation prompt:",

package/scripts/wave-orchestrator/dashboard-state.mjs

@@ -17,6 +17,10 @@ import {
   truncate,
   writeJsonAtomic,
 } from "./shared.mjs";
+import {
+  normalizeGlobalDashboardState,
+  normalizeWaveDashboardState,
+} from "./artifact-schemas.mjs";
 
 export function readStatusCodeIfPresent(statusPath) {
   return readStatusRecordIfPresent(statusPath)?.code ?? null;
@@ -130,7 +134,7 @@ export function buildWaveDashboardState({
   agentRuns,
 }) {
   const now = toIsoTimestamp();
-  return {
+  return normalizeWaveDashboardState({
     lane,
     wave,
     waveFile,
@@ -169,7 +173,7 @@ export function buildWaveDashboardState({
       detail: "",
     })),
     events: [],
-  };
+  });
 }
 
 export function buildGlobalDashboardState({
@@ -181,7 +185,7 @@ export function buildGlobalDashboardState({
   feedbackRequestsDir,
 }) {
   const now = toIsoTimestamp();
-  return {
+  return normalizeGlobalDashboardState({
     lane,
     runId: Math.random().toString(16).slice(2, 14),
     status: "running",
@@ -234,19 +238,27 @@ export function buildGlobalDashboardState({
       infraFindings: [],
     })),
     events: [],
-  };
+  });
 }
 
 export function writeWaveDashboard(dashboardPath, state) {
   ensureDirectory(path.dirname(dashboardPath));
-  state.updatedAt = toIsoTimestamp();
-  writeJsonAtomic(dashboardPath, state);
+  const normalized = normalizeWaveDashboardState({
+    ...state,
+    updatedAt: toIsoTimestamp(),
+  });
+  Object.assign(state, normalized);
+  writeJsonAtomic(dashboardPath, normalized);
 }
 
 export function writeGlobalDashboard(globalDashboardPath, state) {
   ensureDirectory(path.dirname(globalDashboardPath));
-  state.updatedAt = toIsoTimestamp();
-  writeJsonAtomic(globalDashboardPath, state);
+  const normalized = normalizeGlobalDashboardState({
+    ...state,
+    updatedAt: toIsoTimestamp(),
+  });
+  Object.assign(state, normalized);
+  writeJsonAtomic(globalDashboardPath, normalized);
 }
 
 export function recordWaveDashboardEvent(state, { level = "info", agentId = null, message }) {

package/scripts/wave-orchestrator/dep-cli.mjs

@@ -3,8 +3,8 @@ import {
   appendDependencyTicket,
   materializeCoordinationState,
   readDependencyTickets,
-  writeJsonArtifact,
 } from "./coordination-store.mjs";
+import { writeDependencySnapshot } from "./artifact-schemas.mjs";
 import {
   buildDependencySnapshot,
   readAllDependencyTickets,
@@ -209,7 +209,10 @@ export async function runDependencyCli(argv) {
       capabilityRouting: lanePaths.capabilityRouting,
     });
     const markdownPath = dependencyMarkdownPath(lanePaths, lane);
-    writeJsonArtifact(path.join(lanePaths.crossLaneDependenciesDir, `${lane}.json`), snapshot);
+    writeDependencySnapshot(path.join(lanePaths.crossLaneDependenciesDir, `${lane}.json`), snapshot, {
+      lane,
+      wave: options.wave ?? 0,
+    });
     writeTextAtomic(markdownPath, `${renderDependencySnapshotMarkdown(snapshot)}\n`);
     console.log(JSON.stringify({ markdownPath, jsonPath: path.join(lanePaths.crossLaneDependenciesDir, `${lane}.json`) }, null, 2));
     return;

package/scripts/wave-orchestrator/docs-queue.mjs

@@ -8,6 +8,8 @@ export function buildDocsQueue({
   componentPromotions = [],
   runtimeAssignments = [],
 }) {
+  const waveNumber =
+    typeof wave === "object" && wave !== null && Object.hasOwn(wave, "wave") ? wave.wave : wave;
   const items = [];
   for (const [agentId, summary] of Object.entries(summariesByAgentId || {})) {
     if (!summary?.docDelta) {
@@ -28,7 +30,11 @@ export function buildDocsQueue({
       }
     }
     if (summary.docDelta.state === "shared-plan") {
-      for (const docPath of summary.docDelta.paths || sharedPlanDocs) {
+      const sharedPlanPaths =
+        Array.isArray(summary.docDelta.paths) && summary.docDelta.paths.length > 0
+          ? summary.docDelta.paths
+          : sharedPlanDocs;
+      for (const docPath of sharedPlanPaths) {
         items.push({
           id: `${agentId}:shared:${docPath}`,
           kind: "shared-plan",
@@ -57,7 +63,7 @@ export function buildDocsQueue({
   const releaseNotesRequired = items.some((item) => item.kind === "shared-plan");
   return {
     lane,
-    wave: wave.wave || wave,
+    wave: waveNumber,
     createdAt: toIsoTimestamp(),
     updatedAt: toIsoTimestamp(),
     releaseNotesRequired,