@chllming/wave-orchestration 0.5.4 → 0.6.1

package/scripts/wave-orchestrator/planner.mjs

@@ -118,10 +118,16 @@ function defaultExecutorProfile(roleKind) {
   if (roleKind === "infra" || roleKind === "deploy" || roleKind === "research") {
     return "ops-triage";
   }
+  if (roleKind === "security") {
+    return "security-review";
+  }
   return "implement-fast";
 }
 
 function defaultExitContract(roleKind) {
+  if (roleKind === "security") {
+    return null;
+  }
   if (roleKind === "infra" || roleKind === "deploy") {
     return {
       completion: "live",
@@ -147,6 +153,9 @@ function defaultExitContract(roleKind) {
 }
 
 function buildDefaultValidationCommand(template, roleKind) {
+  if (roleKind === "security") {
+    return "Manual review of the changed security-sensitive surfaces plus required proofs.";
+  }
   if (template === "qa" || roleKind === "qa") {
     return "pnpm test";
   }
@@ -157,6 +166,9 @@ function buildDefaultValidationCommand(template, roleKind) {
 }
 
 function buildDefaultOutputSummary(template, roleKind) {
+  if (roleKind === "security") {
+    return "Summarize the threat model, findings, required approvals, requested fixes, and final security disposition.";
+  }
   if (template === "qa" || roleKind === "qa") {
     return "Summarize the proved QA coverage, the remaining gaps, and whether the wave is closure-ready.";
   }
@@ -167,6 +179,9 @@ function buildDefaultOutputSummary(template, roleKind) {
 }
 
 function buildDefaultPrimaryGoal(template, roleKind, title) {
+  if (roleKind === "security") {
+    return `Review the ${title.toLowerCase()} slice for security risks and route exact fixes before integration.`;
+  }
   if (template === "qa" || roleKind === "qa") {
     return `Build and validate the ${title.toLowerCase()} QA slice.`;
   }
@@ -355,7 +370,18 @@ function renderSkillsSection(skills) {
   return Array.isArray(skills) && skills.length > 0 ? renderBulletLines(skills) : [];
 }
 
-function renderWaveMarkdown(spec, lanePaths) {
+function renderEvalTargetsSection(evalTargets) {
+  if (!Array.isArray(evalTargets) || evalTargets.length === 0) {
+    return [];
+  }
+  return evalTargets.map((target) =>
+    target.selection === "delegated"
+      ? `- id: ${target.id} | selection: delegated | benchmark-family: ${target.benchmarkFamily} | objective: ${target.objective} | threshold: ${target.threshold}`
+      : `- id: ${target.id} | selection: pinned | benchmarks: ${(target.benchmarks || []).join(", ")} | objective: ${target.objective} | threshold: ${target.threshold}`,
+  );
+}
+
+export function renderWaveMarkdown(spec, lanePaths) {
   const sections = [];
   sections.push(`# Wave ${spec.wave} - ${spec.title}`);
   sections.push("");
@@ -404,6 +430,12 @@ function renderWaveMarkdown(spec, lanePaths) {
   sections.push("## Context7 defaults");
   sections.push("");
   sections.push(...renderContext7Section(spec.context7Defaults));
+  if (Array.isArray(spec.evalTargets) && spec.evalTargets.length > 0) {
+    sections.push("");
+    sections.push("## Eval targets");
+    sections.push("");
+    sections.push(...renderEvalTargetsSection(spec.evalTargets));
+  }
   for (const agent of spec.agents) {
     sections.push("");
     sections.push(`## Agent ${agent.agentId}: ${agent.title}`);
@@ -547,39 +579,71 @@ function buildSpecialAgents({ spec, lanePaths, standardRoles }) {
       ...SHARED_PLAN_DOC_PATHS,
     ]),
   );
-  const evaluatorTitle = standardRoles.evaluator ? "Running Evaluator" : "Custom Evaluator";
+  const contQaTitle = standardRoles.contQa ? "cont-QA" : "Custom cont-QA";
+  const contEvalTitle = standardRoles.contEval ? "cont-EVAL" : "Custom cont-EVAL";
   const integrationTitle = standardRoles.integration ? "Integration Steward" : "Custom Integration Steward";
   const documentationTitle = standardRoles.documentation
     ? "Documentation Steward"
     : "Custom Documentation Steward";
   return [
     {
-      agentId: lanePaths.evaluatorAgentId,
-      title: evaluatorTitle,
-      rolePromptPaths: [lanePaths.evaluatorRolePromptPath],
+      agentId: lanePaths.contQaAgentId,
+      title: contQaTitle,
+      rolePromptPaths: [lanePaths.contQaRolePromptPath],
       skills: [],
       executor: { profile: "deep-review" },
       context7: { bundle: "none", query: "Architecture evaluation only; repository docs remain canonical" },
       components: [],
       capabilities: [],
       exitContract: null,
-      primaryGoal: `Evaluate Wave ${spec.wave} and publish the final verdict.`,
+      primaryGoal: `Run continuous QA for Wave ${spec.wave} and publish the final closure verdict.`,
       collaborationNotes: [
         "Collect explicit verdicts from the implementation-facing agents plus A8 and A9 before closing the wave.",
         "Do not publish PASS unless the evidence, documentation closure, and integration summary are all coherent.",
       ],
       requiredContext: commonRequiredContext,
       earlierWaveOutputs: [],
-      ownedPaths: [`docs/plans/waves/reviews/wave-${spec.wave}-evaluator.md`],
+      ownedPaths: [`docs/plans/waves/reviews/wave-${spec.wave}-cont-qa.md`],
       requirements: [
         "Verify the wave requirements are covered by landed evidence, not only by intent.",
         "Record any blocker that later waves must not silently assume away.",
       ],
       validationCommand:
-        "Re-read the changed reports and end the evaluator report with `Verdict: PASS`, `Verdict: CONCERNS`, or `Verdict: BLOCKED`.",
-      outputSummary: "Summarize the gate verdict and the top unresolved cross-cutting risks.",
+        "Re-read the changed reports and end the cont-QA report with `Verdict: PASS`, `Verdict: CONCERNS`, or `Verdict: BLOCKED`.",
+      outputSummary: "Summarize the cont-QA verdict and the top unresolved cross-cutting risks.",
       deployEnvironmentId: null,
     },
+    ...(standardRoles.contEval
+      ? [
+          {
+            agentId: lanePaths.contEvalAgentId,
+            title: contEvalTitle,
+            rolePromptPaths: [lanePaths.contEvalRolePromptPath],
+            skills: [],
+            executor: { profile: "eval-tuning" },
+            context7: { bundle: "none", query: "Eval tuning only; repository docs remain canonical" },
+            components: [],
+            capabilities: ["eval"],
+            exitContract: null,
+            primaryGoal: `Run the Wave ${spec.wave} eval tuning loop until the declared eval targets are satisfied or explicitly blocked.`,
+            collaborationNotes: [
+              "Treat the wave's eval targets as the governing contract for benchmark choice and tuning depth.",
+              "This standard cont-EVAL role is report-only by default; if fixes belong to another owner, open exact follow-up work instead of broadening scope implicitly.",
+            ],
+            requiredContext: commonRequiredContext,
+            earlierWaveOutputs: [],
+            ownedPaths: [`docs/plans/waves/reviews/wave-${spec.wave}-cont-eval.md`],
+            requirements: [
+              "Record the selected benchmark set, the commands run, observed output gaps, and regressions.",
+              "Emit a final `[wave-eval]` marker with target_ids and benchmark_ids that matches the final tuning state.",
+            ],
+            validationCommand:
+              "Re-run the selected benchmarks or service-output checks and end with a final `[wave-eval]` marker that enumerates target_ids and benchmark_ids.",
+            outputSummary: "Summarize the selected benchmarks, tuning outcome, regressions, and remaining owners.",
+            deployEnvironmentId: null,
+          },
+        ]
+      : []),
     {
       agentId: lanePaths.integrationAgentId,
       title: integrationTitle,
@@ -590,7 +654,7 @@ function buildSpecialAgents({ spec, lanePaths, standardRoles }) {
       components: [],
       capabilities: ["integration", "docs-shared-plan"],
       exitContract: null,
-      primaryGoal: `Synthesize the final Wave ${spec.wave} state before documentation and evaluator closure.`,
+      primaryGoal: `Synthesize the final Wave ${spec.wave} state before documentation and cont-QA closure.`,
       collaborationNotes: [
         "Re-read the message board, compiled inboxes, and latest artifacts before final output.",
         "Treat contradictions, missing proof, or stale shared-plan assumptions as integration failures.",
@@ -656,6 +720,9 @@ function buildWorkerAgentSpec({
     ]),
   );
   const capabilities = values.capabilities.slice();
+  if (roleKind === "security" && !capabilities.some((capability) => capability.startsWith("security"))) {
+    capabilities.push("security-review");
+  }
   if (roleKind === "infra" && !capabilities.includes("infra")) {
     capabilities.push("infra");
   }
@@ -668,7 +735,8 @@ function buildWorkerAgentSpec({
   return {
     agentId,
     title,
-    rolePromptPaths: [],
+    rolePromptPaths:
+      roleKind === "security" ? [lanePaths.securityRolePromptPath] : [],
     skills: values.skills || [],
     executor: {
       profile: values.executorProfile,
@@ -684,7 +752,7 @@ function buildWorkerAgentSpec({
       values.primaryGoal || buildDefaultPrimaryGoal(template, roleKind, title),
     collaborationNotes: [
       "Re-read the wave message board before major decisions, before validation, and before final output.",
-      `Notify Agent ${lanePaths.evaluatorAgentId} when your evidence changes the closure picture.`,
+      `Notify Agent ${lanePaths.contQaAgentId} when your evidence changes the closure picture.`,
     ],
     requiredContext,
     earlierWaveOutputs: values.earlierWaveOutputs,
@@ -722,6 +790,7 @@ function buildSpecPayload({ config, lanePaths, profile, draftValues }) {
       bundle: draftValues.context7Bundle,
       query: draftValues.context7Query || null,
     },
+    evalTargets: draftValues.evalTargets,
     componentPromotions: draftValues.componentPromotions,
     componentsCatalog: draftValues.componentCatalog,
     agents: [
@@ -879,7 +948,7 @@ async function runProjectSetupFlow(options = {}) {
 async function collectComponentPromotions({ prompt, matrix, template, waveNumber }) {
   const targetLevel = defaultTargetLevel(template);
   const promotionCount = await prompt.askInteger("How many component promotions belong in this wave?", 1, {
-    min: 1,
+    min: 0,
   });
   const componentPromotions = [];
   const componentCatalog = [];
@@ -935,7 +1004,7 @@ async function collectComponentPromotions({ prompt, matrix, template, waveNumber
   return { componentPromotions, componentCatalog };
 }
 
-async function collectWorkerAgents({ prompt, template, profile, componentPromotions, waveNumber }) {
+async function collectWorkerAgents({ prompt, template, profile, componentPromotions, waveNumber, lane }) {
   const defaultRoleKind = defaultWorkerRoleKindForTemplate(template);
   const workerCount = await prompt.askInteger("How many worker agents should this wave include?", 1, {
     min: 1,
@@ -951,19 +1020,21 @@ async function collectWorkerAgents({ prompt, template, profile, componentPromoti
     const title = cleanText(await prompt.ask(`Worker ${agentId} title`, defaults.title));
     const roleKind = await prompt.askChoice(
       `Worker ${agentId} role kind`,
-      ["implementation", "qa", "infra", "deploy", "research"],
+      ["implementation", "qa", "infra", "deploy", "research", "security"],
       defaultRoleKind,
     );
     const executorProfile = await prompt.askChoice(
       `Worker ${agentId} executor profile`,
-      ["implement-fast", "deep-review", "docs-pass", "ops-triage"],
+      ["implement-fast", "deep-review", "eval-tuning", "docs-pass", "ops-triage", "security-review"],
       defaultExecutorProfile(roleKind),
     );
     const ownedPaths = normalizeRepoPathList(
       normalizeListText(
         await prompt.ask(
           `Worker ${agentId} owned paths (comma or | separated)`,
-          template === "infra"
+          roleKind === "security"
+            ? `.tmp/${lane}-wave-launcher/security/wave-${waveNumber}-review.md`
+            : template === "infra"
             ? "scripts/,docs/plans/"
             : template === "release"
               ? "CHANGELOG.md,README.md"
@@ -975,11 +1046,16 @@ async function collectWorkerAgents({ prompt, template, profile, componentPromoti
     const components = normalizeListText(
       await prompt.ask(
         `Worker ${agentId} component ids (comma or | separated)`,
-        componentPromotions.map((promotion) => promotion.componentId).join(", "),
+        roleKind === "security"
+          ? ""
+          : componentPromotions.map((promotion) => promotion.componentId).join(", "),
       ),
     ).map((componentId) => normalizeComponentId(componentId, `${agentId}.components`));
     const capabilities = normalizeListText(
-      await prompt.ask(`Worker ${agentId} capabilities (comma or | separated)`, roleKind === "implementation" ? "" : roleKind),
+      await prompt.ask(
+        `Worker ${agentId} capabilities (comma or | separated)`,
+        roleKind === "implementation" ? "" : roleKind === "security" ? "security-review" : roleKind,
+      ),
     );
     const additionalContext = normalizeRepoPathList(
       normalizeListText(
@@ -1041,28 +1117,30 @@ async function collectWorkerAgents({ prompt, template, profile, componentPromoti
     );
     const context7Query = cleanText(await prompt.ask(`Worker ${agentId} Context7 query`, ""));
     const exitDefaults = defaultExitContract(roleKind);
-    const exitContract = {
-      completion: await prompt.askChoice(
-        `Worker ${agentId} exit completion`,
-        EXIT_CONTRACT_COMPLETION_VALUES,
-        exitDefaults.completion,
-      ),
-      durability: await prompt.askChoice(
-        `Worker ${agentId} exit durability`,
-        EXIT_CONTRACT_DURABILITY_VALUES,
-        exitDefaults.durability,
-      ),
-      proof: await prompt.askChoice(
-        `Worker ${agentId} exit proof`,
-        EXIT_CONTRACT_PROOF_VALUES,
-        exitDefaults.proof,
-      ),
-      docImpact: await prompt.askChoice(
-        `Worker ${agentId} exit doc impact`,
-        EXIT_CONTRACT_DOC_IMPACT_VALUES,
-        exitDefaults.docImpact,
-      ),
-    };
+    const exitContract = exitDefaults
+      ? {
+          completion: await prompt.askChoice(
+            `Worker ${agentId} exit completion`,
+            EXIT_CONTRACT_COMPLETION_VALUES,
+            exitDefaults.completion,
+          ),
+          durability: await prompt.askChoice(
+            `Worker ${agentId} exit durability`,
+            EXIT_CONTRACT_DURABILITY_VALUES,
+            exitDefaults.durability,
+          ),
+          proof: await prompt.askChoice(
+            `Worker ${agentId} exit proof`,
+            EXIT_CONTRACT_PROOF_VALUES,
+            exitDefaults.proof,
+          ),
+          docImpact: await prompt.askChoice(
+            `Worker ${agentId} exit doc impact`,
+            EXIT_CONTRACT_DOC_IMPACT_VALUES,
+            exitDefaults.docImpact,
+          ),
+        }
+      : null;
     workerAgents.push({
       agentId,
       title,
@@ -1086,6 +1164,57 @@ async function collectWorkerAgents({ prompt, template, profile, componentPromoti
   return workerAgents;
 }
 
+async function collectEvalTargets({ prompt }) {
+  const targetCount = await prompt.askInteger(
+    "How many eval targets should cont-EVAL own?",
+    1,
+    { min: 1 },
+  );
+  const evalTargets = [];
+  for (let index = 0; index < targetCount; index += 1) {
+    const id = normalizeComponentId(
+      await prompt.ask(`Eval target ${index + 1} id`, index === 0 ? "service-output" : `eval-target-${index + 1}`),
+      `eval target ${index + 1} id`,
+    );
+    const selection = await prompt.askChoice(
+      `Eval target ${id} benchmark selection`,
+      ["delegated", "pinned"],
+      "delegated",
+    );
+    const benchmarkFamily =
+      selection === "delegated"
+        ? normalizeComponentId(
+            await prompt.ask(`Eval target ${id} benchmark family`, "service-output"),
+            `eval target ${id} benchmark family`,
+          )
+        : null;
+    const benchmarks =
+      selection === "pinned"
+        ? normalizeListText(
+            await prompt.ask(
+              `Eval target ${id} benchmark ids (comma or | separated)`,
+              "golden-response-smoke, manual-session-review",
+            ),
+          ).map((entry) => normalizeComponentId(entry, `eval target ${id} benchmark id`))
+        : [];
+    const objective = cleanText(
+      await prompt.ask(`Eval target ${id} objective`, "Improve the observable service output against the selected benchmark set."),
+    );
+    const threshold = cleanText(
+      await prompt.ask(`Eval target ${id} success threshold`, "All selected checks green with no unresolved regressions."),
+    );
+    evalTargets.push({
+      id,
+      selection,
+      benchmarkFamily,
+      benchmarks,
+      objective,
+      threshold,
+    });
+  }
+  return evalTargets;
+}
+
 async function runDraftFlow(options = {}) {
   const config = options.config || loadWaveConfig();
   const profile = await ensureProjectProfile({ config });
@@ -1136,10 +1265,14 @@ async function runDraftFlow(options = {}) {
     const context7Bundle = await prompt.askChoice("Wave Context7 bundle", ["none"], "none");
     const context7Query = cleanText(await prompt.ask("Wave Context7 query", ""));
     const standardRoles = {
-      evaluator: await prompt.askBoolean("Use the standard evaluator role?", true),
+      contQa: await prompt.askBoolean("Use the standard cont-QA role?", true),
+      contEval: await prompt.askBoolean("Include the standard cont-EVAL role?", false),
       integration: await prompt.askBoolean("Use the standard integration role?", true),
       documentation: await prompt.askBoolean("Use the standard documentation role?", true),
     };
+    const evalTargets = standardRoles.contEval
+      ? await collectEvalTargets({ prompt })
+      : [];
     const { componentPromotions, componentCatalog } = await collectComponentPromotions({
       prompt,
       matrix,
@@ -1152,6 +1285,7 @@ async function runDraftFlow(options = {}) {
       profile,
       componentPromotions,
       waveNumber,
+      lane: lanePaths.lane,
     });
     const draftValues = {
       wave: waveNumber,
@@ -1165,6 +1299,7 @@ async function runDraftFlow(options = {}) {
       context7Bundle,
       context7Query,
       standardRoles,
+      evalTargets,
       componentPromotions,
       componentCatalog,
       workerAgents,

package/scripts/wave-orchestrator/replay.mjs

@@ -22,19 +22,22 @@ function buildReplayLanePaths(metadata) {
       : null;
   const roles = replayContext?.roles || metadata?.roles || {};
   const validation = replayContext?.validation || metadata?.validation || {};
-  const evaluatorAgentId = roles.evaluatorAgentId || "A0";
+  const contQaAgentId = roles.contQaAgentId || roles.evaluatorAgentId || "A0";
+  const contEvalAgentId = roles.contEvalAgentId || "E0";
   const integrationAgentId = roles.integrationAgentId || "A8";
   const documentationAgentId = roles.documentationAgentId || "A9";
   return {
     lane: replayContext?.lane || metadata?.lane || "main",
-    evaluatorAgentId,
+    contQaAgentId,
+    contEvalAgentId,
     integrationAgentId,
     documentationAgentId,
     requireIntegrationStewardFromWave:
       validation.requireIntegrationStewardFromWave ?? null,
     laneProfile: {
       roles: {
-        evaluatorAgentId,
+        contQaAgentId,
+        contEvalAgentId,
         integrationAgentId,
         documentationAgentId,
       },

package/scripts/wave-orchestrator/role-helpers.mjs

@@ -0,0 +1,84 @@
+import {
+  DEFAULT_CONT_EVAL_AGENT_ID,
+  DEFAULT_SECURITY_ROLE_PROMPT_PATH,
+} from "./config.mjs";
+
+function cleanPath(value) {
+  return String(value || "")
+    .trim()
+    .replaceAll("\\", "/");
+}
+
+export function isContQaReportPath(relPath) {
+  return /(?:^|\/)(?:reviews?|.*cont[-_]?qa).*\.(?:md|txt)$/i.test(cleanPath(relPath));
+}
+
+export function isContEvalReportPath(relPath) {
+  return /(?:^|\/)(?:reviews?|.*cont[-_]?eval|.*eval).*\.(?:md|txt)$/i.test(cleanPath(relPath));
+}
+
+export function isSecurityRolePromptPath(
+  relPath,
+  securityRolePromptPath = DEFAULT_SECURITY_ROLE_PROMPT_PATH,
+) {
+  const normalized = cleanPath(relPath);
+  const configured = cleanPath(securityRolePromptPath);
+  return (
+    normalized === configured ||
+    normalized === DEFAULT_SECURITY_ROLE_PROMPT_PATH ||
+    normalized.endsWith("/wave-security-role.md")
+  );
+}
+
+export function isSecurityReportPath(relPath) {
+  return /(?:^|\/).*security.*\.(?:md|txt)$/i.test(cleanPath(relPath));
+}
+
+export function isContEvalImplementationOwningAgent(
+  agent,
+  { contEvalAgentId = DEFAULT_CONT_EVAL_AGENT_ID } = {},
+) {
+  if (!agent || agent.agentId !== contEvalAgentId) {
+    return false;
+  }
+  const ownedPaths = Array.isArray(agent.ownedPaths) ? agent.ownedPaths.map(cleanPath).filter(Boolean) : [];
+  if (ownedPaths.length === 0) {
+    return false;
+  }
+  return ownedPaths.some((ownedPath) => !isContEvalReportPath(ownedPath));
+}
+
+export function isContEvalReportOnlyAgent(
+  agent,
+  { contEvalAgentId = DEFAULT_CONT_EVAL_AGENT_ID } = {},
+) {
+  return agent?.agentId === contEvalAgentId && !isContEvalImplementationOwningAgent(agent, {
+    contEvalAgentId,
+  });
+}
+
+export function isSecurityReviewAgent(
+  agent,
+  { securityRolePromptPath = DEFAULT_SECURITY_ROLE_PROMPT_PATH } = {},
+) {
+  if (!agent || typeof agent !== "object") {
+    return false;
+  }
+  const rolePromptPaths = Array.isArray(agent.rolePromptPaths) ? agent.rolePromptPaths : [];
+  if (
+    rolePromptPaths.some((rolePromptPath) =>
+      isSecurityRolePromptPath(rolePromptPath, securityRolePromptPath),
+    )
+  ) {
+    return true;
+  }
+  const capabilities = Array.isArray(agent.capabilities)
+    ? agent.capabilities.map((entry) => String(entry || "").trim().toLowerCase())
+    : [];
+  return capabilities.includes("security-review");
+}
+
+export function resolveSecurityReviewReportPath(agent) {
+  const ownedPaths = Array.isArray(agent?.ownedPaths) ? agent.ownedPaths.map(cleanPath).filter(Boolean) : [];
+  return ownedPaths.find((ownedPath) => isSecurityReportPath(ownedPath)) || null;
+}

package/scripts/wave-orchestrator/shared.mjs

@@ -77,22 +77,71 @@ export function sanitizeOrchestratorId(value) {
   return id.slice(0, 64);
 }
 
+export function sanitizeAdhocRunId(value) {
+  const id = String(value || "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  if (!id) {
+    throw new Error("Ad-hoc run ID is required");
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(id)) {
+    throw new Error(`Invalid ad-hoc run ID: ${value}`);
+  }
+  return id;
+}
+
+export function buildWorkspaceTmuxToken(workspaceRoot = REPO_ROOT) {
+  const repoBase =
+    path
+      .basename(path.resolve(String(workspaceRoot || REPO_ROOT)))
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "_")
+      .replace(/^_+|_+$/g, "")
+      .slice(0, 12) || "repo";
+  const repoHash = crypto
+    .createHash("sha1")
+    .update(path.resolve(String(workspaceRoot || REPO_ROOT)))
+    .digest("hex")
+    .slice(0, 8);
+  return `${repoBase}_${repoHash}`;
+}
+
 export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
   const config = options.config || loadWaveConfig();
-  const laneProfile = resolveLaneProfile(config, laneInput || config.defaultLane);
+  const baseLaneProfile = resolveLaneProfile(config, laneInput || config.defaultLane);
+  const adhocRunId = options.adhocRunId ? sanitizeAdhocRunId(options.adhocRunId) : null;
+  const laneProfile = adhocRunId
+    ? {
+        ...baseLaneProfile,
+        validation: {
+          ...baseLaneProfile.validation,
+          requireComponentPromotionsFromWave: null,
+          requireAgentComponentsFromWave: null,
+        },
+      }
+    : baseLaneProfile;
   const lane = laneProfile.lane;
   const laneTmux = lane.replace(/-/g, "_");
+  const runKind = adhocRunId ? "adhoc" : "roadmap";
   const runVariant = String(options.runVariant || "")
     .trim()
     .toLowerCase();
   if (runVariant && runVariant !== "dry-run") {
     throw new Error(`Unsupported lane path variant: ${options.runVariant}`);
   }
+  const workspaceTmuxToken = buildWorkspaceTmuxToken(REPO_ROOT);
   const docsDir = path.join(REPO_ROOT, laneProfile.docsDir);
   const plansDir = path.join(REPO_ROOT, laneProfile.plansDir);
   const preferredWavesDir = path.join(REPO_ROOT, laneProfile.wavesDir);
   const legacyWavesDir = path.join(docsDir, "waves");
-  const baseStateDir = path.join(REPO_ROOT, laneProfile.paths.stateRoot, `${lane}-wave-launcher`);
+  const adhocRootDir = path.join(REPO_ROOT, ".wave", "adhoc");
+  const adhocRunDir = adhocRunId ? path.join(adhocRootDir, "runs", adhocRunId) : null;
+  const baseStateDir = adhocRunId
+    ? path.join(REPO_ROOT, laneProfile.paths.stateRoot, `${lane}-wave-launcher`, "adhoc", adhocRunId)
+    : path.join(REPO_ROOT, laneProfile.paths.stateRoot, `${lane}-wave-launcher`);
   const stateDir = runVariant === "dry-run" ? path.join(baseStateDir, "dry-run") : baseStateDir;
   const orchestratorStateDir =
     runVariant === "dry-run"
@@ -103,14 +152,24 @@ export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
     config,
     laneProfile,
     lane,
+    runKind,
+    runId: adhocRunId,
     runVariant,
     docsDir,
     plansDir,
     wavesDir:
-      fs.existsSync(preferredWavesDir) || !fs.existsSync(legacyWavesDir)
+      adhocRunDir ||
+      (fs.existsSync(preferredWavesDir) || !fs.existsSync(legacyWavesDir)
         ? preferredWavesDir
-        : legacyWavesDir,
+        : legacyWavesDir),
     legacyWavesDir,
+    adhocRootDir,
+    adhocRunDir,
+    adhocIndexPath: path.join(adhocRootDir, "index.json"),
+    adhocRequestPath: adhocRunDir ? path.join(adhocRunDir, "request.json") : null,
+    adhocSpecPath: adhocRunDir ? path.join(adhocRunDir, "spec.json") : null,
+    adhocWavePath: adhocRunDir ? path.join(adhocRunDir, "wave-0.md") : null,
+    adhocResultPath: adhocRunDir ? path.join(adhocRunDir, "result.json") : null,
     promptsDir: path.join(stateDir, "prompts"),
     logsDir: path.join(stateDir, "logs"),
     statusDir: path.join(stateDir, "status"),
@@ -121,6 +180,7 @@ export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
     inboxesDir: path.join(stateDir, "inboxes"),
     ledgerDir: path.join(stateDir, "ledger"),
     integrationDir: path.join(stateDir, "integration"),
+    securityDir: path.join(stateDir, "security"),
     dependencySnapshotsDir: path.join(stateDir, "dependencies"),
     docsQueueDir: path.join(stateDir, "docs-queue"),
     tracesDir: path.join(stateDir, "traces"),
@@ -130,6 +190,7 @@ export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
     terminalsPath: path.join(REPO_ROOT, laneProfile.paths.terminalsPath),
     skillsDir: path.join(REPO_ROOT, laneProfile.skills?.dir || "skills"),
     context7BundleIndexPath: path.join(REPO_ROOT, laneProfile.paths.context7BundleIndexPath),
+    benchmarkCatalogPath: path.join(REPO_ROOT, laneProfile.paths.benchmarkCatalogPath),
     componentCutoverMatrixDocPath: path.join(
       REPO_ROOT,
       laneProfile.paths.componentCutoverMatrixDocPath,
@@ -138,15 +199,18 @@ export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
       REPO_ROOT,
       laneProfile.paths.componentCutoverMatrixJsonPath,
     ),
-    sharedPlanDocs: laneProfile.sharedPlanDocs,
+    sharedPlanDocs: laneProfile.sharedPlanDocs || [],
     requiredPromptReferences: laneProfile.validation.requiredPromptReferences,
     rolePromptDir: laneProfile.roles.rolePromptDir,
-    evaluatorAgentId: laneProfile.roles.evaluatorAgentId,
+    contQaAgentId: laneProfile.roles.contQaAgentId,
+    contEvalAgentId: laneProfile.roles.contEvalAgentId,
     integrationAgentId: laneProfile.roles.integrationAgentId,
     documentationAgentId: laneProfile.roles.documentationAgentId,
-    evaluatorRolePromptPath: laneProfile.roles.evaluatorRolePromptPath,
+    contQaRolePromptPath: laneProfile.roles.contQaRolePromptPath,
+    contEvalRolePromptPath: laneProfile.roles.contEvalRolePromptPath,
     integrationRolePromptPath: laneProfile.roles.integrationRolePromptPath,
     documentationRolePromptPath: laneProfile.roles.documentationRolePromptPath,
+    securityRolePromptPath: laneProfile.roles.securityRolePromptPath,
     requireDocumentationStewardFromWave:
       laneProfile.validation.requireDocumentationStewardFromWave,
     requireContext7DeclarationsFromWave:
@@ -167,10 +231,10 @@ export function buildLanePaths(laneInput = DEFAULT_WAVE_LANE, options = {}) {
     terminalNamePrefix: `${lane}-wave`,
     dashboardTerminalNamePrefix: `${lane}-wave-dashboard`,
     globalDashboardTerminalName: `${lane}-wave-dashboard-global`,
-    tmuxSessionPrefix: `oc_${laneTmux}_wave`,
-    tmuxDashboardSessionPrefix: `oc_${laneTmux}_wave_dashboard`,
-    tmuxGlobalDashboardSessionPrefix: `oc_${laneTmux}_wave_dashboard_global`,
-    tmuxSocketName: `oc_${laneTmux}_waves`,
+    tmuxSessionPrefix: `oc_${laneTmux}_${workspaceTmuxToken}_wave`,
+    tmuxDashboardSessionPrefix: `oc_${laneTmux}_${workspaceTmuxToken}_wave_dashboard`,
+    tmuxGlobalDashboardSessionPrefix: `oc_${laneTmux}_${workspaceTmuxToken}_wave_dashboard_global`,
+    tmuxSocketName: `oc_${laneTmux}_${workspaceTmuxToken}_waves`,
     orchestratorStateDir,
     defaultOrchestratorBoardPath: path.join(
       orchestratorStateDir,