@chorus-aidlc/chorus 0.18.0 → 0.19.0

package/.next/standalone/public/skill/proposal-reviewer-chorus/SKILL.md

@@ -114,14 +114,62 @@ Classify **every** finding as exactly one of:
 
 **Rules:** Pseudocode inconsistencies → **always NOTE**. Cross-document wording differences → **always NOTE**. Only semantic contradictions → BLOCKER.
 
+Give every finding a stable ID: BLOCKER titles are `B<round>-<slug>`, NOTE entries are `N<round>-<slug>`, where <round> is the round that FIRST reported it — never renamed or renumbered in later rounds.
+Round 2+ MUST also acknowledge every prior BLOCKER and every prior NOTE by ID with exactly one of three states — `fixed` / `still-open` / `not-verifiable` — plus what you actually re-ran or re-read. Silence is not a fix: only an explicit `fixed` closes a finding. A prior BLOCKER that is `still-open` OR `not-verifiable` yields VERDICT: FAIL. An unresolved NOTE never yields worse than PASS WITH NOTES.
+
 ---
 
+## What to report / what NOT to report
+
+This list is specific to the proposal gate. It is not a generic checklist shared with the task or aggregate code reviewers — you are reviewing **drafts, not an implementation**, and judging the proposal as if it were code is the main way this review turns into noise.
+
+**DO report:**
+- Requirements that are not traceable to human-authored intent, and human-stated intent that no requirement carries.
+- Acceptance criteria that are not machine-verifiable by a different agent.
+- Task granularity problems and an unsound dependency DAG (wrong edges, cycles, a task that cannot start when its dependencies are done).
+- A missing integration checkpoint once the DAG has 4+ tasks.
+- Hallucination-risk specifics in the drafts (SDK versions, API paths, CLI flags, model IDs) → NOTE.
+
+**DO NOT report:**
+- **Never report something as missing without first confirming its absence with read-only Bash** (`ls` / `grep` / `rg` / `find` / `git ls-files`), and cite what you checked. An unverified "X is missing" is the single most common false BLOCKER.
+- **Do not report document wording or formatting.** Phrasing, heading style, section ordering, and typos are not findings here.
+- **Do not report that "the implementation detail isn't specific enough."** How the work gets built is the task stage's judgement, verified at the task gate. A proposal is not required to pre-specify implementation.
+- **Do not propose alternative architectures.** Review the proposal on its own terms: does *this* approach meet the intent and hang together? A different design you would have preferred is not a finding.
+- **Do not report future extensibility.** "This won't scale to a use case nobody asked for" is out of scope.
+
 ## Round 2+ Awareness
 
 You may receive the current review round number in your context.
 
 - **Round 1** — Full review at normal strictness.
-- **Round 2+** — Focus ONLY on whether the previous BLOCKERs were fixed. Do NOT introduce new NOTEs on areas not flagged in earlier rounds. Round 1 already did the full-depth draft review. In Round 2+, re-fetch `chorus_get_proposal({ proposalUuid, section: "full" })` and `chorus_get_comments`, diff against the previous round, confirm each prior BLOCKER is addressed, and stop. If all previous BLOCKERs are resolved → `VERDICT: PASS` (or `VERDICT: PASS WITH NOTES` if old NOTEs remain).
+- **Round 2+** — Focus ONLY on whether the previous BLOCKERs were fixed. Do NOT introduce new NOTEs on areas not flagged in earlier rounds. Round 1 already did the full-depth draft review. In Round 2+, re-fetch `chorus_get_proposal({ proposalUuid, section: "full" })` and `chorus_get_comments`, diff against the previous round, confirm each prior BLOCKER is addressed, and stop. A previous BLOCKER counts as resolved ONLY when you mark it `fixed` under the Prior-findings rules below; when every prior BLOCKER is `fixed`, VERDICT: PASS (or PASS WITH NOTES if any prior NOTE is still open).
+
+## Prior findings: stable IDs and cross-round acknowledgement
+
+**Stable IDs.** Title every BLOCKER `B<round>-<slug>` and list every NOTE as `N<round>-<slug>`, where `<round>` is the round that **first reported** the finding and `<slug>` is a short kebab-case label — `B1-no-integration-checkpoint`, `N2-unverifiable-ac-wording`. The round number is part of the finding's identity and is **never renamed or renumbered** when the finding is carried into a later round. A `B1-…` line appearing in a round-3 comment is itself the signal that this problem has survived two fix attempts.
+
+**Acknowledgement.** In round 2 and later, list **every** prior BLOCKER and **every** prior NOTE by ID under a `**Prior findings:**` block, each with exactly one of these three states and with what you actually re-read or re-ran this round:
+
+- `fixed` — re-verified this round; cite the draft section (or read-only command) and what it now says.
+- `still-open` — re-checked, and the problem is still there.
+- `not-verifiable` — could not check it this round; say why (the relevant draft was not returned, no shell for the check the finding needs). Never counts as fixed.
+
+Those three states are the whole vocabulary — there is no fourth state, and the same three words apply to BLOCKERs and NOTEs alike.
+
+Three rules govern what the states mean for the verdict:
+
+- **Silence is not a fix.** Not re-reporting a finding does not close it. Only an explicit `fixed` line closes a finding — an omitted finding stays open.
+- **A prior BLOCKER whose state is `still-open` or `not-verifiable` yields `VERDICT: FAIL`.** Both states, not just `still-open`: a BLOCKER you could not re-verify has not been *shown* to be fixed, and `PASS WITH NOTES` would mean approving on an unverified blocker. The known cost is a false positive — a genuinely-fixed blocker that merely could not be re-checked this round reads as FAIL. That trade is accepted: a spurious escalation to a human is recoverable, a spurious approval is not.
+- **NOTEs never escalate.** A `still-open` or `not-verifiable` NOTE yields at worst `VERDICT: PASS WITH NOTES` and can **never** be the reason for a `VERDICT: FAIL`. Only BLOCKERs block.
+
+**How the NOTE limit composes with the round-2+ rule above.** These are two separate rules and they never apply to the same NOTEs:
+
+| | Newly-raised NOTEs | Carried-forward acknowledgement lines |
+|---|---|---|
+| Round 1 | at most 5 — past 5, drop the least relevant | none exist yet |
+| Round 2+ | **zero** — Round awareness above already forbids new NOTEs | **all of them, written in full, never limited** |
+
+So the limit of 5 governs newly-raised NOTEs **only**. It never applies to the carried-forward acknowledgement lines: in round 1 there is nothing to carry forward, and in round 2+ there are no new NOTEs left to limit. Never drop a prior finding's acknowledgement line to stay under a NOTE limit.
 
 ---
 
@@ -157,19 +205,24 @@ Do NOT invent other verdicts like "APPROVE" or "OK" — automation greps for the
 
 ## Output Format (Required)
 
-Keep total output **under ~800 characters** — be concise. No preamble, no trailing summary paragraph. PASS items: names only. NOTE items: one-line descriptions. BLOCKER items: full evidence.
+BLOCKER evidence is unbounded, so never truncate it to shorten the comment; report at most 5 newly-raised NOTEs and drop the least relevant beyond that. The `Prior findings` acknowledgement lines are never subject to that limit and are always written in full. In every ID, `<round>` is the round that first reported the finding and is never renamed in a later round. No preamble, no trailing summary paragraph. PASS items: names only. NOTE items: one-line descriptions. BLOCKER items: full evidence.
 
 ```
 ### Review Summary
 
+**Prior findings:** (round 2+ only — omit this block in round 1)
+- B1-<slug>: fixed — `<what you re-ran or re-read>` → <result observed>
+- B1-<other-slug>: still-open — `<what you re-ran or re-read>` → <problem still present>
+- B2-<slug>: not-verifiable — <why you could not check it this round>
+- N1-<slug>: still-open
 **PASS (N):** Check-1 name, Check-2 name, ...
 
 **NOTE (M):**
-- Note-1: [one-line description]
-- Note-2: [one-line description]
+- N<round>-<slug>: [one-line description]
+- N<round>-<slug>: [one-line description]
 
 **BLOCKER (K):**
-### Blocker-1: name
+### B<round>-<slug>
 **Evidence:** [specific finding]
 **Expected:** [what should be there]
 **Actual:** [what is there or what is missing]

package/.next/standalone/public/skill/task-reviewer-chorus/SKILL.md

@@ -107,6 +107,19 @@ Pick 2-3 probes that fit the specific task — boundary values, missing fields,
 
 **Hallucination check:** Flag anything that looks LLM-fabricated as a **NOTE** — API signatures, CLI flags, config keys, model IDs, endpoint URLs, package names, or any external detail the developer likely wrote from memory rather than referencing docs.
 
+**Code quality and correctness beyond the AC — checked by default**
+
+The AC were written before the code existed: they describe what to build, never how well it was built. Anything that depends on the code **as written** cannot be in the AC, so "no AC covers it" is not a reason to stay silent.
+
+- **Correctness without an AC.** Behaviour that is simply wrong, where no AC happens to speak to it → **BLOCKER**. You do not need an acceptance criterion to report a bug.
+- **Reimplementation.** Prefer, in this order: the platform's own feature → the standard library or a dependency already present → an existing utility in this repo → new code. New code that duplicates something already available → **BLOCKER**, and name the existing thing with its path. "This could be shorter" with nothing named is not a finding.
+- **Security in this task's own code.** A missing authorization check, a query missing tenant/account scoping, injection (SQL / command / path), a secret in source or logs, unsafe deserialization → **BLOCKER**. Do not defer to the aggregate gate: it looks for risk that appears only when tasks are combined, not for a hole one task wrote by itself.
+- **Tests that cannot fail.** Ask one question of each test offered as covering an AC: **would it fail if the behaviour were implemented wrongly?** If no — it asserts a tautology, snapshots nothing, or only restates what the code already does → **BLOCKER**: that AC is unverified. Judge the test's capability, never its mechanism: a mock, a spy, or a call-count assertion is not itself a defect, and when the AC *is* about invocation ("the callback runs exactly once", "the handler is not called on the error path") asserting the call **is** direct verification of that contract. Thin-but-real tests → NOTE.
+- **Silent failure.** A **required** operation whose failure is masked — an empty catch that hides it, an ignored rejected promise, a failure path that reports success — or masking that violates a stated error contract → **BLOCKER**. Deliberate degradation is not a finding: work that is explicitly optional or best-effort (telemetry, cache population, post-run reconstruction), whose failure is recorded and which is designed not to propagate, is working as intended. Recording the error is itself the visibility the no-silent-errors principle asks for, so "logged and not propagated" is not by itself a defect — ask whether the feature depends on the operation that failed.
+- **Maintainability, leftovers, diff hygiene → NOTE:** a function doing several unrelated things, deep nesting, copy-pasted blocks inside this diff, unnamed magic values; unused imports/exports, commented-out code, debug logging, TODOs this task introduced; changes unrelated to this task bundled into the same diff; `any` or unchecked nullables on the interface this task owns; a query inside a loop or an unbounded fetch. Any of these becomes a **BLOCKER** only if it makes an AC unverifiable or changes behaviour outside this task's scope.
+
+**Severity rule.** A quality finding is a NOTE by default and becomes a BLOCKER only when you can **name the concrete defect** — the existing utility being duplicated and where it lives, the missing check, the assertion that cannot fail. Taste never blocks: if you cannot point at it, it is a NOTE or it is nothing. Report the cheapest concrete change, never a redesign.
+
 ### Step 6: Intent Alignment
 
 Resolve the originating Idea (this task's proposal → `inputUuids[0]`) and read its body + human-answered elaboration + human-authored comments (`answeredBy.type` / `author.type == "user"`; agent-authored entries are audit context, not intent). Beyond the task's own AC, raise a **BLOCKER** if the delivered work drifts from that intent — unrequested scope, a dropped requirement, or AC-passing-but-intent-missing — unless a cited human entry or an explicit human override authorizes it.
@@ -140,16 +153,64 @@ Classify **every** finding as exactly one of:
 - Style / naming suggestions.
 - Hallucination-risk specifics (SDK versions, API paths, CLI flags, model IDs).
 
-**Rules:** Pseudocode inconsistencies → **always NOTE**. Cross-document wording differences → **always NOTE**. Only functional / behavioral issues → BLOCKER.
+**Rules:** Style, naming, and pseudocode inconsistencies → **always NOTE**. Functional, security, and verification-integrity issues → BLOCKER. A quality finding blocks only when you can name the concrete defect.
+
+Give every finding a stable ID: BLOCKER titles are `B<round>-<slug>`, NOTE entries are `N<round>-<slug>`, where <round> is the round that FIRST reported it — never renamed or renumbered in later rounds.
+Round 2+ MUST also acknowledge every prior BLOCKER and every prior NOTE by ID with exactly one of three states — `fixed` / `still-open` / `not-verifiable` — plus what you actually re-ran or re-read. Silence is not a fix: only an explicit `fixed` closes a finding. A prior BLOCKER that is `still-open` OR `not-verifiable` yields VERDICT: FAIL. An unresolved NOTE never yields worse than PASS WITH NOTES.
 
 ---
 
+## What to report / what NOT to report
+
+This list is specific to the task gate. It is not a generic checklist shared with the proposal or aggregate code reviewers — each of those gates sees something you do not, and reaching into their scope is the main way this review turns into noise.
+
+**DO report:**
+- The result of running this task's tests/build, quoting the real output — exact command, exit code, the relevant lines.
+- **Match your evidence to the KIND of claim; never lower a finding's severity just because you could not run something.** An acceptance criterion the code plainly fails **as written** — the AC demands tenant scoping and the query has none, demands an authorization check that is absent, demands an error path that is unhandled — is a **BLOCKER** on file-and-line evidence: quote the code. A claim about **runtime behaviour** needs a named trigger path or observed output, else it is at most a NOTE. Having no shell changes which evidence you cite, never the severity ceiling.
+- Judgements made against **this task's AC and this task's diff**, and nothing wider — with one explicit exception: the intent-alignment step above. Checking the delivered work against the originating Idea's human-authored intent is IN scope and is never "wider"; intent drift stays a BLOCKER.
+- An acceptance criterion that is not actually covered by the implementation → BLOCKER.
+- Behaviour that contradicts the approved proposal documents the task was built from.
+
+**DO NOT report:**
+- **Never report something as missing without first confirming its absence with read-only Bash** (`ls` / `grep` / `rg` / `find` / `git ls-files`), and cite the command you ran. An unverified "X is missing" is the single most common false BLOCKER.
+- **Do not re-litigate decisions inside an already-approved proposal.** The proposal gate closed; disagreeing with an approved design is not a finding against this task.
+- **Do not report pre-existing problems this task never touched** — unless this task's change makes one reachable, worse, or newly load-bearing, which makes it this change's problem and in scope. If the task's diff did not introduce it, it is not this review's finding.
+- **Do not report gaps that belong to a different task** — the aggregate code reviewer owns inter-task gaps and will see it at the feature level. Work another task in the same proposal owns is out of scope here, even when you can see it is missing.
+- **Never raise a BLOCKER for absent end-to-end integration tests.** Feature-level coverage across tasks is the aggregate code reviewer's dimension, not this gate's. This task's own AC is the standard here.
+
 ## Round 2+ Awareness
 
 You may receive the current review round number in your context.
 
 - **Round 1** — Full review at normal strictness.
-- **Round 2+** — Focus ONLY on whether the previous BLOCKERs were fixed. Do NOT introduce new NOTEs on areas not flagged in earlier rounds. Round 1 already did the full-depth review. In Round 2+, re-read only the specific files and re-run only the specific tests/commands tied to previous BLOCKERs — do not re-scan unrelated code, do not rerun the full suite, and do not probe new areas. If all previous BLOCKERs are resolved → `VERDICT: PASS` (or `VERDICT: PASS WITH NOTES` if old NOTEs remain). Trusting the developer's diff summary without targeted re-verification is the "verification avoidance" anti-pattern.
+- **Round 2+** — Focus ONLY on whether the previous BLOCKERs were fixed. Do NOT introduce new NOTEs on areas not flagged in earlier rounds. Round 1 already did the full-depth review. In Round 2+, re-read only the specific files and re-run only the specific tests/commands tied to prior findings (BLOCKERs and NOTEs alike — a prior NOTE you may not re-read is a NOTE you can never close) — do not re-scan unrelated code, do not rerun the full suite, and do not probe new areas. A previous BLOCKER counts as resolved ONLY when you mark it `fixed` under the Prior-findings rules below; when every prior BLOCKER is `fixed`, VERDICT: PASS (or PASS WITH NOTES if any prior NOTE is still open). Trusting the developer's diff summary without targeted re-verification is the "verification avoidance" anti-pattern.
+
+## Prior findings: stable IDs and cross-round acknowledgement
+
+**Stable IDs.** Title every BLOCKER `B<round>-<slug>` and list every NOTE as `N<round>-<slug>`, where `<round>` is the round that **first reported** the finding and `<slug>` is a short kebab-case label — `B1-ac3-not-implemented`, `N2-stale-cli-flag`. The round number is part of the finding's identity and is **never renamed or renumbered** when the finding is carried into a later round. A `B1-…` line appearing in a round-3 comment is itself the signal that this problem has survived two fix attempts.
+
+**Acknowledgement.** In round 2 and later, list **every** prior BLOCKER and **every** prior NOTE by ID under a `**Prior findings:**` block, each with exactly one of these three states and with the command you actually re-ran this round:
+
+- `fixed` — re-verified this round; cite the command and its result.
+- `still-open` — re-checked, and the problem is still there.
+- `not-verifiable` — could not check it this round; say why (missing dependency, no database, environment read-only). Never counts as fixed.
+
+Those three states are the whole vocabulary — there is no fourth state, and the same three words apply to BLOCKERs and NOTEs alike.
+
+Three rules govern what the states mean for the verdict:
+
+- **Silence is not a fix.** Not re-reporting a finding does not close it. Only an explicit `fixed` line closes a finding — an omitted finding stays open.
+- **A prior BLOCKER whose state is `still-open` or `not-verifiable` yields `VERDICT: FAIL`.** Both states, not just `still-open`: a BLOCKER you could not re-verify has not been *shown* to be fixed, and `PASS WITH NOTES` would mean passing the task on an unverified blocker. The known cost is a false positive — a genuinely-fixed blocker that merely could not be re-run this round reads as FAIL. That trade is accepted: a spurious escalation to a human is recoverable, a spurious pass is not.
+- **NOTEs never escalate.** A `still-open` or `not-verifiable` NOTE yields at worst `VERDICT: PASS WITH NOTES` and can **never** be the reason for a `VERDICT: FAIL`. Only BLOCKERs block.
+
+**How the NOTE limit composes with the round-2+ rule above.** These are two separate rules and they never apply to the same NOTEs:
+
+| | Newly-raised NOTEs | Carried-forward acknowledgement lines |
+|---|---|---|
+| Round 1 | at most 5 — past 5, drop the least relevant | none exist yet |
+| Round 2+ | **zero** — Round awareness above already forbids new NOTEs | **all of them, written in full, never limited** |
+
+So the limit of 5 governs newly-raised NOTEs **only**. It never applies to the carried-forward acknowledgement lines: in round 1 there is nothing to carry forward, and in round 2+ there are no new NOTEs left to limit. Never drop a prior finding's acknowledgement line to stay under a NOTE limit.
 
 ---
 
@@ -177,19 +238,24 @@ Do NOT invent other verdicts like "APPROVE" or "OK" — automation greps for the
 
 ## Output Format (Required)
 
-Keep total output **under ~800 characters** — be concise. No preamble, no trailing summary paragraph. PASS items: names only. NOTE items: one-line descriptions. BLOCKER items: full evidence (command + output + expected vs actual).
+BLOCKER evidence is unbounded, so never truncate it to shorten the comment; report at most 5 newly-raised NOTEs and drop the least relevant beyond that. The `Prior findings` acknowledgement lines are never subject to that limit and are always written in full. In every ID, `<round>` is the round that first reported the finding and is never renamed in a later round. No preamble, no trailing summary paragraph. PASS items: names only. NOTE items: one-line descriptions. BLOCKER items: full evidence (command + output + expected vs actual).
 
 ```
 ### Review Summary
 
+**Prior findings:** (round 2+ only — omit this block in round 1)
+- B1-<slug>: fixed — `<what you re-ran or re-read>` → <result observed>
+- B1-<other-slug>: still-open — `<what you re-ran or re-read>` → <problem still present>
+- B2-<slug>: not-verifiable — <why you could not check it this round>
+- N1-<slug>: still-open
 **PASS (N):** AC-1 name, AC-2 name, ...
 
 **NOTE (M):**
-- Note-1: [one-line description]
-- Note-2: [one-line description]
+- N<round>-<slug>: [one-line description]
+- N<round>-<slug>: [one-line description]
 
 **BLOCKER (K):**
-### Blocker-1: name
+### B<round>-<slug>
 **Command run:** [exact command executed]
 **Output observed:** [actual output — copy-paste, not paraphrased]
 **Evidence:** [specific finding with file paths, line numbers]

package/README.ja.md

@@ -38,6 +38,8 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 
 ## 最近の更新
 
+**[v0.19.0](https://chorus-ai.dev/blog/chorus-v0.19.0-release/)** — Cloudflare を参考にレビューの範囲を明確化し、問題の根拠を省略せず、固定 ID で再レビュー時も追跡。タスクレビューでは受け入れ基準に加え、コード品質も標準で確認します。
+
 **[v0.18.0](https://chorus-ai.dev/blog/chorus-v0.18.0-release/)** — OpenSpec を補う、軽量で Git ネイティブなローカル Spec 管理として `spec-lite` を内蔵しました。live session anchor により、デーモンエージェントからの返信が、起点となったエージェントの既存 Idea セッションへ戻ります。
 
 **[v0.17.2](https://chorus-ai.dev/blog/chorus-v0.17.2-release/)** — Pi が正式配布とデーモンウェイクに対応し、`chorus agents run` でローカルのエージェントプロファイルをすぐ切り替えられます。
@@ -63,7 +65,7 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 2 つのコマンドだけです — データベースも Docker も設定ファイルも不要です。
 
 ```bash
-npm install -g @chorus-aidlc/chorus@0.18.0
+npm install -g @chorus-aidlc/chorus@0.19.0
 chorus
 ```
 

package/README.ko.md

@@ -38,6 +38,8 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 
 ## 최근 업데이트
 
+**[v0.19.0](https://chorus-ai.dev/blog/chorus-v0.19.0-release/)** — Cloudflare를 참고해 리뷰 범위를 명확히 하고, 문제의 근거를 온전히 남기며, 고정 ID로 재검토까지 추적합니다. 태스크 리뷰는 인수 기준 외의 코드 품질도 기본으로 검사합니다.
+
 **[v0.18.0](https://chorus-ai.dev/blog/chorus-v0.18.0-release/)** — OpenSpec을 보완하는 가볍고 Git 친화적인 로컬 Spec 관리 방식으로 `spec-lite`를 내장했습니다. live session anchor를 통해 데몬 에이전트의 응답이 작업을 시작한 에이전트의 기존 Idea 세션으로 돌아갑니다.
 
 **[v0.17.2](https://chorus-ai.dev/blog/chorus-v0.17.2-release/)** — Pi를 정식 패키지와 데몬 웨이크로 사용할 수 있으며, `chorus agents run`으로 로컬 에이전트 프로파일을 빠르게 전환할 수 있습니다.
@@ -63,7 +65,7 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 두 개의 명령이면 됩니다. 데이터베이스도, Docker도, 설정 파일도 필요 없습니다.
 
 ```bash
-npm install -g @chorus-aidlc/chorus@0.18.0
+npm install -g @chorus-aidlc/chorus@0.19.0
 chorus
 ```
 

package/README.md

@@ -38,6 +38,8 @@ The labels under each stage are the **permissions** an actor needs there — gra
 
 ## What's New
 
+**[v0.19.0](https://chorus-ai.dev/blog/chorus-v0.19.0-release/)** — Cloudflare-inspired reviewer rules: clearer scope, complete blocker evidence, and stable finding IDs across rounds. Task reviews now check code quality beyond acceptance criteria.
+
 **[v0.18.0](https://chorus-ai.dev/blog/chorus-v0.18.0-release/)** — Built-in `spec-lite` adds a lightweight, Git-native local spec workflow alongside OpenSpec. Live session anchors let daemon agents return replies to the initiating agent's existing Idea session.
 
 **[v0.17.2](https://chorus-ai.dev/blog/chorus-v0.17.2-release/)** — Pi is now a published, wakeable Chorus agent, and `chorus agents run` switches local agent profiles with one command.
@@ -63,7 +65,7 @@ The labels under each stage are the **permissions** an actor needs there — gra
 Two commands. No database, no Docker, no config files.
 
 ```bash
-npm install -g @chorus-aidlc/chorus@0.18.0
+npm install -g @chorus-aidlc/chorus@0.19.0
 chorus
 ```
 

package/README.zh.md

@@ -29,6 +29,8 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 
 ## 最近更新
 
+**[v0.19.0](https://chorus-ai.dev/zh/blog/chorus-v0.19.0-release/)**：借鉴 Cloudflare，明确 reviewer 职责、保留完整证据，用稳定 ID 逐轮追踪问题。任务审查默认检查验收标准之外的代码质量。
+
 **[v0.18.0](https://chorus-ai.dev/zh/blog/chorus-v0.18.0-release/)** — 内置 `spec-lite`，作为 OpenSpec 之外更轻量、可直接进 Git 的本地 Spec 管理方案。live session anchor 让 daemon Agent 的回复回到发起者已有的 Idea 会话。
 
 **[v0.17.2](https://chorus-ai.dev/zh/blog/chorus-v0.17.2-release/)** — Pi 现在可以正式安装并由 daemon 唤醒，`chorus agents run` 还能一条命令切换本地 Agent profile。
@@ -54,7 +56,7 @@ Idea ──> Proposal ──> [Document + Task DAG] ──> Execute ──> Veri
 两条命令即可，无需数据库、无需 Docker、无需配置文件。
 
 ```bash
-npm install -g @chorus-aidlc/chorus@0.18.0
+npm install -g @chorus-aidlc/chorus@0.19.0
 chorus
 ```
 

package/chorus.mjs

@@ -315,11 +315,39 @@ function isPortOccupied(host, tcpPort, timeoutMs = 1000) {
   });
 }
 
+// Publicly known placeholder secrets (GitHub #559). Must stay identical to
+// KNOWN_INSECURE_SECRETS in src/lib/secret-check.ts and
+// CHORUS_KNOWN_INSECURE_SECRETS in docker/ensure-secret.sh (parity-tested).
+const KNOWN_INSECURE_SECRETS = [
+  "chorus-docker-secret-change-in-production",
+  "chorus-local-secret",
+  "your-secret-key-change-in-production",
+  "change-me-to-a-random-secret",
+];
+
 function ensureSecret() {
   const secretPath = join(dataDir, ".secret");
-  if (process.env.NEXTAUTH_SECRET) return;
+  const fromEnv = process.env.NEXTAUTH_SECRET;
+  if (fromEnv) {
+    if (!KNOWN_INSECURE_SECRETS.includes(fromEnv.trim())) return;
+    // A pasted placeholder is treated exactly like "unset": fall through to the
+    // persisted / generated secret instead of signing JWTs with a public value.
+    console.error(
+      "WARNING: NEXTAUTH_SECRET is set to a publicly known placeholder (GitHub #559); ignoring it and using the persisted secret in " +
+        secretPath
+    );
+  }
   if (existsSync(secretPath)) {
-    process.env.NEXTAUTH_SECRET = readFileSync(secretPath, "utf8").trim();
+    // Fail closed, matching docker/ensure-secret.sh: a persisted file that is
+    // empty or holds a publicly known placeholder must never be exported.
+    const persisted = readFileSync(secretPath, "utf8").trim();
+    if (!persisted || KNOWN_INSECURE_SECRETS.includes(persisted)) {
+      console.error(
+        `ERROR: the secret persisted at ${secretPath} is ${persisted ? "a publicly known placeholder" : "empty"} (GitHub #559); refusing to start — delete the file to regenerate, or set NEXTAUTH_SECRET explicitly.`
+      );
+      process.exit(1);
+    }
+    process.env.NEXTAUTH_SECRET = persisted;
     return;
   }
   const secret = createHash("sha256")

package/cli/child-exit.mjs

@@ -0,0 +1,77 @@
+// cli/child-exit.mjs
+// One shared settlement path for every spawner's child process, so the five
+// backends (pi / claude / codex / kiro / dsh) cannot drift on "when is the wake
+// over?".
+//
+// WHY THIS EXISTS — `close` is not the same event as "the agent finished".
+// Node emits `exit` when the child process itself is reaped, but `close` only
+// once every stdio stream the child was given has been closed. A child that
+// leaves a DETACHED DESCENDANT behind (a backgrounded server, a `nohup`'d
+// helper) hands that descendant the SAME inherited pipes, so the pipes stay
+// open after the child is long gone and `close` may never fire. A spawner that
+// waits only for `close` therefore keeps reporting a finished wake as still
+// `running` — the phantom `running` turn. Settling on `exit` fixes that.
+//
+// !!! THE GRACE IS NOT A WAKE TIMEOUT AND NOT A WATCHDOG !!!
+// `stdioGraceMs` only starts counting AFTER the child process has ALREADY
+// EXITED, and it bounds one thing only: how long we wait for that dead
+// process's pipes to drain so a final stdout chunk is still parsed. It places
+// no limit whatsoever on how long an agent may run — a wake that runs for
+// hours is never interrupted, cancelled or "timed out" by this module. No
+// wake-duration limit is introduced anywhere here; do not repurpose this timer
+// into one.
+
+/** Grace for an already-exited process's pipes to drain. NOT a wake timeout. */
+export const DEFAULT_STDIO_GRACE_MS = 2000;
+
+/**
+ * Resolve once with the child's exit code as soon as the process is KNOWN to be gone.
+ *
+ *  • `close` first  → resolve immediately (today's behaviour, zero regression).
+ *  • `exit` first   → wait up to `stdioGraceMs` for `close` (so a last stdout chunk
+ *                     is still parsed), then resolve with the exit code anyway.
+ *
+ * Settles exactly once and NEVER rejects. The grace timer is `unref`'d so it can
+ * never hold the daemon's event loop open.
+ *
+ * @param {import("node:child_process").ChildProcess} child
+ * @param {{ stdioGraceMs?: number, logger?: { warn?: (msg: string) => void }, label?: string }} [options]
+ * @returns {Promise<number | null>} the exit code (`null` when the child was signalled)
+ */
+export function awaitChildSettled(child, options = {}) {
+  const { stdioGraceMs = DEFAULT_STDIO_GRACE_MS, logger, label = "child" } = options;
+
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer = null;
+
+    const settle = (code) => {
+      if (settled) return;
+      settled = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      resolve(code ?? null);
+    };
+
+    child.on?.("close", (code) => settle(code));
+
+    child.on?.("exit", (code) => {
+      if (settled || timer) return;
+      // The process is gone; give its (possibly descendant-held) pipes a bounded
+      // moment to drain, then settle regardless. See the header: not a timeout.
+      timer = setTimeout(() => {
+        timer = null;
+        if (settled) return;
+        logger?.warn?.(
+          `[Chorus] ${label} exited (code ${code ?? null}) but stdio stayed open for ` +
+            `${stdioGraceMs}ms; settling on exit`
+        );
+        settle(code);
+      }, stdioGraceMs);
+      // Never keep the daemon's event loop alive for a dead process's pipes.
+      timer?.unref?.();
+    });
+  });
+}

package/cli/claude-spawner.mjs

@@ -28,6 +28,7 @@ import { validateAgentCliConfig, overlayAgentEnv, getAgentEnv, assertConfiguredS
 import { existsSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { win32 as pathWin32, posix as pathPosix, join as pathJoin } from "node:path";
+import { awaitChildSettled } from "./child-exit.mjs";
 
 const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
 
@@ -447,7 +448,9 @@ export class ClaudeSpawner {
         resolve({ sessionId: observedSessionId, backendSessionId: id, exitCode: null, isNew });
       });
 
-      child.on("close", (code) => {
+      // Settle on process exit, not only on stdio close: a detached descendant can
+      // inherit the pipes and keep `close` from ever firing (see cli/child-exit.mjs).
+      awaitChildSettled(child, { logger: this.logger, label: "claude" }).then((code) => {
         if (code !== 0) {
           this.logger.warn(`[Chorus] claude exited with code ${code}`);
         }

package/cli/codex-spawner.mjs

@@ -33,6 +33,7 @@ import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, win32 as pathWin32, posix as pathPosix } from "node:path";
 import { parseNdjsonChunk } from "./claude-spawner.mjs";
+import { awaitChildSettled } from "./child-exit.mjs";
 import { getThreadId as defaultGetThreadId, setThreadId as defaultSetThreadId } from "./codex-session-map.mjs";
 import {
   getCodexUsageSnapshot as defaultGetUsageSnapshot,
@@ -370,7 +371,9 @@ export class CodexSpawner {
         resolve({ sessionId: anchor, backendSessionId: observedThreadId, exitCode: null, isNew });
       });
 
-      child.on("close", (code) => {
+      // Settle on process exit, not only on stdio close: a detached descendant can
+      // inherit the pipes and keep `close` from ever firing (see cli/child-exit.mjs).
+      awaitChildSettled(child, { logger: this.logger, label: "codex" }).then((code) => {
         if (code !== 0) {
           this.logger.warn(`[Chorus] codex exited with code ${code}`);
         }

package/cli/control-handler.mjs

@@ -12,6 +12,17 @@
 // so a stale / recycled connection uuid can never make the daemon kill the wrong
 // subprocess (Tech Design "Risks": mis-kill after a reconnect).
 //
+// When Check-2 fails for an `interrupt` (no live child here) the command is NOT
+// silently dropped (fix-phantom-running-turn, Tech Design "D — a no-child interrupt
+// reports the truth"): the handler logs the miss AND fire-and-forgets one
+// `advanceTurn({ status: "interrupted", interruptedReason: "user" })` so a server-side
+// `running` turn with no daemon child behind it converges instead of hanging forever.
+// The session business key is derived without any lookup, and therefore only for the
+// two control entity types where the derivation is an identity (`idea`,
+// `daemon_session` → sessionId === entityUuid). `task` / `proposal` / `document` keep
+// the pure-log behaviour: their session is anchored on the resource's DIRECT idea,
+// which the daemon cannot resolve locally, and guessing would converge the wrong turn.
+//
 // On a verified match it (a) sets a per-entity "interrupting" flag on the waker so
 // the waker reports the resulting exit as interrupted(reason="user") rather than a
 // crash, then (b) invokes the injected killer (process-killer.killProcessTree) on
@@ -25,6 +36,16 @@ import { killProcessTree } from "./process-killer.mjs";
 
 const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
 
+/**
+ * Control entity types whose session business key is the entityUuid itself, so a
+ * no-child interrupt can report the turn terminal WITHOUT any REST lookup:
+ *   • `idea`           — the session anchor IS the direct idea uuid.
+ *   • `daemon_session` — the ad-hoc session's own business id.
+ * Every other member of CONTROL_ENTITY_TYPES (`task`, `proposal`, `document`) is
+ * anchored on that resource's DIRECT idea, which is not derivable locally.
+ */
+const SELF_ANCHORED_ENTITY_TYPES = new Set(["idea", "daemon_session"]);
+
 /**
  * Build the `onControl(event)` callback the SseListener invokes for a
  * `type:"control"` event.
@@ -56,6 +77,15 @@ const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
  *                                            other still-pending turn along. Injected by the
  *                                            daemon (`backfill.pendingTurnsOnly`); the
  *                                            arg-less form (reconnect) still sweeps all.
+ *   advanceTurn?: (params: { sessionId: string, status: string, interruptedReason?: string,
+ *                            entityType?: string|null, entityUuid?: string|null }) => any,
+ *                                            The SAME `createTurnReporter(...)` instance the
+ *                                            waker uses (injected by `cli/daemon.mjs`; no
+ *                                            second transport, no new endpoint). Invoked
+ *                                            fire-and-forget ONLY when an `interrupt` finds no
+ *                                            live child for a self-anchored entity type, to
+ *                                            close a server-side `running` turn that nothing
+ *                                            else would ever close.
  *   logger?: { info(m:string):void, warn(m:string):void, error(m:string):void },
  * }} deps
  * @returns {(event: any) => void}  The onControl callback (synchronous, non-throwing).
@@ -67,6 +97,7 @@ export function createControlHandler(deps) {
   const sigintTimeoutMs = deps.sigintTimeoutMs;
   const redispatchResume = deps.redispatchResume;
   const deliverTurn = deps.deliverTurn;
+  const advanceTurn = deps.advanceTurn;
   const handleDirectoryRequest = deps.handleDirectoryRequest;
   const reportDirectoryRequest = deps.reportDirectoryRequest;
   const logger = deps.logger ?? NOOP_LOGGER;
@@ -202,11 +233,76 @@ export function createControlHandler(deps) {
       }
 
       // --- interrupt path: Check 2 — in-memory entity ownership (running child) ---
+      //
+      // The registry is keyed by the WAKE's own resource (`task:T`), while a
+      // conversation's control key is its session anchor (`idea:A`). A wake on a CHILD
+      // resource of idea A runs on session A (waker: `sessionId = directIdeaUuid`), so an
+      // `idea:A` interrupt must also find a running `task:T` / `proposal:P` / `document:D`
+      // entry whose `directIdeaUuid` is A — the same rule the UI's `executionMatchesSession`
+      // applies. Without this the exact-key lookup misses, we report a turn miss, the
+      // server's FIFO resolution grabs the SIBLING wake's `running` turn, and NOTHING is
+      // killed: the UI would say interrupted while the agent keeps working.
       const key = execKey(entityType, entityUuid);
-      const entry = waker?.executions?.get(key);
+      let entry = waker?.executions?.get(key);
+      // The entity the kill actually targets — normally the command's own, but a sibling
+      // wake when the match below re-points it.
+      let killEntityType = entityType;
+      let killEntityUuid = entityUuid;
+      let killKey = key;
+      if ((!entry || entry.status !== "running" || !entry.child) && entityType === "idea") {
+        for (const candidate of waker?.executions?.values() ?? []) {
+          if (
+            candidate.status === "running" &&
+            candidate.child &&
+            candidate.directIdeaUuid === entityUuid
+          ) {
+            killEntityType = candidate.entityType;
+            killEntityUuid = candidate.entityUuid;
+            killKey = execKey(killEntityType, killEntityUuid);
+            logger.info(
+              `[Chorus] control: no direct child for ${key}, but sibling wake ${killKey} ` +
+                `runs on this session; interrupting that instead`
+            );
+            entry = candidate;
+            break;
+          }
+        }
+      }
       if (!entry || entry.status !== "running" || !entry.child) {
         // Either we never ran this entity, it's only queued (no child yet), or the
-        // wake already finished (race: interrupt arrived after exit). Safe no-op.
+        // wake already finished (race: interrupt arrived after exit). There is nothing
+        // to kill — but the SERVER may still hold a `running` turn for this session
+        // that nothing else will ever close (the phantom-running-turn bug). Report it
+        // terminal so the UI converges. Only for the self-anchored entity types; for
+        // the rest we cannot know the session locally, so keep the old pure log.
+        if (SELF_ANCHORED_ENTITY_TYPES.has(entityType)) {
+          logger.info(
+            `[Chorus] control: no running subprocess for ${key} on this daemon; ` +
+              `reporting the turn as interrupted(user)`
+          );
+          // Fire-and-forget: createTurnReporter never throws and logs its own
+          // failures, but guard both the synchronous throw and the rejection so
+          // nothing escapes into the SSE loop. A server with no `running` turn
+          // answers not_found — a harmless no-op (losing race).
+          try {
+            Promise.resolve(
+              advanceTurn?.({
+                sessionId: entityUuid,
+                status: "interrupted",
+                interruptedReason: "user",
+                entityType,
+                entityUuid,
+              })
+            ).catch((err) => {
+              logger.warn(
+                `[Chorus] control: interrupted-turn report rejected for ${key}: ${err}`
+              );
+            });
+          } catch (err) {
+            logger.warn(`[Chorus] control: interrupted-turn report failed for ${key}: ${err}`);
+          }
+          return;
+        }
         logger.info(
           `[Chorus] control: no running subprocess for ${key} on this daemon; ignoring interrupt`
         );
@@ -215,18 +311,20 @@ export function createControlHandler(deps) {
 
       // --- Both checks passed: mark interrupting (so the waker reports reason=user),
       //     then kill the tree. ---
-      logger.info(`[Chorus] control: interrupting running subprocess for ${key} (pid=${entry.child.pid})`);
+      logger.info(`[Chorus] control: interrupting running subprocess for ${killKey} (pid=${entry.child.pid})`);
       try {
-        waker.markInterrupting?.(entityType, entityUuid);
+        // Flag the entity whose wake we are actually killing — a sibling re-point must
+        // mark THAT wake interrupting, or its exit would be reported as a crash.
+        waker.markInterrupting?.(killEntityType, killEntityUuid);
       } catch (err) {
-        logger.warn(`[Chorus] control: markInterrupting failed for ${key}: ${err}`);
+        logger.warn(`[Chorus] control: markInterrupting failed for ${killKey}: ${err}`);
       }
 
       // Fire-and-forget the kill: the waker observes the child's exit and reports
       // the interrupted state. The killer never throws, but guard the promise
       // anyway so a rejection can't surface as an unhandled rejection.
       Promise.resolve(killer(entry.child, { sigintTimeoutMs, logger })).catch((err) => {
-        logger.warn(`[Chorus] control: killProcessTree rejected for ${key}: ${err}`);
+        logger.warn(`[Chorus] control: killProcessTree rejected for ${killKey}: ${err}`);
       });
     } catch (err) {
       // Absolute backstop — a control event must never crash the SSE loop.