@ericrisco/rsc 3.7.4 → 4.0.0

package/skills/constitution/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: constitution
-description: "Use when setting or amending a project's non-negotiables — stack canon, quality bars, conventions, security/a11y floors — as numbered, testable rules later phases obey. First rsc-sdd phase; writes 02-DOCS/wiki/sdd/constitution.md. NOT a feature spec (that is `specify`), NOT the technical plan (that is `plan`), NOT the wiki itself (that is `harness`)."
-tags: [sdd, constitution, principles]
+description: "Use when setting or amending a project's non-negotiables — stack canon, quality bars, conventions, security/a11y floors — as numbered, testable rules later phases obey, and drafting the REVIEW.md the reviewer reads. ASDD's base stage; writes 02-DOCS/wiki/sdd/constitution.md and REVIEW.md at the project root. NOT a feature spec (that is `specify`), NOT the technical plan (that is `plan`), NOT the wiki itself (that is `harness`)."
+tags: [asdd, constitution, principles, review]
 recommends: [specify]
 profiles: [core, full]
 origin: risco
@@ -9,7 +9,7 @@ origin: risco
 
 # constitution — the project's non-negotiable principles
 
-*The first rsc-sdd phase. Run once per project, then amend. It writes down the rules every later phase obeys: stack canon, quality bars, conventions. Everything downstream — specify, plan, analyze, implement, verify, review — reads this file as guardrails.*
+*ASDD's base stage (`../asdd/SKILL.md`). Run once per project, then amend. It writes down the rules every later phase obeys — stack canon, quality bars, conventions — and the `REVIEW.md` the reviewer reads first. Everything downstream — specify, plan, analyze, implement, verify, review — reads these as guardrails.*
 
 A constitution is small, durable, and enforceable. It is **not** a wiki of everything you know about the project (that is what `02-DOCS/wiki/` already is, run by the `harness`). It is the short list of principles that, if violated, mean the work is wrong regardless of whether it runs. If a rule here cannot be checked or pointed at later, it does not belong here — move it to the stack wiki and link it.
 
@@ -17,7 +17,7 @@ Not this phase: *what to build* → `../specify/SKILL.md`; the technical approac
 
 ## Model tier — `heavy` (opt-in routing)
 
-This phase's default model tier is **`heavy`** — it sets the project's non-negotiables, the highest-leverage decisions in the repo. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../sdd/references/model-routing.md` — announce the switch in one line when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model. Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change.
+This phase's default model tier is **`heavy`** — it sets the project's non-negotiables, the highest-leverage decisions in the repo. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../asdd/references/model-routing.md` — announce the switch in one line when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model. Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change.
 
 ## Honor the register first
 
@@ -88,6 +88,18 @@ Create `02-DOCS/wiki/sdd/` if it does not exist. Do not overwrite an existing co
 
 **A draft is "complete me", not "amend me".** `rsc onboard` writes a skeleton with `status: draft` in the frontmatter: the template's headings, the facts onboarding knew (goal, kind, scope, workflow, detected stack) and no principle. Keep those facts, run the interview, fill the sections, then on ratification drop `status: draft`, set `version: v1.0.0` and log v1.0.0 in the amendment log.
 
+## REVIEW.md — what the reviewer reads first
+
+With the constitution, draft `REVIEW.md` at the project root (the code repo — the reviewer runs there). It is short, specific to this repo, and ratified with the constitution:
+
+- **What failure looks like here** — the defect classes that actually hurt this project (e.g. "a query without the tenant filter", "a migration that is not reversible").
+- **Paths to skip** — generated code, vendored files, fixtures.
+- **Nit cap** — the most nits one review may report (e.g. 3); the rest are dropped.
+- **Always-human paths** — what must never merge without a person (billing, auth, infra). Listing them here only informs; to be *enforced* they go into `.rsc/sello-config.json` `risk.raise`, which `rsc risk` reads — say so to the user.
+- **Summary starts with a count** — "3 findings: 1 blocker, 2 nits", before anything else.
+
+`review` adds to it when a finding keeps repeating; amend it like the constitution, never silently.
+
 ## Versioning & amendment protocol
 
 The constitution is versioned so `analyze` and `review` can cite "constitution v1.2.0, principle 4".
@@ -118,6 +130,7 @@ The constitution is versioned so `analyze` and `review` can cite "constitution v
 - [ ] The Definition-of-Done checklist is present (what `verify` runs against).
 - [ ] Fixed principles included: human git authorship + decisions logged.
 - [ ] `02-DOCS/wiki/sdd/constitution.md` written with version + ratified date + amendment log.
+- [ ] `REVIEW.md` drafted at the project root; always-human paths mirrored into `.rsc/sello-config.json` `risk.raise` (or the user told why they are not).
 - [ ] Root `CLAUDE.md` `## Knowledge map` pointer has the read-first row for the constitution.
 - [ ] The constitution was shown to the user and explicitly ratified.
 
@@ -133,8 +146,8 @@ Every later rsc-sdd phase reads this file before it works. The harness maintains
 
 ## Result envelope
 
-End with the parseable block every SDD phase shares, so the dispatcher can chain without
-interpreting prose (contract: `../sdd/SKILL.md`):
+End with the parseable block every phase shares, so the dispatcher can chain without
+interpreting prose (contract: `../asdd/SKILL.md`):
 
 ```json result-envelope
 {
@@ -149,10 +162,10 @@ interpreting prose (contract: `../sdd/SKILL.md`):
     "fallback": [],
     "compact_rules": ["Principles are inherited constraints, not choices to re-make.", "Every rule is testable or it is a preference."]
   },
-  "evidence": ["constitution path exists", "rules numbered and testable", "decisions log appended"]
+  "evidence": ["constitution path exists", "rules numbered and testable", "REVIEW.md drafted", "decisions log appended"]
 }
 ```
 
 ## Next in the chain
 
-The constitution is the guardrail; now describe what to build. Hand off to **`../specify/SKILL.md`** — turn a fuzzy intent into a spec (what & why, no implementation), grounded in these principles. The full chain: **constitution → specify → clarify → plan → tasks → analyze → implement → verify → review → ship** (with `debug`, `worktrees`, `parallel` callable on demand). The dispatcher is `../sdd/SKILL.md`.
+The constitution is the guardrail; now describe what to build. Hand off to **`../specify/SKILL.md`** — turn a fuzzy intent into a spec (what & why, no implementation), grounded in these principles. The ASDD stages: **base → spec → plan → per-task loop → closing → learn** (with `debug`, `worktrees`, `parallel` callable on demand). The dispatcher is `../asdd/SKILL.md`.

package/skills/constitution/evals/README.md

@@ -64,5 +64,5 @@ even if it reads tidy.
 - Re-run after any edit to `SKILL.md` or `references/constitution-template.md` —
   wording changes shift both triggering and rubric coverage.
 - Several `route_to` targets are rsc-sdd phase siblings (`specify`, `plan`,
-  `analyze`, `sdd`) that ship alongside this skill; the near-misses here route
+  `analyze`, `asdd`) that ship alongside this skill; the near-misses here route
   only to skills already present in the repo so the eval is runnable today.

package/skills/debug/SKILL.md

@@ -26,7 +26,7 @@ delegation table below.
 
 ## Model tier — `heavy` (opt-in routing)
 
-This phase's default model tier is **`heavy`** — root-cause diagnosis is deep reasoning. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../sdd/references/model-routing.md` — announce the switch in one line when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model. Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change.
+This phase's default model tier is **`heavy`** — root-cause diagnosis is deep reasoning. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../asdd/references/model-routing.md` — announce the switch in one line when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model. Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change.
 
 ## Read the room first (register)
 

package/skills/fastapi/SKILL.md

@@ -20,7 +20,7 @@ pytest 8 + pytest-asyncio 1.0+ (`asyncio_mode=auto`), ruff 0.7+, mypy 1.13+ stri
 uv 0.5+, uvicorn 0.32+ / gunicorn 23+ + uvicorn-worker 0.3+, PyJWT 2.10+, argon2-cffi 23+,
 pip-audit 2.7+, PostgreSQL 16. (All lower bounds; install the latest in each line.)
 
-> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../asdd/SKILL.md`.
 
 Out of scope, and where it goes instead: [`django`](../django/SKILL.md) for Django; Flask / sync WSGI,
 notebooks and CLI-only scripts (no skill); language-level Python, typing and packaging →

package/skills/flutter/SKILL.md

@@ -18,7 +18,7 @@ this skill targets: **Flutter 3.44 / Dart 3.12**, **Riverpod 3.0**, **go_router
 
 ## Boundaries
 
-> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../asdd/SKILL.md`.
 
 This skill owns the `pubspec.yaml` subproject and nothing else in the repo. Hand off when the UI is
 Compose Multiplatform (`compose-multiplatform`), SwiftUI/native iOS (`swift-ios`) or React Native

package/skills/ftd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ftd
-description: "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and asks whether to branch before the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing."
+description: "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, asks whether to branch before the work writes code, and runs a minimal risk loop (self-check, `rsc risk`, one reviewer from tier 1). NOT the full method (that is `asdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing."
 tags: [ftd, lane, default, feature-document, evidence]
 recommends: [worktrees, debug, verify]
 profiles: [minimal, core, full]
@@ -10,11 +10,11 @@ origin: risco
 # FTD — Fast-Track Development
 
 The lane ordinary work takes. Not a lighter methodology: the **same** discipline about evidence with
-none of the coordination the ten-phase chain exists to buy. One document instead of five, written
+none of the coordination `asdd` exists to buy. One document instead of five, written
 because the work might be interrupted, not because somebody has to approve it first.
 
 You are here because the decisor in `../suggest/SKILL.md` ruled that this turn authorises a change
-and did not select `../sdd/SKILL.md`. If it is still a question, you are in the wrong place: go back
+and did not select `../asdd/SKILL.md`. If it is still a question, you are in the wrong place: go back
 and answer it.
 
 ## Why this lane exists
@@ -24,7 +24,7 @@ riesgo. Silencio para lo trivial, ceremonia solo donde el fallo es caro. Un sist
 80% inofensivo acaba apagado, y apagado no protege el 20% que importa.»*
 
 The harness spent a long time contradicting it — every request that sounded like building went
-through ten phases. This lane is that principle finally implemented, not a new idea.
+through the whole chain. This lane is that principle finally implemented, not a new idea.
 
 ## The feature document
 
@@ -60,6 +60,20 @@ the test output, the command's result, the page rendering. A task whose check wa
 could not run is recorded as such, honestly. The tenth principle applies here exactly as it does in
 the chain: a result asserted without evidence is treated as not done.
 
+## The minimal loop — per change that writes code
+
+The lane inherits ASDD's per-task loop, cut to its floor:
+
+1. **Self-check** — run the change's own check and record the output under Evidence.
+2. **`npx @ericrisco/rsc risk`** — the tier of what changed (same path table as the sello; works
+   with it off).
+3. **Tier ≥ 1 → one fresh-context reviewer** (`../review/SKILL.md`, per-task mode). Tier 0 → none.
+4. **Mandatory controls** — tests, build, the security scan the project has. What did not run is
+   written «not executed», never left blank.
+
+**Escalate to `asdd`** when `rsc risk` says **tier 2**, or when the change contradicts a decision
+already recorded in `decisions.md`: the feature document becomes its spec input, as below.
+
 ## Isolation
 
 Where the work runs follows the project's decision (asked at install: «main» or «ramas y PR»; rsc
@@ -83,10 +97,10 @@ cleanup is automatic and you do not run anything.
 
 ## Growing out of the lane
 
-A feature that turns out to need the chain is **promoted, not restarted**: the feature document
-becomes the input to `../specify/SKILL.md`, and no completed work is discarded. Promotion happens for
-the same reason the chain is ever entered — durable artifacts would remove a substantial ambiguity —
-and never because the work turned out to be big.
+A feature that turns out to need `asdd` is **promoted, not restarted**: the feature document
+becomes the input to `../specify/SKILL.md`, and no completed work is discarded. Promotion happens
+when durable artifacts would remove a substantial ambiguity, or by the escalation above (tier 2, a
+contradicted decision) — never because the work turned out to be big.
 
 ## Anti-patterns → STOP
 
@@ -96,13 +110,15 @@ and never because the work turned out to be big.
 | Check a task off because you believe it works | Observed proof or it is not done (P10). Record the check you could not run. |
 | Write the document into the code repository | It belongs in `02-DOCS`. A clone should get code, not notes. |
 | Open a worktree "to be safe" | That is the chain's ceremony arriving through the back door (P7). |
-| Escalate to the chain because the change is large | Size never selects it. Only unresolved ambiguity that artifacts would settle. |
+| Escalate to `asdd` because the change is large | Size never selects it. Only unresolved ambiguity, tier 2, or a contradicted decision. |
+| Skip the reviewer because the change looks safe | `rsc risk` decides, not the feeling. Tier ≥ 1 gets one. |
 | Produce a spec, plan or task artifact here | Those are the chain's. This lane has one document. |
 
 ## See Also
 
 - `../suggest/SKILL.md` — the decisor that routed here, and the other two lanes.
-- `../sdd/SKILL.md` — the ten-phase chain, for when artifacts genuinely earn their cost.
+- `../asdd/SKILL.md` — the full method, for when artifacts genuinely earn their cost.
+- `../review/SKILL.md` — the reviewer the minimal loop calls at tier ≥ 1.
 - `../verify/SKILL.md` — the evidence gate, when this lane's checks need the full battery.
 - `../debug/SKILL.md` — a failure to reproduce before fixing; comes back here afterwards.
 

package/skills/ftd/evals/cases.yaml

@@ -3,7 +3,7 @@ skill: ftd
 # Cases for FTD — Fast-Track Development, the lane ordinary authorised change takes.
 # FTD keeps ONE feature document per feature in 02-DOCS (intent, scope, checklist,
 # evidence, next step), checks tasks off only against observed proof, and branches when
-# the work writes code. It is NOT the ten-phase chain (sdd), NOT the classification
+# the work writes code. It is NOT the full method (asdd), NOT the classification
 # itself (the decisor lives in the always-on suggest body), and NOT a request for
 # information — those write nothing at all.
 

package/skills/ftd/evals/routing.json

@@ -3,7 +3,7 @@
   "lanes": {
     "answer": "information only; writes nothing, creates no artifact",
     "ftd": "authorised change, ordinary; one feature document",
-    "sdd": "the ten-phase chain, entered by the agent for big or complex work"
+    "asdd": "the ASDD chain (review inside every task), entered by the agent for big or complex work"
   },
   "cases": [
     { "request": "¿Por qué el login tarda tanto en producción?", "expect": "answer", "why": "investigation; nothing authorises a change" },
@@ -17,8 +17,8 @@
     { "request": "Renombra la tabla de usuarios en las 40 llamadas que la usan", "expect": "ftd", "why": "large and mechanical: size alone must never select the chain" },
     { "request": "Sube la versión de la dependencia y arregla lo que rompa", "expect": "ftd", "why": "authorised change with no unresolved design question" },
     { "request": "Migra los tres endpoints al nuevo formato de respuesta", "expect": "ftd", "why": "many files, but nothing a spec would settle that the code does not" },
-    { "request": "Quiero especificar bien el sistema de permisos antes de tocar nada", "expect": "sdd", "why": "explicit request for the chain" },
-    { "request": "Vamos a hacer una spec de esto", "expect": "sdd", "why": "explicit request, stated in the user's own words" },
-    { "request": "No tengo claro si los permisos van por rol o por recurso, y afecta al esquema, a la API y a la UI", "expect": "sdd", "why": "enter the chain: several interlocking decisions that durable artifacts would settle; the agent enters it and says why" }
+    { "request": "Quiero especificar bien el sistema de permisos antes de tocar nada", "expect": "asdd", "why": "explicit request for the chain" },
+    { "request": "Vamos a hacer una spec de esto", "expect": "asdd", "why": "explicit request, stated in the user's own words" },
+    { "request": "No tengo claro si los permisos van por rol o por recurso, y afecta al esquema, a la API y a la UI", "expect": "asdd", "why": "enter the chain: several interlocking decisions that durable artifacts would settle; the agent enters it and says why" }
   ]
 }

package/skills/go/SKILL.md

@@ -12,7 +12,7 @@ Targets **Go 1.22+** (Go 1.26 is the current stable release): enhanced `net/http
 (`mux.HandleFunc("GET /users/{id}", h)` + `r.PathValue`), `log/slog` structured
 logging, and fixed loop-variable semantics (no more `tt := tt`).
 
-> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../asdd/SKILL.md`.
 
 ## Boundary
 

package/skills/implement/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: implement
-description: "Use when an approved plan and task list exist and it is time to turn them into working, tested code — the SDD phase after `analyze` and before `verify`. Enforces TDD: a failing test comes before the code that makes it pass, one task at a time, appended to a progress ledger that survives compaction. Delegates test tooling to the stack skill and fans disjoint tasks out via `parallel`. NOT spec writing (that is `specify`), NOT planning (that is `plan`), NOT the final lint/test/audit gate (that is `verify`)."
-tags: [sdd, implement, code]
-recommends: [verify]
+description: "Use when an approved plan and task list exist and it is time to turn them into working, reviewed code — ASDD stage 4, the per-task loop after `analyze`: TDD build and self-check, `rsc risk` on the diff, review scaled by tier (0/1/3 reviewers), mandatory controls (tests, build, security, traceability), at most 3 fix rounds, then fix-and-record or park in the decision queue. Progress ledger survives compaction; disjoint tasks fan out via `parallel`. NOT spec writing (that is `specify`), NOT planning (that is `plan`), NOT the closing whole-branch gate (stage 5: `verify` + `review`)."
+tags: [asdd, sdd, implement, code]
+recommends: [verify, review]
 profiles: [core, full]
 origin: risco
 ---
@@ -10,10 +10,11 @@ origin: risco
 # implement — turn the task list into tested code
 
 You have a spec, a plan, and an ordered task list (from `specify` → `plan` → `tasks`), and the
-`analyze` gate has cleared. This skill does the building: it walks the tasks in order, writes each
-one **test-first**, stops to show its work after every task, and records the decisions it makes
-along the way. It is the *intent → shipped code* engine's hands — `verify` is the gate that comes
-after, not part of this skill.
+`analyze` gate has cleared. This skill is **ASDD stage 4**: it walks the tasks in order and runs each
+one through a build → risk → review → controls → fix → decide loop before the next starts. Review
+lives *inside* the task, not after the branch: tests prove the code works, not that it is what was
+asked, and an unrequested feature caught at one commit is cheap — caught under thousands of green
+tests at the end, it is not.
 
 This is a **process skill**. It owns the discipline (red → green → refactor, checkpoints, decision
 logging, constitution adherence). It does **not** own the test tooling — pytest fixtures, `go test`
@@ -51,9 +52,11 @@ back — you do not write feature code anyway.
 6. **Scan the tasks for independence.** Mark which tasks share files/state and which are disjoint.
    Disjoint clusters are candidates for `parallel`; everything else runs in order.
 
-## The loop — one task at a time
+## The loop — seven steps per task
 
-For **each task** in the list, in order (or dispatched per the parallel rule below):
+For **each task** in the list, in order (or dispatched per the parallel rule below), run a → g.
+
+### a) Build and self-check (TDD)
 
 ```text
 RED      → write the smallest failing test that encodes the task's done-check. Run it. Watch it FAIL
@@ -63,24 +66,15 @@ GREEN    → write the least code that makes that test pass. No extra features,
 TRIANGULATE → add the smallest edge-case test that proves the behavior is not hard-coded
            (only when config.testing.strict_tdd is true and the task has meaningful edge cases).
 REFACTOR → with the test green, clean up names/duplication/shape. Re-run; still green. Only now.
-CHECK    → re-read the task's done-check. Met? Constitution still honored? Decision worth logging?
-PROGRESS → append task/test/blocker/decision state to 02-DOCS/wiki/sdd/progress/<slug>.md.
 COMMIT   → commit this task as one logical unit (authorship = Eric; see ship for the rule).
-REVIEW   → dispatch a fresh reviewer subagent over THIS task's commits (see "Per-task review gate").
-           Fold its Critical/Important findings back in before you move on; Minor can wait.
-CHECKPOINT → stop and show: what changed, test output, review verdict, the next task. Wait for the user.
 ```
 
 The order is load-bearing. **Red before green** is not a suggestion — a test you write *after* the
 code tells you nothing about whether it can fail. **Refactor only on green** keeps every cleanup
-reversible against a passing bar. **Checkpoint after each task** is what makes this resumable and
-reviewable instead of a 2000-line surprise diff.
+reversible against a passing bar. Self-check means evidence: the test output you saw, not "I tested it".
 
 ### Four things you may never do to reach green
 
-The loop only means anything if green cannot be manufactured. These are absolute, and each one is a
-way people reach green without fixing anything:
-
 1. **Never weaken a test to make it pass.** Not broadening an assertion, not adding a skip, not
    raising a tolerance, not deleting it. A test that looks wrong is a **spec conversation** — surface
    it, don't bury it.
@@ -94,12 +88,82 @@ way people reach green without fixing anything:
    added to touch lines, with no meaningful assertion, is gaming — and mutation testing exists
    precisely to catch it (`../testing-py/SKILL.md`, `../testing-web/SKILL.md`, `../testing-go/SKILL.md`).
 
-### The done-check is the contract
+**The done-check is the contract.** The task's done-check **is** your first failing test. Never
+invent a looser one; done means that test is green and the traced acceptance criterion holds.
+
+### b) Risk — computed, never chosen
+
+```bash
+npx @ericrisco/rsc risk --base <task base sha> --json
+```
+
+It reads the task's **actual** diff through the sello's path table (sello on or off) and prints the
+tier, the touched classes, `reviewers: 0|1|3` and `human approval: required|not required`. Tier 2 =
+auth, billing, CI workflows, migrations, secrets, harness config. The computed tier wins over the
+task's risk forecast. **The agent never picks or argues down its own tier.**
+
+### c) Review scaled by tier — fresh context
+
+| Tier | Review |
+| --- | --- |
+| 0 | none — the controls (e) still run |
+| 1 | one fresh-context reviewer; frozen brief in `references/per-task-review.md` |
+| 2 | the three refuters (`refuter-correctness` · `refuter-security` · `refuter-tests`) in parallel, as `../review/SKILL.md` runs them |
+
+Every reviewer gets the **spec**, the **diff as a file** (`scripts/review-package <BASE> <HEAD>`, BASE
+= the task's *recorded* base sha, never `HEAD~1`), the **surrounding code** at that sha (not just the
+hunk), the task's done-check, its **Interfaces → Produces** and the plan's **§0 Global Constraints**.
+Never your session reasoning. **Anti-pre-judging (hard rule):** the dispatch never says what not to
+flag, pre-rates a severity, or explains why a choice is fine — a stated rationale never downgrades a
+finding.
+
+### d) Consolidate, verify, record
+
+Exactly as `../review/SKILL.md` → *Consolidate, then verify*: `npx @ericrisco/rsc review consolidate
+<reports…>`, then `finding-verifier` on every finding it marks `verify` (tier 1: on every blocker).
+Then `npx @ericrisco/rsc review ledger record <findings.json>`. A finding the ledger already holds
+comes back `repeat`: **never raise it again**. When a finding closes, record its outcome:
+`review ledger outcome <id> fixed|false|intentional|irrelevant`.
+
+### e) Mandatory controls — every tier
+
+These are `verify`'s per-task mode (`../verify/SKILL.md`):
+
+- **Tests** — the affected suite, not just the new test (`testing.commands.apply`).
+- **Build** — the project compiles and type-checks.
+- **Security** — the stack's audit; `../secure-coding/SKILL.md` when input, authz or secrets are touched.
+- **Traceability** — every new behaviour in the diff traces to a spec acceptance criterion.
+  **Untraced behaviour is a finding.** This is the control that catches the unrequested feature: a
+  QR nobody asked for passes every test.
+
+A control that did not run is reported as **not run**, never as passed — and the task is not done.
+
+### f) Fix loop — at most 3 rounds
 
-Each task carries a done-check from the `tasks` phase ("returns 409 on duplicate email", "list
-renders empty state when zero items"). That sentence **is** your first failing test. Do not invent a
-looser check, and do not mark a task done because the code "looks right" — done means the done-check's
-test is green and the relevant acceptance criterion in the spec is satisfied.
+Each round opens with `npx @ericrisco/rsc review ledger round <slug>/<task>`. It exits non-zero on the 4th
+round with the action to take; obey it (step g).
+
+- **From round 2, re-review only the new diff** (BASE = the previous round's head).
+- **Fix the bug class, not the line**: name the class and fix every instance in the task's scope.
+- **Never repeat a finding** — the ledger marks repeats; drop them.
+- Re-run the controls (e) before the next round.
+
+### g) Decide
+
+| Situation | Action |
+| --- | --- |
+| Trivial, or no business weight | Fix it and record it in `decisions.md` with the task id |
+| Tier 2, contradicts a decision in `decisions.md`, or no convergence in 3 rounds | Park the task in the **decision queue** and continue with independent tasks |
+
+The **decision queue** is a `## Decision queue` section in `02-DOCS/wiki/sdd/progress/<slug>.md`, one
+entry per parked task: task id, tier, the question, the options, your recommendation, the evidence
+path. Tasks that depend on a parked task wait; the rest continue. Only a human empties the queue — an
+agent's approval never counts as human.
+
+Then append the progress entry and show the checkpoint (below).
+
+**`verify` and `review` run twice.** Per task, inside this loop (steps c–e); and once more at
+**closing** (stage 5), over the whole branch against main.
 
 ## Delegating the test tooling (do not reinvent it)
 
@@ -118,27 +182,10 @@ stack and pulls that stack's testing reference — you do not mix idioms inside
 
 ## Skill digestion and resolution
 
-When a task or subagent needs skill context, use the registry path from config:
-
-```text
-.rsc/skill-registry.json
-```
-
-Select the smallest set of skills that match the task. Digest each selected skill into 4-5 compact rules that affect this task. A task brief or checkpoint includes:
-
-```text
-Selected skills: fastapi, postgresdb, implement
-Compact rules:
-- Use the configured apply command from config.yaml.
-- Red test first; verify it fails for the right reason.
-- Keep DB migrations expand-contract when touching production tables.
-Skill resolution:
-- used: [...]
-- missing: [...]
-- fallback: [...]
-```
-
-If a skill is referenced but unavailable, say so and record the fallback. Do not silently pretend it was used.
+Select the smallest set of skills from `.rsc/skill-registry.json` that match the task and digest
+each into 4-5 compact rules. Every task brief or checkpoint carries `Selected skills`, `Compact
+rules` and `Skill resolution` (`used` / `missing` / `fallback`). A referenced skill that is
+unavailable is named with its fallback — never silently pretended.
 
 ## Apply progress
 
@@ -157,8 +204,10 @@ Entry shape:
 - green: same test passed
 - triangulation: blank title returns 422
 - files: app/auth.py, tests/auth/test_login.py
-- decision: none
-- blocker: none
+- risk: tier 2 (auth) — 3 refuters
+- review: 5 reported → 2 unique → 1 confirmed (fixed, round 2)
+- controls: tests ✅ build ✅ security ✅ traceability ✅ (AC3)
+- decision: parked in decision queue (tier 2)
 ```
 
 This file is what makes resumes and archive reliable. Never rewrite old entries; append corrections as new entries.
@@ -194,7 +243,7 @@ discipline inside each branch.
 pinned to the balanced tier (Sonnet by default, chosen at onboarding, never `light`). When you
 delegate a task or fan out via `parallel`, dispatch it to that agent (e.g. Claude Code
 `subagent_type: developer`) so the bulk of TDD execution runs on the cheaper-but-capable model
-while you stay on the session model to orchestrate. Full rationale: `../sdd/references/model-routing.md`.
+while you stay on the session model to orchestrate. Full rationale: `../asdd/references/model-routing.md`.
 
 ### The dispatch contract (carriers, statuses, escalation)
 
@@ -220,51 +269,19 @@ each dispatch self-sufficient and make its return machine-checkable:
   escalate the tier (balanced → heavy) for a genuinely hard sub-problem. Re-running an identical
   prompt on an identical model is how a loop burns budget without progress.
 
-## Per-task review gate
-
-After a task is committed and before its checkpoint, run a **small, fresh-eyes review of that task
-alone** — catching over-/under-building while it is one commit cheap to fix, instead of waiting for
-the whole-branch review when it is buried in a large diff. It is a mid-build gate, not the finish
-line (see the boundary below).
-
-How to run it:
-
-1. **Package the diff as a file, not a paste.** `scripts/review-package <BASE> <HEAD>` where `BASE`
-   is the task's *recorded* base sha (never `HEAD~1` — that drops every commit but the last of a
-   multi-commit task). It writes the commit list + `--stat` + full diff to one file.
-2. **Dispatch a fresh reviewer subagent** (context-isolated — it must NOT inherit your session
-   reasoning). Hand it: the review-package *path*, the task's **done-check**, the task's
-   **Interfaces → Produces** contract, and the plan's **§0 Global Constraints**. With routing on,
-   balanced is the floor; escalate to heavy for a risky/security-touching task. The frozen brief
-   lives in `references/per-task-review.md`.
-3. **It returns two verdicts in one pass:** *spec compliance* (missing / extra / misunderstood vs the
-   done-check + Produces) and *code quality* — every finding tagged severity
-   (`Critical`/`Important`/`Minor`) with `file:line` evidence.
-4. **Fold `Critical`/`Important` back in now**; `Minor` may wait for the end-of-branch review.
-
-**Anti-pre-judging (hard rule).** The dispatch must never tell the reviewer what *not* to flag,
-pre-rate a finding's severity, or explain why a choice is fine ("the plan chose X, treat as Minor").
-A stated rationale never downgrades a finding — that is laundering your own bias through the reviewer.
-Hand it the evidence and the contract; let it judge.
-
-**Boundary — this does not replace the end gates.** `verify` still runs the *whole* suite and the
-acceptance criteria once at the end, and `review` still reads the *whole* diff adversarially once
-before `ship`. The per-task gate is the cheap early pass; the broad reviews remain. Skip the per-task
-gate on a genuinely trivial task (a one-line change), like the rest of the chain.
-
 ## Model tier — `balanced` (opt-in routing)
 
-This phase's default model tier is **`balanced`** — it is the bulk of TDD execution: cost-sensitive, with quality balanced handles well. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../sdd/references/model-routing.md` — announce the switch in one line when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model (this is where routing pays off most — fan-out runs on `balanced` while a hard sub-problem can be escalated to `heavy`). Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change.
+Default tier **`balanced`** — the bulk of TDD execution. Routing is **off** unless `models.enabled:
+true` in `02-DOCS/wiki/sdd/config.yaml`; when on, resolve and apply it per
+`../asdd/references/model-routing.md` (fan-out on `balanced`, a hard sub-problem escalated to
+`heavy`). Routing off → honor the session model silently.
 
 ## Checkpoints — what to say
 
-Speak in the `orient` voice, in the register `technical_level` sets. At each checkpoint show: the
-task, tests green or red, the one *why* behind any non-obvious choice, and the next task. Ask only
-where the plan genuinely forked, and confirm before deviating from the plan or doing anything
-irreversible.
-
-How short you are **never** changes the engineering. TDD, the done-checks, the constitution and
-decision logging hold for every reader.
+In the `orient` voice and the `technical_level` register, show: the task, tier, review verdict
+(reported → unique → confirmed), controls (passed / **not run**), rounds, the *why* of any
+non-obvious choice, and the next task. Ask only where the plan forked; confirm before deviating or
+anything irreversible. In autopilot, log it and continue. Brevity never changes the engineering.
 
 ## Logging decisions (the 02-DOCS trail)
 
@@ -299,13 +316,14 @@ outranks the plan, and the plan outranks your in-the-moment preference.
 | "I'll write the tests after, once the code settles" | Then the test only confirms what you built, not what was asked. Red first, always. |
 | "This task is trivial, skip the failing test" | Trivial code breaks too, and the next task may lean on it. Smallest red test still goes first. |
 | "I'm here anyway, I'll also fix that other thing" | Scope creep buries the diff and breaks the done-check contract. One task, one commit. |
-| "The test passed first try without ever being red" | It tests nothing. Make it fail on purpose, then make it pass. |
 | "I'll batch ten tasks into one big commit to save time" | You just made the work unreviewable and un-resumable. One logical unit per task. |
 | "The constitution's rule doesn't fit here, I'll bend it" | The constitution outranks you. Surface the conflict; don't bend it silently. |
 | "These two tasks touch the same file but I'll parallelize anyway" | Shared file = shared state = merge pain and lost work. Serialize them. |
-| "Refactor now, the test is still red" | Never refactor on red — you can't tell a cleanup from a regression. Get green first. |
 | "I'll mark it done, the code looks correct" | Done = the done-check's test is green and the acceptance criterion holds. Looks ≠ green. |
 | "I'll just write the .env so the integration test runs" | Never. Secrets are the user's; mock/stub the boundary or use a test fixture. |
+| "This diff is obviously low-risk, skip the review" | The tier is `rsc risk`'s, not yours. Run it and obey it. |
+| "The security scan didn't run, but nothing changed there" | Report it **not run**. The task is not done. |
+| "Round 4 will crack it" | The ledger stops at 3. Park the task; continue with independent ones. |
 
 ## Red flags — stop and re-route
 
@@ -324,16 +342,14 @@ outranks the plan, and the plan outranks your in-the-moment preference.
 ## Checklist (copy per task)
 
 ```text
-- [ ] Read the task's done-check; it is my first test's assertion
-- [ ] RED: smallest test written, run, fails for the RIGHT reason
-- [ ] GREEN: least code to pass; test now green
-- [ ] REFACTOR: cleaned up on green; still green
-- [ ] Constitution honored; no banned pattern introduced
-- [ ] Non-obvious decision (if any) logged to 02-DOCS/wiki/sdd/decisions.md
-- [ ] Apply progress appended to 02-DOCS/wiki/sdd/progress/<slug>.md
-- [ ] Skill resolution recorded (used/missing/fallback/compact rules)
-- [ ] Committed as one logical unit (authorship = Eric)
-- [ ] Checkpoint shown in the orient voice; next task named
+- [ ] a) RED for the right reason → GREEN → REFACTOR; committed as one unit (authorship = Eric)
+- [ ] b) `rsc risk` on the task diff; tier recorded
+- [ ] c) review by tier, fresh context, spec + diff + surrounding code, no pre-judging
+- [ ] d) `review consolidate` + `finding-verifier`; `review ledger record`
+- [ ] e) tests, build, security, traceability — each passed or **not run**
+- [ ] f) `review ledger round <slug>/<task>` each round; ≤ 3; class fixed, no repeats
+- [ ] g) fixed + logged in decisions.md, or parked in the decision queue
+- [ ] Progress entry appended; skill resolution recorded; checkpoint shown
 ```
 
 ## Result envelope
@@ -343,7 +359,7 @@ End every implementation checkpoint or completed batch with:
 ```json result-envelope
 {
   "status": "complete",
-  "executive_summary": "Implemented task(s) with red/green/triangulate/refactor evidence.",
+  "executive_summary": "Implemented task(s): red/green evidence, tier, review, controls, decision-queue state.",
   "artifact": "02-DOCS/wiki/sdd/progress/<slug>.md",
   "next_recommended": "implement|verify",
   "risk": "low|medium|high",
@@ -351,31 +367,28 @@ End every implementation checkpoint or completed batch with:
     "used": ["implement"],
     "missing": [],
     "fallback": [],
-    "compact_rules": ["Use config testing commands.", "Append progress after every task."]
+    "compact_rules": ["Tier comes from rsc risk, never the agent.", "Max 3 fix rounds; park, don't loop."]
   },
-  "evidence": ["red test output", "green test output", "progress entry path"]
+  "evidence": ["red/green output", "rsc risk output", "ledger record", "controls", "progress entry path"]
 }
 ```
 
 ## What this skill is NOT
 
-- **Not the lint/type/audit gate.** Per-task tests prove the task; the *whole-suite* run plus
-  lint/type/security audit and acceptance-criteria sign-off is `verify`'s job. Don't claim the
-  feature is done here — that claim belongs to `verify`, on evidence.
+- **Not the closing gate.** The per-task controls prove each task; the whole branch against main,
+  the rollback plan and the human explanation are stage 5 (`verify` closing mode, `review`, `ship`).
 - **Not spec or plan writing.** If you find the plan is wrong mid-build, stop and amend it via
   `plan`; don't silently re-architect inside a commit.
 - **Not the deep-debug protocol.** When a test fails for a reason you don't understand, switch to
   `debug` (reproduce → isolate → hypothesize → fix → verify) instead of guessing.
 
-## Where you are in the chain
+## Where you are in ASDD
 
-`constitution` → `specify` → `clarify` → `plan` → `tasks` → `analyze` → **implement** → `verify` →
-`review` → `ship`. On-demand from here: `debug` (a test fails mysteriously), `worktrees` (need
-isolation), `parallel` (independent tasks to fan out).
+Base → Spec → Plan (`plan` · `tasks` · `analyze`) → **Build loop (this skill)** → Close (`verify` ·
+`review` · `ship`) → Learn. On demand: `debug`, `worktrees`, `parallel`. Front door: `../asdd/SKILL.md`.
 
-**Next:** when every task's done-check is green and committed, go to `verify` — run the stack skill's
-`scripts/verify.sh`, confirm the spec's acceptance criteria, and let evidence (not assertion) declare
-the feature done.
+**Next:** when every task is done or parked, go to stage 5 — `verify` in closing mode over the whole
+branch. Parked tasks travel in the decision queue for the human.
 
 ## Orientación (siempre)