@gtrabanco/pi-agentic-workflow 0.19.0 → 0.20.0

package/README.md

@@ -246,9 +246,13 @@ dialog.
 
 ## Notes
 
-- Verified against Pi 0.99.1 (2026-09-29) (`pi install`, package skills, friendly
+- Verified against the peer floor Pi 0.99.1 (2026-09-29) (`pi install`, package skills, friendly
   command registration, routed set/clear, settings console round-trip, `sendUserMessage`
-  with prompt template expansion).
+  with prompt template expansion). Also verified against Pi 1.2.0 (2026-10-14) via a local
+  two-leg `tsc --noEmit` run (legs `0.99.1` + `latest`, the `latest` leg resolving to pi
+  1.2.0; COMPAT-OK); continuously against the
+  `latest` dist-tag by the `pi-compat-guard` PR gate (the leg is a moving tripwire,
+  not a pinned version — a breaking release shows red here first).
 - The package declares Pi as a peer dependency; it bundles no copy of Pi.
 - Skills can instruct the model to run commands. Review them as you would any
   third-party package.

package/dist/extension/index.js

@@ -284,12 +284,16 @@ export default function extension(pi) {
         });
         return decision.block ? { block: true, reason: decision.reason } : undefined;
     });
-    pi.on("agent_settled", (_event, ctx) => {
-        void router.settle(toInvocationContext(ctx));
+    pi.on("agent_settled", (event, ctx) => {
+        // pi 1.1.0+: event may carry { aborted: true }
+        const aborted = event?.aborted === true;
+        void router.settle(toInvocationContext(ctx), aborted);
         // Terminal hygiene is said out loud once the turn is over; a clean tree
         // stays silent. The probe is time-bounded (2000 ms) and swallows timeout,
         // spawn error and non-zero status, so an unresponsive git can never park
         // the settled turn — best-effort by construction (issue #182 F4).
+        // The dirty-worktree warning still fires on abort (an aborted run is exactly
+        // when half-applied edits can be left behind).
         const warning = guards.dirtyWorktreeWarning(readGitStatusBounded(ctx.cwd));
         if (warning)
             ctx.ui.notify(warning, "warning");

package/dist/routing/dispatch.d.ts

@@ -29,7 +29,7 @@ export interface Router<M extends ModelRef = ModelRef> {
     /** Pi `thinking_level_select` — same distinction for the thinking level. */
     noteThinkingLevelSelect(level: ThinkingLevel): void;
     /** Pi `agent_settled` — restores whatever this turn still owns. */
-    settle(ctx: InvocationContext<M>): Promise<void>;
+    settle(ctx: InvocationContext<M>, aborted?: boolean): Promise<void>;
     /** True while a routed turn owns the session. The console shows and clears it. */
     inFlight(): boolean;
     /**

package/dist/routing/dispatch.js

@@ -79,13 +79,20 @@ export function createRouter({ surface, loadConfig, hint, settingsCommand, known
             await restore(turn, surface(ctx), ctx, `undo: nothing was dispatched by /${turn.command}`);
             return true;
         },
-        async settle(ctx) {
+        async settle(ctx, aborted) {
             const turn = pending;
             if (!turn)
                 return;
             // Cleared first: the restore fires its own select events, and a turn that is
             // already over must not read them as operator changes.
             pending = undefined;
+            // `aborted`: pi 1.1.0 added `agent_settled.aborted` to distinguish a
+            // cancelled run from a finished one. An aborted turn is cleared without
+            // restoring the snapshot — an interrupted run must not silently swap the
+            // session model underneath the operator, matching the backing-off stance
+            // for an operator mid-turn change (AC7, pi 1.1.0 scope extension).
+            if (aborted)
+                return;
             // `keep`: leave the routed model and thinking level in the open chat window,
             // so a follow-up edit or question keeps running on the model that planned it.
             // The operator's own mid-turn choice is still untouched (nothing is restored,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gtrabanco/pi-agentic-workflow",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Pi package: canonical agentic-workflow skills, friendly slash commands, and per-command model routing.",
   "keywords": [
     "pi-package",
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@gtrabanco/agentic-workflow": "0.2.0",
-    "@gtrabanco/agentic-workflow-schema": "4.5.0"
+    "@gtrabanco/agentic-workflow-schema": "4.6.0"
   },
   "devDependencies": {
     "@types/node": "24.13.3",

package/skills/audit-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: audit-pr
 user-invocable: true
-version: 5.4.0
+version: 5.6.0
 argument-hint: <pr-number> (optional — defaults to the current branch's PR)
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -120,9 +120,20 @@ gh pr view <N> --json headRefOid,comments
   review evidence, then evaluate the delivery gates below.
 - **absent** — no matching marker on the PR → **BLOCKER**: no review evidence at
   the head; route to `/review-change`.
-- **stale** — a marker exists but its `sha` does not equal `headRefOid`. Any SHA
-  mismatch voids the receipt → **BLOCKER**: route to `/review-change` for a
-  re-review. Do not use a local `git diff` to override the PR-head comparison.
+- **stale** — a marker exists but its `sha` does not equal `headRefOid`. Before
+  voiding, apply the scope-aware judge (fix/286, #182 AC 3/9): a receipt that
+  recorded a scope manifest (`scope=<64-hex>` in the marker) stays **current**
+  when the head delta (receipt sha → head, `git diff --name-only`) touches only
+  non-affecting paths — the closed classes (session log `docs/LOGS.md`, agent
+  toolstate/memory `.engram/`, `.pi/`, `.serena/`) are owned by
+  `scripts/scope-manifest.mjs`; any path matching no named class is affecting.
+  Run `bun scripts/review-receipt.mjs verify --pr <N>` — it computes the delta
+  locally and answers `current` (exit 0) or `stale` (exit 4, naming the
+  affecting paths). A legacy receipt without a scope attribute, an affecting
+  delta, or an unresolvable delta voids the receipt → **BLOCKER**: route to
+  `/review-change` for a re-review. Do not use a local `git diff` to override
+  the PR-head comparison — the delta check only ever *keeps* a scoped receipt
+  current; it never manufactures currency for a scope-less one.
 
 Never compose, reconstruct, or "spot-check" the review from the diff to clear a
 missing/stale receipt — that is `review-change`'s turn, and re-litigating axes

package/skills/audit-pr/references/02_CLOSURE_AND_SCOPE_GATES.md

@@ -88,16 +88,57 @@ This gate sits downstream of both pre-execution reviews, so it verifies their
 authority **survived the build** — it never re-reviews a plan and never re-judges a
 verdict:
 
-1. **Upstream lineage is current.** The unit's `progress.md` carries
-   `## Pre-execution review receipt v1 — plan` whose digest re-derives identically
-   (`scripts/pre-execution-snapshot.mjs verify --stage plan --parent <the receipt's
-   Product digest>`; a fix unit binds no parent —
-   `structural.reasonCode`/`changedPaths` name the drifted dimension), and — for a
-   feature unit — its named `— spec` parent re-derives the same way. Bound artifacts
-   are frozen: new implementation-phase files are allowed, edits to a bound artifact
-   are not. Stale, missing, wrong-stage **or impossible-timeline** lineage → **BLOCKED**,
-   `→ Next: /unit-lane <unit>` (the lane's `review` step re-derives the artifact). A `SPEC-REVIEW-PASS` never satisfies the plan hop, and vice versa.
-2. **Obligations are closed.** Every row of the unit's obligation ledger is
+1. **Upstream lineage is current** — run the machine check and read its fixed
+   verdict; the gate never re-implements the check by hand:
+   `bun scripts/unit-lineage.mjs --unit <unit>` prints exactly one of
+   `LINEAGE OK — legacy …` / `LINEAGE OK — lane-era …` (pass) or
+   `LINEAGE BLOCKED — <reason>` followed by a `→ Next:` route (**BLOCKED** —
+   that route). The check keys the lane-era/legacy split on evidence, not on an
+   author-controlled artifact (fix/285; the lane-era pipeline structurally never
+   writes `progress.md` or `ACCEPTANCE.md`, so demanding them made the gate
+   unsatisfiable for every lane-era unit — issue #285):
+   - **Legacy path** — opened only when the unit's `progress.md` carries a
+     `## Pre-execution review receipt v1 — plan` whose digest **re-derives**
+     (`scripts/pre-execution-snapshot.mjs verify --stage plan` exits 0 over the
+     bound bytes): the unit's
+     `progress.md` carries
+     `## Pre-execution review receipt v1 — plan` whose digest re-derives
+     identically (`scripts/pre-execution-snapshot.mjs verify --stage plan
+     --parent <the receipt's Product digest>`; a fix unit binds no parent —
+     `structural.reasonCode`/`changedPaths` name the drifted dimension), and —
+     for a feature unit — its named `— spec` parent re-derives the same way.
+     The acceptance manifest binds when present (fix/285): a unit that carries
+     `ACCEPTANCE.md` still binds it in the snapshot. Bound artifacts
+     are frozen: new implementation-phase files are allowed, edits to a bound
+     artifact are not. A receipt that does not re-derive — stale, missing,
+     wrong-stage **or impossible-timeline** — is never a pass: the check falls
+     through to the lane-era path, so a planted or stale `progress.md` cannot
+     buy a weaker gate (and a unit doc with no lane-era surface left is then
+     **BLOCKED**, `→ Next: /unit-lane <unit>`).
+   - **Lane-era path** (feature 61's single-doc contract) — the unit doc's
+     Evidence section carries the `## Triaged steps` block whose `Steps:` /
+     `Skipped:` / `Budget:` lines re-derive identically from the doc's own
+     facts (`bun scripts/unit-route.mjs --triage <unit>`), and the obligation
+     ledger carries ≥1 row with every row `verified` or an explicit
+     `n/a: <reason>` (see item 2 for the ledger shapes). This comparison binds
+     the unit doc's **bytes**: the triage output is a pure function of the
+     doc's content, so any tampering — with the pasted block *or* with the
+     facts (Tasks, scope, tests) the block is derived from — changes the
+     re-derived lines and the check answers **BLOCKED**,
+     `→ Next: /unit-lane <unit> --retriage`. No separate digest surface is
+     needed (the earlier "frozen digest anchor" wording claimed
+     `unit-route.mjs --triage` emits a digest of the pasted block; it never
+     did, and the paragraph is retracted — review finding F9). An absent or
+     empty obligation ledger is a producer defect, not an audit pass: the
+     lane's plan step writes the ledgers (see item 2), and a vacuous ledger
+     cannot demonstrate closure — **BLOCKED**, `→ Next: /unit-lane <unit>`; if
+     there are truly no obligations, the ledger carries a single
+     `n/a: <reason>` row.
+   A `SPEC-REVIEW-PASS` never satisfies the plan hop, and vice versa.
+2. **Obligations are closed.** Every row of the unit's obligation ledger —
+   `### Obligations` inside the unit doc (embedded shape) or
+   `planning-obligations.md` (separate-file shape, per the sizing rule in
+   `pre-execution-review`'s `LEDGERS.md`; never both) — is
    `verified` — with the validator that ran on this candidate — or an explicit
    `n/a: <reason>`. Any `planned`, `in-progress`, blank, or `deferred` row is
    **BLOCKED**, naming the ids. `deferred` is legal only when the user amended the

package/skills/execute-phase/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: execute-phase
 user-invocable: true
-version: 5.0.1
+version: 5.1.0
 argument-hint: <NN-slug> [P<k>|step] [--max-attempts N] [--force]
 allowed-tools: [Bash, Read, Edit, Write, MultiEdit]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
@@ -39,7 +39,8 @@ done:
 ✓ Unit doc read and step selected (explicit P<k> or first unfinished)
 ✓ Step executed and committed (one commit per step, conventional format)
 ✓ Evidence rows updated (command → exit/digest → output → verified-by)
-✓ Progress log updated with a dated `YYYY-MM-DD HH:MM` entry (what, commit, next)
+✓ Progress log updated with a dated `YYYY-MM-DD HH:MM` entry that names the
+  phase id (what, commit, next)
 ✓ Diff guard passed (on implement steps) — see `diff-guard` in PREFLIGHT.md
 ✓ → Next: block printed as the absolute last output
 ```
@@ -139,10 +140,13 @@ After each step: run the project's verification gate (type-check + tests + build
 ### 7. Whole-unit mode
 
 When invoked as `<NN-slug>` with no step: loop all remaining steps, one commit
-each. After each step: gates, execute, diff guard (if implement), evidence/
-progress update, commit. Skip intermediate review checkpoints; the mandatory end
-review covers the full accumulated diff. On gate red at any step: repair that
-step (up to `--max-attempts`), then continue the loop. Terminal:
+each. This is an **explicit operator choice only** — the lane's hand-offs
+always name exactly one phase (`<NN-slug> P<k>`), so a bare `<NN-slug>` from a
+lane hand-off is a defect; re-read the hand-off before looping. After each
+step: gates, execute, diff guard (if implement), evidence/progress update,
+commit. Skip intermediate review checkpoints; the mandatory end review covers
+the full accumulated diff. On gate red at any step: repair that step (up to
+`--max-attempts`), then continue the loop. Terminal:
 
 ```text
 UNIT LOOP — <unit> COMPLETE
@@ -195,12 +199,17 @@ These files must be loaded when their topic is active:
 
 ## Relationship to other skills
 
-`unit-lane` conducts (triage → steps → doc updates); this executes (one step at a
-time or all remaining). `fold-findings` handles review finding repairs. The review
-pack axes (`review-implementation`, `review-code`, `review-security`, `review-perf`,
+`unit-lane` conducts (triage → judgment steps → close-out ladder) and hands
+execution off **one phase per turn** (`<NN-slug> P<k>` with the catalog tier);
+this executes the named phase — or, as an explicit operator choice only, all
+remaining steps. The closing hand-off names exactly one phase and the tier
+while phases remain, and resumes the lane after the last one.
+`fold-findings` handles review finding repairs. The review pack axes
+(`review-implementation`, `review-code`, `review-security`, `review-perf`,
 `review-a11y`, `review-debt`) compose the review step; `workflow-status` routes
-here. `triage-issue` feeds issues into the lane. This skill is the **step executor**
-a turn invokes to perform one triaged step of a unit under the full gate machinery.
+here. `triage-issue` feeds issues into the lane. This skill is the **step
+executor** a turn invokes to perform one triaged step of a unit under the full
+gate machinery.
 
 ## Portability (agents other than Claude Code)
 
@@ -215,15 +224,30 @@ a turn invokes to perform one triaged step of a unit under the full gate machine
 
 ## Done when
 
-- Requested scope is implemented (all remaining steps, one explicit step), gate
-  is green, unit doc Evidence/Progress are current, and the work is committed.
+- Requested scope is implemented (the named phase, or all remaining steps in an
+  explicit operator run), gate is green, unit doc Evidence/Progress are current
+  (the Progress entry names the phase id), and the work is committed.
 - **The closing `→ Next:` block is printed.**
 
 ## Closing recommendation
 
+Exactly one end-state applies — pick by the unit's Tasks section, never print a
+phase id the Tasks section does not define:
+
+Phases remain:
+
+```
+→ Next: /execute-phase <NN-slug> P<k+1> (tier: <tier>) — one phase per turn; <tier> is the catalog's implement entry
+  · whole-unit operator run complete → /review-change (mandatory end review)
+  · findings (REVIEW-FAIL) → /fold-findings repairs them; a fresh /review-change follows the fold
+  · merge gate after REVIEW-PASS → /audit-pr — the merge gate
+```
+
+The last phase just closed (a lane-run unit):
+
 ```
-→ Next: /unit-lane <NN-slug> — the conductor continues with the next triaged step
-  · all steps done → /review-change — the mandatory end review
+→ Next: /unit-lane <NN-slug> — resume the conductor for the remaining judgment steps
+  · whole-unit operator run complete → /review-change (mandatory end review)
   · findings (REVIEW-FAIL) → /fold-findings repairs them; a fresh /review-change follows the fold
   · merge gate after REVIEW-PASS → /audit-pr — the merge gate
 ```

package/skills/pre-execution-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pre-execution-review
 user-invocable: false
-version: 2.6.0
+version: 2.7.0
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
 description: >

package/skills/pre-execution-review/references/SNAPSHOT.md

@@ -28,9 +28,15 @@ digest at all; the fixed form that stands in the digest's place is each stage's
 
 Rules the builder enforces and no caller may improvise around:
 
-- **`SPEC.md` and `ACCEPTANCE.md` are required** for their stage: a missing one is
+- **`SPEC.md` is required** for its stage: a missing one is
   refused, not silently dropped, because dropping it would bind a smaller set than
   the contract reviewed.
+- **`ACCEPTANCE.md` binds when present** (fix/285): the acceptance manifest is a
+  pre-lane artifact. A unit that carries one (pre-lane and adoption units) binds
+  it as the `acceptance` row; a lane-era unit whose acceptance criteria live in
+  the unit doc builds without that row. Requiring the manifest made every
+  lane-era plan snapshot unsatisfiable — the enforcer demanded a file the
+  current pipeline structurally never writes (issue #285).
 - **A ledger that lives inside the SPEC has no row** (D20): an XS/S or fix unit
   embeds `### Planning evidence` / `### Obligations`, so those rows are absent and
   their bytes are already bound by the `spec` row. Never point a row at a file that

package/skills/review-change/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-change
 user-invocable: true
-version: 3.10.0
+version: 3.11.0
 argument-hint: <path-or-glob> [--adversarial N] [--synthesize]
 author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
 license: MIT
@@ -31,6 +31,13 @@ For a final PR review, the turn is incomplete until this additional box passes:
   `review-change:pass` marker is confirmed, so its exit code IS this box
 ```
 
+When the receipt emitter runs, it also records the affecting-path scope
+manifest (fix/286) so a foreign-only commit after the review (a session-log or
+toolstate commit on a shared checkout) does not void the receipt at the merge
+gate — pass `--scope-base main` (the unit's base ref) and the runtime derives
+the manifest itself; never hand-assemble a digest. A receipt without a scope
+manifest stays head-bound (legacy semantics).
+
 The receipt closeout is a precondition of the report, not a follow-up: do not
 print the fixed report block on a non-zero exit. A clean report without a
 current receipt must not recommend `/audit-pr`.

package/skills/review-change/references/PERSIST_AND_DECIDE.md

@@ -60,9 +60,16 @@ exact command tokens.
    bun scripts/review-receipt.mjs emit --pr <N> \
      --head "$(git rev-parse HEAD)" --scope "<reviewed surface>" \
      --axes "<axes run and skipped>" --coverage "<criterion-to-evidence>" \
-     --invariants pass|n/a --proposals <n> --manual "<items or none>"
+     --invariants pass|n/a --proposals <n> --manual "<items or none>" \
+     --scope-base main
    ```
 
+   `--scope-base <ref>` (fix/286) records the affecting-path scope manifest
+   beside the reviewed head: the emitter derives it from the branch delta vs
+   that ref, so a later foreign-only commit (session log, agent toolstate) no
+   longer voids the receipt at the merge gate — any affecting-path delta still
+   voids it. Never hand-assemble the manifest or its digest.
+
    The script is the contract: it refuses a PR whose `headRefOid` differs from
    the reviewed head, posts the one idempotent SHA-bound comment (skipping an
    identical one), re-reads the comments, and **exits non-zero unless the newest

package/skills/unit-lane/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: unit-lane
 user-invocable: true
-version: 1.2.0
+version: 1.5.0
 argument-hint: <NN-slug | "<idea>"> [--retriage] | --fix <issue-number> | --from-issue <issue-number>
 description: >
   One-shot lane conductor for a delivery unit: triage, implement, evidence, and
@@ -48,7 +48,9 @@ Both `--fix <n>` and `--from-issue <n>` are the exact forms
 
 Per the agent guide's **Workflow conventions** + **documentation map**, then read
 `docs/features/_TEMPLATE/SPEC.md` (the unit doc template). If the unit folder
-exists, read its current `SPEC.md` to avoid overwriting.
+exists, read its current `SPEC.md` to avoid overwriting. If this work returns
+to an area other unit docs already touch, scan their `## Future` sections and
+surface each open row as plan-now / keep-deferred / discard before continuing.
 
 ## Process
 
@@ -67,7 +69,11 @@ For `--fix`/`--from-issue`, read the tracked issue in the forge first and keep
 its number; the folder name carries it (`fix/<issue-number>-<topic>`). Fill
 objective, why, user outcome, and non-goals from the invocation (or the issue).
 Acceptance criteria are induced from user scenarios — **ask-don't-infer**; if the
-request is too vague, STOP and ask the user with concrete options. See
+request is too vague, STOP and ask the user with concrete options. Open
+decisions that are not acceptance criteria run through the design step's
+**gap interview** — one batched form-turn with recommended options + why,
+`Decide for me` (recorded in `decisions.md`), and cheap defaults recorded as
+assumptions. See
 [the unit doc template](references/STEPS.md) for section order.
 
 ### 2. Triage — read the catalog, never re-derive
@@ -79,8 +85,9 @@ re-derives, reorders, or invents steps — it executes only what the catalog say
 
 ### 3. Execute triaged steps in order
 
-For each step the triage returned, follow its reference file. Execute **one step
-per turn-commit**:
+For each step the triage returned, follow its reference file. Judgment steps
+(research, design, plan, evidence, docs, review) run inline, **one step per
+turn-commit**:
 
 1. Read the step's reference — for example:
    [research](references/RESEARCH.md), [design](references/DESIGN.md),
@@ -94,6 +101,23 @@ per turn-commit**:
 5. Commit with a conventional commit message.
 6. For implement steps, run the diff guard (step 4 below).
 
+Execution steps (implement, tests) **never run inline at the conductor's
+tier** — per-step model routing is reachable only across a turn boundary, so
+execution work hands off one phase per turn:
+
+```
+→ Next: /execute-phase <NN-slug> P<k> (tier: <tier>) — run phase P<k>; the lane resumes after the last phase
+  · no unfinished phase → continue the close-out ladder (step 6)
+```
+
+`<k>` is the first unfinished phase (the unit doc's Progress log records the
+phases done so far; `bun scripts/unit-route.mjs <NN-slug>` prints it) and
+`<tier>` is the `implement` entry of the triage block's `Tiers:` line. Never
+print the bare whole-unit `/execute-phase <NN-slug>` — whole-unit loop mode
+survives only as an explicit operator choice. When the last phase's turn
+closes, `execute-phase` resumes the lane and the remaining judgment steps
+(evidence, review, docs, release) run here.
+
 ### 4. Diff-size guard (after each implement step)
 
 Run `bun scripts/diff-guard.mjs --base <last-reviewed-ref> --unit <NN>`. Paste
@@ -110,16 +134,33 @@ Before every commit:
 - **Progress log**: `YYYY-MM-DD HH:MM — <what was done> → <commit sha> — next:
   <what is next>`
 
-### 6. Close the unit
+### 6. Close the unit — the close-out ladder
+
+When all triaged steps are done, in order:
+
+1. Run the review step (the in-doc `REVIEW-VERDICT` per
+   [review](references/REVIEW.md)).
+2. Resolve every `## Future` row with the user (planned now — registered on
+   explicit request only —, kept deferred, or discarded, dated).
+3. Update the unit doc's status and the index row (release step: branch
+   hygiene, PR creation, forge reconciliation).
+4. **Receipt stage.** The in-doc verdict is not the machine receipt. Verify
+   the PR's review receipt (`bun scripts/review-receipt.mjs verify --pr <N>`):
+   - **exit 0** (a current `review-change:pass` receipt at the settled head) →
+     the closing `→ Next:` recommends `/audit-pr <PR-url>` as the terminal
+     stage, with the receipt stated as its precondition.
+   - **otherwise** → the closing block is `→ Next: /review-change <NN-slug>`
+     (the receipt's sole owner) and `/audit-pr` is not printed — the gate is
+     never named before its precondition exists.
 
-When all triaged steps are done, run the review pack axis summary, update the
-unit doc's status, and print the closing block.
+A turn that ends with an unchecked ladder step is not done.
 
 ## Guardrails
 
 **Allowed:**
 - Only the triaged steps listed by the catalog
 - Changes scoped to the acceptance criteria
+- Deferred user ideas recorded in the unit doc's `## Future`, never implemented
 - Documentation updates in docs/ and template/
 - Conventional commit messages per the project's Workflow conventions
 
@@ -131,16 +172,25 @@ unit doc's status, and print the closing block.
 - Findings never authorize scope growth — record them, route to their owner
 - Never commit red (test failure) — fix or replan, never silence tests
 - Never alter a triaged step's order
+- Never run an execution phase inline or print a bare whole-unit
+  `/execute-phase` command — one phase per hand-off, tier attached
+- Never print `/audit-pr` before the PR's review receipt verifies current —
+  the receipt stage precedes the gate, always
 
 ## Relationship to other skills
 
 `unit-lane` absorbed the retired fixed-pipeline skills (design-feature,
-plan-feature, review-spec, review-plan) into catalog steps. The review pack axes
-(`review-implementation`, `review-code`, `review-security`, `review-perf`,
-`review-a11y`, `review-debt`) compose the review step; `triage-issue` feeds
-issues into the lane; `workflow-status` computes the next lane invocation.
-`init-workspace` seeds the unit doc template and catalog conventions into target
-projects.
+plan-feature, review-spec, review-plan) into catalog steps. `execute-phase` is
+the lane's executor: the lane conducts (triage, plan, evidence, review,
+close-out) and hands execution off one phase per turn at the phase's tier;
+its closing block names the next single phase and resumes the lane after the
+last one. The review pack axes (`review-implementation`, `review-code`,
+`review-security`, `review-perf`, `review-a11y`, `review-debt`) compose the
+review step; `/review-change` owns the SHA-bound receipt the close-out ladder
+verifies; `/audit-pr` is the terminal merge gate. `triage-issue` feeds issues
+into the lane; `workflow-status` computes the next lane invocation.
+`init-workspace` seeds the unit doc template and catalog conventions into
+target projects.
 
 ## Portability (agents other than Claude Code)
 
@@ -153,17 +203,20 @@ projects.
 
 ## Done when
 
-- Every triaged step is executed and committed.
+- Every triaged step is executed and committed — execution phases one
+  `/execute-phase <NN-slug> P<k>` turn each, never inline.
 - The unit doc's Evidence rows, Progress log, and References section are current.
-- The diff guard passed for all implement steps.
+- The diff guard passed for all implement steps (or an exception is recorded).
 - The review step is complete (or skipped per catalog).
+- The close-out ladder ran: receipt verified current, or the closing block
+  hands off to `/review-change` before any `/audit-pr` mention.
 - **The closing `→ Next:` block is printed.**
 
 ## Closing recommendation
 
 ```
-→ Next: /unit-lane <NN-slug> — continue to the next triaged step
-  · all steps done → /review-change (review the accumulated diff)
+→ Next: /execute-phase <NN-slug> P<k> (tier: <tier>) — run the next unfinished phase
+  · execution done, receipt current (verify --pr <N> exit 0) → /audit-pr <PR-url> — terminal merge gate; the current review-change:pass receipt is its precondition
+  · execution done, PR open, receipt missing → /review-change <NN-slug> — post the SHA-bound receipt first
   · re-triage needed → /unit-lane <NN-slug> --retriage
-  · finished and merge-ready → /audit-pr (merge gate)
 ```

package/skills/unit-lane/references/DESIGN.md

@@ -2,14 +2,58 @@
 
 ## Purpose
 
-Induce acceptance criteria from user scenarios and close entity, role, and
-expectation boundaries — distilled from the full design skill's closure.
+Run the gap interview, induce acceptance criteria from user scenarios, and
+close entity, role, and expectation boundaries — distilled from the full design
+skill's closure.
 
 ## Inputs
 
 - The unit's objective, why, and user outcome from the SPEC
+- The user's original request, the repository's current state, and the
+  installed tooling — whatever they already answer is never asked again
 - Research findings from the research step
 
+## The gap interview (runs before acceptance criteria lock)
+
+Collect every open decision the unit depends on and filter each one:
+
+| The gap… | The lane does |
+|---|---|
+| The request, the repo, or the installed tooling already answers it | Never asks |
+| Blocks now and is expensive to undo once code sits on top | Asks |
+| Blocks a later task that is already foreseeable | Asks now as a possibility; re-asks only if conditions change |
+| Cheap to change later | Takes a reasonable default and records it as an assumption — never silent |
+
+Expensive to undo = the choices that cost a lot to change once code exists on
+top: **scope** (personal / team / global), **stack**, **architecture pattern**,
+**data model**, **deployment target**, and **security configuration**.
+
+Mechanics — one batched form-turn, never one-question-per-turn:
+
+- Group all independent questions into a single turn; ≤6 slots, one-word
+  defaults accepted, ≤2 ambiguity follow-ups per slot.
+- Ask a single question first only when its answer changes the others. When
+  more than five gaps remain, the root decision (objective or scope) goes
+  first — its answer usually removes most of the rest.
+- Every slot carries: the **recommended option with its why**, one
+  alternative, **"Decide for me"**, and **"Explain the options"** — the user
+  may always answer freely.
+- **"Decide for me"**: the lane chooses, then records the choice and its
+  reason as a dated row in the unit folder's `decisions.md` — explicit, never
+  guessed silently.
+- **"Explain the options"**: explain each alternative didactically, then
+  re-ask only that slot.
+- A tool the project lacks may be offered as one more option (with its
+  recommendation and why); installing it always needs the user's explicit
+  consent.
+- **Ready when:** no expensive-to-undo blocking gap remains unanswered — not
+  when no gaps remain. An answer the user already gave is never re-asked.
+
+Deferred ideas ("down the road I'd like…") are never implemented, never turned
+into spec or tasks by this unit: they go verbatim to the unit doc's
+`## Future` section, dated, so the architecture may accommodate them without
+building them.
+
 ## Fixed output contract
 
 Fill the unit doc's **Acceptance criteria** section. Each AC must be:
@@ -19,6 +63,12 @@ Fill the unit doc's **Acceptance criteria** section. Each AC must be:
 
 ## Checklist (pass only if)
 
+- [ ] The gap interview ran before the ACs locked: one batched form-turn,
+      each gap filtered through the table above
+- [ ] No expensive-to-undo blocking gap remains unanswered
+- [ ] Every "Decide for me" choice is recorded with its reason in `decisions.md`
+- [ ] Cheap defaults are recorded as assumptions, correctable by the user
+- [ ] Deferred user ideas landed in `## Future`, not in scope
 - [ ] Every AC is induced from a user scenario, not inferred from vague intent
 - [ ] Acceptance criteria are command-verified where possible
 - [ ] Entity closure: every entity mentioned has its role in the unit stated
@@ -28,8 +78,12 @@ Fill the unit doc's **Acceptance criteria** section. Each AC must be:
 
 ## Forbidden
 
+- Do not ask what the request, the repo, or the installed tooling already answers
+- Do not ask one question per turn when slots are independent
+- Do not implement, spec, or task anything from `## Future`
+- Do not install a missing tool without explicit user consent
 - Do not build a separate DESIGN.md — one SPEC, all in the unit doc
 - Do not invent product scope the user did not confirm
 - Do not pre-fill engineering content (phases, tests, architecture)
 - Do not stamp "designed" with an incomplete closure row
-- An incomplete row silently un-does the skill's purpose
+- An incomplete row silently un-does the skill's purpose

package/skills/unit-lane/references/IMPLEMENT.md

@@ -2,42 +2,55 @@
 
 ## Purpose
 
-Execute the plan's tasks against the code. One phase per commit. Layer order
-respected. Guard enforced.
+Hand the plan's phases to the executor, one phase per turn. The conductor
+never runs an execution phase inline — per-step model routing is reachable
+only across a turn boundary (issue #291 AC3/AC4).
 
 ## Inputs
 
 - The unit's Tasks section (filled by the plan step)
-- The project's architecture doc (layer rules)
-- The diff guard baseline from the triage step's reference
+- The triage block's `Tiers:` line (the `implement` entry is the execution tier)
+- The unit's Progress log (which phases are done)
 
 ## Fixed output contract
 
-After each phase commit, update the unit doc's **Evidence** section and
-**Progress log**:
+At each execution boundary, print exactly one phase hand-off and end the turn:
+
+```
+→ Next: /execute-phase <NN-slug> P<k> (tier: <tier>) — run phase P<k>; the lane resumes after the last phase
+  · no unfinished phase → continue the close-out ladder
+```
+
+`<k>` = first unfinished phase (lowest `P<n>` bullet the Progress log does not
+record; `bun scripts/unit-route.mjs <NN-slug>` prints it). `<tier>` = the
+`implement` entry of the triage block's `Tiers:` line. Never the bare
+whole-unit command.
+
+When the last phase's turn closes, `execute-phase` resumes the lane. Verify
+its work landed in the unit doc before continuing:
 
 | AC | What was run | Exit / digest | Output (≤2 lines) | Verified-by |
 |---|---|---|---|---|
-| P1 | <git commit sha> | 0 · <sha> | <result ≤2 lines> | <model> |
+| P1 | <phase validator> | 0 · <sha> | <result ≤2 lines> | <executor model> |
 
 ## Checklist (pass only if)
 
-- [ ] Phases executed in P1, P2, … order from the Tasks section
-- [ ] One phase per commit (no bundling)
-- [ ] Layer order respected (inner layers don't import outer)
-- [ ] `git status --porcelain` is empty after each commit
-- [ ] Diff guard passed after each phase (see step 4 in SKILL.md)
-- [ ] Red run avoided — tests pass before committing, or tests-first red-run
-    evidence recorded
+- [ ] Every phase handed off as `/execute-phase <NN-slug> P<k> (tier: <tier>)`
+      — exactly one phase, never a bare whole-unit command
+- [ ] Phases ran in P1, P2, … order from the Tasks section
+- [ ] Each executor turn recorded its Evidence row and dated Progress entry
+- [ ] Diff guard run at the lane's resume (see step 4 in SKILL.md)
+- [ ] `git status --porcelain` is empty when the lane resumes
 
 ## Allowed
 
-- Changes scoped to the phase's acceptance criteria only
-- Bug fixes in affected paths that the phase touches
+- Changes scoped to the phase's acceptance criteria only (enforced by the
+  executor's own gates)
 - Documentation updates in the same commit as the code change
 
 ## Forbidden
 
+- Never run an execution phase inline at the conductor's tier
 - No unrelated refactors in the same commit
 - No new abstractions or dependencies beyond what the unit doc demands
 - Never commit red (test failure)

package/skills/unit-lane/references/PLAN.md

@@ -64,6 +64,29 @@ candidate match is clean and proceeds** — a miss never blocks it, a missed
 candidate can never void a plan, and the sweep issues no stage verdict and grants no
 gate of its own.
 
+## Planning ledgers (same step)
+
+Cut both planning ledgers in the same pass — the plan snapshot binds them, and
+the audit's lineage gate closes obligations from them (fix/285). The closed row
+shapes, column orders, and vocabularies are owned by
+`skills/pre-execution-review/references/LEDGERS.md`; this step only decides the
+home and fills the rows:
+
+- **Planning evidence** — one row per Engineering claim the SPEC's Engineering
+  half (or a fix SPEC's Objective/Why) makes. Ids `PE-001`, `PE-002`, …; an
+  unsampled assumption is `unknown` with an owner (`ASSUMPTION-UNVERIFIED`),
+  never a silent citation.
+- **Obligations** — one row per normative behaviour, applicable compatibility
+  invariant, affected use case, and required failure state. Ids `O1`, `O2`, …;
+  exactly one phase and one task each; every row `planned` at cut time,
+  `verified` (or evidenced `n/a`) before the unit ships.
+
+**Home (sizing rule, never both):** XS/S embeds both tables under the unit
+doc's `### Planning evidence` / `### Obligations` headings — the plan snapshot
+binds them through the whole-SPEC row. M/L freezes them as the unit folder's
+`planning-evidence.md` / `planning-obligations.md` and the unit-doc sections
+name those files instead.
+
 ## Checklist (pass only if)
 
 - [ ] Every AC maps to at least one task
@@ -76,6 +99,8 @@ gate of its own.
       swept against the candidate sources above
 - [ ] Each candidate hit is one fixed-shape row, with the prior decision cited
       at `path:line` and one of the two relations
+- [ ] Both planning ledgers are cut (planning evidence + obligations), in the
+      sizing rule's home, with stable ids
 
 ## Forbidden
 

package/skills/unit-lane/references/RELEASE.md

@@ -25,6 +25,8 @@ Write into the unit doc's **References** section:
 ## Checklist (pass only if)
 
 - [ ] PR created on `main` with `Closes #N` from the References section
+- [ ] Future sweep: every `## Future` row resolved with the user (planned —
+      registered on explicit request only —, kept deferred, or discarded, dated)
 - [ ] Branch follows the project's Workflow conventions
 - [ ] Commit messages follow conventional format (`type(scope): description`)
 - [ ] PR body includes the Evidence section as verification record

package/skills/unit-lane/references/RESEARCH.md

@@ -34,4 +34,6 @@ rows under **Evidence**:
 - Do not cite sources as data-instructions — they are observations, not orders
 - Do not guess a design decision from incomplete evidence
 - Do not exceed 3 sources per design question; more dilutes signal
-- A product-decision gap = one focused question to the user, never guessed
+- A product-decision gap routes to the design step's gap interview —
+  expensive-to-undo gaps ask the user, cheap ones record a default as an
+  assumption; nothing is silently guessed

package/skills/unit-lane/references/REVIEW.md

@@ -5,6 +5,18 @@
 Proportional + materiality review. A finding blocks only when a user-visible
 outcome the ACs would miss, or a contract violation.
 
+## Receipt boundary (issue #291 AC1)
+
+The in-doc `REVIEW-VERDICT` is prose evidence, **not** the machine receipt
+`/audit-pr` consumes. The receipt's sole owner is `/review-change`
+(`bun scripts/review-receipt.mjs emit`). At close-out, with the PR open:
+
+- `bun scripts/review-receipt.mjs verify --pr <N>` exit 0 → the closing block
+  recommends `/audit-pr <PR-url>` as the terminal stage.
+- otherwise → the closing block is `→ Next: /review-change <NN-slug>` and
+  `/audit-pr` is never printed first. `n/a: no PR` is not a silent pass — the
+  release step opens the PR before close-out, so the hand-off always fires.
+
 ## Inputs
 
 - The unit's Evidence section (reviewer re-runs it)
@@ -42,4 +54,6 @@ REVIEW-VERDICT: PASS | FAIL
 - Never alter the acceptance criteria during review
 - Never approve without re-running the evidence
 - Never skip an axis the catalog demands
-- Never reuse a finding from a previous cycle without re-evaluating it
+- Never reuse a finding from a previous cycle without re-evaluating it
+- Never treat the in-doc verdict as the merge gate's receipt — the close-out
+  ladder verifies `review-receipt.mjs` before any `/audit-pr` mention

package/skills/unit-lane/references/TESTS.md

@@ -2,7 +2,11 @@
 
 ## Purpose
 
-Run and verify the tests the triage determined are applicable.
+Run and verify the tests the triage determined are applicable. Test execution
+rides the executor's phases (each phase's `validator:` runs the project's
+gate); when the tests step is the turn's own boundary, it hands off like
+implement does — one `/execute-phase <NN-slug> P<k> (tier: <tier>)` turn,
+never inline.
 
 ## Inputs