@kontextmind/kxm 0.6.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
+  "name": "kxm",
+  "description": "KXM: headless multi-agent orchestration and live operator dashboard",
+  "owner": {
+    "name": "KontextMind",
+    "url": "https://github.com/kontextmind"
+  },
+  "plugins": [
+    {
+      "name": "kxm",
+      "source": "./plugins/kxm",
+      "description": "Durable workflows, peer agents, and kxm tui",
+      "version": "0.6.0",
+      "category": "development",
+      "tags": ["kxm", "multi-agent", "workflows", "mcp"]
+    }
+  ]
+}

package/.kxm/README.md

@@ -0,0 +1,14 @@
+# KontextMind workspace
+
+`.kxm` is the canonical home for repository-local Pi Mesh configuration, logs, assets, and runtime state.
+
+| Directory | Contents | Git policy |
+|---|---|---|
+| `config/` | Reviewable workflow and harness configuration without secrets | Tracked |
+| `logs/` | Hub, worker, and agent process logs | Ignored except documentation |
+| `assets/` | Durable workflow inputs and outputs that belong to this workspace | Track intentionally; generated content is ignored |
+| `state/` | SQLite and other restart-recovery state | Ignored except documentation |
+
+Secrets remain in environment variables or an approved secret manager. Do not put tokens, webhook secrets, credentials, or private prompt dumps anywhere under `.kxm/config`.
+
+All directory defaults derive from `.kxm`. Set `KXM_WORKSPACE_DIR` to relocate the complete workspace or use a specific path override when an operator-managed volume requires it.

package/.kxm/assets/README.md

@@ -0,0 +1,5 @@
+# Workspace assets
+
+Store durable workflow inputs and outputs here when they belong with the repository: approved prompt templates, sanitized fixtures, diagrams, exported reports, or evidence manifests.
+
+Commit intentional reusable assets. Put transient or machine-generated artifacts under `generated/`; that directory is ignored by Git. Never store credentials, raw private webhook payloads, or unrestricted production logs here.

package/.kxm/assets/retrospectives/README.md

@@ -0,0 +1,5 @@
+# Workflow retrospectives
+
+`kxm workflow export` writes bounded Markdown and JSON here.
+
+Exported files are proposals. Review them before changing workflow policy, gates, or harness configuration. Do not commit live run exports that may contain private engineering context.

package/.kxm/config/README.md

@@ -0,0 +1,5 @@
+# Workspace configuration
+
+Store reviewable, repository-specific harness and workflow configuration here. `env.example` documents supported environment settings. `workflows/` contains the complete Jira development lifecycle, the v0.4 dogfood workflow, and the provenance/quorum workflow used by parser and evidence-policy tests.
+
+Configuration files may reference secret environment-variable names such as `JIRA_WEBHOOK_SECRET`; they must never contain the secret values. Set `KXM_WEBHOOK_WORKFLOWS_FILE` to the chosen workflow file.

package/.kxm/config/agents.json

@@ -0,0 +1,43 @@
+{
+  "schema": "kxm.agents.v1",
+  "project": "kxm",
+  "host": "local",
+  "agents": [
+    {
+      "name": "grok",
+      "kind": "agent",
+      "driver": "ai",
+      "model": "xai/grok-4.6",
+      "thinking": "xhigh",
+      "purpose": "Sole writer; independent critic of kxm CLI and envelopes"
+    },
+    {
+      "name": "fable",
+      "kind": "agent",
+      "driver": "ai",
+      "model": "anthropic/claude-fable-5-1",
+      "thinking": "xhigh",
+      "purpose": "Independent critic: architecture and permissions"
+    },
+    {
+      "name": "gpt-sol",
+      "kind": "agent",
+      "driver": "ai",
+      "model": "openai-codex/gpt-5.6-sol",
+      "thinking": "xhigh",
+      "purpose": "Independent critic: CLI contracts and documentation"
+    },
+    {
+      "name": "kimi",
+      "kind": "agent",
+      "driver": "ai",
+      "model": "kimi-coding/kimi-for-coding",
+      "thinking": "max",
+      "purpose": "Independent critic: mapping gaps and portability"
+    }
+  ],
+  "ownership": {
+    "writeAgent": "grok",
+    "peerAgents": ["fable", "gpt-sol", "kimi"]
+  }
+}

package/.kxm/config/env.example

@@ -0,0 +1,56 @@
+KXM_HOST=127.0.0.1
+KXM_PORT=7331
+KXM_AUTH_TOKEN=replace-with-a-long-random-token
+KXM_WORKSPACE_DIR=.kxm
+# KXM_CONFIG_DIR=.kxm/config
+# KXM_LOGS_DIR=.kxm/logs
+# KXM_ASSETS_DIR=.kxm/assets
+# KXM_STATE_DIR=.kxm/state
+# KXM_DATA_PATH=.kxm/state/kxm.db
+# KXM_LOG_PATH=.kxm/logs/kxm-hub.jsonl
+KXM_PROJECT_TOKENS={"my-project":"replace-with-a-project-token"}
+KXM_MESSAGE_TTL_MS=86400000
+KXM_MESSAGE_RETENTION_MS=604800000
+KXM_RATE_LIMIT_MAX=600
+KXM_RATE_LIMIT_WINDOW_MS=60000
+KXM_WEBHOOK_WORKFLOWS_FILE=.kxm/config/workflows/jira-development.json
+JIRA_WEBHOOK_SECRET=replace-with-a-high-entropy-webhook-secret
+WORKFLOW_SIGNAL_SECRET=replace-with-a-separate-callback-secret
+
+# Client / Pi extension settings
+KXM_SERVER_URL=http://127.0.0.1:7331
+KXM_PROJECT=my-project
+KXM_AGENT_NAME=planner
+KXM_AGENT_PURPOSE=Plans work and reviews architecture
+
+# Long-lived headless Pi worker
+KXM_WORKDIR=C:\path\to\project
+KXM_WORKER_CONTINUE=true
+# Opt in after reviewing the fresh scoped-history upgrade behavior:
+# workflow = stable default Pi session plus one session per durable workflow run
+# KXM_WORKER_SESSION_ISOLATION=workflow
+# KXM_WORKER_MAX_RUN_SESSIONS=128
+# KXM_WORKER_INITIAL_CONTINUE=false
+# KXM_WORKER_LOG_PATH=.kxm/logs/kxm-worker-planner.jsonl
+# KXM_AGENT_LOG_PATH=.kxm/logs/pi-agent-planner.log
+# KXM_WORKER_MAX_RESTARTS=20
+# KXM_WORKER_MODEL=provider/model
+# KXM_WORKER_FALLBACK_MODELS=provider/fallback-one,provider/fallback-two
+# KXM_WORKER_PROVIDER_RETRY_MS=60000
+# KXM_WORKER_TOOL_TIMEOUT_MS=1860000
+# KXM_WORKER_ACTIVATION_TIMEOUT_MS=60000
+# KXM_WORKER_TOOLS=read,grep,find,ls,kxm_fanout,kxm_workflow_get
+# KXM_WORKER_EXTENSION_PATHS=plugins/kxm/src/extension.ts;C:\path\to\provider\extension.ts
+# KXM_WORKER_SKILL_PATHS=plugins/kxm/skills/kxm
+
+# Optional proposed-improvement telemetry classification override: cli or project
+# KXM_IMPROVE_TARGET=project
+
+# Opt-in Nous Pi providers (unset = no fetch, no registration)
+# KXM_NOUS_PROVIDERS=direct
+# KXM_NOUS_PROVIDERS=proxy
+# KXM_NOUS_PROVIDERS=direct,proxy
+# NOUS_API_KEY=
+# KXM_NOUS_PROXY_URL=http://127.0.0.1:8645/v1
+# KXM_NOUS_DISCOVERY_TIMEOUT_MS=5000
+# KXM_NOUS_CATALOG_FILE=

package/.kxm/config/update.example.yaml

@@ -0,0 +1,9 @@
+# Copy this file to the per-user state root. kxm never reads a project
+# .kxm/update.yaml (it prints a warning and continues). Locations:
+#   Windows: %LOCALAPPDATA%\KXM\update.yaml
+#   macOS:   ~/Library/Application Support/KXM/update.yaml
+#   Linux:   ${XDG_STATE_HOME:-~/.local/state}/kxm/update.yaml
+# Override the state root with an absolute KXM_STATE_HOME for tests.
+schema: kxm.update.v1
+auto: false
+source: github

package/.kxm/config/workflows/fix.json

@@ -0,0 +1,160 @@
+[
+  {
+    "id": "fix",
+    "source": "generic",
+    "project": "kxm",
+    "target": "coordinator",
+    "secretEnv": "FIX_WEBHOOK_SECRET",
+    "signalSecretEnv": "WORKFLOW_SIGNAL_SECRET",
+    "delivery": "followUp",
+    "maxTransitions": 28,
+    "reproOracle": { "stageId": "repro-review", "evidenceKey": "repro" },
+    "planHash": { "stageId": "final-plan", "evidenceKey": "plan" },
+    "requirePlanHash": ["implement", "local-verify", "delivery"],
+    "promptTemplate": "Bug report: {{task}}\n\nRun the /fix workflow: two-phase reproduction before any production edit, approved plan before implementation, bounded rework on failure. The confirmed reproduction is an immutable oracle.\n\nHard rules: (1) The oracle must invoke the diagnosis-named production callables on the reporter path — a sibling API or newer stack is invalid even if it fails. (2) After repro_invalidated, rewrite the draft against that named seam; never checkpoint blocked because the previous seam was wrong or because a method news its own DbContext. (3) Search existing test hosts (controller fixtures, HttpContext helpers, TransactionScope, read-only call against existing data) before declaring a seam untestable.",
+    "stages": [
+      {
+        "id": "intake",
+        "label": "Intake",
+        "area": "workflow",
+        "instructions": "Classify the bug report: expected vs actual behavior, affected surface, severity, and reproduction hints. Record a journal 'plan' entry with the classification. If the report is not actionable, checkpoint with outcome 'blocked'.",
+        "requiredEvidence": ["classification"],
+        "maxAttempts": 2,
+        "on": { "passed": "repro-explore", "blocked": "$terminal" }
+      },
+      {
+        "id": "repro-explore",
+        "label": "Repro explore (read-only)",
+        "area": "implementation",
+        "instructions": "Read and search only: locate the bug, note prior reproductions, test conventions, and similar incidents via kxm context. No source or test edits. Produce a diagnosis that names the exact production callables on the reporter path (handler, data method, or rendered component), root-cause hypothesis, expected/actual behavior, reproduction strategy, reference tests in existing area folders, and target assertions. Secondary surfaces (other API versions, other tabs) are notes only — they are not substitute oracles. Record the diagnosis with journal category 'hypothesis'.",
+        "requiredEvidence": ["diagnosis"],
+        "maxAttempts": 3,
+        "on": { "passed": "repro-write", "blocked": "$terminal" }
+      },
+      {
+        "id": "repro-write",
+        "label": "Repro write (tests only)",
+        "area": "implementation",
+        "instructions": "Write and execute the failing reproduction. Tests and test helpers only — production and configuration stay byte-for-byte unchanged. Every target assertion must call the diagnosis-named production handler, production seam, or rendered production component and fail for the reported reason rather than compilation/setup. A sibling API, newer stack, or 'also used by some admins' handler is invalid even if it fails. A method that news its own DbContext is not grounds for blocked: use existing test hosts (controller fixtures, HttpContext helpers, TransactionScope so a new context still rolls back) or a read-only call against existing data with no seed. After repro_invalidated, write a new draft against the named seam; do not checkpoint outcome blocked because the previous draft was the wrong seam. Checkpoint failed (outcome failed) to consume an attempt and rewrite. blocked is only when the ticket is not a code defect. Cite evidence key 'repro' with every test path, sha256, exact command, and failed/passed counts. This is a reviewable draft; it is not immutable until independent repro-review passes.",
+        "requiredEvidence": ["repro"],
+        "maxAttempts": 3,
+        "on": { "passed": "repro-review", "failed": "repro-write", "blocked": "$terminal" }
+      },
+      {
+        "id": "repro-review",
+        "label": "Independent reproduction review",
+        "area": "gates",
+        "instructions": "Before the oracle is captured, send the diagnosis, test files/hashes, exact failing results, and production/config git status to both independent critics. They must verify production coupling to the diagnosis-named reporter-path seam (a sibling API is invalid), full expected-behavior coverage, failure causality, immutability feasibility, and absence of production/config edits. Caller-authored evidence cannot satisfy peer review. If either critic finds an omission or invalid test, checkpoint status 'failed' with outcome 'repro_invalidated' and return to repro-write. Only unanimous validation may pass; cite the unchanged draft under evidence key 'repro'. Passing this stage captures the immutable oracle.",
+        "requiredEvidence": ["repro", "review"],
+        "maxAttempts": 3,
+        "evidencePolicies": {
+          "review": {
+            "kind": "peer-reply",
+            "minProducers": 2,
+            "eligibleAgents": ["critic-1", "critic-2"],
+            "acceptedStatuses": ["replied"]
+          }
+        },
+        "on": { "passed": "plan", "repro_invalidated": "repro-write", "blocked": "$terminal" }
+      },
+      {
+        "id": "plan",
+        "label": "Plan",
+        "area": "workflow",
+        "instructions": "Using the diagnosis and the confirmed reproduction, write the implementation plan: changed files, approach, risks, and how the reproduction proves the fix. Cite evidence key 'plan' with the plan artifact path and content hash.",
+        "requiredEvidence": ["plan"],
+        "maxAttempts": 3,
+        "on": { "passed": "critics", "blocked": "$terminal" }
+      },
+      {
+        "id": "critics",
+        "label": "Independent critics",
+        "area": "gates",
+        "instructions": "Two independent critics review the plan for correctness, scope creep, and risk. Both must reply through the mesh; caller-authored evidence cannot satisfy this policy. If the plan is invalidated, checkpoint with outcome 'plan_invalidated'.",
+        "requiredEvidence": ["critique"],
+        "maxAttempts": 3,
+        "evidencePolicies": {
+          "critique": {
+            "kind": "peer-reply",
+            "minProducers": 2,
+            "eligibleAgents": ["critic-1", "critic-2"],
+            "acceptedStatuses": ["replied"]
+          }
+        },
+        "on": { "passed": "final-plan", "plan_invalidated": "plan", "blocked": "$terminal" }
+      },
+      {
+        "id": "final-plan",
+        "label": "Final plan",
+        "area": "workflow",
+        "instructions": "Fold critic feedback into the final plan. Re-cite evidence key 'plan' with the final artifact path and content hash. The hash of this stage's plan evidence becomes the approved plan hash required by implementation.",
+        "requiredEvidence": ["plan"],
+        "maxAttempts": 2,
+        "on": { "passed": "approval", "plan_invalidated": "plan", "blocked": "$terminal" }
+      },
+      {
+        "id": "approval",
+        "label": "Human approval",
+        "area": "security",
+        "instructions": "Human operator approves the plan. Cite evidence key 'signoff' with the approver identity and approval reference. A 'rejected' outcome routes back to planning; this stage cannot be bypassed by any transition.",
+        "requiredEvidence": ["signoff"],
+        "maxAttempts": 8,
+        "on": { "passed": "implement", "rejected": "plan", "blocked": "$terminal" }
+      },
+      {
+        "id": "implement",
+        "label": "Implement",
+        "area": "implementation",
+        "instructions": "Implement the approved plan. The reproduction oracle is immutable: local verification must fail before the fix and pass after it. Cite evidence keys 'diff' and 'repro' (same value as the oracle).",
+        "requiredEvidence": ["diff"],
+        "maxAttempts": 4,
+        "on": { "passed": "local-verify", "blocked": "$terminal" }
+      },
+      {
+        "id": "local-verify",
+        "label": "Local verify",
+        "area": "gates",
+        "instructions": "Run the repo-defined gates: unit, lint, typecheck, build, and the confirmed reproduction test. Cite evidence key 'gates' with per-gate results. 'implementation_failure' reworks implementation; 'plan_invalidated' routes back to planning rather than expanding scope.",
+        "requiredEvidence": ["gates"],
+        "maxAttempts": 4,
+        "on": {
+          "passed": "delivery",
+          "implementation_failure": "implement",
+          "plan_invalidated": "plan",
+          "blocked": "$terminal"
+        }
+      },
+      {
+        "id": "delivery",
+        "label": "Delivery",
+        "area": "workflow",
+        "instructions": "Create and push the branch and merge request with the reproduction, plan, and diff references. Delivery never auto-merges: CI and review outcomes are watched in the next stage.",
+        "requiredEvidence": ["mr"],
+        "maxAttempts": 2,
+        "on": { "passed": "ci-watch", "blocked": "$terminal" }
+      },
+      {
+        "id": "ci-watch",
+        "label": "CI and review watch",
+        "area": "gates",
+        "instructions": "Watch required CI checks and review status. On failure, checkpoint with outcome 'failure' to rework through bounded transitions. On success, continue to human acceptance.",
+        "requiredEvidence": ["ci"],
+        "maxAttempts": 6,
+        "on": {
+          "passed": "ready-for-human-acceptance",
+          "failure": "implement",
+          "blocked": "$terminal"
+        }
+      },
+      {
+        "id": "ready-for-human-acceptance",
+        "label": "Ready for human acceptance",
+        "area": "workflow",
+        "instructions": "Summarize the fix: reproduction (immutable oracle), approved plan hash, diff, gate results, CI outcome, and the full claim-to-evidence trail from the run journal. Checkpoint 'passed' to complete the run; a human performs final acceptance outside the workflow.",
+        "requiredEvidence": ["summary"],
+        "maxAttempts": 2,
+        "on": { "passed": "$terminal", "blocked": "$terminal" }
+      }
+    ]
+  }
+]

package/.kxm/config/workflows/jira-development.json

@@ -0,0 +1,116 @@
+[
+  {
+    "id": "jira-development",
+    "source": "jira",
+    "project": "product",
+    "target": "coordinator",
+    "secretEnv": "JIRA_WEBHOOK_SECRET",
+    "signalSecretEnv": "WORKFLOW_SIGNAL_SECRET",
+    "event": "jira:issue_updated",
+    "filter": {
+      "path": "issue.fields.status.name",
+      "equals": "In Progress"
+    },
+    "delivery": "followUp",
+    "ttlMs": 604800000,
+    "promptTemplate": "Take ownership of Jira issue {{issue.key}} — {{issue.fields.summary}}.\n\nDescription:\n{{issue.fields.description}}\n\nIssue URL: {{issue.self}}\n\nUse the kxm workflow tools as the durable record. Preserve Jira issue {{issue.key}} as the correlation key. Only perform push, merge, or Jira mutations when the current harness permissions and repository policy authorize them.",
+    "stages": [
+      {
+        "id": "intake",
+        "area": "workflow",
+        "label": "Intake and ownership",
+        "instructions": "Validate the webhook context, repository, scope, permissions, and acceptance criteria. Confirm that the issue is actually In Progress.",
+        "requiredEvidence": ["issue key", "acceptance criteria", "repository and branch", "authorization boundary"],
+        "maxAttempts": 2
+      },
+      {
+        "id": "reproduce",
+        "area": "implementation",
+        "label": "Reproduce the issue",
+        "instructions": "Reproduce the defect before changing production code. Prefer a deterministic failing automated test and capture environment details.",
+        "requiredEvidence": ["reproduction steps", "observed failure", "expected behavior", "failing test or diagnostic artifact"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "plan-moa",
+        "area": "workflow",
+        "label": "Plan with single-agent or three-agent mixture of agents",
+        "instructions": "For simple work, produce one plan. For ambiguous or high-risk work, ask three strong planning peers independently, compare assumptions and tradeoffs, record contradictions, and synthesize the best evidence-backed plan.",
+        "requiredEvidence": ["candidate plans", "contradictions and resolutions", "selected plan", "ownership boundaries"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "plan-review",
+        "area": "workflow",
+        "label": "Review the plan",
+        "instructions": "Have an independent reviewer challenge correctness, security, migration, test, and rollback assumptions. Revise the plan when findings are material.",
+        "requiredEvidence": ["review findings", "accepted and rejected feedback", "revised plan"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "implementation",
+        "area": "implementation",
+        "label": "Implementation",
+        "instructions": "Implement the reviewed plan with explicit file ownership. Keep changes focused and preserve unrelated user work.",
+        "requiredEvidence": ["changed paths", "implementation decisions", "tests added or updated"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "local-gates",
+        "area": "gates",
+        "label": "Local code checks",
+        "instructions": "Run the repository-defined lint, build/typecheck, security scan, and Playwright suite. A warning or failure must be recorded, corrected, and rerun; do not downgrade a gate silently.",
+        "requiredEvidence": ["lint result", "build or typecheck result", "security result", "Playwright result"],
+        "maxAttempts": 5
+      },
+      {
+        "id": "repository-gates",
+        "area": "gates",
+        "label": "Repository and CodeRabbit gates",
+        "instructions": "Reproduce required repository checks locally where possible. Address CodeRabbit or equivalent review findings by evidence and rerun affected gates.",
+        "requiredEvidence": ["repository gate results", "review findings", "resolutions or justified dismissals"],
+        "maxAttempts": 5
+      },
+      {
+        "id": "documentation",
+        "area": "documentation",
+        "label": "Documentation",
+        "instructions": "Update user, operator, architecture, changelog, and test-matrix material affected by the change.",
+        "requiredEvidence": ["documentation paths", "behavior and operational changes", "examples updated"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "push-watch",
+        "area": "gates",
+        "label": "Push, open review, and watch",
+        "instructions": "When authorized, push the branch and open or update the review. Call kxm_workflow_wait with commit, pull-request, and resolved-warning evidence, then watch the example `ci` check with `kxm gate github watch --run-id <id> --stage-id push-watch --signal-key <key> --repo <owner/name> --pr <n> --required ci` so the durable wait receives exact `github.check:ci` evidence. Replace `ci` in this template and command with the repository's real required check names. Record every warning or failure, fix it, push again, and continue watching until required checks pass.",
+        "requiredEvidence": ["commit", "pull request", "resolved warnings and failures", "github.check:ci"],
+        "maxAttempts": 10
+      },
+      {
+        "id": "merge",
+        "area": "security",
+        "label": "Merge",
+        "instructions": "Merge only when approvals, required checks, branch policy, and user authorization permit it. Capture the resulting merge commit.",
+        "requiredEvidence": ["approval state", "required checks", "merge commit"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "jira-update",
+        "area": "workflow",
+        "label": "Update Jira",
+        "instructions": "Update the Jira issue through an authorized integration with the outcome, implementation and test evidence, pull request, merge commit, and any follow-up risk. Transition it according to team policy.",
+        "requiredEvidence": ["Jira transition", "Jira comment or fields", "links to pull request and merge"],
+        "maxAttempts": 3
+      },
+      {
+        "id": "retrospective",
+        "area": "workflow",
+        "label": "Continuous-improvement retrospective",
+        "instructions": "Review the run journal. Turn recurring errors, contradictions, delays, flaky gates, and harness friction into an evidence-linked improvement backlog. Do not apply policy changes automatically.",
+        "requiredEvidence": ["lessons by area", "prioritized improvements", "owner or next action", "success measure"],
+        "maxAttempts": 3
+      }
+    ]
+  }
+]

package/.kxm/config/workflows/provenance-quorum.json

@@ -0,0 +1,150 @@
+[
+  {
+    "id": "kxm-provenance",
+    "source": "generic",
+    "project": "kxm-provenance",
+    "target": "provenance-coordinator",
+    "secretEnv": "KXM_V04_WORKFLOW_SECRET",
+    "signalSecretEnv": "KXM_V04_SIGNAL_SECRET",
+    "event": "extension.provenance_requested",
+    "delivery": "followUp",
+    "ttlMs": 604800000,
+    "promptTemplate": "Deliver issue {{issue}} for {{repository}}: provenance-bound peer evidence and quorum workflow gates.\n\nIssue URL: {{issueUrl}}\nProject board: {{projectBoard}}\n\nYou are the sole code writer. Ask provenance-grok and provenance-gemini independently for research, plans, and final review through pi-mesh. Bind every claimed peer result to its durable message ID in the run record. Record plans, decisions, contradictions, errors, and lessons under .kxm. Keep the issue and project board current. The user authorizes branch-local implementation, tests, documentation, commits, pushes, pull requests, CI monitoring, and merge only after all required checks and independent review pass. Preserve backward compatibility and never claim exactly-once execution.",
+    "stages": [
+      {
+        "id": "research",
+        "area": "workflow",
+        "label": "Independent research",
+        "instructions": "Ask provenance-grok and provenance-gemini independently to analyze issue 22 and the current workflow, message, persistence, CLI, MCP, retrospective, and migration contracts. Send each request with workflowContext for this run, research stage, the matching required-evidence key, and the current one-based attempt. At checkpoint, cite the replied message IDs through evidenceRefs. Capture agreements, contradictions, threat cases, and acceptance criteria in a research synthesis under .kxm/assets.",
+        "requiredEvidence": [
+          "Grok message ID and replied result",
+          "Gemini message ID and replied result",
+          "current-state trace",
+          "contradictions and resolutions",
+          "acceptance criteria"
+        ],
+        "evidencePolicies": {
+          "Grok message ID and replied result": {
+            "kind": "peer-reply",
+            "minProducers": 1,
+            "eligibleAgents": ["provenance-grok"],
+            "acceptedStatuses": ["replied"]
+          },
+          "Gemini message ID and replied result": {
+            "kind": "peer-reply",
+            "minProducers": 1,
+            "eligibleAgents": ["provenance-gemini"],
+            "acceptedStatuses": ["replied"]
+          }
+        },
+        "maxAttempts": 3
+      },
+      {
+        "id": "plan",
+        "area": "workflow",
+        "label": "Reviewed architecture plan",
+        "instructions": "Ask both peers for independent implementation plans using one shared workflowContext bound to this run, plan stage, the independent-plan-message-IDs requirement, and the current attempt. Synthesize a backward-compatible schema for evidence type, producer identity or role, quorum, terminal state, message binding, and explicit degraded policy. Define persistence and migration, validation boundaries, all affected interfaces, tests, documentation, rollout, and rollback. Cite both replied message IDs through evidenceRefs.",
+        "requiredEvidence": [
+          "independent plan message IDs",
+          "selected schema and invariants",
+          "migration and compatibility",
+          "security boundaries",
+          "test and rollout plan"
+        ],
+        "evidencePolicies": {
+          "independent plan message IDs": {
+            "kind": "peer-reply",
+            "minProducers": 2,
+            "eligibleAgents": ["provenance-grok", "provenance-gemini"],
+            "acceptedStatuses": ["replied"]
+          }
+        },
+        "maxAttempts": 3
+      },
+      {
+        "id": "implement",
+        "area": "implementation",
+        "label": "Implementation",
+        "instructions": "Implement the reviewed plan as the sole writer. Verify peer evidence against durable hub state and unique producers. Pending, expired, cancelled, duplicated, wrong-run, wrong-stage, or coordinator-authored substitute evidence must not satisfy a peer quorum. Permit degradation only through an explicit journaled policy branch. Preserve readable legacy string evidence and keep Pi, MCP, webhook, CLI, retrospective, documentation, and generated bundles aligned.",
+        "requiredEvidence": [
+          "changed paths",
+          "schema and migration",
+          "verification logic",
+          "interface parity",
+          "tests and documentation"
+        ],
+        "maxAttempts": 6
+      },
+      {
+        "id": "local-gates",
+        "area": "gates",
+        "label": "Complete local gates",
+        "instructions": "Run the complete repository validation gate, generated-artifact check, strict Claude marketplace validation, package inspection, and isolated packed CLI/hub smoke on supported Node engines. Record and resolve every warning or failure.",
+        "requiredEvidence": [
+          "test and coverage results",
+          "typecheck and docs lint",
+          "generated artifacts",
+          "Claude validation",
+          "package and engine smoke"
+        ],
+        "maxAttempts": 5
+      },
+      {
+        "id": "review",
+        "area": "gates",
+        "label": "Independent implementation review",
+        "instructions": "Give Grok and Gemini the actual diff and ask them independently to review provenance integrity, authorization, uniqueness, correlation, migration, degradation visibility, interface parity, tests, portability, and documentation. Send each request with workflowContext bound to this run, review stage, its matching review requirement, and the current attempt; cite both replied message IDs through evidenceRefs. Resolve every material finding and rerun affected gates.",
+        "requiredEvidence": [
+          "Grok review message ID",
+          "Gemini review message ID",
+          "accepted and rejected findings",
+          "resolved findings",
+          "rerun gates"
+        ],
+        "evidencePolicies": {
+          "Grok review message ID": {
+            "kind": "peer-reply",
+            "minProducers": 1,
+            "eligibleAgents": ["provenance-grok"],
+            "acceptedStatuses": ["replied"]
+          },
+          "Gemini review message ID": {
+            "kind": "peer-reply",
+            "minProducers": 1,
+            "eligibleAgents": ["provenance-gemini"],
+            "acceptedStatuses": ["replied"]
+          }
+        },
+        "maxAttempts": 5
+      },
+      {
+        "id": "delivery",
+        "area": "gates",
+        "label": "Deliver and watch",
+        "instructions": "Commit and push the reviewed increment, open a pull request closing issue 22, add it to Project 3, and watch every required GitHub check. Merge only when all required checks pass and the evidence verifier confirms the independent-review quorum.",
+        "requiredEvidence": [
+          "commit",
+          "pull request",
+          "green required checks",
+          "verified peer quorum",
+          "merge and project status"
+        ],
+        "maxAttempts": 5
+      },
+      {
+        "id": "retrospective",
+        "area": "workflow",
+        "label": "Continuous-improvement retrospective",
+        "instructions": "Export and review the durable retrospective. Record timing, contradictions, errors, degraded paths, manual interventions, and measurable follow-ups. Separate verified peer evidence from coordinator synthesis and do not silently promote proposed policy.",
+        "requiredEvidence": [
+          "retrospective Markdown",
+          "retrospective JSON",
+          "evidence provenance audit",
+          "review decision",
+          "remaining backlog"
+        ],
+        "maxAttempts": 3
+      }
+    ]
+  }
+]