@kontextmind/kxm 0.6.0 → 0.7.0

package/scripts/harness-run.mjs

@@ -269,7 +269,15 @@ function isAbsoluteOn(path, platform) {
   return path.startsWith("/");
 }
 
-export function resolveLauncher(cliId, options = {}) {
+/** Allowlisted npm-global inner launchers, relative to the directory that contains `name.cmd`. */
+export const WIN_NPM_INNER_EXE = Object.freeze({
+  claude: Object.freeze(["node_modules", "@anthropic-ai", "claude-code", "bin", "claude.exe"]),
+});
+export const WIN_NPM_INNER_NODE_SCRIPT = Object.freeze({
+  pi: Object.freeze(["node_modules", "@earendil-works", "pi-coding-agent", "dist", "bundle", "cli.js"]),
+});
+
+export function resolveLaunch(cliId, options = {}) {
   const platform = options.platform ?? process.platform;
   const pathEnv = options.pathEnv ?? process.env.PATH ?? "";
   const exists = options.existsSync ?? existsSync;
@@ -282,25 +290,57 @@ export function resolveLauncher(cliId, options = {}) {
   if (cliId.includes("\0")) throw failClosed("launcher id is invalid");
 
   const explicit = cliId.includes("/") || cliId.includes("\\") || isAbsoluteOn(cliId, platform);
-  if (explicit) return assertWinExecutable(cliId, platform, options);
+  if (explicit) return { command: assertWinExecutable(cliId, platform, options), args: [] };
 
   const dirs = pathEnv.split(delim).filter(Boolean);
   let rejectedShim;
-  for (const dir of dirs) {
-    if (platform === "win32") {
-      const exeName = cliId.toLowerCase().endsWith(".exe") ? cliId : `${cliId}.exe`;
+  if (platform === "win32") {
+    const exeName = cliId.toLowerCase().endsWith(".exe") ? cliId : `${cliId}.exe`;
+    for (const dir of dirs) {
       const exe = path.join(dir, exeName);
-      if (exists(exe)) return canonicalize(exe, { ...options, platform });
-      for (const ext of [".cmd", ".bat", ".ps1", ""]) {
-        const shim = path.join(dir, `${cliId}${ext}`);
-        if (exists(shim)) {
-          rejectedShim = shim;
-          break;
+      if (exists(exe)) return { command: canonicalize(exe, { ...options, platform }), args: [] };
+    }
+    for (const dir of dirs) {
+      const cmdShim = path.join(dir, `${cliId}.cmd`);
+      if (!exists(cmdShim)) continue;
+      const exeSegs = WIN_NPM_INNER_EXE[cliId];
+      if (exeSegs) {
+        const inner = path.join(dir, ...exeSegs);
+        if (exists(inner)) {
+          return { command: assertWinExecutable(inner, platform, options), args: [] };
+        }
+      }
+      const scriptSegs = WIN_NPM_INNER_NODE_SCRIPT[cliId];
+      if (scriptSegs) {
+        const script = path.join(dir, ...scriptSegs);
+        const nodeExe = options.execPath ?? process.execPath;
+        if (exists(script) && exists(nodeExe)) {
+          return {
+            command: canonicalize(nodeExe, { ...options, platform }),
+            args: [canonicalize(script, { ...options, platform })],
+          };
         }
       }
-      if (rejectedShim) break;
-    } else if (exists(path.join(dir, cliId))) {
-      return canonicalize(path.join(dir, cliId), { ...options, platform });
+      rejectedShim = cmdShim;
+      break;
+    }
+    if (!rejectedShim) {
+      for (const dir of dirs) {
+        for (const ext of [".bat", ".ps1", ""]) {
+          const shim = path.join(dir, `${cliId}${ext}`);
+          if (exists(shim)) {
+            rejectedShim = shim;
+            break;
+          }
+        }
+        if (rejectedShim) break;
+      }
+    }
+  } else {
+    for (const dir of dirs) {
+      if (exists(path.join(dir, cliId))) {
+        return { command: canonicalize(path.join(dir, cliId), { ...options, platform }), args: [] };
+      }
     }
   }
   if (rejectedShim) {
@@ -309,6 +349,10 @@ export function resolveLauncher(cliId, options = {}) {
   throw failClosed(`missing binary ${cliId}; install and authenticate the native CLI`);
 }
 
+export function resolveLauncher(cliId, options = {}) {
+  return resolveLaunch(cliId, options).command;
+}
+
 function canonicalize(target, options = {}) {
   const platform = options.platform ?? process.platform;
   if (platform === "win32" && process.platform !== "win32") return target;
@@ -510,6 +554,7 @@ export function buildArgv(request, ctx = {}) {
       "--sandbox",
       "read-only",
       "--ignore-user-config",
+      "-c", 'approval_policy="never"',
       ...(schemaPath ? ["--output-schema", schemaPath] : []),
       "--json",
       "-",
@@ -1572,19 +1617,22 @@ export async function runHarness(request, deps = {}) {
     schemaText: schemaInput?.text,
   });
   const cliId = request.harness;
-  const resolved = resolveLauncher(cliId, {
+  const launch = resolveLaunch(cliId, {
     platform,
     pathEnv: env.PATH,
     existsSync: exists,
     realpathSync: deps.realpathSync,
+    execPath: deps.execPath ?? process.execPath,
   });
+  const resolved = launch.command;
+  const launchArgs = launch.args;
 
   const authArgs = request.harness === "claude"
     ? [...claudeIsolationArgs(mcpConfigPath), ...route.auth.args]
     : request.harness === "pi"
       ? piAuthCheckArgs(request)
       : [...route.auth.args];
-  const auth = spawnSyncImpl(resolved, authArgs, {
+  const auth = spawnSyncImpl(resolved, [...launchArgs, ...authArgs], {
     cwd,
     env,
     encoding: "utf8",
@@ -1628,7 +1676,7 @@ export async function runHarness(request, deps = {}) {
   let killRequest;
   let child;
   try {
-    child = spawnImpl(resolved, argv, {
+    child = spawnImpl(resolved, [...launchArgs, ...argv], {
       cwd,
       env,
       shell: false,

package/scripts/kxm-hub.mjs

@@ -50,6 +50,12 @@ function claimPidFile() {
       if (existing?.version === 1 && existing.role === "hub" && Number.isInteger(existing.pid) && processExists(existing.pid)) {
         throw new Error(`KXM hub is already managed by PID ${existing.pid}`);
       }
+      // A well-formed claim whose owner is dead is safe to reclaim. Keep
+      // malformed claims fail-closed because they may belong to another tool.
+      if (existing?.version === 1 && existing.role === "hub" && Number.isInteger(existing.pid) && !processExists(existing.pid)) {
+        rmSync(pidPath, { force: true });
+        continue;
+      }
       throw new Error(
         `KXM hub PID claim is stale at ${pidPath}; remove it only after verifying no hub process is running`,
       );

package/scripts/native-critic.d.mts

@@ -0,0 +1,5 @@
+export function nativeCriticLaunch(harness: string): {
+  model: string;
+  command: string;
+  args: string[];
+};

package/scripts/native-critic.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { HubClient } from "../plugins/kxm/dist/client.js";
+import { buildArgv } from "./harness-run.mjs";
+
+// Launch intent only: these labels are not observed model identity or admission.
+export function nativeCriticLaunch(harness) {
+  if (!["fable", "astra"].includes(harness)) {
+    throw new Error("usage: native-critic.mjs <fable|astra> <prompt>");
+  }
+  const model = harness === "fable" ? "fable" : "gpt-6-astra";
+  const command = harness === "fable" ? "claude" : "codex";
+  const args = harness === "fable"
+    ? ["-p", "--model", model, "--output-format", "json", "--no-session-persistence", "--tools", "Read,Glob,Grep", "--setting-sources", "user"]
+    : buildArgv({ harness: "codex", model, effort: "low", permission: "read-only", prompt_file: "-" });
+  return { model, command, args };
+}
+
+async function main() {
+  const [harness, ...promptParts] = process.argv.slice(2);
+  let launch;
+  try {
+    launch = nativeCriticLaunch(harness);
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 2;
+    return;
+  }
+  const { model, command, args } = launch;
+  const env = process.env;
+  const serverUrl = env.KXM_SERVER_URL || "http://127.0.0.1:7331";
+  const outDir = env.KXM_CRITIC_DIR || join(process.cwd(), ".kxm", "assets", "critic-reviews");
+  mkdirSync(outDir, { recursive: true });
+  const client = new HubClient({ serverUrl, authToken: env.KXM_AUTH_TOKEN, name: `${harness}-critic`, purpose: "independent CLI critic", project: env.KXM_PROJECT || ".kxm", model });
+  const prompt = promptParts.join(" ");
+  const agent = await client.start(() => {});
+  const result = await new Promise((resolve) => {
+    const child = spawn(command, args, { env, stdio: ["pipe", "pipe", "pipe"], shell: false });
+    let stdout = "", stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.on("error", (error) => resolve({ code: null, stdout, stderr: String(error) }));
+    child.on("close", (code, signal) => resolve({ code, signal, stdout, stderr }));
+    child.stdin.end(prompt);
+  });
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const path = join(outDir, `${harness}-${stamp}.json`);
+  writeFileSync(path, JSON.stringify({ schema: "kxm.native-critic-review.v1", harness, model, agentId: agent.id, completedAt: new Date().toISOString(), ...result }, null, 2) + "\n", { mode: 0o600 });
+  try { await client.send({ target: env.KXM_REVIEW_TARGET || agent.id, content: `${harness} review completed; artifact=${path}; exit=${String(result.code)}`, delivery: "followUp", idempotencyKey: `critic:${harness}:${stamp}` }); } catch { /* Transport artifact remains, not approval or hub peer-reply evidence. */ }
+  await client.stop();
+  if (result.code !== 0) process.exit(result.code ?? 1);
+  console.log(path);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  await main();
+}

package/.kxm/config/README.md

@@ -1,5 +0,0 @@
-# Workspace configuration
-
-Store reviewable, repository-specific harness and workflow configuration here. `env.example` documents supported environment settings. `workflows/` contains the complete Jira development lifecycle, the v0.4 dogfood workflow, and the provenance/quorum workflow used by parser and evidence-policy tests.
-
-Configuration files may reference secret environment-variable names such as `JIRA_WEBHOOK_SECRET`; they must never contain the secret values. Set `KXM_WEBHOOK_WORKFLOWS_FILE` to the chosen workflow file.

package/.kxm/config/agents.json

@@ -1,43 +0,0 @@
-{
-  "schema": "kxm.agents.v1",
-  "project": "kxm",
-  "host": "local",
-  "agents": [
-    {
-      "name": "grok",
-      "kind": "agent",
-      "driver": "ai",
-      "model": "xai/grok-4.6",
-      "thinking": "xhigh",
-      "purpose": "Sole writer; independent critic of kxm CLI and envelopes"
-    },
-    {
-      "name": "fable",
-      "kind": "agent",
-      "driver": "ai",
-      "model": "anthropic/claude-fable-5-1",
-      "thinking": "xhigh",
-      "purpose": "Independent critic: architecture and permissions"
-    },
-    {
-      "name": "gpt-sol",
-      "kind": "agent",
-      "driver": "ai",
-      "model": "openai-codex/gpt-5.6-sol",
-      "thinking": "xhigh",
-      "purpose": "Independent critic: CLI contracts and documentation"
-    },
-    {
-      "name": "kimi",
-      "kind": "agent",
-      "driver": "ai",
-      "model": "kimi-coding/kimi-for-coding",
-      "thinking": "max",
-      "purpose": "Independent critic: mapping gaps and portability"
-    }
-  ],
-  "ownership": {
-    "writeAgent": "grok",
-    "peerAgents": ["fable", "gpt-sol", "kimi"]
-  }
-}

package/.kxm/config/env.example

@@ -1,56 +0,0 @@
-KXM_HOST=127.0.0.1
-KXM_PORT=7331
-KXM_AUTH_TOKEN=replace-with-a-long-random-token
-KXM_WORKSPACE_DIR=.kxm
-# KXM_CONFIG_DIR=.kxm/config
-# KXM_LOGS_DIR=.kxm/logs
-# KXM_ASSETS_DIR=.kxm/assets
-# KXM_STATE_DIR=.kxm/state
-# KXM_DATA_PATH=.kxm/state/kxm.db
-# KXM_LOG_PATH=.kxm/logs/kxm-hub.jsonl
-KXM_PROJECT_TOKENS={"my-project":"replace-with-a-project-token"}
-KXM_MESSAGE_TTL_MS=86400000
-KXM_MESSAGE_RETENTION_MS=604800000
-KXM_RATE_LIMIT_MAX=600
-KXM_RATE_LIMIT_WINDOW_MS=60000
-KXM_WEBHOOK_WORKFLOWS_FILE=.kxm/config/workflows/jira-development.json
-JIRA_WEBHOOK_SECRET=replace-with-a-high-entropy-webhook-secret
-WORKFLOW_SIGNAL_SECRET=replace-with-a-separate-callback-secret
-
-# Client / Pi extension settings
-KXM_SERVER_URL=http://127.0.0.1:7331
-KXM_PROJECT=my-project
-KXM_AGENT_NAME=planner
-KXM_AGENT_PURPOSE=Plans work and reviews architecture
-
-# Long-lived headless Pi worker
-KXM_WORKDIR=C:\path\to\project
-KXM_WORKER_CONTINUE=true
-# Opt in after reviewing the fresh scoped-history upgrade behavior:
-# workflow = stable default Pi session plus one session per durable workflow run
-# KXM_WORKER_SESSION_ISOLATION=workflow
-# KXM_WORKER_MAX_RUN_SESSIONS=128
-# KXM_WORKER_INITIAL_CONTINUE=false
-# KXM_WORKER_LOG_PATH=.kxm/logs/kxm-worker-planner.jsonl
-# KXM_AGENT_LOG_PATH=.kxm/logs/pi-agent-planner.log
-# KXM_WORKER_MAX_RESTARTS=20
-# KXM_WORKER_MODEL=provider/model
-# KXM_WORKER_FALLBACK_MODELS=provider/fallback-one,provider/fallback-two
-# KXM_WORKER_PROVIDER_RETRY_MS=60000
-# KXM_WORKER_TOOL_TIMEOUT_MS=1860000
-# KXM_WORKER_ACTIVATION_TIMEOUT_MS=60000
-# KXM_WORKER_TOOLS=read,grep,find,ls,kxm_fanout,kxm_workflow_get
-# KXM_WORKER_EXTENSION_PATHS=plugins/kxm/src/extension.ts;C:\path\to\provider\extension.ts
-# KXM_WORKER_SKILL_PATHS=plugins/kxm/skills/kxm
-
-# Optional proposed-improvement telemetry classification override: cli or project
-# KXM_IMPROVE_TARGET=project
-
-# Opt-in Nous Pi providers (unset = no fetch, no registration)
-# KXM_NOUS_PROVIDERS=direct
-# KXM_NOUS_PROVIDERS=proxy
-# KXM_NOUS_PROVIDERS=direct,proxy
-# NOUS_API_KEY=
-# KXM_NOUS_PROXY_URL=http://127.0.0.1:8645/v1
-# KXM_NOUS_DISCOVERY_TIMEOUT_MS=5000
-# KXM_NOUS_CATALOG_FILE=

package/.kxm/config/update.example.yaml

@@ -1,9 +0,0 @@
-# Copy this file to the per-user state root. kxm never reads a project
-# .kxm/update.yaml (it prints a warning and continues). Locations:
-#   Windows: %LOCALAPPDATA%\KXM\update.yaml
-#   macOS:   ~/Library/Application Support/KXM/update.yaml
-#   Linux:   ${XDG_STATE_HOME:-~/.local/state}/kxm/update.yaml
-# Override the state root with an absolute KXM_STATE_HOME for tests.
-schema: kxm.update.v1
-auto: false
-source: github

package/.kxm/config/workflows/fix.json

@@ -1,160 +0,0 @@
-[
-  {
-    "id": "fix",
-    "source": "generic",
-    "project": "kxm",
-    "target": "coordinator",
-    "secretEnv": "FIX_WEBHOOK_SECRET",
-    "signalSecretEnv": "WORKFLOW_SIGNAL_SECRET",
-    "delivery": "followUp",
-    "maxTransitions": 28,
-    "reproOracle": { "stageId": "repro-review", "evidenceKey": "repro" },
-    "planHash": { "stageId": "final-plan", "evidenceKey": "plan" },
-    "requirePlanHash": ["implement", "local-verify", "delivery"],
-    "promptTemplate": "Bug report: {{task}}\n\nRun the /fix workflow: two-phase reproduction before any production edit, approved plan before implementation, bounded rework on failure. The confirmed reproduction is an immutable oracle.\n\nHard rules: (1) The oracle must invoke the diagnosis-named production callables on the reporter path — a sibling API or newer stack is invalid even if it fails. (2) After repro_invalidated, rewrite the draft against that named seam; never checkpoint blocked because the previous seam was wrong or because a method news its own DbContext. (3) Search existing test hosts (controller fixtures, HttpContext helpers, TransactionScope, read-only call against existing data) before declaring a seam untestable.",
-    "stages": [
-      {
-        "id": "intake",
-        "label": "Intake",
-        "area": "workflow",
-        "instructions": "Classify the bug report: expected vs actual behavior, affected surface, severity, and reproduction hints. Record a journal 'plan' entry with the classification. If the report is not actionable, checkpoint with outcome 'blocked'.",
-        "requiredEvidence": ["classification"],
-        "maxAttempts": 2,
-        "on": { "passed": "repro-explore", "blocked": "$terminal" }
-      },
-      {
-        "id": "repro-explore",
-        "label": "Repro explore (read-only)",
-        "area": "implementation",
-        "instructions": "Read and search only: locate the bug, note prior reproductions, test conventions, and similar incidents via kxm context. No source or test edits. Produce a diagnosis that names the exact production callables on the reporter path (handler, data method, or rendered component), root-cause hypothesis, expected/actual behavior, reproduction strategy, reference tests in existing area folders, and target assertions. Secondary surfaces (other API versions, other tabs) are notes only — they are not substitute oracles. Record the diagnosis with journal category 'hypothesis'.",
-        "requiredEvidence": ["diagnosis"],
-        "maxAttempts": 3,
-        "on": { "passed": "repro-write", "blocked": "$terminal" }
-      },
-      {
-        "id": "repro-write",
-        "label": "Repro write (tests only)",
-        "area": "implementation",
-        "instructions": "Write and execute the failing reproduction. Tests and test helpers only — production and configuration stay byte-for-byte unchanged. Every target assertion must call the diagnosis-named production handler, production seam, or rendered production component and fail for the reported reason rather than compilation/setup. A sibling API, newer stack, or 'also used by some admins' handler is invalid even if it fails. A method that news its own DbContext is not grounds for blocked: use existing test hosts (controller fixtures, HttpContext helpers, TransactionScope so a new context still rolls back) or a read-only call against existing data with no seed. After repro_invalidated, write a new draft against the named seam; do not checkpoint outcome blocked because the previous draft was the wrong seam. Checkpoint failed (outcome failed) to consume an attempt and rewrite. blocked is only when the ticket is not a code defect. Cite evidence key 'repro' with every test path, sha256, exact command, and failed/passed counts. This is a reviewable draft; it is not immutable until independent repro-review passes.",
-        "requiredEvidence": ["repro"],
-        "maxAttempts": 3,
-        "on": { "passed": "repro-review", "failed": "repro-write", "blocked": "$terminal" }
-      },
-      {
-        "id": "repro-review",
-        "label": "Independent reproduction review",
-        "area": "gates",
-        "instructions": "Before the oracle is captured, send the diagnosis, test files/hashes, exact failing results, and production/config git status to both independent critics. They must verify production coupling to the diagnosis-named reporter-path seam (a sibling API is invalid), full expected-behavior coverage, failure causality, immutability feasibility, and absence of production/config edits. Caller-authored evidence cannot satisfy peer review. If either critic finds an omission or invalid test, checkpoint status 'failed' with outcome 'repro_invalidated' and return to repro-write. Only unanimous validation may pass; cite the unchanged draft under evidence key 'repro'. Passing this stage captures the immutable oracle.",
-        "requiredEvidence": ["repro", "review"],
-        "maxAttempts": 3,
-        "evidencePolicies": {
-          "review": {
-            "kind": "peer-reply",
-            "minProducers": 2,
-            "eligibleAgents": ["critic-1", "critic-2"],
-            "acceptedStatuses": ["replied"]
-          }
-        },
-        "on": { "passed": "plan", "repro_invalidated": "repro-write", "blocked": "$terminal" }
-      },
-      {
-        "id": "plan",
-        "label": "Plan",
-        "area": "workflow",
-        "instructions": "Using the diagnosis and the confirmed reproduction, write the implementation plan: changed files, approach, risks, and how the reproduction proves the fix. Cite evidence key 'plan' with the plan artifact path and content hash.",
-        "requiredEvidence": ["plan"],
-        "maxAttempts": 3,
-        "on": { "passed": "critics", "blocked": "$terminal" }
-      },
-      {
-        "id": "critics",
-        "label": "Independent critics",
-        "area": "gates",
-        "instructions": "Two independent critics review the plan for correctness, scope creep, and risk. Both must reply through the mesh; caller-authored evidence cannot satisfy this policy. If the plan is invalidated, checkpoint with outcome 'plan_invalidated'.",
-        "requiredEvidence": ["critique"],
-        "maxAttempts": 3,
-        "evidencePolicies": {
-          "critique": {
-            "kind": "peer-reply",
-            "minProducers": 2,
-            "eligibleAgents": ["critic-1", "critic-2"],
-            "acceptedStatuses": ["replied"]
-          }
-        },
-        "on": { "passed": "final-plan", "plan_invalidated": "plan", "blocked": "$terminal" }
-      },
-      {
-        "id": "final-plan",
-        "label": "Final plan",
-        "area": "workflow",
-        "instructions": "Fold critic feedback into the final plan. Re-cite evidence key 'plan' with the final artifact path and content hash. The hash of this stage's plan evidence becomes the approved plan hash required by implementation.",
-        "requiredEvidence": ["plan"],
-        "maxAttempts": 2,
-        "on": { "passed": "approval", "plan_invalidated": "plan", "blocked": "$terminal" }
-      },
-      {
-        "id": "approval",
-        "label": "Human approval",
-        "area": "security",
-        "instructions": "Human operator approves the plan. Cite evidence key 'signoff' with the approver identity and approval reference. A 'rejected' outcome routes back to planning; this stage cannot be bypassed by any transition.",
-        "requiredEvidence": ["signoff"],
-        "maxAttempts": 8,
-        "on": { "passed": "implement", "rejected": "plan", "blocked": "$terminal" }
-      },
-      {
-        "id": "implement",
-        "label": "Implement",
-        "area": "implementation",
-        "instructions": "Implement the approved plan. The reproduction oracle is immutable: local verification must fail before the fix and pass after it. Cite evidence keys 'diff' and 'repro' (same value as the oracle).",
-        "requiredEvidence": ["diff"],
-        "maxAttempts": 4,
-        "on": { "passed": "local-verify", "blocked": "$terminal" }
-      },
-      {
-        "id": "local-verify",
-        "label": "Local verify",
-        "area": "gates",
-        "instructions": "Run the repo-defined gates: unit, lint, typecheck, build, and the confirmed reproduction test. Cite evidence key 'gates' with per-gate results. 'implementation_failure' reworks implementation; 'plan_invalidated' routes back to planning rather than expanding scope.",
-        "requiredEvidence": ["gates"],
-        "maxAttempts": 4,
-        "on": {
-          "passed": "delivery",
-          "implementation_failure": "implement",
-          "plan_invalidated": "plan",
-          "blocked": "$terminal"
-        }
-      },
-      {
-        "id": "delivery",
-        "label": "Delivery",
-        "area": "workflow",
-        "instructions": "Create and push the branch and merge request with the reproduction, plan, and diff references. Delivery never auto-merges: CI and review outcomes are watched in the next stage.",
-        "requiredEvidence": ["mr"],
-        "maxAttempts": 2,
-        "on": { "passed": "ci-watch", "blocked": "$terminal" }
-      },
-      {
-        "id": "ci-watch",
-        "label": "CI and review watch",
-        "area": "gates",
-        "instructions": "Watch required CI checks and review status. On failure, checkpoint with outcome 'failure' to rework through bounded transitions. On success, continue to human acceptance.",
-        "requiredEvidence": ["ci"],
-        "maxAttempts": 6,
-        "on": {
-          "passed": "ready-for-human-acceptance",
-          "failure": "implement",
-          "blocked": "$terminal"
-        }
-      },
-      {
-        "id": "ready-for-human-acceptance",
-        "label": "Ready for human acceptance",
-        "area": "workflow",
-        "instructions": "Summarize the fix: reproduction (immutable oracle), approved plan hash, diff, gate results, CI outcome, and the full claim-to-evidence trail from the run journal. Checkpoint 'passed' to complete the run; a human performs final acceptance outside the workflow.",
-        "requiredEvidence": ["summary"],
-        "maxAttempts": 2,
-        "on": { "passed": "$terminal", "blocked": "$terminal" }
-      }
-    ]
-  }
-]

package/.kxm/config/workflows/jira-development.json

@@ -1,116 +0,0 @@
-[
-  {
-    "id": "jira-development",
-    "source": "jira",
-    "project": "product",
-    "target": "coordinator",
-    "secretEnv": "JIRA_WEBHOOK_SECRET",
-    "signalSecretEnv": "WORKFLOW_SIGNAL_SECRET",
-    "event": "jira:issue_updated",
-    "filter": {
-      "path": "issue.fields.status.name",
-      "equals": "In Progress"
-    },
-    "delivery": "followUp",
-    "ttlMs": 604800000,
-    "promptTemplate": "Take ownership of Jira issue {{issue.key}} — {{issue.fields.summary}}.\n\nDescription:\n{{issue.fields.description}}\n\nIssue URL: {{issue.self}}\n\nUse the kxm workflow tools as the durable record. Preserve Jira issue {{issue.key}} as the correlation key. Only perform push, merge, or Jira mutations when the current harness permissions and repository policy authorize them.",
-    "stages": [
-      {
-        "id": "intake",
-        "area": "workflow",
-        "label": "Intake and ownership",
-        "instructions": "Validate the webhook context, repository, scope, permissions, and acceptance criteria. Confirm that the issue is actually In Progress.",
-        "requiredEvidence": ["issue key", "acceptance criteria", "repository and branch", "authorization boundary"],
-        "maxAttempts": 2
-      },
-      {
-        "id": "reproduce",
-        "area": "implementation",
-        "label": "Reproduce the issue",
-        "instructions": "Reproduce the defect before changing production code. Prefer a deterministic failing automated test and capture environment details.",
-        "requiredEvidence": ["reproduction steps", "observed failure", "expected behavior", "failing test or diagnostic artifact"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "plan-moa",
-        "area": "workflow",
-        "label": "Plan with single-agent or three-agent mixture of agents",
-        "instructions": "For simple work, produce one plan. For ambiguous or high-risk work, ask three strong planning peers independently, compare assumptions and tradeoffs, record contradictions, and synthesize the best evidence-backed plan.",
-        "requiredEvidence": ["candidate plans", "contradictions and resolutions", "selected plan", "ownership boundaries"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "plan-review",
-        "area": "workflow",
-        "label": "Review the plan",
-        "instructions": "Have an independent reviewer challenge correctness, security, migration, test, and rollback assumptions. Revise the plan when findings are material.",
-        "requiredEvidence": ["review findings", "accepted and rejected feedback", "revised plan"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "implementation",
-        "area": "implementation",
-        "label": "Implementation",
-        "instructions": "Implement the reviewed plan with explicit file ownership. Keep changes focused and preserve unrelated user work.",
-        "requiredEvidence": ["changed paths", "implementation decisions", "tests added or updated"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "local-gates",
-        "area": "gates",
-        "label": "Local code checks",
-        "instructions": "Run the repository-defined lint, build/typecheck, security scan, and Playwright suite. A warning or failure must be recorded, corrected, and rerun; do not downgrade a gate silently.",
-        "requiredEvidence": ["lint result", "build or typecheck result", "security result", "Playwright result"],
-        "maxAttempts": 5
-      },
-      {
-        "id": "repository-gates",
-        "area": "gates",
-        "label": "Repository and CodeRabbit gates",
-        "instructions": "Reproduce required repository checks locally where possible. Address CodeRabbit or equivalent review findings by evidence and rerun affected gates.",
-        "requiredEvidence": ["repository gate results", "review findings", "resolutions or justified dismissals"],
-        "maxAttempts": 5
-      },
-      {
-        "id": "documentation",
-        "area": "documentation",
-        "label": "Documentation",
-        "instructions": "Update user, operator, architecture, changelog, and test-matrix material affected by the change.",
-        "requiredEvidence": ["documentation paths", "behavior and operational changes", "examples updated"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "push-watch",
-        "area": "gates",
-        "label": "Push, open review, and watch",
-        "instructions": "When authorized, push the branch and open or update the review. Call kxm_workflow_wait with commit, pull-request, and resolved-warning evidence, then watch the example `ci` check with `kxm gate github watch --run-id <id> --stage-id push-watch --signal-key <key> --repo <owner/name> --pr <n> --required ci` so the durable wait receives exact `github.check:ci` evidence. Replace `ci` in this template and command with the repository's real required check names. Record every warning or failure, fix it, push again, and continue watching until required checks pass.",
-        "requiredEvidence": ["commit", "pull request", "resolved warnings and failures", "github.check:ci"],
-        "maxAttempts": 10
-      },
-      {
-        "id": "merge",
-        "area": "security",
-        "label": "Merge",
-        "instructions": "Merge only when approvals, required checks, branch policy, and user authorization permit it. Capture the resulting merge commit.",
-        "requiredEvidence": ["approval state", "required checks", "merge commit"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "jira-update",
-        "area": "workflow",
-        "label": "Update Jira",
-        "instructions": "Update the Jira issue through an authorized integration with the outcome, implementation and test evidence, pull request, merge commit, and any follow-up risk. Transition it according to team policy.",
-        "requiredEvidence": ["Jira transition", "Jira comment or fields", "links to pull request and merge"],
-        "maxAttempts": 3
-      },
-      {
-        "id": "retrospective",
-        "area": "workflow",
-        "label": "Continuous-improvement retrospective",
-        "instructions": "Review the run journal. Turn recurring errors, contradictions, delays, flaky gates, and harness friction into an evidence-linked improvement backlog. Do not apply policy changes automatically.",
-        "requiredEvidence": ["lessons by area", "prioritized improvements", "owner or next action", "success measure"],
-        "maxAttempts": 3
-      }
-    ]
-  }
-]