@ngockhoale/ukit 3.0.1 → 3.0.3

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes to UKit are documented here.
 
 
+## 3.0.3 - 2026-09-23
+
+- Same content as 3.0.2 (npm staged-publish never finalized; re-published as 3.0.3).
+
+## 3.0.2 - 2026-09-23
+
+- **v3 reshape leftovers + docs verify-and-close (cycles C49–C51)**:
+  - Decision table v2: `MODEL_TIER_BY_CONTRACT` + `resolveModelTier` in `src/core/executionContracts.js` — contract→tier resolution is now data-driven.
+  - `limits=` route-text segment behind `routing.rigor.stage` (`src/index/taskRouting.js` + `route-task.mjs` mirror; stage-off output byte-identical, 10-case suite).
+  - Mechanical validators: `handoffDocValidator.js` + `reviewPanelAggregate.js` (+ `.mjs` CLIs) — handoff doc checks and review-panel aggregation now scriptable.
+  - Exit-predicate loop in stop-coordinator; diversity-review contract; M05.1' program-gate verdict + pstack doc banners.
+  - Docs: DOC-201..206 verified shipped (165/165 acceptance tests); stale STATUS.md queue pointer + 11 roadmap rows corrected.
+
 ## 3.0.1 - 2026-09-23
 
 - **Template root split (breaking-scale layout change, kept on 3.0.x per owner decision)**: `templates/` → `template_project/` (project-level install surface) and `templates/user/` → `template_user/` (user-level `~/.ukit/` seeds). `buildPathConfig` gains `userTemplatesRoot`; `platform.user.yaml` sourceTemplates resolve relative to `template_user/`. Dev mirrors re-synced (C47 drift fixed). Pre-existing test debt fixed: `packageVersion` major pin, runtime config version, `routeCatalog` principle-skill map, `packageArtifact` negation handling, `artifactReferenceIntegrity` allowlist.

package/manifests/documentation.yaml

@@ -146,6 +146,17 @@ entries:
     load_policy: on-demand
     validation: [manual]
     archive_policy: never
+  - id: docs-engine-conformance
+    path: docs/ENGINE_CONFORMANCE.md
+    class: canonical
+    audience: [agent, maintainer]
+    owner: adapter
+    source_of_truth: manifests/engineConformance.yaml
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [manual, test:tests/consistency/engineConformance.test.js]
+    archive_policy: never
+    notes: 'hand-authored mirror of manifests/engineConformance.yaml (M05.2 rescope); edit both together'
   - id: docs-gateway
     path: docs/GATEWAY.md
     class: canonical

package/manifests/engineConformance.yaml

@@ -0,0 +1,32 @@
+# Engine conformance contract (M05.2 rescope — V3_RESHAPE §5).
+# Same logical route on all 3 engines; same completion semantics where the host
+# supports blocking; documented degradation elsewhere.
+# Every class x host cell carries a support value:
+#   enforced  — the host can hard-block / a gate reads persisted state (evidence required)
+#   degraded  — the mechanism exists only as advisory text on this host (note required)
+#   advisory  — stdout/prompt text the model is asked to respect; no enforcement expected
+# Human mirror: docs/ENGINE_CONFORMANCE.md
+# Consistency enforced by: tests/consistency/engineConformance.test.js
+version: 1
+routeParity:
+  mechanism: shared-mirror   # all engines route through the same route-task.mjs
+  evidence: tests/consistency/engineConformance.test.js
+classes:
+  host-enforced:
+    description: hook can hard-block (PreToolUse deny, Stop gate, hook deadlines)
+    hosts:
+      claude-code: { support: enforced, evidence: tests/hooks/blockDangerous.test.js }
+      codex:       { support: degraded, note: 'no PreToolUse hook surface; deny rules are advisory text in AGENTS.md/settings' }
+      omp:         { support: enforced, evidence: tests/hooks/ompHookBridge.test.js }
+  state-checked:
+    description: persisted state a gate reads (completionEvidence, ledger counters, riskEscalation)
+    hosts:
+      claude-code: { support: enforced, evidence: tests/hooks/executionLedgerRiskGate.test.js }
+      codex:       { support: degraded, note: 'no Stop hook; completionEvidence is advisory in .codex/README.md' }
+      omp:         { support: enforced, evidence: tests/hooks/ompHookBridge.test.js }
+  advisory:
+    description: stdout/prompt text the model is asked to respect (routes, suppress, budgets)
+    hosts:
+      claude-code: { support: advisory }
+      codex:       { support: advisory }
+      omp:         { support: advisory }

package/manifests/hostCapabilities.yaml

@@ -32,7 +32,7 @@ hosts:
     subagents:               { state: tested,    evidence: tests/consistency/ompAgentParity.test.js }
     hooks:                   { state: tested,    evidence: tests/hooks/ompHookBridge.test.js }
     session-start-injection: { state: tested,    evidence: tests/hooks/ompHookBridge.test.js }
-    stop-gate:               { state: unknown }
+    stop-gate:               { state: tested,    evidence: tests/hooks/ompHookBridge.test.js }
     slash-commands:          { state: observed,  note: 'delegation parentheticals checked by tests/consistency/ompCommandParity.test.js' }
     owner-file-injection:    { state: unknown }
     settings-env:            { state: observed,  note: 'template_project/.omp/config.yml modelRoles reviewed by ompAgentParity' }

package/manifests/platform.full.yaml

@@ -1815,6 +1815,32 @@ items:
     packs:
       - core
 
+  # Mechanic #10 (TASK-004): both scripts ship in template_project/ and must be
+  # manifest-listed or autoDiscoverTemplates:false skips them and the documented
+  # `node .claude/ukit/index/handoff-doc-validator.mjs` gate 404s on installs —
+  # the same bug class as BUG-C21-14 above.
+  - id: ukit-index-handoff-doc-validator-script
+    type: config
+    sourceTemplate: .claude/ukit/index/handoff-doc-validator.mjs
+    targetPath: .claude/ukit/index/handoff-doc-validator.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
+  - id: ukit-index-review-panel-aggregate-script
+    type: config
+    sourceTemplate: .claude/ukit/index/review-panel-aggregate.mjs
+    targetPath: .claude/ukit/index/review-panel-aggregate.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
   - id: gitignore-root
     type: config
     sourceTemplate: .gitignore

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/cli/commands/doctor.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import fs from 'node:fs/promises';
 import os from 'node:os';
+import { parse } from 'yaml';
 import { pathExists, readJsonIfExists } from '../../core/fileOps.js';
 import { buildPathConfig } from '../../core/paths.js';
 import { buildRuntimePaths } from '../../core/runtimePaths.js';
@@ -32,8 +33,8 @@ import { loadPlaybooks } from '../../core/userPlaybooks.js';
 import { userMemoryStats } from '../../core/memory/userMemory.js';
 
 export const DOCTOR_HELP_FLAGS = new Set(['--help', '-h']);
-const KNOWN_FLAGS = new Set([...DOCTOR_HELP_FLAGS, '--skills', '--gateway', '--docs', '--permissions', '--json']);
-const SUPPORTED_FLAGS_LIST = '--help, -h, --skills, --gateway, --docs, --permissions, --json';
+const KNOWN_FLAGS = new Set([...DOCTOR_HELP_FLAGS, '--skills', '--gateway', '--docs', '--permissions', '--conformance', '--json']);
+const SUPPORTED_FLAGS_LIST = '--help, -h, --skills, --gateway, --docs, --permissions, --conformance, --json';
 
 export function printDoctorHelp() {
   console.log('Usage: ukit doctor [options]');
@@ -47,6 +48,7 @@ export function printDoctorHelp() {
   console.log('  --docs          Run doc-contract checks (manifests/documentation.yaml projects only)');
   console.log('  --permissions   Print the full per-host permission report table');
   console.log('  --json          Emit the permission report as JSON ({permissions:{...}})');
+  console.log('  --conformance   Print the engine conformance matrix (enforcement class per host)');
 }
 
 function printPermissionSection(permissionReport, { verbose }) {
@@ -91,6 +93,40 @@ export async function runDoctor({ packageRoot, projectRoot, argv = [], homeDir =
     return;
   }
 
+  // TASK-002 / FR-003 — `--conformance` is a standalone diagnostic surface: it
+  // prints the enforcement-class matrix from manifests/engineConformance.yaml
+  // and returns. Missing/malformed manifest degrades to an `unavailable` line;
+  // it never throws and never affects the exit code (advisory report only).
+  if (argv.includes('--conformance')) {
+    const conformancePath = path.join(packageRoot, 'manifests', 'engineConformance.yaml');
+    let conformance = null;
+    let unavailableReason = null;
+    try {
+      conformance = parse(await fs.readFile(conformancePath, 'utf8'));
+    } catch (error) {
+      unavailableReason = error?.code === 'ENOENT'
+        ? 'manifests/engineConformance.yaml not found'
+        : (error?.message ?? String(error));
+    }
+    const classes = conformance?.classes;
+    if (!unavailableReason && (conformance?.version !== 1 || !classes || typeof classes !== 'object')) {
+      unavailableReason = 'unexpected manifest shape (expected version: 1 with classes)';
+    }
+    if (unavailableReason) {
+      console.log(`[UKit]   conformance: unavailable (${unavailableReason})`);
+      return;
+    }
+    console.log('[UKit] Engine conformance matrix:');
+    for (const [className, classEntry] of Object.entries(classes)) {
+      const hosts = classEntry?.hosts ?? {};
+      for (const [host, cell] of Object.entries(hosts)) {
+        const detail = cell?.evidence ?? cell?.note;
+        console.log(`[UKit]   ${host} · ${className}: ${cell?.support ?? 'unknown'}${detail ? ` (${detail})` : ''}`);
+      }
+    }
+    return;
+  }
+
   const pathConfig = buildPathConfig({ packageRoot, projectRoot });
   const runtimePaths = buildRuntimePaths(projectRoot);
   const manifest = await loadManifest(pathConfig.manifestPath);

package/src/core/executionContracts.js

@@ -90,6 +90,46 @@ export const MODEL_TIER_BY_CONTRACT = {
   'review-release': 'smart',
 };
 
+// Decision table v2 (V3_RESHAPE §5): MODEL_TIER_BY_CONTRACT stays the base row;
+// resolveModelTier adds the (riskFloor, hostCapabilities) columns. Deterministic —
+// no registry, no leases, no outbound capability calls.
+export const ROUTE_EFFORTS = new Set(['low', 'medium', 'high']);
+
+// Tier ladder for the one-band high-risk escalation; effort rides the resolved tier.
+const MODEL_TIER_ORDER = ['lite', 'code', 'smart'];
+const MODEL_TIER_EFFORT = {
+  lite: 'low',
+  code: 'medium',
+  smart: 'high',
+};
+
+/**
+ * Resolves {tier, effort, advisoryOnly} for a route. A 'high-risk' floor escalates
+ * the tier one band (lite→code→smart, capped at smart) and forces effort 'high'.
+ * Unknown mode → {tier:null, effort:null, advisoryOnly:true}. Missing/unknown
+ * riskFloor → 'none'. Missing hostCapabilities → advisoryOnly:true (the route text
+ * is all the host gets when it cannot bind model and effort).
+ */
+export function resolveModelTier({
+  executionMode = null,
+  riskFloor = null,
+  hostCapabilities = null,
+} = {}) {
+  const baseTier = MODEL_TIER_BY_CONTRACT[executionMode] ?? null;
+  if (!baseTier) {
+    return { tier: null, effort: null, advisoryOnly: true };
+  }
+  const highRisk = riskFloor?.floor === 'high-risk';
+  const tier = highRisk
+    ? MODEL_TIER_ORDER[Math.min(MODEL_TIER_ORDER.indexOf(baseTier) + 1, MODEL_TIER_ORDER.length - 1)]
+    : baseTier;
+  return {
+    tier,
+    effort: highRisk ? 'high' : MODEL_TIER_EFFORT[tier],
+    advisoryOnly: !(hostCapabilities?.canBindModel === true && hostCapabilities?.canBindEffort === true),
+  };
+}
+
 export const CONTRACT_RISK_PROFILES = {
   'tiny-fix': { riskLevel: 'minimal', contextPolicy: 'confirm-target-only' },
   'local-fix': { riskLevel: 'local', contextPolicy: 'bounded-local' },

package/src/core/handoffDocValidator.js

@@ -0,0 +1,152 @@
+// handoffDocValidator.js — TASK-004 / Cycle C50 (mechanic #10, FR-007)
+//
+// Mechanical structure gate for handoff docs. Unlike taskBudgetValidator (advisory,
+// exit 0), this validator is a REAL gate: the CLI twin exits 1 on any violation.
+// Keep that difference explicit — do not "fix" the exit code.
+//
+// Exports:
+//   validateHandoffDoc(markdown, kind) → { ok: boolean, failures: string[] }
+//     kind ∈ 'plan' | 'task' | 'executor-report'
+//
+// Rules (SPEC §5 FR-007):
+//   plan            — `## §1`..`## §6` headings present and in ascending order
+//                     (extra trailing sections allowed), `## Planner Report`
+//                     section containing `PLANNER_MODEL:`.
+//   task            — required `## ` sections: Goal, Target Files, Test Cases,
+//                     Test Files, Verification Commands, Acceptance Criteria,
+//                     Dependencies, Interfaces; plus a `- Status:` field.
+//                     When the doc also carries `## Executor Report`, the report
+//                     header fields are validated too.
+//   executor-report — required fields: EXECUTOR_TOOL, EXECUTOR_MODEL,
+//                     EXECUTOR_SUBAGENT, RED_OUTPUT.
+//
+// Parsing is deliberately markdown-light and dependency-free so the logic can be
+// duplicated byte-for-byte into the shipped CLI twin
+// (template_project/.claude/ukit/index/handoff-doc-validator.mjs) without
+// dragging `src/` into user installs — same pattern as taskBudgetValidator (C12).
+
+const PLAN_SECTIONS = ['§1', '§2', '§3', '§4', '§5', '§6'];
+
+const TASK_SECTIONS = [
+  'Goal',
+  'Target Files',
+  'Test Cases',
+  'Test Files',
+  'Verification Commands',
+  'Acceptance Criteria',
+  'Dependencies',
+  'Interfaces',
+];
+
+const REPORT_FIELDS = ['EXECUTOR_TOOL', 'EXECUTOR_MODEL', 'EXECUTOR_SUBAGENT', 'RED_OUTPUT'];
+
+// Section helpers. Any line starting with `## ` opens a section; the body runs
+// until the next `## ` line or EOF. Returns [{ name, body, pos }] in file order.
+function splitSections(markdown) {
+  const sections = [];
+  const lines = String(markdown).split('\n');
+  let current = null;
+  lines.forEach((line, idx) => {
+    const m = line.match(/^##\s+(.+?)\s*$/);
+    if (m) {
+      current = { name: m[1], body: '', pos: idx };
+      sections.push(current);
+    } else if (current) {
+      current.body += line + '\n';
+    }
+  });
+  return sections;
+}
+
+// Positions of `## §<n>` headings, keyed by the literal token ('§1'..'§6').
+// A heading matches when its name starts with the token (`## §1 Intent`).
+function planSectionPositions(sections) {
+  const positions = new Map();
+  for (const s of sections) {
+    for (const token of PLAN_SECTIONS) {
+      if (!positions.has(token) && s.name.startsWith(token)) positions.set(token, s.pos);
+    }
+  }
+  return positions;
+}
+
+function hasSection(sections, name) {
+  return sections.some((s) => s.name === name || s.name.startsWith(`${name} `) || s.name.startsWith(`${name}(`));
+}
+
+function getSection(sections, name) {
+  return sections.find((s) => s.name === name || s.name.startsWith(`${name} `) || s.name.startsWith(`${name}(`));
+}
+
+function validatePlan(markdown) {
+  const failures = [];
+  const sections = splitSections(markdown);
+  const positions = planSectionPositions(sections);
+
+  for (const token of PLAN_SECTIONS) {
+    if (!positions.has(token)) failures.push(`missing required section heading "## ${token}"`);
+  }
+
+  // Order check over the sections that exist: each must appear after the
+  // highest position seen so far.
+  let maxPos = -1;
+  for (const token of PLAN_SECTIONS) {
+    const pos = positions.get(token);
+    if (pos === undefined) continue;
+    if (pos < maxPos) {
+      failures.push(`section order violation: "## ${token}" appears after a later section`);
+    } else {
+      maxPos = pos;
+    }
+  }
+
+  const report = getSection(sections, 'Planner Report');
+  if (!report) {
+    failures.push('missing required section "## Planner Report"');
+  } else if (!/^PLANNER_MODEL\s*:/m.test(report.body)) {
+    failures.push('missing required field "PLANNER_MODEL:" inside "## Planner Report"');
+  }
+
+  return failures;
+}
+
+function validateExecutorReportFields(markdown, prefix) {
+  const failures = [];
+  for (const field of REPORT_FIELDS) {
+    if (!new RegExp(`^${field}\\s*:`, 'm').test(markdown)) {
+      failures.push(`${prefix}missing required field "${field}:"`);
+    }
+  }
+  return failures;
+}
+
+function validateTask(markdown) {
+  const failures = [];
+  const sections = splitSections(markdown);
+
+  for (const name of TASK_SECTIONS) {
+    if (!hasSection(sections, name)) failures.push(`missing required section "## ${name}"`);
+  }
+  if (!/^\s*-?\s*Status\s*:/m.test(markdown)) {
+    failures.push('missing required field "Status:"');
+  }
+
+  // A task file that already carries an Executor Report must satisfy the
+  // report header contract too (FR-007).
+  const report = getSection(sections, 'Executor Report');
+  if (report) {
+    failures.push(...validateExecutorReportFields(report.body, 'executor-report: '));
+  }
+
+  return failures;
+}
+
+export function validateHandoffDoc(markdown, kind) {
+  const text = String(markdown ?? '');
+  let failures;
+  if (kind === 'plan') failures = validatePlan(text);
+  else if (kind === 'task') failures = validateTask(text);
+  else if (kind === 'executor-report') failures = validateExecutorReportFields(text, '');
+  else failures = [`unknown kind "${kind}" (expected plan|task|executor-report)`];
+  return { ok: failures.length === 0, failures };
+}

package/src/core/reviewPanelAggregate.js

@@ -0,0 +1,120 @@
+// reviewPanelAggregate.js — TASK-004 / Cycle C50 (mechanic #10, FR-008)
+//
+// Deterministic aggregation of `## Reviewer Verdict` blocks written by the
+// `modelRoles['review-panel']` diversity-review panel (mechanic #6). The
+// orchestrator stays context-lean: this script does the consensus math.
+//
+// Exports:
+//   parseVerdictBlock(text) → { member, verdict, findings } | null
+//   aggregatePanelVerdicts(verdicts: string[]) →
+//     { agreementMap: [{ finding, members[] }],
+//       verdict: 'approved' | 'approved_minor' | 'changes_requested',
+//       highSignal: [{ finding, members[] }],
+//       unparsed: string[] }
+//
+// Consensus rules (SPEC §5 FR-008):
+//   changes_requested — ≥1 CRITICAL verdict, ≥1 critical-severity finding,
+//                       or ≥2 CHANGES-REQUESTED verdicts.
+//   approved          — ≥2 APPROVED verdicts and no critical.
+//   approved_minor    — everything else (incl. degenerate/empty panel).
+//
+// High signal: a finding reported by ≥2 panel members, or any critical-severity
+// finding (a lone critical must never be buried below the lead's judgment).
+//
+// Advisory class: the CLI twin always exits 0.
+//
+// Parsing is deliberately markdown-light and dependency-free so the logic can be
+// duplicated byte-for-byte into the shipped CLI twin
+// (template_project/.claude/ukit/index/review-panel-aggregate.mjs) — same
+// pattern as taskBudgetValidator (C12).
+
+const SEVERITIES = ['critical', 'important', 'minor'];
+
+// Parse one `## Reviewer Verdict` block (format: code-reviewer.md §Output).
+// Returns null when no recognizable VERDICT line exists — the block is then
+// counted as absent and named in `unparsed`.
+export function parseVerdictBlock(text) {
+  const src = String(text ?? '');
+  const verdictMatch = src.match(/^VERDICT\s*:\s*(APPROVED-WITH-MINOR|APPROVED|CHANGES-REQUESTED|CRITICAL)\s*$/im);
+  if (!verdictMatch) return null;
+
+  const memberMatch = src.match(/^PANEL_MEMBER\s*:\s*(\S+)\s*$/im);
+  const member = memberMatch && memberMatch[1] !== '-' ? memberMatch[1] : null;
+
+  const findings = { critical: [], important: [], minor: [] };
+  const findingsMatch = src.match(/^FINDINGS:\s*$/im);
+  if (findingsMatch) {
+    const rest = src.slice(findingsMatch.index + findingsMatch[0].length);
+    let severity = null;
+    for (const line of rest.split('\n')) {
+      if (/^\S/.test(line)) break; // next top-level field ends FINDINGS
+      const sev = line.match(/^\s{2}(critical|important|minor)\s*:/);
+      if (sev) {
+        severity = sev[1];
+        continue;
+      }
+      const item = line.match(/^\s{4}-\s+(.+?)\s*$/);
+      if (item && severity) {
+        const text2 = item[1];
+        if (text2 !== 'none' && text2 !== '-') findings[severity].push(text2);
+      }
+    }
+  }
+
+  return { member, verdict: verdictMatch[1].toUpperCase(), findings };
+}
+
+// Normalize a finding bullet for identity comparison: two members report the
+// "identical finding" when the normalized text matches.
+function normalizeFinding(text) {
+  return String(text).replace(/\s+/g, ' ').trim().toLowerCase();
+}
+
+export function aggregatePanelVerdicts(verdicts) {
+  const list = Array.isArray(verdicts) ? verdicts : [];
+  const parsed = [];
+  const unparsed = [];
+
+  list.forEach((block, i) => {
+    const p = parseVerdictBlock(block);
+    if (p) parsed.push({ ...p, label: p.member || `verdict[${i}]` });
+    else unparsed.push(`verdict[${i}]`);
+  });
+
+  // Agreement Map: finding → set of panel members reporting it.
+  const map = new Map(); // normalized → { finding, members:Set, critical:boolean }
+  for (const p of parsed) {
+    for (const sev of SEVERITIES) {
+      for (const f of p.findings[sev]) {
+        const key = normalizeFinding(f);
+        let entry = map.get(key);
+        if (!entry) {
+          entry = { finding: f, members: new Set(), critical: sev === 'critical' };
+          map.set(key, entry);
+        }
+        entry.members.add(p.label);
+        if (sev === 'critical') entry.critical = true;
+      }
+    }
+  }
+
+  const agreementMap = [...map.values()].map((e) => ({
+    finding: e.finding,
+    members: [...e.members],
+  }));
+  const highSignal = [...map.values()]
+    .filter((e) => e.members.size >= 2 || e.critical)
+    .map((e) => ({ finding: e.finding, members: [...e.members] }));
+
+  const approvals = parsed.filter((p) => p.verdict === 'APPROVED').length;
+  const changeRequests = parsed.filter((p) => p.verdict === 'CHANGES-REQUESTED').length;
+  const hasCritical =
+    parsed.some((p) => p.verdict === 'CRITICAL') || parsed.some((p) => p.findings.critical.length > 0);
+
+  let verdict;
+  if (hasCritical || changeRequests >= 2) verdict = 'changes_requested';
+  else if (approvals >= 2) verdict = 'approved';
+  else verdict = 'approved_minor';
+
+  return { agreementMap, verdict, highSignal, unparsed };
+}

package/src/index/taskRouting.js

@@ -11,6 +11,8 @@ import {
   EXECUTION_CONTRACTS,
   EXECUTION_MODE_ORDER,
   MODEL_TIER_BY_CONTRACT,
+  ROUTE_EFFORTS,
+  resolveModelTier,
 } from '../core/executionContracts.js';
 import { resolveModelRoles, readMergedRuntimeConfig } from '../core/runtimeConfig.js';
 import { resolvePlaybook } from '../core/userPlaybooks.js';
@@ -275,6 +277,37 @@ function formatRiskFloorSegment(riskFloor = null) {
   return printed.length > 0 ? `risk=${riskFloor.floor}(${printed.join(',')})` : null;
 }
 
+// FR-001 (M01.2' limits fragment): compile the contract's numeric budget keys
+// into an advisory map. Only finite numbers survive — a non-numeric or missing
+// key is simply absent. Zero is a real budget ("no read passes"), never
+// filtered. Same key set as the ceremonyBudget.limits builder below.
+export function deriveCeremonyLimits(executionContract = null) {
+  if (executionContract === null || typeof executionContract !== 'object') {
+    return {};
+  }
+  return Object.fromEntries(
+    ['maxReadPasses', 'maxContextPulls', 'maxReadPassesBeforeReassess']
+      .filter((key) => Number.isFinite(executionContract[key]))
+      .map((key) => [key, executionContract[key]]),
+  );
+}
+
+// Route-line segment (FR-002): fixed reads,ctx,reassess order; only present
+// keys print. Empty/absent map → null so the segment never appears.
+export function formatLimitsSegment(limits = null) {
+  if (limits === null || typeof limits !== 'object') {
+    return null;
+  }
+  const parts = [
+    ['reads', 'maxReadPasses'],
+    ['ctx', 'maxContextPulls'],
+    ['reassess', 'maxReadPassesBeforeReassess'],
+  ]
+    .filter(([, key]) => Number.isFinite(limits[key]))
+    .map(([label, key]) => `${label}:${limits[key]}`);
+  return parts.length > 0 ? `limits=${parts.join(',')}` : null;
+}
+
 // FR-004 (M01.3'): Fast Path eligibility predicate. Returns null when no riskFloor
 // was supplied — eligibility must never be derived without the floor check, so a
 // missing floor means "not computed", not "none". Eligible iff the lane is
@@ -383,6 +416,10 @@ function buildResolvedRouteFields({
   completionState = null,
   riskFloor = null,
 } = {}) {
+  // Decision table v2 (FR-001/FR-002): tier + effort resolve together from the
+  // contract lane and the additive riskFloor. The router cannot observe host
+  // binding capabilities, so the emitted pair is advisory text by definition.
+  const tierDecision = resolveModelTier({ executionMode, riskFloor });
   const signalText = buildRouteSignalText(routingContext.promptText, routingContext.commandText);
   const deliveryOnly = isDeliveryOnlyRequest({
     signalText,
@@ -407,7 +444,8 @@ function buildResolvedRouteFields({
       riskFloor: riskFloor?.floor ?? null,
       phase: null,
       contractVersion: ROUTE_CONTRACT_VERSION,
-      modelTier: executionContract?.modelTier ?? MODEL_TIER_BY_CONTRACT[executionMode] ?? null,
+      modelTier: tierDecision.tier,
+      effort: tierDecision.effort,
     },
     evidence: {
       observations: [],
@@ -490,6 +528,10 @@ export function validateResolvedRoute(route = null) {
     if (route.execution.modelTier !== null && !ROUTE_MODEL_TIERS.has(route.execution.modelTier)) {
       errors.push(`execution.modelTier must be null or one of: ${[...ROUTE_MODEL_TIERS].join(', ')}.`);
     }
+    if (route.execution.effort !== null && route.execution.effort !== undefined
+      && !ROUTE_EFFORTS.has(route.execution.effort)) {
+      errors.push(`execution.effort must be null or one of: ${[...ROUTE_EFFORTS].join(', ')}.`);
+    }
   }
   if (!isObject(route.evidence)) {
     errors.push('evidence must be an object.');
@@ -849,6 +891,12 @@ export function buildRouteSummary({
       })
     : null;
   const riskSegment = formatRiskFloorSegment(riskFloor);
+  // FR-003 (M01.2' limits fragment): the rigor advisory — emitted whenever
+  // rigor.stage is on, independent of fastPath/escalation. Stage off → no
+  // segment, byte-identical route.
+  const limitsSegment = resolveRouteStage(runtimeConfig, 'rigor') !== 'off'
+    ? formatLimitsSegment(deriveCeremonyLimits(executionContract))
+    : null;
   // FR-004 (M01.3'): fastPath is emitted whenever its own stage is on — the field
   // is always set then (eligible or not) so telemetry/harness can read it; the
   // route-line segment prints only for eligible routes.
@@ -920,6 +968,7 @@ export function buildRouteSummary({
     formatCompactSegment('styles', styleFiles),
     editGuardHint ? `editGuard=${editGuardHint}` : null,
     riskSegment,
+    limitsSegment,
     fastPathSegment,
     delegationRecommendation?.hint ? `delegate=${delegationRecommendation.hint}` : null,
     policyMode ? `policy=${policyMode}` : null,

package/template_project/.claude/agents/code-reviewer.md

@@ -57,6 +57,8 @@ If any input is missing, return `CHANGES-REQUESTED` with reason "incomplete hand
 VERDICT: APPROVED | APPROVED-WITH-MINOR | CHANGES-REQUESTED | CRITICAL
 REVIEWER_MODEL: [model name actually used]
 EXECUTOR_MODEL: [from executor report]
+PANEL_MEMBER: [panel tier — `smart`/`code`/`lite`, or `solo` when the panel degenerates; `-` outside panel runs]
+AGREEMENT_MAP: [lead member only — finding → panel members reporting it, from review-panel-aggregate.mjs output; `-` otherwise]
 VERIFICATION_RERUN:
   command: [exact command]
   result: [N pass / M fail]
@@ -121,6 +123,29 @@ Same model is the most common silent failure. Do not skip this check.
 - Keep the verdict block <= 30 lines. Findings are bullet points, not essays.
 - The same-model refusal above is non-negotiable: bypassing it defeats the entire Quality Gate.
 
+## Panel review (diversity review)
+
+When the orchestrator spawns you as one member of the `modelRoles['review-panel']`
+panel (`.ukit/storage/config.json` → `modelRoles`, default `['smart','code','lite']`),
+everything above applies unchanged — same Review order, same severity ladder, same
+verdict block — with these additions:
+
+- Set `PANEL_MEMBER: <tier>` in the verdict to your panel tier (e.g. `smart`,
+  `code`, `lite`). Every member runs the same rubric independently; do not read or
+  wait for other members' verdicts.
+- Leave `AGREEMENT_MAP` as `-` unless you are the **lead member** (the first entry in
+  `modelRoles['review-panel']` = the judgment tier). After the orchestrator runs
+  `node .claude/ukit/index/review-panel-aggregate.mjs <TASK-xxx.md...>` and hands you
+  the output, the lead fills `AGREEMENT_MAP` with the emitted finding → members map
+  and applies the lead-judgment buckets to every finding: **Act on** / **Consider** /
+  **Noted** / **Dismissed**.
+- `consensus≥2 identical findings = high signal`: a finding reported by two or more
+  panel members is high-signal and must not be bucketed below **Consider** without a
+  stated reason.
+- Degenerate panel: if `modelRoles['review-panel']` is empty or has one entry, the
+  panel collapses to a single reviewer — run the normal solo review, set
+  `PANEL_MEMBER: solo`, and note the fallback in `NOTES`.
+
 ## Spec/Plan Review (REVIEW_TARGET_TYPE=spec|plan)
 
 ### Inputs you expect