@ngockhoale/ukit 3.0.12 → 3.1.1

package/template_project/.omp/agents/code-reviewer.md

@@ -48,6 +48,26 @@ If any input is missing, return `CHANGES-REQUESTED` with reason "incomplete hand
 - **APPROVED-WITH-MINOR** — Minor naming / doc / style issues. Logged on task file but handoff allowed.
 - **APPROVED** — Clean.
 
+### Stage gate — verdict emission (unic-decision)
+
+You generate the findings; the FINAL verdict/bucket classification is a bounded
+decision owned by the local decision model when staged. Read
+`decisionPlane.families.review.stage` from `.ukit/storage/config.json`:
+
+- `off` (default) or any adapter failure (`outcomeClass` ≠ `accepted`/`partial`) →
+  you emit the verdict directly, exactly as today; the deterministic severity
+  aggregate (any critical → CHANGES-REQUESTED; ≥1 important or any
+  unclassified/unknown severity → APPROVED-WITH-MINOR; else APPROVED) stays
+  authoritative.
+- not `off` → emit the verdict via `node .claude/ukit/index/review-verdict.mjs`
+  (registered key `review.verdict.v1`): pipe your extracted findings as JSON on
+  stdin — whitelisted fields only (`id`, `severity`, `file`, `line`, short
+  `claim`; never diff hunks or secrets). Use the adapter's `verdict`/`buckets`
+  fields in the `## Reviewer Verdict` block.
+
+Model isolation is preserved: the verdict pass runs on the local unic-decision
+model, so reviewer ≠ executor still stands.
+
 ### Output (append to task file as `## Reviewer Verdict`)
 
 ```
@@ -139,7 +159,11 @@ additions:
   `node .claude/ukit/index/review-panel-aggregate.mjs <TASK-xxx.md...>` and hands you
   the output, the lead fills `AGREEMENT_MAP` with the emitted finding → members map
   and applies the lead-judgment buckets to every finding: **Act on** / **Consider** /
-  **Noted** / **Dismissed**.
+  **Noted** / **Dismissed**. When `decisionPlane.families.review.stage` is not `off`,
+  the lead's bucketing and panel verdict go through
+  `node .claude/ukit/index/review-verdict.mjs --panel` (`review.finding-bucket.v1` /
+  `review.panel-verdict.v1`) per the stage gate above — the deterministic aggregate
+  stays authoritative at `off` or on adapter failure.
 - `consensus≥2 identical findings = high signal`: a finding reported by two or more
   panel members is high-signal and must not be bucketed below **Consider** without a
   stated reason.

package/template_project/.omp/agents/ukit-small-task-maintainer.md

@@ -27,6 +27,22 @@ You are UKit's internal small-task maintainer. You run as a sidecar/parallel/non
 - Keeping agent context compact without removing existing lanes: Claude PreCompact/reinject stays active and Codex Desktop soft handoffs use `compact.codexContext.compactTarget` (default 150 lines; preferred 120-150; hard max 170) while preserving critical state.
 - Small, reversible UKit runtime maintenance decisions.
 
+## Bounded Decisions (stage-gated unic-decision)
+
+The six bounded decisions enumerated in `.codex/settings.json` `smallTaskModel.decisionPolicy.decisions` — `fast-vs-slow-lane`, `safe-vs-risky-lane`, `skill-routing-needed`, `step-budget-enough`, `compact-now-or-later`, `summarize-docs-or-keep-detail` — consult `unic-decision` first via the installed CLI when the decision-plane stage allows:
+
+```
+node .claude/ukit/index/sidecar-decision.mjs --decision <name> [--root <dir>]   # context JSON on stdin
+```
+
+The CLI resolves `decisionPlane.families.workflow.stage` and owns the name → `workflow.*` decision-key mapping (`--list` prints it):
+
+- `off` (default): the CLI's deterministic rules answer directly — zero transport, authoritative.
+- `shadow`: run the batch for comparison only; the deterministic rule answer stays authoritative.
+- `canary`/`default`: a valid unic-decision answer wins; an invalid or unavailable adapter falls back to the deterministic rule (`outcomeClass: 'unavailable'`).
+
+`unic-decision` is the only model allowed in these decision steps — on any failure the deterministic rule is the fallback, never another LLM for the verdict. This lane's own model (`unic-lite`) keeps generative work only: summarization, doc maintenance, and cleanup — it never emits a verdict for these decisions.
+
 ## Never Use For
 
 - Security/auth/permission/secrets work.