@open-agent-toolkit/cli 0.2.76 → 0.2.79

package/assets/skills/oat-project-complete/scripts/recover-completion-receipts.mjs

@@ -1,6 +1,7 @@
 import { execFile } from 'node:child_process';
-import { basename } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -692,10 +693,29 @@ async function main(argv) {
   return recoverCompletionReceipts(options);
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+/**
+ * Direct invocation, compared as canonical paths on both sides. Comparing a raw
+ * `process.argv[1]` against `import.meta.url` makes this script a silent no-op
+ * that exits 0 whenever the skill is reached through a symlinked install root,
+ * and canonicalizing only one side has the same effect under
+ * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
+ */
+function isDirectInvocation(invokedPath) {
+  if (!invokedPath) return false;
+  try {
+    return (
+      realpathSync(fileURLToPath(import.meta.url)) ===
+      realpathSync(resolve(invokedPath))
+    );
+  } catch {
+    return false;
+  }
+}
+
+if (isDirectInvocation(process.argv[1])) {
   main(process.argv.slice(2))
     .then((result) => {
       process.stdout.write(`${JSON.stringify(result)}\n`);

package/assets/skills/oat-project-complete/scripts/resolve-completion-retry.mjs

@@ -1,6 +1,7 @@
+import { realpathSync } from 'node:fs';
 import { lstat, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import {
   detectCompletionReceiptCandidate,
@@ -116,10 +117,29 @@ async function main(argv) {
   return resolveCompletionRetry(parseArguments(argv));
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+/**
+ * Direct invocation, compared as canonical paths on both sides. Comparing a raw
+ * `process.argv[1]` against `import.meta.url` makes this script a silent no-op
+ * that exits 0 whenever the skill is reached through a symlinked install root,
+ * and canonicalizing only one side has the same effect under
+ * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
+ */
+function isDirectInvocation(invokedPath) {
+  if (!invokedPath) return false;
+  try {
+    return (
+      realpathSync(fileURLToPath(import.meta.url)) ===
+      realpathSync(resolve(invokedPath))
+    );
+  } catch {
+    return false;
+  }
+}
+
+if (isDirectInvocation(process.argv[1])) {
   main(process.argv.slice(2))
     .then((result) => {
       process.stdout.write(`${JSON.stringify(result)}\n`);

package/assets/skills/oat-project-complete/scripts/resolve-synced-archive-entry.mjs

@@ -1,6 +1,8 @@
 import { execFile as execFileCallback } from 'node:child_process';
+import { realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 
 const execFile = promisify(execFileCallback);
@@ -149,10 +151,29 @@ async function main(argv) {
   return resolveSyncedArchiveEntry({ ...options, record });
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+/**
+ * Direct invocation, compared as canonical paths on both sides. Comparing a raw
+ * `process.argv[1]` against `import.meta.url` makes this script a silent no-op
+ * that exits 0 whenever the skill is reached through a symlinked install root,
+ * and canonicalizing only one side has the same effect under
+ * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
+ */
+function isDirectInvocation(invokedPath) {
+  if (!invokedPath) return false;
+  try {
+    return (
+      realpathSync(fileURLToPath(import.meta.url)) ===
+      realpathSync(resolve(invokedPath))
+    );
+  } catch {
+    return false;
+  }
+}
+
+if (isDirectInvocation(process.argv[1])) {
   main(process.argv.slice(2))
     .then((result) => process.stdout.write(`${JSON.stringify(result)}\n`))
     .catch((error) => {

package/assets/skills/oat-project-complete/scripts/validate-durable-archive-receipt.mjs

@@ -134,6 +134,10 @@ async function main(argv) {
   if (options.mode === 'receipt') {
     let report;
     try {
+      // Stdin is read to EOF with no timeout. Every caller pipes the archive
+      // report in (`printf '%s\n' "$ARCHIVE_OUTPUT" | node ...`), so EOF
+      // always arrives; a timeout would turn a slow producer into a false
+      // failure, and a caller that leaves stdin open is a caller bug.
       report = JSON.parse(readFileSync(0, 'utf8'));
     } catch (error) {
       throw receiptError(
@@ -158,6 +162,9 @@ async function main(argv) {
  * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`. Either
  * way the caller reads "exited 0" as "verified" — the fail-open shape this
  * validator exists to prevent.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
  */
 function isDirectInvocation(invokedPath) {
   if (!invokedPath) return false;

package/assets/skills/oat-project-complete/scripts/validate-nonarchive-lifecycle-receipt.mjs

@@ -11,6 +11,7 @@ import {
   resolve,
   sep,
 } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 function fail(message) {
   process.stderr.write(`Invalid non-archive lifecycle receipt: ${message}\n`);
@@ -57,104 +58,134 @@ function gitSucceeds(cwd, args) {
   }
 }
 
-const [recordArgument, commit, projectName] = process.argv.slice(2);
-if (!recordArgument || !/^[0-9a-f]{40}$/.test(commit ?? '') || !projectName) {
-  fail('expected <record-path> <full-commit-sha> <project-name>.');
-}
+function main(argv) {
+  const [recordArgument, commit, projectName] = argv;
+  if (!recordArgument || !/^[0-9a-f]{40}$/.test(commit ?? '') || !projectName) {
+    fail('expected <record-path> <full-commit-sha> <project-name>.');
+  }
 
-const unresolvedRecordPath = resolve(recordArgument);
-if (!existsSync(unresolvedRecordPath)) {
-  fail('record path does not exist; restore the synced discovery record.');
-}
-const recordPath = realpathSync(unresolvedRecordPath);
-const repoRoot = realpathSync(
-  git(dirname(recordPath), ['rev-parse', '--show-toplevel']),
-);
-const recordRelative = relative(repoRoot, recordPath);
-if (
-  recordRelative === '' ||
-  recordRelative === '..' ||
-  recordRelative.startsWith(`..${sep}`) ||
-  isAbsolute(recordRelative)
-) {
-  fail('record path is outside the repository root.');
-}
-const gitRecordPath = recordRelative.split(sep).join('/');
-if (basename(gitRecordPath, extname(gitRecordPath)) !== projectName) {
-  fail('record filename must match the project name.');
-}
-if (!gitSucceeds(repoRoot, ['merge-base', '--is-ancestor', commit, 'HEAD'])) {
-  fail('receipt commit must be an ancestor of the current repository HEAD.');
-}
-const changedPaths = git(repoRoot, [
-  'diff-tree',
-  '--root',
-  '--no-commit-id',
-  '--name-only',
-  '-r',
-  '--format=',
-  commit,
-])
-  .split('\n')
-  .filter(Boolean);
-if (changedPaths.length !== 1 || changedPaths[0] !== gitRecordPath) {
-  fail('receipt commit must change exactly the synced discovery record path.');
-}
-const expectedSubject = `chore(oat): complete synced project ${projectName}`;
-const subject = git(repoRoot, ['show', '-s', '--format=%s', commit]);
-if (subject !== expectedSubject) {
-  fail(`commit subject must be "${expectedSubject}".`);
-}
+  const unresolvedRecordPath = resolve(recordArgument);
+  if (!existsSync(unresolvedRecordPath)) {
+    fail('record path does not exist; restore the synced discovery record.');
+  }
+  const recordPath = realpathSync(unresolvedRecordPath);
+  const repoRoot = realpathSync(
+    git(dirname(recordPath), ['rev-parse', '--show-toplevel']),
+  );
+  const recordRelative = relative(repoRoot, recordPath);
+  if (
+    recordRelative === '' ||
+    recordRelative === '..' ||
+    recordRelative.startsWith(`..${sep}`) ||
+    isAbsolute(recordRelative)
+  ) {
+    fail('record path is outside the repository root.');
+  }
+  const gitRecordPath = recordRelative.split(sep).join('/');
+  if (basename(gitRecordPath, extname(gitRecordPath)) !== projectName) {
+    fail('record filename must match the project name.');
+  }
+  if (!gitSucceeds(repoRoot, ['merge-base', '--is-ancestor', commit, 'HEAD'])) {
+    fail('receipt commit must be an ancestor of the current repository HEAD.');
+  }
+  const changedPaths = git(repoRoot, [
+    'diff-tree',
+    '--root',
+    '--no-commit-id',
+    '--name-only',
+    '-r',
+    '--format=',
+    commit,
+  ])
+    .split('\n')
+    .filter(Boolean);
+  if (changedPaths.length !== 1 || changedPaths[0] !== gitRecordPath) {
+    fail(
+      'receipt commit must change exactly the synced discovery record path.',
+    );
+  }
+  const expectedSubject = `chore(oat): complete synced project ${projectName}`;
+  const subject = git(repoRoot, ['show', '-s', '--format=%s', commit]);
+  if (subject !== expectedSubject) {
+    fail(`commit subject must be "${expectedSubject}".`);
+  }
 
-let committedRecordContents;
-let record;
-try {
-  committedRecordContents = gitRaw(repoRoot, [
-    'show',
-    `${commit}:${gitRecordPath}`,
+  let committedRecordContents;
+  let record;
+  try {
+    committedRecordContents = gitRaw(repoRoot, [
+      'show',
+      `${commit}:${gitRecordPath}`,
+    ]);
+    record = JSON.parse(committedRecordContents);
+  } catch (error) {
+    fail(
+      `committed record is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (readFileSync(recordPath, 'utf8') !== committedRecordContents) {
+    fail('working-tree record content must exactly match the receipt commit.');
+  }
+  const expectedKeys = new Set([
+    'archiveSnapshot',
+    'completedAt',
+    'createdAt',
+    'ref',
+    'remote',
+    'schemaVersion',
+    'scope',
+    'slug',
+    'status',
   ]);
-  record = JSON.parse(committedRecordContents);
-} catch (error) {
-  fail(
-    `committed record is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
-  );
-}
-if (readFileSync(recordPath, 'utf8') !== committedRecordContents) {
-  fail('working-tree record content must exactly match the receipt commit.');
+  if (
+    !record ||
+    typeof record !== 'object' ||
+    Array.isArray(record) ||
+    Object.keys(record).some((key) => !expectedKeys.has(key)) ||
+    record.schemaVersion !== 1 ||
+    record.slug !== projectName ||
+    record.scope !== 'synced' ||
+    record.ref !== `refs/oat/projects/${projectName}` ||
+    record.remote !== 'origin' ||
+    record.status !== 'complete' ||
+    typeof record.createdAt !== 'string' ||
+    Number.isNaN(Date.parse(record.createdAt)) ||
+    typeof record.completedAt !== 'string' ||
+    Number.isNaN(Date.parse(record.completedAt)) ||
+    (record.archiveSnapshot !== undefined &&
+      (typeof record.archiveSnapshot !== 'string' ||
+        record.archiveSnapshot.length === 0))
+  ) {
+    fail(
+      'committed record must be a complete synced record with the exact project identity and lifecycle content.',
+    );
+  }
+
+  process.stdout.write(`${commit}\n`);
 }
-const expectedKeys = new Set([
-  'archiveSnapshot',
-  'completedAt',
-  'createdAt',
-  'ref',
-  'remote',
-  'schemaVersion',
-  'scope',
-  'slug',
-  'status',
-]);
-if (
-  !record ||
-  typeof record !== 'object' ||
-  Array.isArray(record) ||
-  Object.keys(record).some((key) => !expectedKeys.has(key)) ||
-  record.schemaVersion !== 1 ||
-  record.slug !== projectName ||
-  record.scope !== 'synced' ||
-  record.ref !== `refs/oat/projects/${projectName}` ||
-  record.remote !== 'origin' ||
-  record.status !== 'complete' ||
-  typeof record.createdAt !== 'string' ||
-  Number.isNaN(Date.parse(record.createdAt)) ||
-  typeof record.completedAt !== 'string' ||
-  Number.isNaN(Date.parse(record.completedAt)) ||
-  (record.archiveSnapshot !== undefined &&
-    (typeof record.archiveSnapshot !== 'string' ||
-      record.archiveSnapshot.length === 0))
-) {
-  fail(
-    'committed record must be a complete synced record with the exact project identity and lifecycle content.',
-  );
+
+/**
+ * Direct invocation, compared as canonical paths on both sides. Comparing a raw
+ * `process.argv[1]` against `import.meta.url` makes this script a silent no-op
+ * that exits 0 whenever the skill is reached through a symlinked install root,
+ * and canonicalizing only one side has the same effect under
+ * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
+ */
+function isDirectInvocation(invokedPath) {
+  if (!invokedPath) return false;
+  try {
+    return (
+      realpathSync(fileURLToPath(import.meta.url)) ===
+      realpathSync(resolve(invokedPath))
+    );
+  } catch {
+    return false;
+  }
 }
 
-process.stdout.write(`${commit}\n`);
+if (isDirectInvocation(process.argv[1])) {
+  main(process.argv.slice(2));
+}

package/assets/skills/oat-project-implement/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Bash(oat:*), Bash(oat project log:*), Glob, Grep, AskUserQuestion, Task
 metadata:
-  version: 2.3.9
+  version: 2.3.10
 ---
 
 # Implementation Phase

package/assets/skills/oat-project-implement/scripts/capture-dirty-tree.mjs

@@ -1051,6 +1051,9 @@ async function main(argv) {
  * `--preserve-symlinks-main`, which keeps the link in `import.meta.url`. Either
  * way the caller reads "exited 0" as "verified" — the fail-open shape the
  * contracts exist to prevent.
+ * A path that cannot be canonicalized is not a module Node loaded as the entry
+ * point, so a thrown `realpathSync` means "not invoked directly" and returns
+ * `false`; it never masks a direct run.
  */
 function isDirectInvocation(invokedPath) {
   if (!invokedPath) return false;

package/assets/skills/recon/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Glob, Grep, Bash, AskUserQuestion, Agent, mcp__*
 metadata:
-  version: 1.1.2
+  version: 1.1.5
 ---
 
 # Recon
@@ -127,8 +127,8 @@ Use the complete mode policy from `references/profiles.md` and
 `scripts/lib/routing.mjs`. Map manifest wave modes to the worker's closed
 assignment vocabulary: `redundant-gather` to `gather`;
 `semantic-verification` and `redundant-verification` to `verify`; `adversarial`
-and `contradiction-resolution` to `adversary`; and only `reconciliation` to
-`reconcile`. The remaining modes keep their same-named assignment. All lanes
+and `contradiction-resolution` to `adversary`. The remaining worker modes keep
+their same-named assignment; reconciliation is controller-owned. All lanes
 within one launch are a homogeneous wave. Select each wave independently; a
 stronger wave never raises unrelated waves' targets or effort.
 
@@ -164,9 +164,14 @@ task class and class floor. Preserve provider, route, role, model, effort,
 reasoning mode, and service tier as separate provider-native axes. A null axis
 means the adapter exposes no independently requested control; never translate
 effort between harnesses or normalize an opaque selector. Prefer the canonical
-`recon-worker` role. If that role is unavailable, plan the generic role with the
-complete worker contract as a visible generic role fallback before approval. A
-fallback after approval is forbidden.
+`recon-worker` role only when the current live Task catalog exposes it. A
+materialized `.cursor/agents/recon-worker.md` file proves installation, not that
+the current Cursor Task catalog can launch the role. If the role is absent from
+that observed catalog, plan the generic role with the complete worker contract
+as a visible generic role fallback before approval. A fallback after approval
+is forbidden. Every Cursor recon leaf, including that generic fallback, must be
+launched as a background task so a new parent-chat message cannot turn parent
+turn interruption into an apparent worker crash.
 
 Prepare a `schemaVersion: 2` draft manifest. Its execution object contains a
 complete inherited `target`, limits, waves, conditions, and later the approval.
@@ -218,7 +223,8 @@ result. If any approved axis cannot be satisfied, stop with a
 launch nothing. Never substitute a different axis to make the launch fit.
 
 Launch each wave through the dispatch dependency with exactly the approved
-axes. Immediately before each launch, check the constructed target through the
+axes. On Cursor, launch both the custom worker role and the pre-approved generic
+fallback in the background. Immediately before each launch, check the constructed target through the
 same production helper used by preview:
 
 ```bash
@@ -235,13 +241,22 @@ approved `waveId` and `laneId`. This structured identity is required for
 conditional and non-conditional lanes alike; prose is descriptive, not
 identity.
 
+Worker completion is decided from the approved-path artifact before interpreting
+a later provider transport error. When the artifact's identity, closed schema,
+bytes, and digest validate, the lane is complete; a subsequent stream-close or
+RPC error is recorded as a non-material diagnostic and never triggers a
+replacement launch. Missing or invalid output remains a terminal `PASS_FAILED`
+outcome with no retry or replacement.
+
 Run the passes in this order:
 
 1. `map` and `gather` workers write unique dossiers under `raw/dossiers/`.
    Thorough runs complete their independent `redundant-gather` wave here too.
 2. `compile` writes a candidate canonical claim ledger. A thorough candidate
    directly references a complete dossier from every approved primary and
-   redundant gather lane before any review brief is created.
+   redundant gather lane before any review brief is created. Every display
+   excerpt is an exact contiguous substring of its cited source, apart from the
+   declared `redacted-exact` representation; paraphrase is invalid evidence.
 3. Source preflight: run `scripts/validate-artifact.mjs` on the candidate
    manifest and ledger, then reopen every declared source and evidence locator
    with the checks in `scripts/validate-packet.mjs`. Resolve source roots to
@@ -251,23 +266,26 @@ Run the passes in this order:
    manifest and ledger pair validates.
 4. Profile-required `verify`, `adversary`, and `coverage` workers consume only
    immutable selectively blind briefs created by
-   `scripts/create-review-brief.mjs` at unique paths.
+   `scripts/create-review-brief.mjs` at unique paths. Each review-producing
+   wave has exactly one lane; partition source or question fan-out in the
+   applicable gather wave instead.
 5. Evaluate each predeclared evidence condition only after its completed
    predecessor artifacts exist. Record exactly one root-authored condition
    outcome. A triggered `contradiction-resolution` wave runs once as an
    `adversary` evidence assignment; a not-triggered or unresolved wave supplies
    no artifact. Accepted failure, cancellation, timeout, or missing output never
    authorizes replacement work.
-6. Standard and thorough execute exactly one terminal `reconciliation` wave,
-   mapped to `reconcile`, after required review evidence and any triggered
-   contradiction investigation. It writes a new candidate ledger without
-   mutating the prior ledger.
-
-If `reconciliation-needs-judgment` is foreseeable, select an adequate target
-for that one terminal wave before approval. If it appears after approval and
-the approved target is inadequate, preserve completed evidence and return an
-explicit unresolved, out-of-envelope gap for renewed approval or a new run.
-Never mutate the target, launch a second reconciliation, or substitute a
+6. Standard and thorough run one deterministic controller reconciliation after
+   required review evidence and any triggered contradiction investigation. The
+   controller invokes `scripts/reconcile-ledger.mjs` once using the manifest's
+   `execution.reconciliation` paths and literal producer
+   `controller:reconcile-ledger-v1`, validates both candidate outputs, copies
+   the exact ledger bytes to a packet-contained temporary file, and atomically
+   renames it to `claims.json`. No reconciliation worker is dispatched.
+
+If reconciliation requires new semantic judgment, preserve completed evidence
+and return an explicit unresolved caller-owned gap. Never mutate the target or
+substitute a
 contradiction search for synthesis.
 
 Use `references/worker-contract.md` for every assignment. Never allow two

package/assets/skills/recon/references/packet-contract.md

@@ -125,18 +125,21 @@ condition contains `conditionId`, `destinationWaveId`, `afterWaveIds`, one of
 `insufficient-evidence` or `unresolved-material-challenge`, and
 `maxActivations: 1`. Each conditional destination is a uniquely identified
 `contradiction-resolution` evidence wave, has exactly one condition, appears
-after every named predecessor and before the one terminal reconciliation, and
+after every named predecessor and before controller reconciliation, and
 owns unique lane IDs and write roots. Conversely, every wave marked
 `conditional: true` must be the destination of exactly one activating condition;
 dead conditional waves are invalid. Quick permits no conditional wave;
-standard permits one and thorough two. The profile's 4/10/20 adaptive-lane cap
+standard and thorough each permit one. The profile's 4/10/20 evidence-lane cap
 counts `gather`, `semantic-verification`, `adversarial`, `coverage`,
 `redundant-gather`, `redundant-verification`, and
 `contradiction-resolution` when those modes are permitted by the profile.
-Every permitted mode outside that counted set is fixed at exactly one lane:
-`map` and `compile` for quick, plus terminal `reconciliation` for standard and
-thorough. The resulting total lane maxima are 6/13/23, and concurrency remains
-capped at 4/6/8.
+Only `gather` and `redundant-gather` may partition a wave across multiple lanes.
+Every typed review wave and every permitted mode outside the counted set is
+fixed at exactly one lane, including `map` and `compile`. The resulting
+worker-lane maxima are 6/12/22, and concurrency remains capped at 4/6/8.
+Each review lane's approved write root must contain the corresponding fixed
+path in `execution.reconciliation`; a different approved root is invalid before
+launch.
 
 Triggered dispositions require exact complete same-run artifacts from every
 approved predecessor and concrete typed predicate evidence from those same-run
@@ -150,17 +153,14 @@ no achieved pass. Accepted failed, cancelled, timed-out, or missing predecessor
 work cannot activate replacement work. Required profile passes remain required
 regardless of conditional annotations.
 
-`reconciliation-needs-judgment` is a controller escalation outcome, never a
-condition predicate. Foreseeable judgment changes the one terminal target before
-approval. A need discovered later preserves completed work and records an
-unresolved out-of-envelope gap until renewed approval or a new run; it never
-mutates the approved target or launches a second reconciliation.
+`reconciliation-needs-judgment` is a caller-owned unresolved outcome, never a
+condition predicate or target escalation. The controller preserves completed
+work and records the gap; it never dispatches reconciliation work.
 
-The controller maps the ten manifest wave modes onto the worker contract's
-seven assignment modes: redundant gathering uses `gather`; semantic and
+The controller maps the nine manifest wave modes onto the worker contract's
+six assignment modes: redundant gathering uses `gather`; semantic and
 redundant verification use `verify`; adversarial and contradiction-resolution
-use `adversary`; and only terminal reconciliation uses `reconcile`. This mapping
-does not change the approved manifest mode used for artifact and pass checks.
+use `adversary`. Reconciliation is not a worker mode or approval target.
 
 Approval is `{ type: "explicit-user-approval", approvedAt }`. It is valid only
 for the exact proposal shown in the same uninterrupted controller flow. Resume,
@@ -183,7 +183,6 @@ complete typed artifacts of the same run:
 | `semantic-verification`    | a `recon.review-result` with kind `semantic`                              |
 | `adversarial`              | a `recon.review-result` with kind `adversarial`                           |
 | `coverage`                 | a `recon.review-result` with kind `coverage`                              |
-| `reconciliation`           | a `recon.review-result` with kind `reconciliation`                        |
 | `redundant-gather`         | a complete `gather` dossier owned by the approved `redundant-gather` wave |
 | `redundant-verification`   | a `recon.review-result` with kind `redundant-verification`                |
 | `contradiction-resolution` | a `recon.review-result` with kind `contradiction-resolution`              |
@@ -191,11 +190,11 @@ complete typed artifacts of the same run:
 `quick` requires `map` and `gather`; the canonical ledger itself is the
 compile result, so an approved `compile` lane needs no separate artifact, and
 locator validation is performed by the validator.
-`standard` adds `semantic-verification`, `adversarial`, `coverage`, and
-`reconciliation`. `thorough` adds `redundant-gather` and
+`standard` adds `semantic-verification`, `adversarial`, and `coverage`, then
+requires the manifest-bound controller reconciliation. `thorough` adds `redundant-gather` and
 `redundant-verification`. A predeclared conditional
 `contradiction-resolution` evidence pass may feed the same mandatory terminal
-reconciliation when its predicate triggers; it is not a second terminal pass.
+controller reconciliation when its predicate triggers.
 
 Thorough routing completes `redundant-gather` before `compile`. The compiled
 ledger must directly reference by exact path and digest at least one complete
@@ -346,17 +345,21 @@ branch; source ineligibility never bypasses persistence safety.
   claim/evidence associations, coverage findings, unresolved issues, and
   completion status. Every new evidence record has at least one exact
   association, and an association cannot name evidence absent from that result
-  or a claim without a disposition in that result. Reconciliation results
-  replace the brief reference with prior-ledger/revision, additions/removals,
-  exact transitions, and coverage-disposition bindings. Coverage findings are
-  closed records bound to affected claims and exact manifest gaps. Accepted
-  material gaps require a legal downgrade for every affected claim; a resolved
-  finding instead names exact typed evidence. Non-material coverage gaps
-  downgrade verified claims and transition provisional claims to unresolved,
-  while existing supported claims remain supported without verified promotion.
-  Thorough redundant verification and contradiction resolution are
-  claim-bearing typed review results, not raw dossiers: they bind immutable
-  briefs, claim dispositions, and explicit affected-contradiction dispositions.
+  or a claim without a disposition in that result.
+
+Every `unresolvedIssues` member is a string. Review results are closed objects:
+unknown fields and object-valued issue entries are invalid.
+Reconciliation results replace the brief reference with prior-ledger/revision,
+additions/removals, exact transitions, and coverage-disposition bindings.
+Coverage findings are closed records bound to affected claims and exact
+manifest gaps. Accepted
+material gaps require a legal downgrade for every affected claim; a resolved
+finding instead names exact typed evidence. Non-material coverage gaps
+downgrade verified claims and transition provisional claims to unresolved,
+while existing supported claims remain supported without verified promotion.
+Thorough redundant verification and contradiction resolution are
+claim-bearing typed review results, not raw dossiers: they bind immutable
+briefs, claim dispositions, and explicit affected-contradiction dispositions.
 
 Create immutable mode-specific review projections with
 `scripts/create-review-brief.mjs`. Verification briefs expose only claim