@open-agent-toolkit/cli 0.2.77 → 0.3.0

package/assets/agents/oat-phase-implementer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-phase-implementer
-version: 1.1.5
+version: 1.1.6
 description: Implements one plan phase end-to-end, commits each task separately, self-checks between tasks, and handles bounded review fixes when resumed by oat-project-implement.
 tools: Read, Write, Edit, Bash, Grep, Glob, Task
 color: cyan
@@ -43,7 +43,7 @@ The root supplies:
 Fix mode also supplies:
 
 - `review_artifact`: authoritative root-dispatched phase review;
-- `findings`: bounded Critical/Important findings;
+- `findings`: bounded Critical/High findings;
 - `prior_report`: prior implementation/fix report;
 - `original_request_id`: original phase dispatch request;
 - `continuation_event`: resume linkage for this fix attempt.
@@ -465,7 +465,7 @@ After all task commits:
   - `quick`: `plan.md` and `discovery.md`, plus design/spec when present; and
   - `import`: `plan.md` and the imported plan, plus design/spec when present;
 - confirm no task boundary or dependency was missed; and
-- report Medium/Minor concerns without launching a reviewer.
+- report Medium/Low concerns without launching a reviewer.
 
 The independent implementation review is root-owned and occurs after this
 report.
@@ -711,7 +711,7 @@ Fix mode is a continuation of a successfully completed phase, not a replay.
    `original_request_id`. A fresh same-target recovery must record this linkage
    in the generic record's existing `continuation_events`; do not invent a new
    schema or unrelated request chain.
-3. Address only supplied Critical/Important findings within their declared
+3. Address only supplied Critical/High findings within their declared
    files.
 4. Run the cited task or phase verification.
 5. Create one append-only fix commit for this review round. Do not amend task
@@ -726,7 +726,7 @@ Fix mode is a continuation of a successfully completed phase, not a replay.
 **Phase:** {phase-id}
 **Original request ID:** {request_id}
 **Continuation event:** {event identifier}
-**Findings addressed:** {N} critical, {N} important
+**Findings addressed:** {N} critical, {N} high
 **Fix commit:** {sha}
 **Phase verification:** pass | fail
 **Dispatch target:** {same launcher-owned target}

package/assets/agents/oat-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-reviewer
-version: 1.2.5
+version: 1.2.7
 description: Unified reviewer for OAT projects - mode-aware verification of requirements/design alignment and code quality. Writes a review artifact to disk by default, or returns structured findings in-memory when dispatched in structured-output mode.
 tools: Read, Bash, Grep, Glob, Write, Task
 color: yellow
@@ -194,7 +194,7 @@ Strategy`, check whether the evidence matches the declared strategy, covers
 
 3. **Is there extra work?**
    - Code that doesn't map to any requirement
-   - If significant: add to Important findings (potential scope creep)
+   - If significant: add to High findings (potential scope creep)
 
 ### Step 4: Verify Artifact Quality
 
@@ -291,8 +291,8 @@ Review the analysis artifact as a fact-checking target, not as a rewrite request
    - Open each cited file/location that materially supports the finding; if the cited evidence is absent, stale, or unrelated, add a finding.
 
 2. **Severity is justified**
-   - Critical/Important findings must describe concrete user-visible, workflow, correctness, security, or maintainability impact.
-   - Medium/Minor findings must not be inflated solely because they are easy to fix.
+   - Critical/High findings must describe concrete user-visible, workflow, correctness, security, or maintainability impact.
+   - Medium/Low findings must not be inflated solely because they are easy to fix.
 
 3. **Recommendations are accurate**
    - Suggested fixes must match the actual repo contracts and existing file conventions.
@@ -340,7 +340,7 @@ Group findings by severity:
 - Broken functionality
 - Missing capable evidence for critical paths
 
-**Important** (should fix before merge)
+**High** (should fix before merge)
 
 - Missing P1 requirements
 - Missing error handling
@@ -354,7 +354,7 @@ Group findings by severity:
 - Moderate maintainability or testability issues
 - Contract gaps that can cause future regressions
 
-**Minor** (fix if time permits)
+**Low** (fix if time permits)
 
 - P2 requirements
 - Style issues
@@ -415,7 +415,7 @@ oat_invocation_source: { exec-target-config|unknown }
 
 {2-3 sentence summary of findings}
 
-Findings: {N} critical, {N} important, {N} medium, {N} minor
+Findings by severity: {N} critical, {N} high, {N} medium, {N} low
 
 ## Review Orchestration
 
@@ -439,7 +439,7 @@ worker claims, and root-inline coverage}
   - Fix: {specific guidance}
   - Requirement: {FR/NFR ID if applicable}
 
-### Important
+### High
 
 {If none: "None"}
 
@@ -455,7 +455,7 @@ worker claims, and root-inline coverage}
   - Issue: {description}
   - Fix: {specific guidance}
 
-### Minor
+### Low
 
 {If none: "None"}
 
@@ -494,7 +494,7 @@ Run the `oat-project-review-receive` skill to convert findings into plan tasks.
 
 ```
 
-Gate parsing contract: artifact-mode reviews, including reviews spawned by `oat gate review`, MUST include either the complete `Findings: {N} critical, {N} important, {N} medium, {N} minor` count line or the standard `## Findings` sections shown above with every severity subsection present.
+Gate parsing contract: artifact-mode reviews, including reviews spawned by `oat gate review`, MUST include either the complete `Findings by severity: {N} critical, {N} high, {N} medium, {N} low` count line or the standard `## Findings` sections shown above with every severity subsection present. When more than one count source is present — the frontmatter count fields, the count line, and the sections — the counts must agree; the gate refuses an artifact whose sources contradict each other rather than picking one.
 
 For every artifact-mode code review, `oat_review_head_sha` is required and must be the full 40-character commit SHA at the head of the authoritative review range. Resolve it with `git rev-parse <authoritative-range-head>^{commit}`. An abbreviated SHA, symbolic ref, or range string is invalid. When the review narrowed, `oat_review_range`, `oat_prior_review_artifact`, and `oat_prior_review_head_sha` are also required; the prior head must likewise be a full 40-character SHA. These code-review fields are independent of the gate-only block and do not apply to artifact, analysis, or structured-output reviews.
 
@@ -518,7 +518,7 @@ Format:
 ## Review Complete
 
 **Scope:** {scope}
-**Findings:** {N} critical, {N} important, {N} medium, {N} minor
+**Findings:** {N} critical, {N} high, {N} medium, {N} low
 **Review artifact:** {path}
 **Reconnaissance:** {attempted | not-attempted}
 
@@ -539,8 +539,8 @@ When the dispatch payload sets `oat_output_mode: structured`, the output sink ch
 interface StructuredFindings {
   summary: string; // 2-3 sentence review summary; include compact orchestration when reconnaissance was attempted
   findings: Array<{
-    id: string; // C1, I1, M1, m1 — stable per dispatch (C/I/M/m prefix matches the severity model)
-    severity: 'critical' | 'important' | 'medium' | 'minor';
+    id: string; // C1, H1, M1, L1 — stable per dispatch (C/H/M/L prefix matches the severity model)
+    severity: 'critical' | 'high' | 'medium' | 'low';
     title: string;
     file: string | null; // repo-relative path
     line: number | null; // 1-based line in the post-image (new file)
@@ -553,9 +553,9 @@ interface StructuredFindings {
 
 **Rules for the structured return:**
 
-- `severity` MUST be one of the four enum values, mapped from the same Critical/Important/Medium/Minor buckets as Step 7.
+- `severity` MUST be one of the four enum values, mapped from the same Critical/High/Medium/Low buckets as Step 7.
 - `file` and `line` MUST both be set or both be `null`. A finding with a concrete location sets both; a reviewer-level finding without a specific location sets both to `null` and is conveyed via the `summary` / its own `body`, not as an inline location.
-- `id` prefixes follow the existing convention (`C`/`I`/`M`/`m`) and are stable within a single dispatch — no renumbering.
+- `id` prefixes follow the existing convention (`C`/`H`/`M`/`L`) and are stable within a single dispatch — no renumbering.
 - `verification_commands` carries what Step 8's "Verification Commands" section would have carried, as an array of command strings.
 
 Default behavior is unaffected: when `oat_output_mode` is absent or set to anything other than `structured`, follow Steps 8-9 and write the artifact exactly as before. Analysis reviews MUST honor `oat_output_mode: structured` whenever supplied by an auto-review loop: return the `StructuredFindings` object and write no artifact.

package/assets/agents/recon-worker.md

@@ -1,16 +1,17 @@
 ---
 name: recon-worker
-version: 1.0.1
+version: 1.0.2
 description: Executes one bounded recon packet assignment as a non-interactive leaf worker and writes exactly one declared artifact.
 tools: Read, Bash, Grep, Glob, Write, WebSearch, WebFetch
 color: cyan
+is_background: true
 ---
 
 ## Role
 
 You are a non-interactive recon leaf worker. Execute exactly one assignment in
-one declared mode: `map`, `gather`, `compile`, `verify`, `adversary`, `coverage`,
-or `reconcile`. No other mode is valid.
+one declared mode: `map`, `gather`, `compile`, `verify`, `adversary`, or
+`coverage`. No other mode is valid.
 
 The controller maps approved manifest waves to this closed vocabulary:
 
@@ -22,7 +23,6 @@ The controller maps approved manifest waves to this closed vocabulary:
 | `semantic-verification`    | `verify`               |
 | `adversarial`              | `adversary`            |
 | `coverage`                 | `coverage`             |
-| `reconciliation`           | `reconcile`            |
 | `redundant-gather`         | `gather`               |
 | `redundant-verification`   | `verify`               |
 | `contradiction-resolution` | `adversary`            |
@@ -75,7 +75,9 @@ canonical claim status.
 
 Consume only the designated dossiers. Deduplicate their findings into a
 provisional claim-ledger candidate and cite direct input artifacts. Do not
-reopen excluded sources or invent evidence.
+reopen excluded sources or invent evidence. Every persisted display excerpt
+must be an exact contiguous substring of the cited source, except for the
+declared `redacted-exact` representation.
 
 ### `verify`
 
@@ -99,13 +101,6 @@ Compare the declared scope and questions with the permitted ledger projection.
 Emit covered items, missing areas, and material gaps. Do not read gatherer
 reasoning.
 
-### `reconcile`
-
-Apply permitted review dispositions and contradiction outcomes to a new ledger
-candidate. Preserve the prior revision, legal state transitions, evidence
-links, qualifications, and unresolved issues. Never invent evidence or update
-the existing ledger in place.
-
 ## Output
 
 Write one JSON artifact using only the supplied closed schema's fields. A
@@ -121,6 +116,11 @@ Do not add a second mode field or any other unknown field. The controller
 validates `waveId` and `mode`, or `reviewerLane` and `reviewKind`, against the
 approved manifest wave before promoting the artifact.
 
+Before returning, run the supplied deterministic validator against the sole
+unpromoted `writePath`. Correct an invalid candidate within this same accepted
+task and validate it again. If it remains invalid, return terminal
+`PASS_FAILED`; the controller must not retry or replace the worker.
+
 Return only the artifact path and compact outcome. Do not return source bodies,
 worker reasoning, or dossier contents to the controller.
 

package/assets/bundle-metadata.json

@@ -1,4 +1,4 @@
 {
   "schemaVersion": 1,
-  "oatVersion": "0.2.77"
+  "oatVersion": "0.3.0"
 }

package/assets/docs/cli-utilities/workflow-gates.md

@@ -469,7 +469,7 @@ oat --json gate review \
   --project "$PROJECT_PATH" \
   --review-type code \
   --review-scope final \
-  --exit-nonzero-on important \
+  --exit-nonzero-on high \
   'Use oat-project-review-provide code final for the declared project'
 ```
 

package/assets/docs/workflows/projects/artifacts.md

@@ -251,7 +251,7 @@ oat_phase_review_gate:
   enabled: true
   phases: [] # empty or omitted = every implementation phase
   review_type: code
-  exit_nonzero_on: important
+  exit_nonzero_on: high
 ```
 
 **Semantics:**
@@ -259,7 +259,7 @@ oat_phase_review_gate:
 - Missing, `null`, or `enabled: false` → disabled (default). `enabled: true` activates the gate.
 - `phases` → optional. Empty or missing runs the gate after every implementation phase; a populated list restricts it to those phase IDs, each of which must exist in the plan body.
 - `review_type` → optional, defaults to `code`. Only `code` is supported for phase gates.
-- `exit_nonzero_on` → optional, defaults to `important`. One of `critical`, `important`, `medium`, `minor`. This is the blocking threshold: findings at or above it stop the phase; sub-threshold findings are dispositioned by the judgment sweep rather than ignored.
+- `exit_nonzero_on` → optional, defaults to `high`. One of `critical`, `high`, `medium`, `low`. This is the blocking threshold: findings at or above it stop the phase; sub-threshold findings are dispositioned by the judgment sweep rather than ignored.
 
 A malformed gate stops the run before task execution rather than being silently disabled. The gate is independent of HiLL checkpoints and reuses the existing `oat gate review` target config — it does not hardcode a `--target`. See [Reviews → Phase review gate](reviews.md#phase-review-gate) for the runtime behavior and disposition rules.
 

package/assets/docs/workflows/projects/autonomy.md

@@ -107,7 +107,7 @@ Autonomous execution preserves independent review:
   a cheaper or less independent reviewer.
 - Eligible review artifacts are received immediately. Fix tasks use the normal
   bounded implement-and-re-review loop.
-- Critical findings and failed blocking reviews stop progression. Important
+- Critical findings and failed blocking reviews stop progression. High
   findings follow the configured gate policy.
 - A normal phase or final lifecycle review cannot satisfy a configured
   implementation exit gate. Only gate invocation provenance with the matching

package/assets/docs/workflows/projects/implementation-execution.md

@@ -237,8 +237,8 @@ already part of the next phase's base.
 
 The root sends the reviewer a fresh scope containing the authoritative phase
 commit range, task IDs and boundaries, project artifacts, and verification
-evidence. The review passes with zero Critical and zero Important findings.
-Medium and Minor findings are recorded without blocking the phase.
+evidence. The review passes with zero Critical and zero High findings.
+Medium and Low findings are recorded without blocking the phase.
 
 ## Final Exit-Gate Boundary
 
@@ -381,7 +381,7 @@ See [Dispatch Policy](dispatch-ceiling.md) for configuration and
 
 ## Fix Continuity
 
-When review finds Critical or Important issues, the root resumes the original
+When review finds Critical or High issues, the root resumes the original
 phase handle in `fix` mode with:
 
 - the review artifact and bounded findings;
@@ -404,7 +404,7 @@ sequenceDiagram
   Root->>Phase: Phase Scope (request_id=A)
   Phase-->>Root: DONE + task commits
   Root->>Review: Review phase commit range
-  Review-->>Root: Critical / Important findings
+  Review-->>Root: Critical / High findings
   Root->>Phase: Resume A in fix mode
   Phase-->>Root: Fix commit + verification
   Root->>Review: New independent review round

package/assets/docs/workflows/projects/lifecycle.md

@@ -260,7 +260,7 @@ registers. Non-interactive completion skips this offer, so autonomous
 generation occurs only through an explicitly configured post-approval `retro`
 step.
 
-When `workflow.autoReviewAtHillCheckpoints` is enabled or `plan.md` frontmatter sets `oat_auto_review_at_hill_checkpoints`, completing a HiLL checkpoint automatically runs the extra lifecycle review scoped to every implementation phase not already covered by a passed whole-phase code review, through the just-completed checkpoint. Mid-implementation multi-phase reviews use inclusive phase-range scopes such as `p02-p03`; the final implementation checkpoint uses `code final`. The review uses auto-disposition mode (minors auto-converted to fix tasks, no user prompts). Disabled by default. Legacy `autoReviewAtCheckpoints` and `oat_auto_review_at_checkpoints` are still read as fallbacks. This does not control Tier 1 per-phase `oat-reviewer` gates.
+When `workflow.autoReviewAtHillCheckpoints` is enabled or `plan.md` frontmatter sets `oat_auto_review_at_hill_checkpoints`, completing a HiLL checkpoint automatically runs the extra lifecycle review scoped to every implementation phase not already covered by a passed whole-phase code review, through the just-completed checkpoint. Mid-implementation multi-phase reviews use inclusive phase-range scopes such as `p02-p03`; the final implementation checkpoint uses `code final`. The review uses auto-disposition mode (low findings auto-converted to fix tasks, no user prompts). Disabled by default. Legacy `autoReviewAtCheckpoints` and `oat_auto_review_at_checkpoints` are still read as fallbacks. This does not control Tier 1 per-phase `oat-reviewer` gates.
 
 ### Phase-review setup during planning
 

package/assets/docs/workflows/projects/reviews.md

@@ -76,7 +76,7 @@ The common rule is offer-and-confirm: the model may recognize the request and pr
 
 - **GitHub is the source of truth.** No local review artifact is written on the reviewing machine, and the project rail makes no `plan.md`/bookkeeping mutations there — the originating machine's `*-receive-remote` owns those. The posted PR review carries metadata markers (`oat_provide_remote`, `oat_review_head_sha`, and on the project rail `oat_project` + `oat_review_scope`) so a subsequent provide-remote pass can find the prior review for re-review narrowing.
 - **Hybrid read strategy.** The skill checks the PR out into an ephemeral worktree for full-context review by default, and falls back to diff-only mode (`gh pr diff`, or when `--no-checkout` is set / checkout fails) with a degraded-context warning.
-- **Single posted review.** Findings are posted as one PR review via `gh api` with inline `comments[]`; the verdict is `REQUEST_CHANGES` when any Critical/Important finding exists, otherwise `COMMENT` (including clean reviews — never an automatic `APPROVE`). Findings whose line is outside the PR diff are downgraded into the top-level review body rather than dropped.
+- **Single posted review.** Findings are posted as one PR review via `gh api` with inline `comments[]`; the verdict is `REQUEST_CHANGES` when any Critical/High finding exists, otherwise `COMMENT` (including clean reviews — never an automatic `APPROVE`). Findings whose line is outside the PR diff are downgraded into the top-level review body rather than dropped.
 - **Project rail is project-aware but read-only.** It resolves the project by scanning the PR diff for `.oat/projects/*/*/state.md` (with a `--project <path>` override), reads project artifacts to drive mode-aware review quality, and uses Tier 1/2/3 dispatch (`oat-reviewer` structured-output mode → fresh session → inline). The ad-hoc rail runs inline only.
 - **Re-review narrowing** scopes a follow-up pass to commits since the prior matching review, guarded against a stale/force-pushed prior SHA (existence + ancestry checks; falls back to full scope when the prior SHA is unreachable). Project-rail narrowing matches on the `(project, scope)` tuple so a `p02` re-review never narrows against a prior `final` review.
 
@@ -111,11 +111,11 @@ the relevant scope and type.
 
 ## Current policy
 
-- Critical/Important: address before pass.
+- Critical/High: address before pass.
 - Medium: address by default; defer only with explicit approval and recorded rationale/disposition.
-- Minor: **default to `convert`** (fix inline). Small non-blocking findings are usually cheaper to fix than to track as backlog items, so the receive skills convert them by default rather than deferring.
-- Deferring (or dismissing) a finding **at any severity, including minor**, requires a concrete recorded rationale (duplicate, blocked dependency, explicit out-of-scope follow-up, or disproportionate churn now). This brings the manual receive path in line with the auto-review path, which already converts minors.
-- Minor (final scope): still require explicit per-finding user disposition after a plain-language explanation, with `convert` as the recommended default.
+- Low: **default to `convert`** (fix inline). Small non-blocking findings are usually cheaper to fix than to track as backlog items, so the receive skills convert them by default rather than deferring.
+- Deferring (or dismissing) a finding **at any severity, including low**, requires a concrete recorded rationale (duplicate, blocked dependency, explicit out-of-scope follow-up, or disproportionate churn now). This brings the manual receive path in line with the auto-review path, which already converts low findings.
+- Low (final scope): still require explicit per-finding user disposition after a plain-language explanation, with `convert` as the recommended default.
 
 ## Auto-review at HiLL checkpoints
 
@@ -132,7 +132,7 @@ latest stamp as the producer for the whole scope.
 
 This is separate from Tier 1 phase gate reviews. Tier 1 implementation always runs `oat-reviewer` after each phase; `workflow.autoReviewAtHillCheckpoints` only controls the additional lifecycle review when a HiLL checkpoint is reached. Legacy `autoReviewAtCheckpoints` and `oat_auto_review_at_checkpoints` are still read as fallbacks.
 
-Auto-triggered reviews use `oat_review_invocation: auto` in the review artifact frontmatter. In auto mode, `oat-project-review-receive` auto-converts all findings to fix tasks without user prompts (Minor findings that are clearly out of scope are deferred with a note).
+Auto-triggered reviews use `oat_review_invocation: auto` in the review artifact frontmatter. In auto mode, `oat-project-review-receive` auto-converts all findings to fix tasks without user prompts (Low findings that are clearly out of scope are deferred with a note).
 
 This feature is opt-in and disabled by default. When disabled, the manual `oat-project-review-provide` workflow applies.
 
@@ -150,7 +150,7 @@ leaves the gate disabled.
 
 It is independent of [HiLL checkpoints](hill-checkpoints.md): a passing gate does not pause, and the gate never touches `oat_hill_completed`, `oat_plan_hill_phases`, or `oat_auto_review_at_hill_checkpoints`.
 
-Gate-produced review artifacts use `oat_review_invocation: gate` in frontmatter (the third invocation marker alongside `manual` and `auto`). The gate verdict — controlled by `exit_nonzero_on` (default `important`) — decides whether the **phase stops**; it does not decide whether sub-threshold findings are ignored. Before invoking `oat-project-review-receive`, the result must satisfy all three eligibility conditions: `status` is `ok` or `blocked`, `receiveEligible` is `true`, and `handoff` is non-null. A missing or contradictory field is an operational failure even when `artifactPath` is present. Once eligibility is established, the produced artifact is consumed autonomously and without user prompts, so findings never evaporate:
+Gate-produced review artifacts use `oat_review_invocation: gate` in frontmatter (the third invocation marker alongside `manual` and `auto`). The gate verdict — controlled by `exit_nonzero_on` (default `high`) — decides whether the **phase stops**; it does not decide whether sub-threshold findings are ignored. Before invoking `oat-project-review-receive`, the result must satisfy all three eligibility conditions: `status` is `ok` or `blocked`, `receiveEligible` is `true`, and `handoff` is non-null. A missing or contradictory field is an operational failure even when `artifactPath` is present. Once eligibility is established, the produced artifact is consumed autonomously and without user prompts, so findings never evaporate:
 
 The gate prompt provides six additional frontmatter values: `oat_gate_run_id`,
 `oat_gate_target`, `oat_gate_runtime`, `oat_invocation_model`,
@@ -160,7 +160,7 @@ separate from optional observed or self-reported producer identity. Missing or
 mismatched values produce `artifact_validation_failed` before finding severity
 is evaluated.
 
-- **Passing gate** (no findings at or above the threshold): receive runs a non-pausing **judgment sweep**. It makes a per-finding decision for each Medium/Minor — defer to final review (the default, recorded so [final review](#phase-and-final-review) resurfaces it), address now (only for small, contained, low-risk fixes, which do **not** re-trigger the standard reviewer or re-gate the phase), or reject with rationale — then archives the artifact. Address-now is an exception, not the norm; if such a fix reveals a Critical/Important concern it escalates to the blocking path.
+- **Passing gate** (no findings at or above the threshold): receive runs a non-pausing **judgment sweep**. It makes a per-finding decision for each Medium/Low — defer to final review (the default, recorded so [final review](#phase-and-final-review) resurfaces it), address now (only for small, contained, low-risk fixes, which do **not** re-trigger the standard reviewer or re-gate the phase), or reject with rationale — then archives the artifact. Address-now is an exception, not the norm; if such a fix reveals a Critical/High concern it escalates to the blocking path.
 - **Blocking gate** (one or more findings at or above the threshold): receive converts findings to fix tasks and implementation re-runs the standard reviewer and the gate for the phase. These block → fix → re-gate rounds are bounded by `oat_orchestration_retry_limit` (default `2`); exhausting the bound stops a sequential run or excludes the phase in a parallel group, matching the standard fix loop's terminal handling.
 
 Gate-originated artifacts (`oat_review_invocation: gate`) are excluded from the same-scope review-cycle cap in `oat-project-review-receive`. The cap measures failed fix cycles of the standard review loop, so counting gate artifacts would trip it on artifact volume rather than real fix rounds.
@@ -173,7 +173,7 @@ This feature is opt-in and disabled by default (missing or `enabled: false`). Fo
 
 Generated planning and analysis artifacts have a separate review loop from code/phase reviews.
 
-For plans, `oat-project-plan`, `oat-project-quick-start`, `oat-project-lite`, and `oat-project-import-plan` run a bounded `plan.md` artifact review before marking the plan ready for implementation. The loop dispatches `oat-reviewer` in structured-output artifact mode with `scope: plan`, applies unambiguous Critical and Important artifact-local fixes, offers Medium and Minor fixes, and re-runs until clean or the retry bound is exhausted. A clean result records the `plan` row in the plan's `## Reviews` table as `passed`.
+For plans, `oat-project-plan`, `oat-project-quick-start`, `oat-project-lite`, and `oat-project-import-plan` run a bounded `plan.md` artifact review before marking the plan ready for implementation. The loop dispatches `oat-reviewer` in structured-output artifact mode with `scope: plan`, applies unambiguous Critical and High artifact-local fixes, offers Medium and Low fixes, and re-runs until clean or the retry bound is exhausted. A clean result records the `plan` row in the plan's `## Reviews` table as `passed`.
 
 For analysis artifacts, `oat-docs-analyze` and `oat-agent-instructions-analyze` run a bounded accuracy review after writing their severity-rated artifacts. The reviewer checks cited evidence, severity, and recommendations before the matching apply workflow consumes the artifact. The analysis loop updates tracking metadata to mark the artifact verified.
 
@@ -219,9 +219,9 @@ Use phase-scoped review artifacts during implementation (`p01`, `p02`, etc), the
 
 Final review `passed` gate requires:
 
-- No unresolved Critical/Important/Medium findings.
+- No unresolved Critical/High/Medium findings.
 - Deferred Medium findings resurfaced and explicitly dispositioned.
-- Minor findings explicitly dispositioned (after plain-language explanation).
+- Low findings explicitly dispositioned (after plain-language explanation).
 
 ## Subagent Compatibility
 

package/assets/docs/workflows/skills/recon.md

@@ -69,19 +69,21 @@ context source, output directory, or strict authority:
 The default profile is `standard`. Each homogeneous wave has an independently
 selected and approved exact target. Bounded mapping, extraction, citation
 reopening, counterexample search, and mechanical dossier compilation start with
-economical qualified routes. A wave that genuinely requires interpretation or
-reconciliation judgment can use a stronger approved target without raising the
-cost of unrelated evidence waves.
+economical qualified routes. Reconciliation is deterministic controller work
+rather than a separately approved worker target.
 
 | Profile    | Use it for                                  | Required assurance work                                                                                            | Claim ceiling |
 | ---------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------- |
 | `quick`    | Bounded orientation                         | Mapping, gathering, compilation, schema validation, and locator validation; no independent semantic pass by design | `supported`   |
-| `standard` | Load-bearing evidence                       | Quick work plus blind semantic verification, adversarial review, coverage, and reconcile                           | `verified`    |
+| `standard` | Load-bearing evidence                       | Quick work plus blind semantic verification, adversarial review, coverage, and deterministic reconciliation        | `verified`    |
 | `thorough` | Expensive failure or correlated blind spots | Standard work plus required redundant gathering and redundant verification                                         | `verified`    |
 
 A thorough run may additionally predeclare an optional, condition-bound
 `contradiction-resolution` evidence wave. It runs only when its approved
 predicate triggers and is not required when that branch is not triggered.
+Gather and redundant-gather waves may partition source work across lanes. Each
+typed review wave uses exactly one lane so deterministic reconciliation has one
+result per review kind, at the fixed path bound by the approved manifest.
 
 The approval manifest shows each wave's exact target, task class, class floor,
 selection rationale, adaptive lane count, conditional rule, concurrency,
@@ -93,11 +95,16 @@ change requires renewed approval; there is no silent substitution after
 approval.
 
 Before any worker launches, recon confirms that the live launch surface can run
-the approved role, model, effort, and authority level. If it cannot, the run
-stays at `awaiting-approval` with a provider/dispatch diagnostic and nothing is
-launched. Deadlines are approved execution limits chosen for the task class,
-not short watchdogs; an accepted lane is never interrupted by hand because a
-displayed deadline elapsed.
+the approved role, model, effort, and authority level. A materialized Cursor
+role file is configuration, not evidence that the current Task catalog exposes
+that role; the live catalog controls eligibility, with the approved generic
+fallback used when needed. If the launch surface cannot run the selected
+target, the run stays at `awaiting-approval` with a provider/dispatch diagnostic
+and nothing is launched. Every Cursor leaf runs in the background so later
+parent-chat messages cannot interrupt multi-minute evidence work. Deadlines are
+approved execution limits chosen for the task class, not short watchdogs; an
+accepted lane is never interrupted by hand because a displayed deadline
+elapsed.
 
 ### Preview and Check Routing
 
@@ -117,29 +124,30 @@ compare the constructed target with that wave's approved exact target:
 node .agents/skills/recon/scripts/prepare-routing.mjs --manifest manifest.json --wave gather-1 --check-target candidate-target.json
 ```
 
-These commands validate structure, approval integrity, and exact identity. They
-do not launch a worker, rank model names, attest actual runtime identity, or
-measure cost.
+These commands validate structure, approval integrity, and exact identity. Like
+the other recon command-line helpers, they use a shared realpath-aware entry
+check, so direct and symlinked invocations execute identically. They do not
+launch a worker, rank model names, attest actual runtime identity, or measure
+cost.
 
 ### Bounded Conditional Evidence
 
-Standard and thorough may predeclare finite conditional
-`contradiction-resolution` evidence waves. A completed predecessor can trigger
-one such wave to seek discriminating evidence; accepted failure, cancellation,
+Standard and thorough may each predeclare at most one conditional
+`contradiction-resolution` evidence wave. A completed predecessor can trigger
+that wave to seek discriminating evidence; accepted failure, cancellation,
 timeout, or missing output cannot trigger a replacement. Triggered,
 not-triggered, and unresolved dispositions remain visible. Both branches feed
-the same single mandatory terminal reconciliation.
+the same deterministic controller reconciliation.
 
 A triggered condition must cite complete, digest-bound evidence from an approved
 predecessor in the same run. Evidence copied from another run cannot activate
 the destination wave and fails packet validation with
 `CONDITION_EVIDENCE_RUN_MISMATCH`.
 
-If a need for stronger reconciliation judgment is foreseeable, select that one
-terminal target before approval. If it appears only after approval, recon
-preserves completed evidence and returns an unresolved, out-of-envelope gap for
-renewed approval or a new run. It never mutates the target, silently retries,
-or launches a second reconciliation.
+If reconciliation exposes a need for new semantic judgment, recon preserves
+completed evidence and returns an unresolved, out-of-envelope gap for renewed
+approval or a new run. It never converts deterministic reconciliation into a
+worker wave or silently retries an accepted worker.
 
 ## Destination Precedence
 
@@ -173,8 +181,8 @@ non-publishable candidate generation withdraws any existing `packet.md`:
 - `claims.json` is the canonical claim ledger.
 - `manifest.json` records request, source, approved execution envelope, and
   gap provenance.
-- `reviews/` contains compact semantic, adversarial, coverage, and
-  reconciliation evidence.
+- `reviews/` contains compact semantic, adversarial, coverage, and the
+  controller-produced reconciliation record.
 - `raw/` contains worker dossiers, candidate artifacts, and safe failure
   diagnostics. It is not normal consumer input.
 
@@ -198,6 +206,20 @@ ledger must reference every completed primary and redundant gather dossier by
 exact path and digest before review briefs are created. Missing provenance fails
 with `MISSING_THOROUGH_GATHER_LEDGER_INPUT`.
 
+Compile workers copy each evidence excerpt as one contiguous exact substring of
+the reopened source. A source-required redaction may replace only the sensitive
+span while preserving the surrounding bytes and recording the redaction. Recon
+does not repair stale locators after compilation. Each accepted worker validates
+its own closed artifact schema once, within the same accepted task, before
+returning. An invalid accepted artifact is terminal; the controller neither
+retries the schema nor substitutes another worker.
+
+When an accepted lane has already written a schema-valid, lane-matching artifact
+at its approved path, that durable artifact remains the result even if the
+provider stream later closes with an error. Recon records the stream failure as
+a provider diagnostic and does not relaunch the lane. A missing or invalid
+artifact remains a failed pass.
+
 The ledger compiler and packet validator enforce categorical referential
 integrity on `synthesis.keyClaimIds` and `synthesis.unresolvedQuestionIds`. Any
 reference to an unknown claim or question ID fails validation with
@@ -228,10 +250,14 @@ the caller assesses sufficiency and conclusions. Stronger profiles can promote
 claims only when their required independent review artifacts validate and were
 written by approved lanes.
 
-When an independent semantic review rejects a proposed claim, the reconciler
-transitions it to `unsupported` rather than deleting it. This preserves the
-claim statement, cited evidence, and transition history in `claims.json`, and
-renders the finding under Contradictions and Qualifications.
+When an independent semantic review rejects a proposed claim, deterministic
+controller reconciliation transitions it to `unsupported` rather than deleting
+it. The controller validates the digest-bound input ledger and required review
+set, writes `raw/drafts/claims-v2.json` and
+`reviews/reconciliation.json`, validates both, then atomically promotes the
+candidate ledger to `claims.json`. This preserves the claim statement, cited
+evidence, and transition history and renders the finding under Contradictions
+and Qualifications.
 
 An adversarial challenge transitions a claim to `contested`. A run with
 contested claims may publish as `complete` when all declared questions and

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.2.77",
-  "docs-config": "0.2.77",
-  "docs-theme": "0.2.77",
-  "docs-transforms": "0.2.77"
+  "cli": "0.3.0",
+  "docs-config": "0.3.0",
+  "docs-theme": "0.3.0",
+  "docs-transforms": "0.3.0"
 }

package/assets/skills/oat-agent-instructions-analyze/SKILL.md

@@ -5,7 +5,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Glob, Grep, AskUserQuestion, Task
 metadata:
-  version: 1.12.1
+  version: 1.12.2
 ---
 
 # Agent Instructions Analysis
@@ -457,8 +457,8 @@ Follow the canonical loop exactly:
 1. Resolve `workflow.autoArtifactReview.analysis`; missing config means enabled, and only explicit `false` skips the loop.
 2. Resolve `oat_orchestration_retry_limit`; default to `2` if unavailable.
 3. Dispatch `oat-reviewer` in structured mode via Tier 1 subagent when available, falling back to the same reviewer prompt inline when needed.
-4. Apply Critical and Important fixes when they are local to the analysis artifact, companion bundle, and unambiguous.
-5. Offer Medium and Minor fixes rather than applying them silently.
+4. Apply Critical and High fixes when they are local to the analysis artifact, companion bundle, and unambiguous.
+5. Offer Medium and Low fixes rather than applying them silently.
 6. Rewrite `$ARTIFACT_PATH` and any affected bundle files after applied fixes, then re-dispatch while retries remain.
 7. Stop when the reviewer is clean or the retry bound is exhausted.
 

package/assets/skills/oat-docs-analyze/SKILL.md

@@ -5,7 +5,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Glob, Grep, AskUserQuestion, Task
 metadata:
-  version: 1.5.1
+  version: 1.5.2
 ---
 
 # Docs Analysis
@@ -448,8 +448,8 @@ Follow the canonical loop exactly:
 1. Resolve `workflow.autoArtifactReview.analysis`; missing config means enabled, and only explicit `false` skips the loop.
 2. Resolve `oat_orchestration_retry_limit`; default to `2` if unavailable.
 3. Dispatch `oat-reviewer` in structured mode via Tier 1 subagent when available, falling back to the same reviewer prompt inline when needed.
-4. Apply Critical and Important fixes when they are local to the analysis artifact and unambiguous.
-5. Offer Medium and Minor fixes rather than applying them silently.
+4. Apply Critical and High fixes when they are local to the analysis artifact and unambiguous.
+5. Offer Medium and Low fixes rather than applying them silently.
 6. Rewrite `$ARTIFACT_PATH` after applied fixes and re-dispatch while retries remain.
 7. Stop when the reviewer is clean or the retry bound is exhausted.
 

package/assets/skills/oat-project-autonomous/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, Task
 metadata:
-  version: 1.0.15
+  version: 1.0.16
 ---
 
 # Autonomous OAT Project
@@ -395,7 +395,7 @@ At every required artifact or code review:
    Configured invocation evidence is authoritative; runtime identity is
    separate and non-authoritative.
 6. Fail closed for blocking reviews. Unresolved Critical findings always stop;
-   Important findings follow the configured gate policy.
+   High findings follow the configured gate policy.
 
 Do not reproduce provider-specific model, catalog, or launch mechanics here.