@quantiya/codevibe-core 2.0.6 → 2.0.7

package/dist/orchestration-shell/mode-selection.d.ts

@@ -1,20 +1,4 @@
 import { Mode, Tier } from './types';
-/**
- * Thrown when a Free-tier user explicitly requests `--mode orchestration`.
- * Per §2 + §16 LOCK #1: Orchestration Mode is Pro/Max-gated; Free-tier
- * users hit this error with the upgrade URL.
- */
-export declare class TierError extends Error {
-    constructor(message: string);
-}
-/**
- * Parsed arguments the entrypoint hands to `pickMode`. Either flag is
- * optional; a value of `undefined` means "not specified".
- */
-export interface ParsedModeArgs {
-    /** `--mode companion` | `--mode orchestration` | undefined */
-    mode?: Mode;
-}
 /**
  * Test seam — lets the unit tests inject a deterministic prompt
  * callback instead of opening a real TTY.
@@ -28,15 +12,13 @@ export interface ModeSelectionDeps {
  * read or written here.
  *
  * Rules:
- *   1. Free-tier + `--mode orchestration` → `TierError` with upgrade URL.
- *   2. Explicit `--mode` flag → honor it.
- *   3. Free-tier (no flag) → 'companion'.
- *   4. Pro/Max (no flag) → always prompt the user (sticky preference is
+ *   1. Free-tier → 'companion'.
+ *   2. Pro/Max → always prompt the user (sticky preference is
  *      never consulted; the answer is not persisted).
  */
-export declare function pickMode(args: ParsedModeArgs, tier: Tier, deps?: ModeSelectionDeps): Promise<Mode>;
+export declare function pickMode(tier: Tier, deps?: ModeSelectionDeps): Promise<Mode>;
 /**
  * Default deps wiring — production callers can omit `deps` from
- * `pickMode()` and get this. Tests override via the optional 3rd arg.
+ * `pickMode()` and get this. Tests override via the optional 2nd arg.
  */
 export declare function defaultDeps(): ModeSelectionDeps;

package/dist/orchestration-shell/quorum-loop.d.ts

@@ -3,6 +3,7 @@ import type { Session } from '../types';
 import type { LocalExecutor } from '../local-executor';
 import type { ImageAttachment } from './types';
 import { type ImplementorMode } from '../local-executor/implementor-argv';
+import { type FallbackLadderDeps } from '../substrate-launch/fallback-ladder';
 import type { ConflictModelCaller } from '../local-executor/class2-resolver';
 import type { ConflictResolverContext } from '../local-executor/merge-conflict-resolve';
 import type { AgentKind } from '../local-executor/types';
@@ -16,7 +17,7 @@ import { ReviewerRegistry } from '../reviewer/registry';
 import { type ReviewerFailureReason } from '../reviewer/provider';
 import type { SubstrateHandle } from '../substrate/types';
 import type { VerdictClassifier } from '../reviewer/verdict-classifier';
-import type { AgentKind as ReviewerAgentKind, ReviewerRole } from '../reviewer/types';
+import type { AgentKind as ReviewerAgentKind, ReviewerRole, VerdictKind } from '../reviewer/types';
 import type { OnProgress } from './task-progress';
 import { runShellCommand } from '../local-executor/verification-gates/shell-runner';
 import type { PostDecisionAction, Tier } from './types';
@@ -60,7 +61,7 @@ export declare function classifyImplementorRoundFailure(err: unknown): string;
  * Fixtures (L1):
  *   - Codex (PINNED — CP-13 §0/§2-D1 live sample): `You've hit your usage limit
  *     … try again at <date>` → match on `usage limit` (case-insensitive).
- *   - Claude / Gemini: TBD — CP-13 has not captured real samples. Inventing
+ *   - Claude: TBD — CP-13 has not captured real samples. Inventing
  *     strings risks a FALSE-NEGATIVE classifier that misses a real quota error,
  *     so they are left as additive one-liners to fill once real samples land.
  *     An UNMATCHED quota error degrades FAIL-SAFE to the existing born-halt
@@ -135,6 +136,76 @@ export declare function selectFinalTier2Reviewer(detected: readonly AgentKind[],
  * and never falls through. Pure; NEVER throws.
  */
 export declare function selectFinalTier2Candidates(detected: readonly AgentKind[], resolverAgents: ReadonlySet<string>, override?: AgentKind | null): AgentKind[];
+/**
+ * A1b — ONE reviewer verdict as captured desktop-side at `submitVerdict`,
+ * BEFORE the engine flattens the round's panel into free-text
+ * `ReviseSeatFinding.findings`. This is what lets round N's revise brief carry
+ * the STRUCTURED findings of rounds < N-1 (the "addressing 0 findings" /
+ * re-flagging-fixed-issues fix) without any wire change.
+ */
+export interface RoundFindingRecord {
+    /** The gate round the verdict reviewed (0-based, from `roundByGateId`). */
+    round: number;
+    /** Numeric seat id as a string (matches `ReviseSeatFinding.seatId` shape). */
+    seatId: string;
+    role: ReviewerRole;
+    reviewerAgent: ReviewerAgentKind;
+    verdict: VerdictKind;
+    /** Capped to HISTORY_SUGGESTION_MAX_CHARS each at capture. */
+    suggestedChanges: string[];
+    /** Capped to HISTORY_REASONING_MAX_CHARS at capture. Stored for audit /
+     *  bounded reuse; NOT rendered into the brief (the brief carries verdict +
+     *  suggested changes only). */
+    reasoning: string;
+}
+/**
+ * A1b — ONE implementor rationale entry (Stage-2 R1 Codex LOW-4: the round is
+ * RECORDED with the text, so a round that produced no summary can never drift
+ * the labeling — consumers render the entry's ACTUAL round, never an inferred
+ * `nextRound - 1`).
+ */
+export interface RationaleEntry {
+    /** The implementor round that produced this summary (0-based). */
+    round: number;
+    /** The summary text, char-capped at capture (RATIONALE_ENTRY_MAX_CHARS). */
+    text: string;
+}
+/**
+ * A1d / P2 resolver-intent (design §5 — the resolver's need-to-know projection:
+ * "conflicted paths + 3-way markers + both tracks' intent diffs + each track's
+ * brief + task intent"). ALL fields optional + already BOUNDED by the caller
+ * (`RESOLVER_INTENT_DIFF_MAX_BYTES` / `RESOLVER_TRACK_BRIEF_MAX_BYTES`);
+ * absent/empty ⇒ the brief is byte-identical to the pre-A1d shape (graceful
+ * degrade — mirrors the A1b rationale posture).
+ */
+export interface ResolverIntentContext {
+    /** The INCOMING track's brief (the THEIRS side's task intent), bounded. */
+    incomingBrief?: string | null;
+    /** The incoming track's index (labeling only). */
+    incomingTrackIndex?: number;
+    /**
+     * Briefs of the group's OTHER registered tracks (the OURS side — the
+     * integration tip is the base plus the already-merged tracks), bounded,
+     * sorted by trackIndex.
+     */
+    integrationBriefs?: readonly {
+        trackIndex: number;
+        brief: string;
+    }[];
+    /** Bounded base→trackTip unified diff (THEIRS intent), or a placeholder line. */
+    incomingIntentDiff?: string | null;
+    /** Bounded base→integrationTip unified diff (OURS intent), or a placeholder line. */
+    integrationIntentDiff?: string | null;
+}
+/**
+ * CP-14 WB2 (D1, locked) — the brief delivered on the resolver agent's stdin. It
+ * enumerates the class-2 conflicted paths (which carry 3-way markers), instructs
+ * write-in-place + remove EVERY marker, and tells the agent that ONLY its edits to
+ * the listed files are kept (selective import — any other edit is discarded). The
+ * agent may read other files + run build/test to verify, but those artifacts do
+ * not import (they only help it converge).
+ */
+declare function renderAgenticResolveBrief(conflictedPaths: readonly string[], implementorRationale?: string | null, intent?: ResolverIntentContext): string;
 /**
  * CP-7 §8 (Stage-1-resolved) — the narrow result the QuorumLoop consumes from
  * the reviewer substrate engager. Mirrors `SubstrateLaunch.EngageResult` /
@@ -210,6 +281,19 @@ export interface QuorumLoopDeps {
     getSessionKey: (sessionId: string) => Promise<string | null>;
     /** Working dir for spawned subprocesses (canonicalized). */
     workingDir: string;
+    /**
+     * A1d (Stage-2 R1 Codex MED) — test seams for the RESOLVER-SPECIFIC
+     * construction probe (`probeResolverDispatchConfinement`). `ladderDeps`
+     * stubs the §6 Q2 substrate ladder; `trustedContainer` stubs the
+     * trusted-container boundary check. ABSENT (production) → the real ladder +
+     * `isTrustedContainerBoundary`. The probe decides only whether the agentic
+     * closure is WIRED — the dispatch-time `requireConfined` engage remains the
+     * sole load-bearing confinement gate.
+     */
+    resolverProbeDeps?: {
+        ladderDeps?: FallbackLadderDeps;
+        trustedContainer?: () => boolean;
+    };
     /**
      * CP-14 Wave A — the team execution model. `worktree_merge` makes each team
      * track commit to a persistent branch (the merge-before-push spine) instead of
@@ -247,6 +331,25 @@ export interface QuorumLoopDeps {
      * independent of implementor sandboxing (which has its own engager).
      */
     engageReviewerSubstrate?: ReviewerSubstrateEngager;
+    /**
+     * A1e (P3 slice-wiring REMAP) — compose the bounded repository-context
+     * block for a task dispatch: the resolved `context_ref` structural slice
+     * (`mintContextRef` → `resolveContextRef` → `sliceSummary`) + the FRESH-ONLY
+     * `repo_state` overview (design §8.3 freshness — a stale record fires the
+     * background re-delegation and is NEVER projected). Wired by `cli.ts` to a
+     * tap holder; `runOrchestrationShell` installs the real composer
+     * (`composeDispatchContextBlock`) — the progressTap late-binding pattern.
+     * Appended to the ROUND-0 implementor STDIN payload ONLY (never
+     * `args.brief`, which becomes the execute-first `task_brief` → the
+     * reviewer prompts — the same self-visibility boundary as the A1b prior-
+     * rationale block). Returns `''` for "no block". ABSENT (legacy / companion
+     * / tests) → byte-identical stdin (no projection).
+     */
+    projectDispatchContext?: (input: {
+        taskId: string;
+        agent: AgentKind;
+        roundNumber: number;
+    }) => Promise<string>;
     /**
      * CP-1.f LOCK RP-6 — this orchestration host's detected coding agents
      * (UPPERCASE `CLAUDE` / `CODEX` / `GEMINI`), computed ONCE by `cli.ts` via
@@ -339,6 +442,7 @@ export interface QuorumLoopDeps {
         taskGroupId: string;
         trackIndex: number;
         state: 'Passed' | 'Failed';
+        resolvedBy: 'engine' | 'user';
     }) => void;
     /**
      * PHASE-589/469 W3.1 (C1) — the durable revert-manifest store. For a TEAM
@@ -501,6 +605,46 @@ export declare class QuorumLoop {
      * task's notes.
      */
     private readonly userNotesByTask;
+    /**
+     * A1b — STRUCTURED reviewer findings accumulated across ALL of a task's
+     * review rounds, captured at `submitVerdict` (the desktop-local hook where
+     * the full `ReviewerVerdict` passes through BEFORE the engine flattens the
+     * panel to free-text `ReviseSeatFinding.findings`). Round N's revise brief
+     * renders rounds < N-1 from here as the `## Findings history` section, so
+     * the implementor SEES what earlier rounds flagged (the "addressing 0
+     * findings" / re-flagging-fixed-issues fix) with NO wire change.
+     *
+     * Desktop-local capture is design-correct for GA: the locked shared-context
+     * design's single-write-authority means ONE desktop runs ALL of a task's
+     * seats, so every verdict for the task passes through THIS process's
+     * `submitVerdict` (multi-desktop seat fan-out is post-GA; a cross-desktop
+     * history store would be designed then). Lifecycle mirrors `userNotesByTask`
+     * exactly: cleared on promote / discard / round-0 restart replacement.
+     */
+    private readonly roundHistoryByTask;
+    /**
+     * A1b — the implementor's own per-round stdout rationale (the
+     * `extractAgentSummary` text), recorded as `{ round, text }` (LOW-4: labels
+     * come from the RECORDED round — a summary-less round can never drift them),
+     * bounded per entry, newest last. Three bounded consumers:
+     *   1. The NEXT revise round's implementor stdin (`## Your prior rationale`,
+     *      ≤ PRIOR_RATIONALE_BRIEF_MAX_BYTES) — self-visibility only; it rides
+     *      the stdin, NEVER the task_brief the reviewers see.
+     *   2. The agentic class-2 resolver brief (≤ RATIONALE_RESOLVER_MAX_BYTES,
+     *      ungated — the resolver is intent-starved by design).
+     *   3. Reviewer packets, ONLY behind the DEFAULT-OFF
+     *      OQ-REVIEWER-RATIONALE flag, as a labeled UNTRUSTED claim.
+     * Lifecycle mirrors `userNotesByTask` (promote / terminal discard / restart
+     * clear; PRESERVED across the non-terminal quota-fork/takeover discards).
+     */
+    private readonly rationaleByTask;
+    /**
+     * A1b — gate → the round number its implementor ran (set beside
+     * `taskByGateId` in `runImplementorRound`), so `submitVerdict` can stamp the
+     * verdict's `RoundFindingRecord.round`. Same append-only lifecycle as
+     * `taskByGateId` (per QuorumLoop life; bounded by the session's gate count).
+     */
+    private readonly roundByGateId;
     /** Seats with a reviewer subprocess currently running, keyed `gateId::seatId`. */
     private readonly runningSeats;
     /** Seats whose verdict has been submitted, keyed `gateId::seatId`. */
@@ -1116,13 +1260,26 @@ export declare class QuorumLoop {
             testSurfaces: string[];
             trackIndex: number;
         };
+        /**
+         * A1b — the implementor's OWN summary from the prior round, threaded by
+         * `handleReviseFeedback` so the revise implementor does not re-derive its
+         * own reasoning. Appended to the STDIN payload ONLY (self-visibility) —
+         * NEVER to `args.brief`, which becomes the execute-first `task_brief`
+         * rendered into the reviewer prompts (OQ-REVIEWER-RATIONALE: GA reviewers
+         * see NO rationale; the flag-gated reviewer path is separate).
+         */
+        priorRationale?: {
+            round: number;
+            text: string;
+        };
     }): Promise<void>;
     /**
      * Extract the agent's informational stdout summary (audit-only; reviewers
      * never see it — they review the captured diff). Best-effort: a failure to
      * read the summary is NON-fatal (the diff is the source of truth). For Codex
-     * the clean reply is the `--output-last-message` temp file; for Gemini it is
-     * the JSON envelope's `.response`; Claude `--print` is clean stdout.
+     * the clean reply is the `--output-last-message` temp file; Claude
+     * `--print --output-format json` is unwrapped to `.result`. (Gemini was SUNSET
+     * in 2026-07 — its JSON-envelope unwrap branch was removed; it is never spawned.)
      */
     private extractAgentSummary;
     /**
@@ -1164,6 +1321,17 @@ export declare class QuorumLoop {
      * `gateId` is the track's CURRENT round-N reviewer_quorum gate; REQUIRED for a
      * revisable reason (the engine rejects a revisable marker without it). The
      * TERMINAL-reason callers omit it.
+     *
+     * @returns `autoRevised` — whether the engine's AUTHORITATIVE returned
+     * `trackState` was non-`Failed` (W2 auto-revise: the track stays InFlight and
+     * a `REVISE_FEEDBACK` for the SAME taskId follows). A1b (Stage-2 R2 Codex
+     * MEDIUM-1): the revisable-reason callers key their `discardShadow`
+     * `preserveReviseContext` on THIS, so an auto-revised track's revise round
+     * still sees the accumulated notes/history/rationale, while a genuinely
+     * terminal track (Failed return, thrown/absent marker → state unknown, no
+     * taskGroupId) clears as before. A thrown marker whose write actually landed
+     * server-side is the one lossy edge (the engine may revise while the desktop
+     * cleared) — that degrades to the pre-A1b contextless brief, never worse.
      */
     private reportTeamTrackFailure;
     /**
@@ -1233,7 +1401,26 @@ export declare class QuorumLoop {
      * runImplementorRound) the behavior is exactly as before — discard whatever is
      * currently mapped for the task.
      */
-    discardShadow(taskId: string, expected?: WorkspaceShadow): Promise<void>;
+    discardShadow(taskId: string, expected?: WorkspaceShadow, opts?: {
+        /**
+         * A1b (Stage-2 R1 Codex MEDIUM-1) — set by the NON-terminal discard
+         * callers where the TASK continues on the SAME taskId after the shadow
+         * is gone: the quota fork (`handleQuotaExhaustedFork` → continuation →
+         * `resumeFromContinuation(input.taskId)`) and the four mid-round
+         * `handoffClaimed` takeover suppressions (a `/continue request` /
+         * foreign-accept claims the handoff, then the continuation resumes the
+         * same task). On those paths the accumulated revise context — binding
+         * user notes, structured findings history, implementor rationale — MUST
+         * survive into the resumed rounds; wiping it here was exactly the
+         * "resume starts amnesiac" defect. Terminal discards (user
+         * reject/abort, policy rejection, born-halt, round failure,
+         * all-agents-exhausted) omit this and clear as before. If the user
+         * DECLINES the continuation offer, the preserved maps simply linger
+         * until the task's eventual terminal (bounded: per-task caps), or
+         * process end — an accepted, documented residual.
+         */
+        preserveReviseContext?: boolean;
+    }): Promise<void>;
     private discardShadowLocked;
     /**
      * CP-1.f execute-first (#PR-1/#PR-3) — promote the task's shadow onto the real
@@ -1431,6 +1618,36 @@ export declare class QuorumLoop {
         caller: ConflictModelCaller;
         teardown: () => Promise<void>;
     } | null>;
+    /**
+     * A1d (Stage-2 R1 Codex MED) — the RESOLVER-SPECIFIC construction probe:
+     * can the DISPATCH-time `requireConfined` engage establish a confining
+     * substrate on this host? Wire-vs-legacy ONLY — the dispatch's own engage
+     * (`spawnImplementor({ requireConfined: true })`) remains the sole
+     * load-bearing gate; a probe mistake can never yield an unconfined spawn.
+     *
+     *   - A real §6 Q2 ladder tier (`sandbox_exec` / `docker`) → ESTABLISHABLE.
+     *     A5 covers EVERY agent: the CP-7 broker substrate for the
+     *     provider-backed agents (CLAUDE/CODEX) AND the A1d write-confined
+     *     resolver row for the broker-less agents (GEMINI/ANTIGRAVITY). The
+     *     docker tier covers the provider-backed agents; a broker-less track's
+     *     slot on that tier fail-closes at dispatch to the clean
+     *     `dispatch_unconfined` human-gate (FD-2) — no worse than unwired for
+     *     that slot, and it does not block provider-backed slots in the group.
+     *   - No tier + trusted container → ESTABLISHABLE (the PRESERVED
+     *     D5-AMEND-1 posture: the closure wires and every slot fail-closes
+     *     cleanly at dispatch — dogfood-verified 2026-07-03, 101ms human-gate).
+     *   - No tier, no container → NOT establishable → the closure stays
+     *     unwired, keeping today's IMMEDIATE legacy human-gate instead of
+     *     converting it into a per-slot spawn-time fail-close.
+     *
+     * Deliberately DECOUPLED from `engageWaveBConfinement` and its
+     * `CODEVIBE_SANDBOX_REVIEWERS` opt-in: that flag gates REVIEWER sandboxing
+     * (per-seat, `makeConflictModelCaller`, Tier-2) exactly as before — riding
+     * it here made the A1d resolver row unreachable on the default bare host.
+     * The ladder select is side-effect-free (no launch, no broker); test seams
+     * via `deps.resolverProbeDeps`.
+     */
+    private probeResolverDispatchConfinement;
     /**
      * CP-14 WB2 §2.1/§2.2/§2.3 — build the AGENTIC class-2 resolver, or `null` on
      * path C (no confinement). When wired, a slot's class-2 conflicts are resolved
@@ -1438,11 +1655,18 @@ export declare class QuorumLoop {
      * disposable repo, then fd-safe selective-importing ONLY the conflicted files.
      * SECURITY-CRITICAL — fail-closed on BOTH layers:
      *
-     *   1. CONSTRUCTION-time (mirrors `makeConflictModelCaller` returning null): probe
-     *      `engageWaveBConfinement` ONCE against the loop workdir; path C → return
-     *      `null` → `resolveAgentic` is NOT set on the context → a fresh class-2
-     *      conflict takes the legacy `caller` path (which on path C is the
-     *      CONFINEMENT-UNAVAILABLE caller → human-gate). Byte-identical to today.
+     *   1. CONSTRUCTION-time — the RESOLVER-SPECIFIC probe (A1d, Stage-2 R1 Codex
+     *      MED): `probeResolverDispatchConfinement` wires the closure iff the
+     *      DISPATCH-time engage could establish a confining substrate on this
+     *      host (a real §6 Q2 ladder tier, or the preserved trusted-container
+     *      posture). Deliberately DECOUPLED from `engageWaveBConfinement`'s
+     *      `CODEVIBE_SANDBOX_REVIEWERS` opt-in — that flag gates REVIEWER
+     *      sandboxing (seat/`makeConflictModelCaller`/Tier-2, unchanged), and
+     *      riding it here made the A1d write-confined resolver row unreachable
+     *      on the default bare-host path. Unwired → return `null` →
+     *      `resolveAgentic` is NOT set on the context → a fresh class-2 conflict
+     *      takes the legacy `caller` path (which on path C is the
+     *      CONFINEMENT-UNAVAILABLE caller → human-gate).
      *   2. DISPATCH-time (Stage-2 Codex HIGH — confinement BOUND TO THE ACTUAL SPAWN):
      *      `dispatchImplementor` spawns with `requireConfined: true`, so
      *      `LocalExecutor.spawnImplementor` → `engageSubstrateForSpawn` THROWS
@@ -1717,20 +1941,44 @@ export declare class QuorumLoop {
      * literal NEVER appearing in this file. The branch is `NODE_ENV==='test'`-gated
      * so it is never evaluated in prod regardless.
      */
+    /**
+     * #585 §5.5 / L2 + GA [A2] — parse the force-quota test seam's VALUE grammar.
+     * Returns `null` outside `NODE_ENV === 'test'` or when the fragment-assembled
+     * force-quota env var is unset. The env-var KEY is assembled from fragments so
+     * the force-quota literal NEVER appears verbatim in the published bundle (the
+     * `verify-no-test-hooks` CI grep asserts its absence); the whole gate is ALSO
+     * `NODE_ENV==='test'`-gated so it is never evaluated in prod.
+     *
+     * Value grammar (GA [A2] additive extension — same env var, no new hook, so
+     * the hostile-grep list is unchanged):
+     *   - `<AGENT>`          — classic mode: synthetic quota stderr + forced
+     *                          EMPTY diff → drives the born-halt continuation
+     *                          fork (the `continuation-handoff-quota` E2E).
+     *   - `<AGENT>:partial`  — mid-task partial-diff mode: synthetic quota
+     *                          stderr, but the captured diff is KEPT so the
+     *                          loop's submit-partial-to-review degradation is
+     *                          exercised instead of the fork (an implementor
+     *                          quota-killed MID-TASK with partial work present).
+     * Both segments are case-insensitive.
+     */
+    private forcedQuotaSpec;
     /**
      * #585 §5.5 / L2 — the SINGLE source of the force-quota test gate. Returns true
      * when (a) `NODE_ENV === 'test'` AND (b) the fragment-assembled force-quota env
-     * var names `agent`. The env-var KEY is assembled from fragments so the
-     * force-quota literal NEVER appears verbatim in the published bundle (the
-     * `verify-no-test-hooks` CI grep asserts its absence);
-     * the whole gate is ALSO `NODE_ENV==='test'`-gated so it is never evaluated in
-     * prod. Drives BOTH the synthetic quota stderr (`resolveQuotaClassificationText`)
-     * AND the forced empty-diff born-halt (`runImplementorRound` capture site) — the
-     * two halves that make the `continuation-handoff-quota` E2E reproducible (a real
-     * model will not deterministically exit with NO diff, which the quota fork
-     * requires).
+     * var names `agent` (either value-grammar mode — see `forcedQuotaSpec`).
+     * Drives BOTH the synthetic quota stderr (`resolveQuotaClassificationText`)
+     * AND the capture-site diff handling (`runImplementorRound`): classic mode
+     * forces the EMPTY-diff born-halt (a real model will not deterministically
+     * exit with NO diff, which the quota fork requires); `:partial` mode keeps
+     * the captured diff (GA [A2] — validates submit-partial-to-review).
      */
     private isForcedQuotaAgent;
+    /**
+     * GA [A2] — true when the force-quota seam is armed in `:partial` mode (see
+     * `forcedQuotaSpec` grammar). Only meaningful alongside `isForcedQuotaAgent`;
+     * prod-unreachable through the same `NODE_ENV==='test'` gate.
+     */
+    private isForcedQuotaPartialDiffMode;
     /**
      * Test seam — force the ROUND-0 implementor agent (overriding the session
      * default). `NODE_ENV==='test'`-gated; the env key is fragment-assembled so the
@@ -1864,6 +2112,61 @@ export declare class QuorumLoop {
      * user requirement.
      */
     private buildReviseBrief;
+    /**
+     * A1b — append one structured reviewer verdict to the task's findings
+     * history (called from `submitVerdict`). Per-field caps bound each record
+     * (reasoning ≤ HISTORY_REASONING_MAX_CHARS, each suggestion ≤
+     * HISTORY_SUGGESTION_MAX_CHARS); a per-(task, round) SOFT byte cap degrades
+     * later same-round records to verdict-only stubs (seat + verdict stay
+     * visible; the byte-heavy narrative is dropped) so a pathological panel can
+     * never balloon the in-memory history.
+     */
+    private recordRoundFinding;
+    /**
+     * A1b — record the implementor's own per-round summary as its rationale,
+     * stamped with the round that produced it (LOW-4). Empty/whitespace
+     * summaries are skipped (the entry's ABSENCE is what keeps labels honest —
+     * a later consumer renders the newest entry's OWN round, never an inferred
+     * one); each entry is char-capped and the per-task list keeps only the
+     * newest RATIONALE_MAX_ENTRIES (defensive — a task's round count is already
+     * bounded upstream).
+     */
+    private recordImplementorRationale;
+    /**
+     * A1b — the task's accumulated rationale as ONE bounded string (newest
+     * entries win: oldest are dropped first, and the survivor text is hard
+     * byte-capped). `null` when the task has no rationale (or no task resolved)
+     * so callers can keep their no-rationale shape byte-identical.
+     */
+    private boundedRationale;
+    /**
+     * A1d / P2 resolver-intent (design §5/§8.1) — build the bounded INTENT
+     * projection for one agentic slot resolve:
+     *
+     *   - "each track's brief + task intent" → the INCOMING track's brief
+     *     (THEIRS) + the group's other registered tracks' briefs (OURS — the
+     *     integration tip is the base plus the already-merged tracks), from the
+     *     desktop-local `activeBriefByTask` registry (never on the wire), each
+     *     capped to `RESOLVER_TRACK_BRIEF_MAX_BYTES`.
+     *   - "both tracks' intent diffs" → bounded `base→theirs` / `base→ours`
+     *     hermetic diffs (≤ `RESOLVER_INTENT_DIFF_MAX_BYTES` per side). An
+     *     over-budget/unreadable side degrades to a placeholder line; a
+     *     binary/non-UTF-8-bearing diff (NUL / U+FFFD) likewise (mirrors the
+     *     Tier-2 bundle's placeholder discipline). `baseSha` absent (the
+     *     reconstruction-replay caller) → no diffs.
+     *
+     * GRACEFUL-DEGRADE, never gating: intent is an ADDITIVE projection — a
+     * failure to compute any piece must not human-gate a resolve that succeeds
+     * without it (the final-tip Tier-2 gate re-reviews fail-closed regardless).
+     */
+    private buildResolverIntentContext;
+    /**
+     * A1b — the newest recorded rationale entry for a task (or undefined),
+     * shaped for `runImplementorRound`'s `priorRationale`. The label is the
+     * entry's OWN recorded round (LOW-4) — never an inferred `nextRound - 1`,
+     * which drifts when the immediately previous round produced no summary.
+     */
+    private latestPriorRationale;
     /** @internal — test introspection. */
     get _runningSeatsForTests(): ReadonlySet<string>;
     /** @internal — test introspection. */
@@ -1872,6 +2175,19 @@ export declare class QuorumLoop {
     _setActiveTaskForTests(taskId: string, brief?: string): void;
     /** @internal — read a task's accumulated binding user notes. */
     _userNotesForTests(taskId: string): readonly string[];
+    /** @internal — A1b: read a task's accumulated structured findings history. */
+    _roundHistoryForTests(taskId: string): readonly RoundFindingRecord[];
+    /** @internal — A1b: read a task's accumulated implementor rationale entries. */
+    _rationaleForTests(taskId: string): readonly RationaleEntry[];
+    /** @internal — A1b: the bounded rationale slice a resolver/reviewer consumer gets. */
+    _boundedRationaleForTests(taskId: string | undefined, maxBytes: number): string | null;
+    /** @internal — A1d: the bounded resolver-intent projection for one slot resolve. */
+    _buildResolverIntentContextForTests(args: {
+        implementorTaskId: string;
+        oursCommit: string;
+        theirsCommit: string;
+        baseSha?: string;
+    }): Promise<ResolverIntentContext>;
     /** @internal — read the consumed REVISE_FEEDBACK dedup ids (Stage-2 r1 guard). */
     get _seenReviseFeedbackIdsForTests(): ReadonlySet<string>;
     /** @internal — read the live in-memory shadow handle for a task (or undefined). */
@@ -1897,4 +2213,4 @@ export declare class QuorumLoop {
     _replaceShadowForRound0UnlockedForTests(taskId: string): Promise<void>;
     _ensureShadowUnlockedForTests(taskId: string): Promise<WorkspaceShadow>;
 }
-export { reviewerAgentToLeAgent };
+export { reviewerAgentToLeAgent, renderAgenticResolveBrief };

package/dist/orchestration-shell/task-progress.d.ts

@@ -67,6 +67,8 @@ export type TaskProgressEvent = ({
     phase: 'planner_classifying';
 } | {
     phase: 'familiarizing';
+} | {
+    phase: 'agent_advisory';
 } | {
     phase: 'progress_cleared';
 }) & {

package/dist/orchestration-shell/team-decompose.d.ts

@@ -42,7 +42,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
             test_surfaces: string[];
             auto_modified_files: string[];
         }>;
-        implementorAgent: z.ZodEffects<z.ZodEnum<["CLAUDE", "CODEX", "GEMINI", "ANTIGRAVITY"]>, "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY", unknown>;
+        implementorAgent: z.ZodEffects<z.ZodEnum<["CLAUDE", "CODEX", "ANTIGRAVITY"]>, "CLAUDE" | "CODEX" | "ANTIGRAVITY", unknown>;
         isSharedTestOwner: z.ZodBoolean;
         description: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -56,7 +56,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
             test_surfaces: string[];
             auto_modified_files: string[];
         };
-        implementorAgent: "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY";
+        implementorAgent: "CLAUDE" | "CODEX" | "ANTIGRAVITY";
         isSharedTestOwner: boolean;
     }, {
         description: string;
@@ -85,7 +85,7 @@ export declare const WorkItemInputSchema: z.ZodDiscriminatedUnion<"decompose", [
             test_surfaces: string[];
             auto_modified_files: string[];
         };
-        implementorAgent: "CLAUDE" | "GEMINI" | "CODEX" | "ANTIGRAVITY";
+        implementorAgent: "CLAUDE" | "CODEX" | "ANTIGRAVITY";
         isSharedTestOwner: boolean;
     }[];
 }, {
@@ -127,27 +127,37 @@ export type DecomposerResult = {
     reason: string;
 };
 /**
- * Read the implementor's FINAL message text per-agent (§3.B / L9). Unlike
- * `extractAgentSummary` (which returns '' for Codex because the diff is the
- * single-impl contract), the DECOMPOSER needs the actual reply text — so for
- * Codex we read AND unlink the `--output-last-message` temp file. A Codex
- * decomposer would otherwise always parse-fail on its `--json` JSONL stdout.
+ * Read the implementor's FINAL message text per-agent (§3.B / L9). For Codex
+ * we read AND unlink the `--output-last-message` temp file (a Codex decomposer
+ * would otherwise always parse-fail on its `--json` JSONL stdout). Since A1b
+ * the file branch delegates to the SHARED `readImplementorLastMessage` helper
+ * (the same read `extractAgentSummary` uses), threading `workdir` so a
+ * SUBSTRATE-relocated capture file is found at `<workdir>/<basename>` — the
+ * decomposer runs through `LocalExecutor.spawnImplementor` with a synthetic
+ * taskId, so CP-7 DOES engage for it and the relocation applies. Unlike
+ * `extractAgentSummary`, the decomposer reads even on a NON-ZERO exit (a
+ * partial reply may still parse) — the exit-code gate stays a quorum-loop
+ * concern.
  *   - Claude  → `capture.kind === 'stdout'` → `handle.stdout()`.
- *   - Codex   → `capture.kind === 'file'`   → read+unlink the temp file.
- *   - Gemini  → stdout, unwrap the `{ response }` JSON envelope.
+ *   - Codex   → `capture.kind === 'file'`   → shared read+unlink helper.
  * NEVER throws — a capture error returns '' (→ the caller's parse-fail →
  * single-task fallback).
  */
 export declare function readImplementorFinalMessage(plan: ReturnType<typeof buildImplementorArgv>, handle: {
     stdout: () => string;
-}, agent: AgentKind, exitCode: number): Promise<string>;
+}, agent: AgentKind, exitCode: number, workdir?: string): Promise<string>;
 /**
  * Build the decomposition prompt fed to the local decomposer on stdin (§3.B).
  * `brief` is the composed lossless implementation brief (§3.D step 0).
  * `availableAgents` is the DETECTED set (§3.C) — the strengths list is filtered
  * to it, and the decomposer is told to pick `implementorAgent` from it.
+ * `repoContext` (A1e slice-wiring REMAP) is the OPTIONAL bounded repository-
+ * context block (`composeDispatchContextBlock` — the resolved `context_ref`
+ * slice + the fresh-only `repo_state` overview), appended verbatim so the
+ * decomposer partitions with the SAME grounded repo picture the implementors
+ * get. Empty/absent → the prompt is byte-identical to pre-A1e.
  */
-export declare function buildDecomposerPrompt(brief: string, availableAgents: AgentKind[]): string;
+export declare function buildDecomposerPrompt(brief: string, availableAgents: AgentKind[], repoContext?: string): string;
 /**
  * #590 — append a deterministic "allowed test files" line to a track's brief so
  * the implementor agent writes its own-module tests at the EXACT declared
@@ -184,13 +194,21 @@ export interface RunLocalDecomposerDeps {
  * the first detected agent; CP-7 engages because `role:'implementor'` + a
  * (synthetic) `taskId` are passed.
  */
-export declare function runLocalDecomposer(deps: RunLocalDecomposerDeps, brief: string, availableAgents: AgentKind[]): Promise<DecomposerResult>;
+export declare function runLocalDecomposer(deps: RunLocalDecomposerDeps, brief: string, availableAgents: AgentKind[], 
 /**
- * Validate + normalize each work item's `implementorAgent` against the DETECTED
- * agent set (§3.C — v1 is DETECTED-ONLY; NO capability-health filtering, NO
- * per-spawn auth-recheck). For each item: `.toUpperCase()`-normalize the
- * suggested agent; keep it if detected; else SUBSTITUTE the first detected
- * agent. If NO agent is detected → `null` (the caller falls back to single).
- * Returns NEW work items (does not mutate the inputs).
+ * A1e (slice-wiring REMAP) — the optional bounded repository-context block
+ * (`composeDispatchContextBlock`), appended to the decomposer prompt so the
+ * partitioning is grounded in the same projected repo picture the
+ * implementors get. Empty/absent → byte-identical prompt.
+ */
+repoContext?: string): Promise<DecomposerResult>;
+/**
+ * Validate + normalize each work item's `implementorAgent` against the active
+ * detected agent set (§3.C — v1 is DETECTED-ONLY; NO capability-health
+ * filtering, NO per-spawn auth-recheck). For each item:
+ * `.toUpperCase()`-normalize the suggested agent; keep it if active +
+ * detected; else SUBSTITUTE the first active detected agent. If NO active
+ * agent is detected → `null` (the caller falls back to single). Returns NEW
+ * work items (does not mutate the inputs).
  */
 export declare function validateAgentAvailability(workItems: DecomposerWorkItem[], detected: AgentKind[]): DecomposerWorkItem[] | null;