@r1z4x/tezgah 1.4.0 → 1.5.0

package/hooks/tezgah_task.py

@@ -21,14 +21,19 @@ before it happens is decided once. This module is on the gate's hot path for
 every write, so it imports nothing from tezgah_context and shells out to
 nothing.
 
-A plan's body is read here too, and only here: the acceptance report
+A plan's body is read here too: the acceptance report
 (`tezgah-render-table --acceptance`) counts the items that name no command, so
 the record the gate reads and the items the report counts have one reader. Two
 readers of the body were added beside it and read in the same place - the
-`## Acceptance` items a plan cannot enter a writing phase without
-(`acceptance_gap`), and the spike a plan declares and has not answered
-(`spike_unanswered`) - for the same reason: the CLI refuses the phase move and
-the CI report counts the same items, and one module keeps them agreeing.
+`## Acceptance` items a plan cannot enter a writing phase with while any of them
+names no command (`acceptance_gap`, the predicate `--strict` refuses on too),
+and the spike a plan declares and has not answered (`spike_unanswered`) - for
+the same reason: the CLI refuses the phase move and the CI report counts the
+same items, and one module keeps them agreeing. The open plans' progress (the
+ticked boxes), the plans each one waits on (`after:`) and which ready plans can
+run at once (`queue`, `parallel`) are read here for `tezgah-task status`. The
+injected open-plans block keeps its own small reader
+(`hooks/tezgah_context.py::_plan_row`: id, title, the first `## Next` line).
 
 The `checkpoint:` key is read here for the same reason again: bin/tezgah-task
 writes it when the phase moves to `implementation` - the pre-work commit's sha
@@ -100,8 +105,9 @@ def frontmatter(text):
     return out
 
 
-def allowed_paths(text):
-    """The `allowed_paths:` list as a list of globs, [] when absent."""
+def _list_field(text, key):
+    """One frontmatter key's `- item` block as a list of strings, [] when the key
+    is absent or carries no block."""
     out = []
     collecting = False
     for line in _frontmatter_lines(text):
@@ -110,10 +116,24 @@ def allowed_paths(text):
             out.append(stripped[2:].strip())
             continue
         collecting = (not stripped.startswith("- ") and ":" in stripped
-                      and stripped.partition(":")[0].strip() == "allowed_paths")
+                      and stripped.partition(":")[0].strip() == key)
     return out
 
 
+def allowed_paths(text):
+    """The `allowed_paths:` list as a list of globs, [] when absent."""
+    return _list_field(text, "allowed_paths")
+
+
+def after(text):
+    """The plan ids this plan waits on (`after:`), in the order written: the
+    `- NNN` block `set_fields` writes, or the inline `after: 012, 015` a person
+    types. [] when the plan waits on nothing - which is what lets it run beside
+    the others."""
+    return (_list_field(text, "after")
+            or frontmatter(text).get("after", "").replace(",", " ").split())
+
+
 def section_lines(text, heading):
     """The lines of one `## <heading>` section with their 1-based numbers, []
     when the file has no such heading: the lines after the heading up to the next
@@ -129,7 +149,7 @@ def section_lines(text, heading):
     return out
 
 
-_ITEM = re.compile(r"^\s*- \[[ xX]\]\s*(.*)$")
+_ITEM = re.compile(r"^\s*- \[([ xX])\]\s*(.*)$")
 # The word `unverifiable`, as a word: the lookahead is a boundary a hyphen and a
 # letter both fail, so `unverifiable-ness` is not a marker.
 _MARKER = re.compile(r"unverifiable(?![-\w])", re.I)
@@ -191,10 +211,11 @@ def unverifiable_reason(text):
 
 def acceptance_items(text):
     """One plan file's `## Acceptance` items: a list of
-    {"line", "text", "state"}, plus "reason" when the state is "unverifiable".
-    One field and not two - "checkable" (the item names a command),
-    "unverifiable" (it says so and why) or "missing" (neither) - so no caller can
-    read two answers about one item.
+    {"line", "text", "checked", "state"}, plus "reason" when the state is
+    "unverifiable". One field and not two - "checkable" (the item names a
+    command), "unverifiable" (it says so and why) or "missing" (neither) - so no
+    caller can read two answers about one item. "checked" is the box (`- [x]`),
+    which is the plan's progress and says nothing about the item's proof.
 
     An item is one `- [ ]`/`- [x]` line plus the lines it wraps onto, up to the
     next item or a blank line: the format wraps at 79 columns, so an item is more
@@ -204,8 +225,8 @@ def acceptance_items(text):
     for number, line in section_lines(text, "Acceptance"):
         found = _ITEM.match(line)
         if found:
-            out.append({"line": number, "text": " ".join(found.group(1).split()),
-                        "state": "missing"})
+            out.append({"line": number, "text": " ".join(found.group(2).split()),
+                        "checked": found.group(1) != " ", "state": "missing"})
         elif out and line.strip():
             out[-1]["text"] = " ".join((out[-1]["text"] + " " + line).split())
     for item in out:
@@ -217,19 +238,27 @@ def acceptance_items(text):
     return out
 
 
+def unproven(items):
+    """The items that name no command and declare no `unverifiable` - the one
+    predicate both the phase move (`acceptance_gap`) and `render_table
+    --acceptance --strict` refuse on, so the two cannot let through different
+    plans."""
+    return [item for item in items if item["state"] == "missing"]
+
+
 def acceptance_gap(text):
-    """The plan's Acceptance items when nothing in them can check the work: every
-    item the section carries is `missing`, so none names a command and none
-    declares itself `unverifiable`. [] otherwise, and [] when the plan has no
-    Acceptance items at all.
+    """The plan's Acceptance items that nothing can check: each one names no
+    command and declares no `unverifiable`. [] when every item names its proof,
+    and [] when the plan has no Acceptance items at all.
 
-    A plan with an empty or absent section is a different defect - the format asks
-    plan-add to write the items, and the render_table report does not gate that
-    case either - so refusing it here would tax every plan that predates the rule
-    while the two readers still agreed about every item either of them can see.
-    Returns the items so a refusal can count them."""
-    items = acceptance_items(text)
-    return items if items and all(item["state"] == "missing" for item in items) else []
+    Any such item is a gap, not only a section made of them: the format asks for
+    the proof per item, and the strict report refuses an open plan on one, so a
+    phase move that let one through would be refused later by the reader it was
+    meant to answer first. A plan with an empty or absent section is a different
+    defect - the format asks plan-add to write the items, and the report does not
+    gate that case either - so refusing it here would tax every plan that
+    predates the rule. Returns the items so a refusal can name them."""
+    return unproven(acceptance_items(text))
 
 
 # The `checkpoint:` values a plan can carry: a commit sha (the tree was clean at
@@ -295,6 +324,30 @@ def spike_unanswered(text):
 
 
 ACCEPTANCE_DIRS = ("open", "done")
+# The `status:` a plan carries in each directory (plan-add's format): a plan
+# under open/ is open or blocked, one under done/ is done or discarded.
+OPEN_STATUSES = ("open", "blocked")
+
+
+def _plan_files(root, sub):
+    """(name, path, text) for every readable `*.md` under
+    `<root>/.tezgah/plans/<sub>`, sorted by name; an absent directory or an
+    unreadable file is skipped, so a reader built on it never raises."""
+    directory = os.path.join(root, ".tezgah", "plans", sub)
+    try:
+        names = sorted(os.listdir(directory))
+    except OSError:
+        return
+    for name in names:
+        if not name.endswith(".md"):
+            continue
+        path = os.path.join(directory, name)
+        try:
+            with open(path, "r", encoding="utf-8") as fh:
+                text = fh.read()
+        except OSError:
+            continue
+        yield name, path, text
 
 
 def acceptance_report(root):
@@ -310,20 +363,7 @@ def acceptance_report(root):
     items = []
     plans = 0
     for sub in ACCEPTANCE_DIRS:
-        directory = os.path.join(root, ".tezgah", "plans", sub)
-        try:
-            names = sorted(os.listdir(directory))
-        except OSError:
-            continue
-        for name in names:
-            if not name.endswith(".md"):
-                continue
-            path = os.path.join(directory, name)
-            try:
-                with open(path, "r", encoding="utf-8") as fh:
-                    text = fh.read()
-            except OSError:
-                continue
+        for name, _, text in _plan_files(root, sub):
             plans += 1
             for item in acceptance_items(text):
                 item["plan"] = ".tezgah/plans/%s/%s" % (sub, name)
@@ -331,6 +371,72 @@ def acceptance_report(root):
     return {"plans": plans, "items": items}
 
 
+def _plan_id(fields, name):
+    return fields.get("id") or name.split("-")[0]
+
+
+def _prefix(glob):
+    """The literal head of a glob: everything before its first `*`."""
+    return glob.split("*", 1)[0]
+
+
+def scopes_overlap(first, second):
+    """Could two allowlists name one file? An empty list is every path, and two
+    globs can only meet when one literal head is a prefix of the other's - so
+    `hooks/a*.py` and `hooks/b*.py` never do, and `**/x` meets everything.
+    ponytail: prefix test, not glob intersection - it says "overlap" for
+    `hooks/*.py` against `hooks/x/y.md`, which only costs a missed pairing."""
+    if not first or not second:
+        return True
+    return any(a.startswith(b) or b.startswith(a)
+               for a in map(_prefix, first) for b in map(_prefix, second))
+
+
+def queue(root):
+    """Every open plan as a row: {"id", "status", "path", "checked", "items" (the
+    Acceptance boxes ticked, and their count), "after" ([id, state] per plan it
+    waits on: `done`, `discarded`, `open` or `missing` when no plan carries the
+    id), "ready" (not blocked, and everything it waits on is done), "overlaps"
+    (the other open plans whose allowed_paths can name one of its files)}.
+
+    The plans' progress and order had no reader: the boxes were counted nowhere
+    and nothing said which plans could run beside each other. Never raises."""
+    state = {}
+    for name, _, text in _plan_files(root, "done"):
+        fields = frontmatter(text)
+        state[_plan_id(fields, name)] = ("discarded" if fields.get("status") == "discarded"
+                                         else "done")
+    rows = []
+    scopes = {}
+    for name, path, text in _plan_files(root, "open"):
+        fields = frontmatter(text)
+        ident = _plan_id(fields, name)
+        state[ident] = "open"
+        items = acceptance_items(text)
+        scopes[ident] = allowed_paths(text)
+        rows.append({"id": ident, "status": fields.get("status", ""), "path": path,
+                     "checked": sum(1 for item in items if item["checked"]),
+                     "items": len(items), "after": after(text)})
+    for row in rows:
+        row["after"] = [[ident, state.get(ident, "missing")] for ident in row["after"]]
+        row["ready"] = (row["status"] != "blocked"
+                        and all(dep == "done" for _, dep in row["after"]))
+        row["overlaps"] = [other["id"] for other in rows if other is not row
+                           and scopes_overlap(scopes[row["id"]], scopes[other["id"]])]
+    return rows
+
+
+def parallel(rows):
+    """The ready plans that can run at once, in id order: each one shares no
+    allowed_paths prefix with any other picked (greedy, first id first). [] when
+    fewer than two qualify - one plan is not a fan-out."""
+    picked = []
+    for row in rows:
+        if row["ready"] and not any(other in row["overlaps"] for other in picked):
+            picked.append(row["id"])
+    return picked if len(picked) > 1 else []
+
+
 def active(cwd, base):
     """The active task as a dict, or None. Scans `<repo_root>/.tezgah/plans/open/*.md`
     sorted by name, first file whose frontmatter carries a valid `phase`.

package/hooks/tezgah_taste.py

@@ -218,7 +218,7 @@ def learn_later(root):
     signals of `root` (the git root `enabled` returned) grew since the last
     start and an hour has passed; the stamp (a `taste_learn` document of the
     cache database) keeps the newest signal's append number. Only when
-    TypeSafe resolves: the automatic run never pays a
+    the Jev model resolves through any carrier: the automatic run never pays a
     generative provider for a decision it may not apply. Not on a
     machine without flock (Windows), where two background runs in two
     repositories would race on the user ledger. ponytail: no Windows lock; add
@@ -243,7 +243,7 @@ def learn_later(root):
         import tezgah_judge
         import tezgah_taste_ledger
         if tezgah_taste_ledger.fcntl is None or tezgah_paths.off("judge-off") \
-                or not tezgah_judge.named(("typesafe",)):
+                or not tezgah_judge.named(("jev",)):
             return
         if not store.put_doc("taste_learn", name, {"rows": count, "at": now}):
             return

package/hooks/tezgah_taste_ledger.py

@@ -135,6 +135,15 @@ def rows(root, table, where="", args=()):
         return store.rows(db, table, where, args) if db else []
 
 
+def jev_rows():
+    """(where, args) for `rows`: the rows a Jev carrier (`tezgah_judge.JEV_CARRIERS`)
+    decided, whichever one answered - an old `typesafe` row included. Imported
+    here, not at the top: the write hook loads this module and never asks."""
+    import tezgah_judge
+    carriers = tuple(tezgah_judge.JEV_CARRIERS)
+    return "WHERE provider IN (%s)" % ", ".join("?" * len(carriers)), carriers
+
+
 def append(root, table, row, strict=False):
     """One row into a taste table. A hook drops a row it cannot write; `strict`
     (the CLI's decision, defect and label rows) raises instead, so `learn` stops
@@ -193,10 +202,10 @@ class locked:
 def calibration(root):
     """(x, n, bound): of the labelled signals the typed decision called a
     preference, how many the label agrees with, and the Clopper-Pearson lower
-    bound on that precision. Only typed-provider decisions count; the labels are
+    bound on that precision. Only Jev decisions count; the labels are
     a sample drawn independently of what was injected (`tezgah-taste label`)."""
     x = n = 0
-    for row in rows(root, "labels", "WHERE provider = ?", ("typesafe",)):
+    for row in rows(root, "labels", *jev_rows()):
         if row.get("decided") != "preference":
             continue
         n += 1
@@ -258,7 +267,7 @@ def apply(ledgers, sig, dec, day, applied=()):
 
     `dec` is the typed decision: `kind`, `category`, `scope` as (choice,
     probability), `relations` {learning id: (relation, probability)} and
-    `verified`, True only when TypeSafe answered - any other provider's decision
+    `verified`, True only when the Jev model answered - any other provider's decision
     is never applied. `applied` are the ids injected in the signal's session."""
     if not dec.get("verified"):
         return "unverified"
@@ -571,7 +580,7 @@ def gate(root, need=980, alpha=0.1):
     lower at one-sided p < `alpha`. Returns the report."""
     first = first_injection(root)
     arms = {"before": [0, 0], "after": [0, 0]}
-    for row in rows(root, "decisions", "WHERE provider = ?", ("typesafe",)):
+    for row in rows(root, "decisions", *jev_rows()):
         at = row.get("at")
         if not isinstance(at, (int, float)):
             continue

package/hosts/codex/hook.py

@@ -158,6 +158,11 @@ def main():
     event = payload.get("hook_event_name") or "SessionStart"
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
+    # codex hands its hooks its own env, which carries no codex marker (only the
+    # shell tool gets CODEX_THREAD_ID), so the judge seam's session_cli() could
+    # not tell this is a codex session without it.
+    if session_id:
+        os.environ.setdefault("CODEX_THREAD_ID", str(session_id))
     safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
     if event == "SessionStart":
         safe(session_id, attest_session, "codex", session_id, cwd)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r1z4x/tezgah",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "One shared working contract for every AI coding assistant you run: Claude Code, Codex, Cursor, opencode, dsh and oh-my-pi (omp).",
   "license": "MIT",
   "repository": {

package/skills/harness/SKILL.md

@@ -60,6 +60,10 @@ is reported as such, and an empty list beside it is not evidence of absence.
 `graph-review` splits findings into `confirmed` (no refuter refuted it), `refuted` (do not report as bugs),
 and `unverified` (hit the cap, or every refuter failed - label them as such). Never promote a refuted or unverified finding.
 
+`graph-review` is one review round, not a loop: inside a plan it is round one or round two of the
+plan's single review (two rounds at most, `tezgah-task review` refuses a third), never one run per
+task, and never re-run on a diff it already read.
+
 `graph-impact`'s `graph_blind_spots` are call sites the graph could not see - string dispatch, config,
 templates, generated code. They are usually where a migration actually breaks. Lead with them.
 

package/skills/plan-add/SKILL.md

@@ -40,17 +40,23 @@ Input: `$ARGUMENTS` (free text describing the work). Run these steps in order.
    Acceptance: checkable criteria, each with the command that proves it - or the
    word `unverifiable` and why, since *when possible* is the loophole
    (`~/.config/tezgah/bin/tezgah-render-table --acceptance` reports the items that
-   name no command). A plan whose every item names no command cannot enter a
-   writing phase at all (`tezgah-task` refuses it), so this is the plan's own
-   check, not a report read later. State: `not started` plus the findings from
-   step 4. Next: the first concrete action. Dates: `date +%F`. `allowed_paths:`:
+   name no command). An item that names no command keeps the plan out of a
+   writing phase (`tezgah-task` refuses it, through the predicate `--strict`
+   refuses on), so this is the plan's own check, not a report read later. State:
+   `not started` plus the findings from
+   step 4. Next: the first concrete action - when the plan holds two or more
+   independent tasks, one parallel wave: one slice per task, each with its own
+   worktree and a subset of `allowed_paths:`, spawned in one message. Dates: `date +%F`. `allowed_paths:`:
    the globs the work will write, from the files step 4 found (`apps/admin/**`,
    `packages/ui/src/**`), narrow enough that a write outside them is a surprise
    - the plan names its own scope, and `tezgah-task start` without `--allow`
    holds the task to it. A plan that has to spike an assumption first (does the
    approach work at all?) writes the four `spike:` keys below: `implementation`
    is refused while `spike_recorded:` names no answer, so the answer is recorded
-   before the build rather than after it.
+   before the build rather than after it. `after:`: the ids of the open plans
+   this one cannot start before (`after: 012, 015`), only when step 4 found a
+   real dependency - a plan with none can run beside the others, and
+   `tezgah-task status` names which ready plans share no `allowed_paths:` prefix.
 6. Rewrite the README status table: `~/.config/tezgah/bin/tezgah-render-table` (installed by `bin/tezgah-setup --install`; if it is missing, run that script)
    (one row per open plan, sorted by id; it prints the rows). A new plan has no PR
    state to enrich, so no `--pr-info` here; that enrichment belongs to plan-status.
@@ -72,7 +78,7 @@ Input: `$ARGUMENTS` (free text describing the work). Run these steps in order.
    user passes `--any-path`, so tell the user the exact command - the plan's
    scope included - and never suggest dropping it. Three more refusals land at
    the same moment, and the user fixes them in the plan, not the command: a
-   writing phase whose every Acceptance item names no command, and
+   writing phase while any Acceptance item names no command, and
    `implementation` while the plan's spike is unanswered (both refused with the
    file and the reader that reported it); and `implementation` is refused while
    the tree is dirty, because the phase starts by recording `checkpoint:` - the
@@ -111,6 +117,7 @@ created: YYYY-MM-DD
 updated: YYYY-MM-DD
 allowed_paths:
   - <glob>
+after:
 ---
 ## Goal
 <1-3 sentences>
@@ -134,6 +141,14 @@ acceptance commands run unpiped, and a fresh reviewer (the host's
 `tezgah-task review NNN <reviewer> approve|changes` records as `review:`.
 `tezgah-task close NNN done` (plan-sync) refuses without an `approve`.
 
+`after:` names the plans that must be done before this one starts - a `- NNN`
+block or `after: 012, 015`. `tezgah-task status` reads it: each open plan's
+Acceptance boxes ticked (`acceptance 3/8 checked`), what it still waits on
+(`waits on 012 (open)`), and a `parallel:` line naming the ready plans whose
+`allowed_paths:` share no prefix, which can run at once in separate worktrees.
+An `after:` id no plan carries, or an open plan whose `status:` is not open or
+blocked, is a `FAIL` line there.
+
 `checkpoint:` is written by `tezgah-task` when the phase moves to
 `implementation`: the sha of the commit the work returns to, or `pending` while
 the tree still holds work no commit names - and while it reads `pending` the gate
@@ -163,7 +178,8 @@ Small self-contained edits do not get a plan.
   `allowed_paths` (the plan's scope), `phase` while it is the active task,
   `checkpoint` in the implementation phase (the commit the work returns to) and
   `review` once a fresh reviewer read its diff, plus the optional `spike` keys
-  on a plan that answers one question before building,
+  on a plan that answers one question before building and `after` (the plan ids
+  it waits on),
   sections Goal, Acceptance (checkboxes: each item carries the command that proves
   it, or `unverifiable` and why), State (evidence), Next (one action or BLOCKED).
 - Work for a plan happens on branch `plan/NNN-slug`; a merged PR (or a branch merged

package/skills/plan-add/render_table.py

@@ -37,8 +37,9 @@ def acceptance(strict):
     count = lambda state: sum(1 for i in report["items"] if i["state"] == state)
     print("plans: %d read, acceptance items: %d read; %d name no command, %d declared unverifiable"
           % (report["plans"], len(report["items"]), count("missing"), count("unverifiable")))
-    open_missing = [i for i in report["items"]
-                    if i["state"] == "missing" and i["plan"].startswith(".tezgah/plans/open/")]
+    # the predicate the phase move refuses on (tezgah-task), so the two agree
+    open_missing = tt.unproven([i for i in report["items"]
+                                if i["plan"].startswith(".tezgah/plans/open/")])
     if strict and open_missing:
         print("strict: %d item(s) under .tezgah/plans/open name no command and declare no "
               "unverifiable; a done plan is reported, never gated" % len(open_missing))

package/skills/plan-status/SKILL.md

@@ -15,7 +15,12 @@ description: >
 1. Resolve the root: `ROOT=$(git rev-parse --show-toplevel)`. If it fails, stop and
    say plans need a git repo. If `$ROOT/.tezgah/plans/open` is missing, say so and stop.
 2. For each `.tezgah/plans/open/*.md`: read the frontmatter (id, title, status, branch, pr)
-   and the first line of the `## Next` section.
+   and the first line of the `## Next` section. Then run
+   `~/.config/tezgah/bin/tezgah-task status`: per open plan it prints the
+   Acceptance boxes ticked, the plans its `after:` still waits on, and a
+   `parallel:` line naming the ready plans that share no `allowed_paths:`
+   prefix; a `FAIL` line (a status outside open|blocked, an `after:` id no plan
+   carries, a phase no reader accepts) goes into the report as it printed.
 3. If `pr:` is set, run
    `gh pr view <pr> --json state,mergedAt,reviewDecision,statusCheckRollup -q '[.state, .reviewDecision, ([.statusCheckRollup[]?.conclusion] | unique | join(","))] | map(select(. != null and . != "")) | join(" | ")'`
    and append the result to that row's `pr` cell, e.g. `#12 (OPEN | APPROVED | SUCCESS)`.
@@ -37,16 +42,19 @@ description: >
    no "Generated with" / "Made with", no robot emoji, no Claude/Anthropic/OpenAI/
    GPT/Codex/Gemini/Cursor/Copilot credit.
 8. Print the table, then one line per plan with `status: blocked` quoting its
-   `BLOCKED: <reason>`, then any gh failures.
+   `BLOCKED: <reason>`, then one line per plan that waits on another (`waits on
+   NNN (open)`), then any gh failures and `FAIL` lines.
 9. End with exactly one recommendation: "Work on NNN <slug> next: <reason>". No menu.
    Prefer plans with an approved PR and green CI, then open plans with no blocker,
-   oldest first.
+   oldest first; never a plan that still waits on another. When the `parallel:`
+   line names it with others, add one sentence: those plans can run at once, one
+   worktree each.
 
 ## Format
 
 Plan file `.tezgah/plans/open/NNN-slug.md` (status open|blocked) or `.tezgah/plans/done/NNN-slug.md`
 (status done|discarded). Frontmatter: id, title, status, branch (`plan/NNN-slug`),
-pr, created, updated, allowed_paths, plus phase/allowed_from/review when set. Sections: `## Goal`, `## Acceptance` (checkboxes), `## State`
+pr, created, updated, allowed_paths, plus after/phase/allowed_from/checkpoint/review/review_round/reviewed_sha and the spike keys when set. Sections: `## Goal`, `## Acceptance` (checkboxes), `## State`
 (evidence), `## Next` (one action or `BLOCKED: <reason>`). README table lives between
 `<!-- status:start -->` and `<!-- status:end -->` with columns
 `| id | title | status | branch | pr | next |`.

package/skills/plan-sync/SKILL.md

@@ -28,16 +28,23 @@ description: >
    - gh returned `[]`: fallback `git branch -r --merged origin/main | grep -q "origin/<branch>"`.
      If it matches, treat as done and append `merged without PR`.
    - otherwise: leave the plan untouched.
-5. For every plan marked done: if `## Acceptance` still has `- [ ]` boxes, still move
-   it but append the line `acceptance boxes unchecked at sync` to `## State`.
+5. For every plan marked done: if `## Acceptance` still has `- [ ]` boxes (the
+   `acceptance N/M checked` count `~/.config/tezgah/bin/tezgah-task status` prints
+   per open plan), still move it but append the line
+   `acceptance boxes unchecked at sync (N/M checked)` to `## State`.
 6. Move each done or discarded plan with
    `~/.config/tezgah/bin/tezgah-task close NNN done|discarded`: it sets `status:` and
    `updated:` and moves the file to `.tezgah/plans/done/`. It refuses `done` unless the
-   plan records `review: <reviewer> approve` - a fresh reviewer (the host's
-   `tezgah-reviewer` subagent) read `git diff <base>..HEAD` and
-   `tezgah-task review NNN <reviewer> approve` wrote the verdict - and it refuses
-   the active task. A refused plan stays open: report it with the refusal, never
-   move it by hand.
+   plan records `review: <reviewer> approve` - fresh reviewers (the host's
+   `tezgah-reviewer` subagent, one per dimension in one message for a large diff)
+   read `git diff <base>..HEAD` and `tezgah-task review NNN <reviewer> approve`
+   wrote the verdict - and it refuses the active task. A refused plan stays open:
+   report it with the refusal, never move it by hand, and never start a review
+   round from here. One review per plan, over its whole diff in the verification
+   phase; at most two rounds - only a confirmed critical or major finding opens
+   round two, a minor or suggestion one is recorded fix-later, and after round two
+   what is left goes to the user or is recorded fix-later, never a third round.
+   A plan refused with a spent budget is the user's decision.
 7. Rewrite the README status table: `~/.config/tezgah/bin/tezgah-render-table` (installed by `bin/tezgah-setup --install`; if it is missing, run that script)
    (one row per open plan, sorted by id; it prints the rows). No `--pr-info` here:
    the row's `pr` cell comes from the plan files, and review/check enrichment
@@ -55,14 +62,17 @@ description: >
    no "Generated with" / "Made with", no robot emoji, no Claude/Anthropic/OpenAI/
    GPT/Codex/Gemini/Cursor/Copilot credit.
 9. Report four lists: moved plans (with done/discarded and the evidence line),
-   plans `close` refused (with its reason), still-open plans, and gh failures. Never delete branches, never edit code outside
+   plans `close` refused (with its reason), still-open plans - each with what
+   `tezgah-task status` says it waits on, so a plan whose `after:` names one just
+   discarded (`waits on NNN (discarded)`) is named for the user to re-plan - and
+   gh failures. Never delete branches, never edit code outside
    `.tezgah/plans/`.
 
 ## Format
 
 Plan file `.tezgah/plans/open/NNN-slug.md` (status open|blocked) or `.tezgah/plans/done/NNN-slug.md`
 (status done|discarded). Frontmatter: id, title, status, branch (`plan/NNN-slug`),
-pr, created, updated, allowed_paths, plus phase/allowed_from/review when set.
+pr, created, updated, allowed_paths, plus after/phase/allowed_from/checkpoint/review/review_round/reviewed_sha and the spike keys when set.
 Sections: `## Goal`, `## Acceptance` (checkboxes), `## State`
 (evidence), `## Next` (one action or `BLOCKED: <reason>`). README table lives between
 `<!-- status:start -->` and `<!-- status:end -->` with columns

package/skills/tezgah-contract/SKILL.md

@@ -221,9 +221,11 @@ a list, several files or areas, todo entries that share nothing - go to one
 subagent each, and every writing slice gets its own branch and checkout (see
 below), never the main checkout. The
 orchestrator is the main thread itself: it does not wait idle on a slice while
-independent work remains. Fan out only when the subtasks share no mutable file and no interface: if two of them would edit the same file, or one's answer decides the other's, keep them in one context or sequence them. The shared artifact is the coordination channel, not chatter - naming a lead coordinates nothing by itself. If the work
-cannot be split - one file, one bounded change, a strictly serial chain - do it
-directly. Never spawn a subagent whose briefing is bigger than the work.
+independent work remains. Fan out only when the subtasks share no mutable file and no interface: if two of them would edit the same file, or one's answer decides the other's, keep them in one context or sequence them. The shared artifact is the coordination channel, not chatter - naming a lead coordinates nothing by itself. Only a single item - one file, one
+bounded change, a strictly serial chain - is done directly; a list of
+independent items is never worked one by one on the main thread, however small
+each item is, and that holds at every phase: a plan's tasks, its acceptance
+commands and the sources of a survey fan out the same way.
 A slice that needs its own checkout: inside Orca (the session-start `Orca:`
 line) create it with `orca worktree create --name <slug> --parent-worktree
 active --json` and track it with `orca worktree ps --json` or `tezgah-status
@@ -272,7 +274,8 @@ guards against.
 
 ### The gate, for anything either tier produces
 Read the diff yourself. Then tests, lint and type check must pass, and anything
-non-trivial gets an independent review before it lands. A delegate's output is
+non-trivial gets an independent review before it lands - once per plan, not
+per task or commit. A delegate's output is
 a draft until the router has evidence; "the agent said it works" is not
 evidence.
 
@@ -519,12 +522,20 @@ rewrite it plainly.
 on a merge. Review first with a FRESH reviewer (never my own read of my own
 code), run the full suite, and if the review is clean and every test passes,
 merge, move the plan to `.tezgah/plans/done/`, and report the outcome. Bring it back
-to the user only on a critical or high-severity finding, or a failing test.
-
-**Review population: a change with an executable oracle.** The single FRESH
-reviewer above stays the rule for every change except one whose correctness can
+to the user only on a critical or major finding left after round two, or a
+failing test. One review per plan, over its whole diff in the verification
+phase; at most two rounds - only a confirmed critical or major finding opens
+round two, a minor or suggestion one is recorded fix-later, and after round two
+what is left goes to the user or is recorded fix-later, never a third round.
+A round spawns its reviewers in ONE message, one per dimension (correctness
+and contract, security, tests and performance) or file group; a diff under 300
+changed lines gets one reviewer. Per-task work gets tests, not a reviewer, and
+`tezgah-task review` refuses a third round.
+
+**Review population: a change with an executable oracle.** The fresh review
+above stays the rule for every change except one whose correctness can
 be executed - a checker, a gate rule, a parser - where each claim can be built as
-a fixture. There the fresh-review step becomes a population:
+a fixture. There round one becomes a population:
 1. One agent that has seen no known defect writes four failure directions from
    the code alone.
 2. Four reviewers, one direction each, run at once; every claim names an exact
@@ -534,9 +545,11 @@ a fixture. There the fresh-review step becomes a population:
    kind - a false accept and a false refusal alike. Only a confirmed claim counts.
 4. Confirmed claims are grouped by root mechanism, and each group gets a
    failing-first test.
-5. A population round reviews one revision and does not replace re-review of
-   the fix: every round that confirms a defect is followed by a round over that
-   fix's delta, until a round confirms none.
+5. The population is round one and spends the same two-round budget: a fix
+   for a confirmed critical or major claim carries its failing-first test, and
+   round two reads that fix's delta, the round-one hunks and the direct callers
+   of what it touches. After round two what is left goes to the user or is
+   recorded fix-later, never a third round.
 
 Status: a tentative default, measured on two changes. E1
 (an internal prove-verify experiment): directed reviewers found 3 of 3 ground-truth defects,