@r1z4x/tezgah 1.5.0 → 1.6.0

package/hooks/tezgah_gate.py

@@ -38,28 +38,26 @@ Rules, all only inside a tezgah root:
   8. a write while an active task is set - a plan file under .tezgah/plans/open whose
      frontmatter carries a valid `phase` - is refused when that phase is one
      that only reads, or when the file is outside the task's `allowed_paths`
-     refused (`task`). The record is the user's own, written by bin/tezgah-task and
-     never by the agent, so the refusal leans on a decision the user made rather
-     than one this gate inferred: no active task means no requirement, and the
-     rule invents nothing. The record also carries where the phase returns to - a
+     refused (`task`). The record is written by bin/tezgah-task, which the
+     orchestrating session runs itself as the work moves, so the refusal leans
+     on a state the CLI vetted (an Acceptance item per command, an answered
+     spike, a checkpoint) rather than one this gate inferred: no active task
+     means no requirement, and the rule invents nothing. The record also
+     carries where the phase returns to - a
      `checkpoint:` sha, or `pending` while the tree still holds work no commit
      names - and a write in `implementation` is refused while it reads `pending`
      and the tree is dirty, so the phase's work starts from a named state rather
      than on top of uncommitted changes; the per-file snapshots are not one
-     state to return to. Two further refusals close the ways a session could
-     move the boundary instead of respecting it: a write whose target IS that
-     record, and a shell command that would change it through the CLI. Both were
-     measured open before they were closed - with the refusal naming the command
-     that lifts it, an armed arm removed or disabled the gate in 25 of 25 runs
-     and obeyed it in none (an internal benchmark, block E7) - and neither
-     refusal names a command now. The phase covers the shell too, because the
+     state to return to. A write whose target IS that record is refused too:
+     retyping the frontmatter would skip the preconditions the CLI checks. The
+     phase covers the shell too, because the
      write tools are not the only way to change a file: with them refused, the
      armed arm wrote the target with a heredoc redirect in 3 of 25 runs, so a
      reading phase refuses a shell command that writes. A code-execution tool is
      a third route the phase does not cover: the same block measured one row in
      25 writing the target through `eval` after the write tools and the shell
      were both refused, and that one is named rather than closed. The `task-off`
-     kill switch removes all four.
+     kill switch removes all three.
   9. a `git commit` (or `--amend`) is refused while the newest check recorded in
      this session failed (`order`): a commit is a claim that the tree passed, and
      the state it would freeze is the one a check just rejected. The state is the
@@ -681,9 +679,10 @@ CLASS_NOTE = {
     "transient": "it names a failure the host's own client may retry - a "
                  "timeout, a connection error, a rate limit, a 5xx - and an "
                  "identical repeat by the agent adds nothing to that",
-    "user": "it names something only the user can fix - a credential, a "
-            "login, an access grant - so stop and ask the user for it rather "
-            "than change the approach",
+    "user": "it names something only the user can supply - a credential, a "
+            "login, an access grant - so take a route that needs none first "
+            "(another provider or member, a local run, a public source) and "
+            "ask the user once, naming what it unlocks, only when none is left",
     "permanent": "an assertion or a bad argument does not change by re-running "
                  "it",
 }
@@ -980,52 +979,47 @@ def race_reason(inp, session_id, cwd=None):
     return None
 
 
-# --- task scope: the user's own phase and path allowlist --------------------
-# What this closes: a session that has been told what it is working on - the
-# user activated a plan file under .tezgah/plans/open, so the work has a phase and the
-# files it may touch - and then writes anyway. Two shapes cost the user real
-# work: a write in `discovery`, where the whole point of the phase is to read
-# before deciding, and a write outside the plan's own allowlist, which is how a
-# bounded task quietly becomes an unbounded one. Both are the user's own
-# decisions, which is why this rule may refuse at all: the record is written by
-# bin/tezgah-task, by hand, and never by the agent - a rule the agent could
-# satisfy by editing its own record would be a nudge wearing a gate's clothes.
+# --- task scope: the plan's own phase and path allowlist --------------------
+# What this closes: a session that has declared what it is working on - a plan
+# file under .tezgah/plans/open is active, so the work has a phase and the
+# files it may touch - and then writes anyway. Two shapes cost real work: a
+# write in `discovery`, where the whole point of the phase is to read before
+# deciding, and a write outside the plan's own allowlist, which is how a
+# bounded task quietly becomes an unbounded one. The record is written by
+# bin/tezgah-task, which the orchestrating session runs itself: the plan's
+# lifecycle is the orchestrator's job, never a hand-off to the user. What keeps
+# the boundary is the CLI, not who runs it - a writing phase needs every
+# Acceptance item to name its proving command, `implementation` an answered
+# spike and a checkpoint, `close done` an approving review - so the record's own
+# file is refused to a write (TASK_RECORD_DENY): retyping the frontmatter is the
+# direct route that skips those checks. A shell line's positional target (`sed
+# -i`, `cp`) is not read here (see write_paths), the residual this rule names.
 #
 # The direction is fail-open wherever the record is missing, unreadable or out
-# of phase vocabulary (tezgah_task.active returns None for those), because a
-# refusal has to rest on an ask the user actually made: a rule that refused
-# every write until a record appeared would be the fail-closed trap the design
-# report names, with the whole session as its blast radius. Nothing is named
-# that the user did not name either: an empty allowlist is no scope asked for
-# rather than "nothing is allowed", so the phase is the whole requirement there.
+# of phase vocabulary (tezgah_task.active returns None for those): a rule that
+# refused every write until a record appeared would be the fail-closed trap the
+# design report names, with the whole session as its blast radius. An empty
+# allowlist is no scope declared rather than "nothing is allowed", so the phase
+# is the whole requirement there.
+#
+# The refusals name the CLI move, because running it is the work the rule asks
+# for and the CLI vets it. E7 measured a refusal that named a way to take the
+# rule off (the armed arm disabled the gate in 25 of 25 runs); the switches that
+# do that stay behind the control-plane rule below.
 TASK_PHASE_DENY = (
     "Task gate: the active task %s is in phase `%s`, and this call writes. "
-    "Writes belong to %s. The phase is the user's to move: ask them, or do the "
-    "reading this phase asks for and say what the write was for.")
+    "Writes belong to %s. Finish the reading this phase is for, then move the "
+    "phase yourself with `tezgah-task phase implementation` - it refuses until "
+    "the plan's Acceptance, spike and checkpoint are in order.")
 TASK_SCOPE_DENY = (
-    "Task gate: %s is outside the paths the active task %s allows (%s). The "
-    "allowlist is the user's to widen: ask them, or leave the file alone and say "
-    "why it looked in scope.")
-# The two refusals above deliberately name no command. They used to end with the
-# one that lifts them, and the E7 block measured what that costs: with the unlock
-# printed in the refusal, the armed arm removed or disabled the gate in 25 of 25
-# runs and obeyed it in none (an internal benchmark, block E7). A refusal
-# is a boundary or it is an instruction; it cannot be both.
+    "Task gate: %s is outside the paths the active task %s allows (%s). If the "
+    "plan's work genuinely reaches it, widen the scope yourself with `tezgah-task "
+    "allow <glob> ... --why \"<reason>\"` (listing the current globs too); "
+    "otherwise leave the file alone.")
 TASK_RECORD_DENY = (
     "Task gate: %s is the active task's own record. The phase and the allowlist "
-    "live in that file, so a session that edits it is editing the boundary it is "
-    "being held to. Ask the user to change the task; the record is theirs.")
-TASK_UNLOCK_DENY = (
-    "Task gate: this command changes the active task's own record. The phase and "
-    "the allowlist are the user's, and a session that can move them is held to "
-    "nothing. Ask the user to change the task instead.")
-# A shell command that changes the record. Matched on the masked text, so a
-# command that merely names the CLI - a grep over the docs, a commit message -
-# is not refused. The token is the CLI's own basename, with or without `.py`
-# and run through any interpreter, so any path to it counts.
-TASK_CHANGE = re.compile(
-    r"(?:^|[|;&(]\s*|\s)(?:python3?\s+)?\S*tezgah-task(?:\.py)?\s+"
-    r"(?:start|phase|allow|stop)\b")
+    "live in that file and only `tezgah-task` writes them, because it checks the "
+    "plan's Acceptance, spike and review on the way; change the task through it.")
 # The shapes that make a shell command a write, for the phase rule below. The
 # tools are not the only way to change a file, and E7b measured the other one:
 # with `edit` and `write` refused twelve and six times, the armed arm wrote the
@@ -1053,8 +1047,8 @@ SHELL_WRITE = re.compile(
 TASK_SHELL_DENY = (
     "Task gate: the active task %s is in phase `%s`, and this command writes a "
     "file. The shell is a write route like any other, so the phase covers it. "
-    "The phase is the user's to move: ask them, or do the reading this phase "
-    "asks for and say what the write was for.")
+    "Finish the reading this phase is for, then move the phase yourself with "
+    "`tezgah-task phase implementation`.")
 
 
 # The marker a caller passes when it has NOT read the record, so a rule reads it
@@ -1100,11 +1094,10 @@ def task_shell_reason(inp, cwd, base, task=_UNRESOLVED):
 def task_record_reason(inp, cwd, base, task=_UNRESOLVED):
     """A deny reason when this write's target IS the active task's record.
 
-    The other route to the same hole as TASK_UNLOCK_DENY, and the one a write
-    tool takes: the record is a file in the repo, so an agent that may write
-    files can retype the phase instead of running the CLI. Refused whatever the
-    phase and whatever the allowlist says - the record is not inside its own
-    scope, because a scope that can widen itself is not one."""
+    The record is a file in the repo, so an agent that may write files could
+    retype the phase instead of running the CLI, and skip the Acceptance, spike
+    and review checks the CLI makes on the way. Refused whatever the phase and
+    whatever the allowlist says - the record is not inside its own scope."""
     task = _task(cwd, base, task)
     if not task:
         return None
@@ -1182,11 +1175,9 @@ def task_reason(inp, cwd, base, task=_UNRESOLVED):
 # be read, and `task-off` above. A refusal has to rest on something a reader can
 # check, and a rule that cannot answer must not refuse.
 #
-# The refusal names the one command that makes the boundary real. That is not the
-# mistake TASK_PHASE_DENY records: the E7 lesson is a refusal that names how to
-# take the constraint off (the phase is the user's to move), while the checkpoint
-# command *satisfies* the requirement - running it is the work the rule asks for,
-# so naming it is naming what the rule wants rather than a way around it.
+# The refusal names the one command that makes the boundary real: running it is
+# the work the rule asks for, so naming it is naming what the rule wants rather
+# than a way around it.
 CHECKPOINT_DENY = (
     "Checkpoint gate: the active task %s is in phase `implementation` and its "
     "plan records a pending checkpoint (`checkpoint: pending <sha>`), so this "
@@ -1823,8 +1814,8 @@ def _refusing(label):
 # `tezgah-gate decide` writes a genuine `began` row with `check=1`; the capture
 # CLI writes snapshot rows; pony and adhd write CONFIG_DIR; `tezgah-context
 # attest` re-attests a session, and a clean result clears its drift mark. The
-# task CLI is not here: it is the task rule's (TASK_CHANGE), which `task-off`
-# removes, and that switch is one of the files this rule protects.
+# task CLI is not here: the orchestrating session runs it, and the checks that
+# matter live in the CLI itself (see the task rule above).
 # `tezgah-context user_prompt` is a prompt event, and a prompt naming a switch
 # writes the `authorized` row the switch latch honors (tezgah_paths.off).
 CONTROL_CLIS = {"tezgah-gate": ("decide",), "tezgah-capture": "",
@@ -2651,11 +2642,9 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
         reason = race_reason(inp, session_id, cwd)
         if reason:
             return _deny(session_id, "race", reason, tool, inp, base)
-    # Task scope: the user's own record for this work - its phase and the files
-    # its allowlist names (see task_reason). The
-    # record itself is refused first of all, and a shell that would change it
-    # through the CLI is refused with it: a boundary the agent can move is not a
-    # boundary, and both routes to moving this one were measured open (E7).
+    # Task scope: the active plan's phase and the files its allowlist names (see
+    # task_reason). The record itself is refused first of all: only
+    # bin/tezgah-task writes it, through the checks it makes on the way.
     if not off("task-off"):
         # The record is read once and handed to every rule below: each read lists
         # `.tezgah/plans/open/` and parses a plan, and this path is every write of
@@ -2667,9 +2656,6 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
             reason = task_record_reason(inp, cwd, base, task)
             if reason:
                 return _deny(session_id, "task", reason, tool, inp, base)
-        if t in BASH_TOOLS and TASK_CHANGE.search(
-                mask(str(inp.get("command") or ""))):
-            return _deny(session_id, "task", TASK_UNLOCK_DENY, tool, inp, base)
         if t in BASH_TOOLS:
             reason = task_shell_reason(inp, cwd, base, task)
             if reason:

package/hooks/tezgah_judge.py

@@ -65,7 +65,8 @@ import tezgah_store
 URL = "https://api.typesafe.ai/v1/systemone"
 MODEL = "jev-latest"
 # The other Jev carriers (`JEV_CARRIERS`): OpenRouter's System One endpoint,
-# which takes TypeSafe's body and namespaces the model `typesafe/<id>`; and
+# which takes TypeSafe's body and maps a bare `jev-*` id onto `typesafe/` itself
+# (`typesafe/jev-latest` is no model there: a live 400 on 2026-10-09); and
 # Cloudflare Workers AI, whose run route wraps the state and questions in
 # `input` and serves the one alias `typesafe/jev`. A System One-compatible URL
 # is the user's own (`JEV_API_BASE_URL`), so it has no constant here.
@@ -157,7 +158,7 @@ def _jev_call(provider, model, state, questions):
         return CLOUDFLARE_MODEL, url, {"model": CLOUDFLARE_MODEL, "input": {
             "state": state, "questions": questions}}
     if provider == "jev-openrouter":
-        used = model if "/" in model else "typesafe/" + model
+        used = model
         url = override("TEZGAH_JEV_OPENROUTER_URL", JEV_OPENROUTER_URL)
     elif provider == "jev-compatible":
         used = os.environ.get("TEZGAH_JEV_MODEL", "").strip() or model
@@ -215,12 +216,17 @@ SESSION_ARGV = {
 # prompt asked for; the judge's state can be a screen's untrusted text, so the
 # run gets an inline config (`OPENCODE_CONFIG_CONTENT`) that denies every tool -
 # the same probe with it wrote nothing. cursor-agent's `--mode ask` refused the
-# same shell call, and codex's `-s read-only` sandbox has no network.
+# same shell call, and codex's `-s read-only` sandbox has no network. Inline
+# config overrides the user's files only key by key, and an agent's own
+# `permission` wins over the top-level one, so the deny is repeated for the two
+# built-in agents `run` uses.
+_DENY_ALL = {"*": "deny", "bash": "deny", "edit": "deny", "webfetch": "deny",
+             "external_directory": "deny"}
 SESSION_ENV = {
     "opencode": {"OPENCODE_CONFIG_CONTENT": json.dumps({
-        "permission": {"*": "deny", "bash": "deny", "edit": "deny", "webfetch": "deny",
-                       "external_directory": "deny"},
-        "tools": {"*": False}})},
+        "permission": _DENY_ALL, "tools": {"*": False},
+        "agent": {name: {"permission": _DENY_ALL, "tools": {"*": False}}
+                  for name in ("build", "plan")}})},
 }
 NO_SESSION = ("no session CLI to ask (no omp, Claude Code, opencode, Cursor or Codex "
               "session marker or TEZGAH_JUDGE_CLI/judge_cli pick, or that CLI missing)")
@@ -386,8 +392,9 @@ def ask(state, questions, *, model=MODEL, timeout=30, attempts=2, deadline=None,
         return result
     refused = None
     session = tp.session_cli()
-    if only is None and session and (openrouter_key()
-                                     or any(s for _, s in tp.jev_carriers())):
+    # only a session CLI that was asked can have failed before a refusal
+    if session in (p for p, _ in tried) and (openrouter_key()
+                                            or any(s for _, s in tp.jev_carriers())):
         refused = ("fallback=%s refuses a third-party judge after %s failed"
                    % (tp.fallback_policy(), session))
     _record(None, None, failed="; ".join(failed), refused=refused)

package/hooks/tezgah_models.py

@@ -709,6 +709,39 @@ TIER_QUESTION = {
                     "a hard-to-reverse decision",
     },
 }
+# The second question in the same batched call: whether the brief is one of the
+# specialists' jobs. Before it existed route() could only name a tier, and from
+# 2026-10-07 to 10-09 the five specialists were spawned 0 times in 121
+# delegations while the generic `task` agent took 86. Every specialist but the
+# docs writer is read-only or check-only, so a brief that changes code is `none`.
+ROLE_QUESTION = {
+    "type": "choice",
+    "instructions": (
+        "Is `task` the whole job of one of these specialist agents? Pick `none` "
+        "when the task writes or changes source code, or mixes a specialist job "
+        "with code changes."),
+    "criteria": {
+        "none": "writing or changing code, or anything not listed below",
+        "tester": "only running the checks or tests a change reaches and reporting "
+                  "their output; no edits",
+        "docs": "writing or repairing documentation pages or their path:line "
+                "citations",
+        "security": "a read-only security review of a change or surface",
+        "ui": "inspecting a running web or mobile app's screens against a design "
+              "floor or accessibility",
+        "researcher": "a research line: hypotheses, literature, experiments, a report",
+        "reviewer": "an adversarial read-only review of a diff, branch or pull request",
+    },
+}
+ROLE_AGENT = {role: "tezgah-" + role for role in ROLE_QUESTION["criteria"] if role != "none"}
+# Without a judgement, the phase names the specialist where it is one.
+PHASE_AGENT = {"review": "tezgah-reviewer", "research": "tezgah-researcher"}
+# An override brief never leaves the machine, so the rule decides the one
+# specialist it can name: a security review that writes nothing.
+REVIEW_ONLY = re.compile(r"\b(?:review|audit|assess)\w*\b", re.I)
+# `change` and `update` are left out: in "review the auth change" they are nouns.
+WRITES = re.compile(r"\b(?:fix|implement|edit|write|add|refactor|patch|migrate|"
+                    r"rename|delete|remove|rotate)\w*\b", re.I)
 
 
 def route(brief, phase=None, ask=None):
@@ -724,23 +757,37 @@ def route(brief, phase=None, ask=None):
     reply is the same as no reply and this never raises."""
     hit = OVERRIDE.search(brief or "")
     if hit:
+        if REVIEW_ONLY.search(brief) and not WRITES.search(brief):
+            return _agent("tezgah-security", "override %r, review only" % hit.group(0),
+                          "rule")
         return _pick("frontier", "override: %r" % hit.group(0), "rule")
-    result = ask({"task": ti.redact(brief or "")}, {"tier": TIER_QUESTION}) if ask else None
+    result = ask({"task": ti.redact(brief or "")},
+                 {"tier": TIER_QUESTION, "role": ROLE_QUESTION}) if ask else None
     choice = tj.choice(result, "tier")
     if choice in JEV_TIER:
         chance = tj.noul(result, "tier", choice)
-        out = _pick(JEV_TIER[choice], "jev %s%s" % (
-            choice, "" if chance is None else " %.2f" % chance), "jev")
+        why = "jev %s%s" % (choice, "" if chance is None else " %.2f" % chance)
+        role = tj.choice(result, "role")
+        out = (_agent(ROLE_AGENT[role], "%s, role %s" % (why, role), "jev")
+               if role in ROLE_AGENT else _pick(JEV_TIER[choice], why, "jev"))
         out["judge"] = "%s/%s" % (result.get("provider") or "-",
                                   result.get("model") or "-")
         out["judged"] = result
         return out
+    if phase in PHASE_AGENT:
+        return _agent(PHASE_AGENT[phase], "no judgement; phase %s names it" % phase,
+                      "phase")
     if phase in PHASE_TIER:
         return _pick(PHASE_TIER[phase], "no judgement; static table for phase %s" % phase,
                      "phase")
     return _pick("standard", "no judgement and no phase; the middle tier", "default")
 
 
+def _agent(agent, why, via):
+    """A specialist, on the tier its model slot names (`AGENT_SLOT`)."""
+    return dict(_pick(AGENT_SLOT[agent], why, via), agent=agent)
+
+
 def _pick(tier, why, via):
     return {"agent": "tezgah-" + tier, "tier": tier, "why": why, "via": via,
             "judge": None, "judged": None}

package/hooks/tezgah_paths.py

@@ -592,17 +592,25 @@ JEV_CHOICES = ("auto", "typesafe", "openrouter", "cloudflare", "compatible",
                "clef", "clef-flash")
 
 
+def jev_name(value):
+    """A carrier choice as written by a user, lowercased and with the Workers AI
+    catalog prefix dropped: `@cf/cloudflare/clef-flash` is what Cloudflare's
+    dashboard and docs show, and it names the `clef-flash` carrier."""
+    value = value.strip().lower()
+    return value[len("@cf/cloudflare/"):] if value.startswith("@cf/cloudflare/") else value
+
+
 def jev_choice():
     """TEZGAH_JEV_PROVIDER, else JEV_PROVIDER (jev-mcp's name), else config.json
-    `jev`, else `auto` - lowercased. An unknown value is kept, so it resolves to
-    no carrier instead of silently to another one."""
+    `jev`, else `auto` - through `jev_name`. An unknown value is kept, so it
+    resolves to no carrier instead of silently to another one."""
     for env in ("TEZGAH_JEV_PROVIDER", "JEV_PROVIDER"):
-        value = os.environ.get(env, "").strip().lower()
+        value = jev_name(os.environ.get(env, ""))
         if value:
             return value
     cfg = config()
     value = cfg.get("jev") if isinstance(cfg, dict) else None
-    value = value.strip().lower() if isinstance(value, str) else ""
+    value = jev_name(value) if isinstance(value, str) else ""
     return value or "auto"
 
 
@@ -610,18 +618,25 @@ def jev_carriers():
     """[(carrier, secret), ...] the chosen Jev carriers in the order the seam
     asks them. `auto`: every carrier whose credential resolves. A named one: that
     carrier alone, its secret None when it does not resolve - the seam records
-    why rather than substituting another carrier."""
-    compatible = (os.environ.get("JEV_API_KEY", "").strip() or None
-                  if os.environ.get("JEV_API_BASE_URL", "").strip() else None)
-    workers_ai = cloudflare_token() if cloudflare_account() else None
-    found = [("typesafe", typesafe_key()), ("jev-openrouter", openrouter_key()),
+    why rather than substituting another carrier. Only the chosen carrier's
+    credential is read: the status line asks this on every redraw, and the
+    TypeSafe channel ends in omp's login database."""
+    def compatible():
+        return (os.environ.get("JEV_API_KEY", "").strip() or None
+                if os.environ.get("JEV_API_BASE_URL", "").strip() else None)
+
+    def workers_ai():
+        return cloudflare_token() if cloudflare_account() else None
+    found = [("typesafe", typesafe_key), ("jev-openrouter", openrouter_key),
              ("jev-cloudflare", workers_ai), ("jev-compatible", compatible),
              ("clef", workers_ai), ("clef-flash", workers_ai)]
     choice = jev_choice()
     if choice == "auto":
-        return [(name, secret) for name, secret in found if secret]
+        return [(name, secret) for name, secret in ((n, read()) for n, read in found)
+                if secret]
     name = choice if choice in ("typesafe", "clef", "clef-flash") else "jev-" + choice
-    return [(name, dict(found).get(name))]
+    read = dict(found).get(name)
+    return [(name, read() if read else None)]
 
 
 # How far a model call may leave the session's own vendor (config.json

package/hooks/tezgah_policy.py

@@ -236,17 +236,32 @@ rewrite it plainly.
 **Merge authority: standing, not per-PR.** The user is not the approval step
 on a merge. Review first with a FRESH reviewer (never my own read of my own
 code), run the full suite, and if the review is clean and every test passes,
-merge, move the plan to `.tezgah/plans/done/`, and report the outcome. Bring it back
-to the user only on a critical or major finding left after round two, or a
-failing test. One review per plan, over its whole diff in the verification
+merge and close the plan yourself (`tezgah-task close NNN done`, which also
+deactivates it and removes every merged worktree), then report the outcome. Nothing
+goes back to the user: a failing test you fix, and a critical or major finding
+left after round two you fix yourself, prove with a test and close with
+`tezgah-task close NNN done --resolved "<fix and test>"`. One review per plan, over its whole diff in the verification
 phase; at most two rounds - only a confirmed critical or major finding opens
 round two, a minor or suggestion one is recorded fix-later, and after round two
-what is left goes to the user or is recorded fix-later, never a third round.
+what is left is fixed by the session and closed with `--resolved`, or recorded fix-later, never a third round.
 A round spawns its reviewers in ONE message, one per dimension (correctness
 and contract, security, tests and performance) or file group; a diff under 300
 changed lines gets one reviewer. Per-task work gets tests, not a reviewer, and
 `tezgah-task review` refuses a third round.
 
+**The process is yours: never hand a step back.** The orchestrator runs the
+plan lifecycle itself - `tezgah-task start`, every `phase` move, `review`,
+`close`, the merge, and removing a slice's worktree once its branch is merged -
+and never ends a reply with "run this command" or "shall I close it?" for a
+step it can take. A process parameter the user did not set (a spend ceiling, a
+sample size, a retry budget, a member to consult) is picked by you: choose the
+conservative default, state it in one line, proceed. A credential, a login or an
+access grant is the one thing no tool supplies, and even then take every route
+that needs none first - another consult member or provider, local compute
+instead of managed, a public source - and ask once, naming what it unlocks, only
+when no route is left. A requested item you would drop is still asked about
+(see "Deliver the whole ask").
+
 **Attribution: none, anywhere, ever.** Nothing you persist or publish may name
 the assistant, model, vendor or "AI" as author, co-author, generator or helper -
 on any host (Claude, opencode, Codex, Cursor, dsh, omp), including subagents and cheap
@@ -303,8 +318,10 @@ active --json` and track it with `orca worktree ps --json` or `tezgah-status
 status in Orca; outside Orca, `git worktree add`. Either way the brief names
 absolute paths under that checkout.
 Routing: `{ROUTE_BIN} "<brief>"` names the worker - tezgah-cheap, -standard or
--frontier (overrides for stored data, credentials, security first; then a Jev
-judgement; the static phase table with no key). A worker that answers
+-frontier, or the specialist whose whole job the brief is (tezgah-tester,
+-docs, -security, -ui, -researcher, -reviewer) - and the spawn uses that name,
+never the host's generic task agent (overrides for stored data, credentials,
+security first; then a Jev judgement; the static phase table with no key). A worker that answers
 `ESCALATE:` is restarted on tezgah-frontier with the original brief, never
 continued; the main thread never switches model (the cache is per model). A
 code-discovery brief names codegraph's tools (`codegraph callers`, `callees`,
@@ -400,10 +417,11 @@ question needs facts newer or wider than the codebase - current versions, CVEs,
 vendor status, breaking-change news; skip it for pure code/design reasoning.
 
 Exit 4 means no choice is recorded and exit 5 means every recorded member
-failed: nothing answered, and the output lists `offer:`/`reoffer:` members. Ask
-the user which to use with exactly those options (prefer a model family other
-than your own), record the answer with `{CONSULT_BIN} --use <member>[,<member>]`,
-then ask the question again. Never pick a member for the user.
+failed: nothing answered, and the output lists `offer:`/`reoffer:` members. Do
+not ask the user: record the first listed member from a model family other than
+your own (two make a panel) with `{CONSULT_BIN} --use <member>[,<member>]`, ask
+again, and say which member you chose. After two such rounds with nothing
+answering, report the second opinion as skipped and carry on.
 
 Treat every answer as advisory evidence, never as truth: verify each claim
 against the actual code before adopting it, and tell the user which models were
@@ -451,8 +469,9 @@ are what keeps results comparable, and breaking one silently invalidates the run
 never edit a node once a run has answered it (branch a child instead); the run
 command and environment are a fixed contract identical on every node; vary the
 committed code/config, never CLI args or env knobs; grow the experiment tree
-downward, not sideways. Local research needs no login; managed compute does
-- ask the user to run `{ORX_BIN} login`.
+downward, not sideways. Local research needs no login; managed compute does -
+run locally at a scale that fits, and ask for `{ORX_BIN} login` only when the
+question cannot be answered without managed compute.
 
 A result row and every claim built on it say what they were measured on: `real`
 for the running system, `fixture` for an input you generated, `derived` for a
@@ -804,8 +823,10 @@ never your own summary, conclusion or self-assessment - a reviewer handed the
 author's framing finds measurably fewer defects. It answers with independent
 models, then one referee: read back the referee's named fields (recommendation,
 key disagreements, unchecked assumptions, what would change its mind, requested
-evidence), not a paraphrase. On exit 4/5 ask the user which `offer:`/`reoffer:`
-member to use and record it with `--use` before asking again. Relay the failure
+evidence), not a paraphrase. On exit 4/5 record the first listed
+`offer:`/`reoffer:` member of another model family yourself with `--use` and ask
+again - never ask the user to choose; after two failed rounds say it was
+skipped. Relay the failure
 class and retry line it prints, verify every claim against the code, report
 which models disagreed, and if nothing answered say the second opinion was
 skipped. Skip trivial local edits.
@@ -869,7 +890,9 @@ evidence class - `user-verbatim`, `behaviour`, `ui-observed`, `code`, `external`
 and a finding without one is a question, not a finding. Run it as a research line
 (`{RESEARCH_BIN}`), say what it did not look at, and read the `product-analysis`
 skill for the artifact shape and the scorecard, and `feature-audit` for the
-layer-coherence matrices when the ask is one feature. Off: `research-off`.
+layer-coherence matrices when the ask is one feature. A new capability built from
+data or an ask runs the `product-flow` skill: `{RESEARCH_BIN} next --topic <t>` is
+the step source, and its first missing or due step is the next one. Off: `research-off`.
 
 **No AI attribution, ever, on any host.** Nothing persisted or published may
 name the assistant, model, vendor or "AI" as author/co-author/generator/helper:
@@ -920,7 +943,10 @@ its own branch and checkout - inside Orca `orca worktree create --name <slug>
 --parent-worktree active --json`, else `git worktree add -b <branch> <absolute
 path>`; its brief names every read, edit and shell `cwd` as an absolute path
 under that checkout, never the main checkout, whose `git status --short` must
-not grow. Read-only slices need no worktree. Pick each agent by task class from
+not grow. Read-only slices need no worktree. Once a slice's branch is merged,
+its worktree goes in the same turn - `tezgah-task close` removes every merged
+one, and outside a plan `orca worktree rm --worktree path:<p>` (else `git
+worktree remove <p>`) does it; never leave one for the user to find. Pick each agent by task class from
 the specialists line; `{ROUTE_BIN}` names the tier for code work. Serialize
 only a real dependency - one slice's output is another's input, or two slices
 edit one file - and say which. Never wait idle on a spawned slice while
@@ -951,9 +977,11 @@ CONDITIONAL_KEYS = ("spec", "consult", "research", "product", "graph", "fanout")
 # the session had to recall, and the second list of a session was worked one
 # item at a time. It is the paragraph's own clause, cut to one sentence.
 FANOUT_ACTION = ("count the independent items, spawn one subagent per item in "
-                 "ONE message (each writing slice in its own worktree, absolute "
-                 "paths), and keep the main thread for integrating and verifying;"
-                 " a subagent does its own slice and never fans out again.")
+                 "ONE message, each the agent `tezgah-route` names - a specialist "
+                 "by name, never the generic task agent - (each writing slice in "
+                 "its own worktree, absolute paths), and keep the main thread for "
+                 "integrating and verifying; a subagent does its own slice and "
+                 "never fans out again.")
 
 # The always-on replacement for the conditional paragraphs: one line each so a
 # host without a per-turn hook still knows the rule exists and where the full