axstack 0.10.1 → 0.11.3

package/skills/axstack/references/lifecycle.md

@@ -17,12 +17,9 @@ binding state and receipts to exact revisions.
   `axstack-reviewer-secondary` sessions with identical brief and isolated first
   pass; authored = one eligible configured reviewer from actual author
   provenance. Owner and author never review.
-- Driver/monitor/watchdog: the five-minute driver is the automation session
-  itself, a mutating owner for the PRs it handles with no `axstack-monitor` or
-  `axstack-owner` role row. `axstack-monitor` is an optional read-only observer
-  that never sends. `axstack-watchdog` is the hourly health checker that never
-  mutates GitHub and performs exactly one kind of send, a gate-authorized
-  automation-health escalation recorded in `watchdog.json`.
+- Driver/monitor/watchdog: the driver every 15 minutes dispatches and exits as
+  a mutating owner; the watchdog is model-free and read-only, has no gate, and
+  records `watchdog.log`; there is no watch deadline for automations.
 - Auditor (`axstack-auditor`): report-only; never edits, merges, activates, or
   audits itself.
 
@@ -99,19 +96,18 @@ Tracking grants no merge, release, model-substitution, or scope authority.
 
 ## Deadline (one rule for every owned timer)
 
-The default 24-hour deadline covers every task-owned timer, including open-PR
-monitors and watchdogs. Stop at deadline; remaining work gets a resumable
-handoff, never silent renewal. Merge-ready differs from merged; human merges.
+The default 24-hour deadline covers standalone task-owned timers. Stop them at
+deadline and preserve remaining work; there is no watch deadline for
+automations. Merge-ready differs from merged; human merges.
 
 ## Watch health
 
-The user lifted the native-watch hold by user decision on 2026-09-16. The driver
-automation is a mutating owner for its PRs; `axstack-watchdog` stays
-independent and read-only, with quiet healthy snapshots, deduplicated events,
-restart reconciliation, and one shared deadline. Native Orca automations expose
-a provider but cannot pin model, effort, or permission, so the driver records
-its model identity every tick and the watchdog treats a mismatch as a safety
-hold. Build no custom scheduler and use no legacy fallback. Details live in
+The user lifted the native-watch hold by user decision on 2026-09-16. The
+driver automation is a mutating owner for its PRs; `axstack-watchdog` stays
+independent and read-only. The driver every 15 minutes dispatches and exits;
+the watchdog is model-free, has no gate, and records `watchdog.log`; there is
+no watch deadline for automations. Build no custom scheduler and use no legacy
+fallback. Details live in
 [Watch runtime](../../axstack-watch/references/watch-runtime.md).
 
 ## Audit hook (end of run and meaningful checkpoints)

package/skills/axstack-relay/SKILL.md

@@ -63,12 +63,12 @@ listing all pass.
 
 ## Preserve identity and authority
 
-Delivery is one-way. Hermes does not route a Telegram reply back to the
-sending session; its own agent answers replies. A reply is therefore never a
-receipt, decision, or authority for this session, and no persistent owner is
-needed to send. Every message must say where the user acts: the current Orca
-conversation, the Orca worktree, or the GitHub PR. Do not ask the user to reply with
-decision words, and do not poll Telegram for answers.
+Delivery is one-way; no session polls Telegram. Hermes does not route a reply
+back to the sending session; its own agent answers replies. Outside the fixed
+decision-token flow below, a reply is never a receipt, decision, or authority
+for this session, and no persistent owner is needed to send. Every ordinary
+message must say where the user acts: the current Orca conversation, the Orca
+worktree, or the GitHub PR. Do not invent reply commands.
 
 Send authority comes from the explicit request or applicable standing policy.
 It grants no merge, publication, ownership-transfer, or model-substitution
@@ -76,6 +76,25 @@ authority. Delivery is transport evidence only. Revalidate any user decision
 that arrives through an authorized channel against the current task and
 existing action boundaries before acting; silence never grants permission.
 
+## Decision tokens
+
+An automation escalation is the narrow exception defined by
+[Automation sessions](../axstack/references/automations.md). The PR agent opens
+an immutable-bound decision token, sends one message with the exact
+`/axstack-decide approve <token>` and `/axstack-decide reject <token>` replies,
+records the send receipt, and
+exits without waiting. The Hermes script decides by validating the private
+channel and updating only an open token file; Hermes never performs the bound
+GitHub or Git action. The driver consumes the file on a later tick, revalidates
+all bound state, marks an approval spent before acting, performs only that
+action, and records its receipt.
+
+This does not create a reply channel for the sending agent: Hermes pushes the
+decision to the file through the fixed `axstack-decide` script, and the driver
+reads that file. Delivery is one-way; no session polls Telegram. Token creation,
+decision, and consumption keep their separate writers and authority; a message
+receipt alone authorizes nothing.
+
 ## Reconcile, deliver, and record
 
 Before any new send, check the caller's run record for an existing receipt

package/skills/axstack-review/SKILL.md

@@ -18,10 +18,8 @@ load and verify the
 [candidate-publication boundary](../axstack/references/candidate-publication.md).
 When the caller is an Orca driver automation, load
 [Automation sessions](../axstack/references/automations.md): its reviewer briefs
-carry the required escalation field, and its publication is `COMMENT` only for
-the pair A/B driver. Every peer PR the pair C driver publishes on takes the
-actual verdict instead, under "Binding review verdicts (pair C)" in that
-reference and the authorized-submission branch below.
+carry the required escalation field and every eligible peer PR takes a binding
+`APPROVE` or `REQUEST_CHANGES` verdict under the automation exception below.
 
 ## Peer mode (colleague PR)
 
@@ -221,11 +219,10 @@ Escalate to user: yes | no — <criterion> — <reason>
 
 Every brief ends with the `Escalate to user` field and the reviewer answers it
 in the receipt. A reviewer may cite only a security concern, a permanent
-on-chain state change, or an architectural change in approach; the automation
-health criterion belongs to the watchdog and safety-hold path and is never a
-reviewer criterion. The answer is input to the escalation gate, not a veto and
-not a verdict; see [Automation sessions](../axstack/references/automations.md)
-for the gate.
+on-chain state change, or an architectural change in approach. Health is not a
+reviewer criterion. The answer is input to the PR escalation gate, not a veto
+and not a verdict; see
+[Automation sessions](../axstack/references/automations.md) for the gate.
 
 ## Template: review receipt (one block per revision)
 
@@ -260,9 +257,9 @@ private transport values or configuration.
 Under an automation session, credible serious risk found by a reviewer still
 raises the standing internal prompt and dependent-action hold immediately, and
 the gate governs only external notification: the internal prompt lands in the
-run record and the automation session's own Orca conversation, and no
-`hermes send` occurs without the gate's `escalate` token. `proceed` never
-overrides a validated blocking finding.
+run record and the automation session's own Orca conversation. `escalate`
+opens the bound decision token, sends through `axstack-relay`, and exits
+without waiting; `proceed` never overrides a validated blocking finding.
 
 ## Publishing rule
 
@@ -308,44 +305,26 @@ for a complete `APPROVE` or `REQUEST_CHANGES` verdict:
 Submission is complete only when the remote receipt confirms the review bound
 to the intended commit.
 
-Automation exception — Authorized submission, pair-scoped: for the pair A/B
-driver automation the `COMMENT` branch below, with the existing remote head/base
-readback and ambiguity handling, is the only submission it makes, and for it the
-prohibition on `APPROVE` and `REQUEST_CHANGES` remains a ban on those GitHub
-actions while the review skill's internal verdict vocabulary is unchanged. The
-pair C driver automation instead uses this authorized-submission
-branch and submits the actual verdict on an officially-requested peer PR, under
-"Binding review verdicts (pair C)" in
-[Automation sessions](../axstack/references/automations.md); a peer PR it
-reached through the qualifying mention trigger still takes the `COMMENT` branch.
-
-## Automation publication (`COMMENT`)
-
-The pair A/B driver automation, as owner for a peer PR under
-[Automation sessions](../axstack/references/automations.md), uses this branch:
-one `COMMENT` review, owner-synthesized and bound to the reviewed commit. On
-this branch the automation never submits `APPROVE` or `REQUEST_CHANGES`; a need
-for either is a recorded hold. The pair C driver does not use this branch at
-all; its peer PRs take the authorized-submission branch above. The peer-review submission rule above is unchanged for every other
-caller.
-
-1. Complete the mode-required review: every mode-required receipt is current
-   for the head SHA and current base, and each carries its escalation field.
-   `INCOMPLETE`, unresolved material disagreement, or an unavailable required
-   reviewer publishes nothing and records a hold that pauses mutation for the
-   PR.
-2. The gate returns exactly one token, `escalate` or `proceed`. `escalate`
-   records the hold and the relay receipt and publishes nothing. Only
-   `proceed` plus no unresolved validated blocking finding permits
-   publication.
-3. Read back the remote head and base immediately before submit; stop if
-   either differs from the reviewed candidate.
-4. Submit one owner-synthesized `COMMENT` review bound to the reviewed commit
-   through the actual GitHub commit parameter, carrying every receipt's
-   findings and limitations, then verify the submission receipt.
-5. A receipt for an unchanged head SHA is never published twice; on ambiguity,
-   look up remote state and submit only when absent.
-
-Publication is complete when the remote receipt confirms one `COMMENT` review
-bound to the intended commit, or when the recorded hold names the missing
-input and the next owner.
+## Automation exception
+
+For a peer PR selected under
+[Automation sessions](../axstack/references/automations.md), apply the same
+complete-review and exact-commit requirements, then run the Luna gate.
+`escalate` opens a bound decision token, sends its message, and exits without
+submitting. `proceed` permits `APPROVE` only with no validated blocker and
+permits `REQUEST_CHANGES` only with at least one evidenced validated blocker.
+`INCOMPLETE`, unavailable inputs, unresolved disagreement, or unknown GitHub
+state submits nothing.
+
+Immediately before `gh pr review`, re-read self's reviews at the head. If one
+already exists, skip submission and record its id. Otherwise re-check head,
+base, draft status, authorship, and allowlist, bind the verdict to the exact
+commit parameter, and end the body with this marker line:
+
+```text
+<!-- axstack-automation verdict head=<sha> -->
+```
+
+After submission, read back and record the review id at the bound head. An
+ambiguous result is looked up before any retry. The automation never submits a
+`COMMENT` review.

package/skills/axstack-watch/SKILL.md

@@ -22,7 +22,7 @@ The authenticated human login selects PRs. Runtime session IDs coordinate work
 only and establish neither human identity nor write, reply, or merge authority.
 When the session is the Orca driver automation, also load
 [Automation sessions](../axstack/references/automations.md): it is the owner
-for every PR it handles, and its gate and allowlist bound every mutation.
+for every PR it handles, and its allowlist bounds every mutation.
 
 ## 1. Adopt and reconcile
 
@@ -63,9 +63,10 @@ Read-only checks and updates to the already-owned local record need no runtime
 load. When the watch needs a new owner or automated observation, first read
 [Watch runtime](references/watch-runtime.md) and then
 [Orca runtime](../axstack/references/orca-runtime.md). Reconcile before creating
-anything. The user lifted the native-watch hold by user decision: the 5 min driver
-automation is a mutating owner for the PRs it handles and the hourly watchdog
-stays independent and read-only. The driver is the automation session itself,
+anything. The user lifted the native-watch hold by user decision: the driver
+every 15 minutes dispatches and exits as a mutating owner; the watchdog is
+model-free and read-only, has no gate, and records `watchdog.log`; there is no
+watch deadline for automations. The driver is the automation session itself,
 with no `axstack-monitor` or `axstack-owner` role row; `axstack-monitor` stays
 an optional read-only observer that never sends. One read-only PR observation
 needs neither.
@@ -114,10 +115,10 @@ the current revision, and a recorded hold or next owner where work remains.
 
 When a new actionable event is eligible under a recorded `Notification policy`,
 the owner may use the optional [axstack-relay](../axstack-relay/SKILL.md).
-The monitor never sends, and `axstack-watchdog` never mutates GitHub and
-performs exactly one kind of send, a gate-authorized automation-health
-escalation recorded in `watchdog.json`; absent policy or failed relay uses the
-current Orca conversation and leaves every existing hold open.
+The monitor never sends. The automation watchdog never mutates GitHub, has no
+gate, and records occurrences and send receipts in `watchdog.log`; absent
+policy or failed relay uses the current Orca conversation and leaves every
+existing hold open.
 
 ## 5. State readiness precisely
 
@@ -128,15 +129,13 @@ observed state distinct from merged, and the human merges by default.
 
 ## 6. End and preserve continuity
 
-End early when all required PRs merge, or at cancel or the shared default 24h
-deadline. In every case, stop and verify all owned registrations. The deadline
-also stops timers for open PRs; never silently renew them.
+End a standalone watch early when all required PRs merge, at cancellation, or
+at its shared default 24 h deadline. There is no watch deadline for
+automations. In every case, stop and verify all owned registrations.
 
 At every end condition, leave the compact state below in the private run record
 and report it in the current chat, even when work remains. Expiry grants neither
-silent renewal nor ownership-transfer authority. Under an automation, expiry
-marks the PR `expired` in the record and sidecar; an `expired` PR is never
-silently re-adopted and is skipped until the user re-arms it.
+silent renewal nor ownership-transfer authority.
 
 Transfer ownership through the runtime-owned Orca handoff route only when the
 user explicitly requests it. Before transfer, follow the lifecycle-owned

package/skills/axstack-watch/references/repair-publication.md

@@ -36,9 +36,11 @@ exact new revision and base, all six angles, applicable acceptance, the reply
 body identities, and every affected boundary, with no unresolved material
 finding or urgent hold. Under an automation the escalation gate of
 [Automation sessions](../../axstack/references/automations.md) also runs on
-the local SHA: publication additionally requires the gate to return `proceed`
-with no unresolved validated blocking finding, and a push before the gate
-settles is forbidden.
+the local SHA. `escalate` creates a token, pins the candidate at
+`refs/axstack/decisions/<token>`, opens the decision token, sends its message,
+and exits instead of pushing. `proceed` permits publication only with no
+unresolved validated blocking finding, and a push before the gate settles is
+forbidden.
 
 ## 3. Revalidate immediately before publication
 

package/skills/axstack-watch/references/watch-runtime.md

@@ -4,18 +4,16 @@ Read this before starting, resuming, or stopping automated PR observation.
 
 ## Accepted policy
 
-The PR owner remains accountable throughout one shared default 24-hour window.
-`axstack-monitor` and `axstack-watchdog` are independent, read-only roles, not
-authors, reviewers, repliers, or owners.
+The PR owner remains accountable throughout a standalone watch's default
+24-hour window. `axstack-monitor` and `axstack-watchdog` are independent,
+read-only roles, not authors, reviewers, repliers, or owners.
 
 - **Monitor:** `axstack-monitor` is an optional read-only observer that reads
-  GitHub, all PR feedback, and latest checks every five minutes, persists event
+  GitHub, all PR feedback, and latest checks on its registered cadence, persists event
   IDs, wakes the owner only for a new actionable event, and never sends.
-- **Watchdog:** `axstack-watchdog` reads only automation health, handshake
-  state, and snapshot freshness hourly and never mutates GitHub; it may perform
-  exactly one kind of send, a gate-authorized automation-health escalation
-  recorded in `watchdog.json`, and otherwise reports a verified health failure
-  to the owner.
+- **Watchdog:** for the PR automations, it is a model-free hourly shell precheck
+  that never mutates GitHub, has no gate, and records each tick in
+  `watchdog.log`.
 
 Healthy observations are snapshot-only and update quietly; they wake neither owner nor
 driver. Both roles deduplicate event IDs. Uncertain delivery is reconciled
@@ -32,25 +30,21 @@ permission pinning are unsupported, and its schedule parser cannot preserve
 the accepted bounded expiry by itself. Requested role values or a post-launch
 self-report are not effective launch evidence.
 
-The user lifted the native-watch hold by user decision on 2026-09-16. The accepted
-contract now has a new shape: the driver automation is a mutating owner for the
-PRs it handles, not an independent read-only monitor, and the watchdog keeps
-the independent read-only health contract. The driver is the automation
-session itself, with no `axstack-monitor` or `axstack-owner` role row
-materialized for it. The driver records its own model
-identity on every tick and the watchdog compares it with the expected model; a
-mismatch is a safety hold, never a silent substitution. The bounded expiry is
-enforced by the run record's watch deadline, not by the schedule parser. Still
+The user lifted the native-watch hold by user decision on 2026-09-16. The
+driver every 15 minutes dispatches and exits as the mutating owner, and the
+watchdog is model-free and read-only, has no gate, and records `watchdog.log`;
+there is no watch deadline for automations. The driver is the automation
+session itself, with no `axstack-monitor` or `axstack-owner` role row. Still
 introduce no custom scheduler or polling loop and use no legacy runtime
 fallback. The session-level contract lives in
 [Automation sessions](../../axstack/references/automations.md).
 
 ## Preserve the contract under automation
 
-An automation session preserves the roles, five-minute/hourly cadences, quiet
-healthy behavior, deduplication, handshake, watched scope, wake owner, and
-shared expiry. Test active expiry, missed final ticks, restart, duplicate
-ticks, cancellation, session-reuse fallback, and final cleanup before enabling.
+An automation session preserves its 15-minute driver and hourly model-free
+watchdog cadences, quiet healthy behavior, deduplication, handshake, watched
+scope, and wake owner. Test restart, duplicate ticks, cancellation,
+session-reuse fallback, and final cleanup before enabling.
 A firing timestamp proves neither delivery nor work advancement. An unrequested
 fallback session reconciles ownership and never becomes owner silently.