axstack 0.11.1 → 0.11.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -23,9 +23,9 @@ Pair A/B is retired for this contract; its artefacts remain untouched.
 - `axstack-monitor` remains an optional read-only observer that never sends.
 
 Self is resolved on every run with `gh api user --jq .login`; never hardcode
-it. The review allowlist is `defi-com/monorepo`, `defi-com/mobile`, and
-`defi-com/azure-next-hybrid`. The repair allowlist is `defi-com/monorepo` and
-`defi-com/mobile`. State both lists verbatim in the driver prompt. An own PR is
+it. The review allowlist is `defi-com/monorepo`, `defi-com/mobile`,
+`defi-com/azure-next-hybrid`, and `defi-com/ci-workflows`. The repair allowlist
+is `defi-com/monorepo` and `defi-com/mobile`. State both lists verbatim in the driver prompt. An own PR is
 open, authored by self, on the repair allowlist, and not a draft. A peer PR is
 open, on the review allowlist, authored by someone else, and either officially
 review-requested from self or has a non-self comment that both mentions self
@@ -180,11 +180,26 @@ The verdict body ends with this exact marker line:
 <!-- axstack-automation verdict head=<sha> -->
 ```
 
+The verdict body is written for the person reading the PR and reads as one
+reviewer's findings. It never names the reviewer count, the brief, the
+angles, the gate, receipts, or which reviewer found what: "two independent
+reviews", "from secondary", and "the reviewers ran" are pipeline facts, not
+review content. It is self-contained: every validated finding, blocking or
+not, appears in full in the body — evidence and consequence, file and line
+where they exist — so a reader is never told that notes exist without seeing
+them, and a finding is never dropped to keep the body short. It never points
+at the local review file or at anything the reader cannot open. Evidence
+appears as what was checked and observed, not as who ran it: the reviewed
+head and base SHAs, CI status, test counts, and diff size are reader-useful
+facts and belong; "shape verified" and "pinned CI" are pipeline phrasing and
+do not. The marker line is the only pipeline artefact the body carries.
+
 Write the local review file to the workspace review directory
 `~/defi/misc/reviews/` under the existing convention:
 `review-PR-<num>.html` with no prefix means `defi-com/monorepo`;
-`review-mobile-PR-<num>.html` and
-`review-azure-next-hybrid-PR-<num>.html` name the other repositories. A write
+`review-mobile-PR-<num>.html`,
+`review-azure-next-hybrid-PR-<num>.html` and `review-ci-workflows-PR-<num>.html`
+name the other repositories. A write
 failure is recorded but does not withhold the verdict.
 
 Authored repair commits a local candidate, obtains one Sol review at that
@@ -235,7 +250,9 @@ Before opening a `push` token, the repair agent pins its candidate with local
 ref `refs/axstack/decisions/<token>` in the project clone, so the candidate
 survives worktree removal. It then sends one
 `hermes send --to telegram` message naming the PR, criterion, every reviewer's
-reason, and the exact replies `approve <token>` and `reject <token>`. Store the
+reason, and the exact replies `/axstack-decide approve <token>` and
+`/axstack-decide reject <token>` (the slash form loads the Hermes skill
+deterministically; bare `approve <token>` is best effort). Store the
 send receipt. The driver retries a `failed` send once next tick and reconciles
 an `uncertain` send against Hermes output before any retry.
 

package/skills/axstack-relay/SKILL.md

@@ -81,7 +81,8 @@ existing action boundaries before acting; silence never grants permission.
 An automation escalation is the narrow exception defined by
 [Automation sessions](../axstack/references/automations.md). The PR agent opens
 an immutable-bound decision token, sends one message with the exact
-`approve <token>` and `reject <token>` replies, records the send receipt, and
+`/axstack-decide approve <token>` and `/axstack-decide reject <token>` replies,
+records the send receipt, and
 exits without waiting. The Hermes script decides by validating the private
 channel and updating only an open token file; Hermes never performs the bound
 GitHub or Git action. The driver consumes the file on a later tick, revalidates