axstack 0.15.0 → 0.17.0

package/README.md

@@ -12,9 +12,9 @@ role choices, evidence, review policy, and one private derived run record.
 
 ## How a run works
 
-Invoke `axstack` or the needed phase directly: `axstack-align`,
-`axstack-spec`, `axstack-tickets`, `axstack-implement`, `axstack-review`, and
-`axstack-watch`. Direct `axstack-research`, `axstack-explain`,
+Invoke the needed phase directly: `axstack-align`, `axstack-spec`,
+`axstack-tickets`, `axstack-implement`, `axstack-review`, and `axstack-watch`.
+Direct `axstack-research`, `axstack-explain`,
 `axstack-improve`, and `axstack-debug` routes need no spec ceremony. `axstack-relay` remains an
 optional inline route for explicit messages and authorized notifications; an
 unavailable or legacy-runtime-only relay falls back to the current conversation
@@ -68,8 +68,8 @@ See [installation details](docs/installation.md).
 
 `--instructions` manages one versioned Axstack block in `AGENTS.md`,
 `CLAUDE.md`, or `GEMINI.md`. Harness defaults resolve those files automatically. The block
-points at the installed entry skill and requires every subagent, delegated worker,
-reviewer, and cross-harness dispatch to use visible Orca orchestration via the `orca` CLI
+requires direct matching phase-skill invocation and requires every subagent, delegated
+worker, reviewer, and cross-harness dispatch to use visible Orca orchestration via the `orca` CLI
 rather than a harness-native subagent tool (e.g. Claude/Codex native subagents). OpenCode
 and Antigravity subagents run as Orca-supervised workers. Text and file
 mode outside the markers are preserved; edited, malformed, unowned, or unsafe
@@ -77,7 +77,7 @@ targets are reported without normal-path adoption. Install exits nonzero when
 an instruction conflict is preserved, while clean and idempotent installs exit
 successfully.
 
-The public bundle preserves three canonical 23-role inputs:
+The public bundle preserves three canonical 24-role inputs:
 [mixed](profiles/presets/mixed.json),
 [codex-only](profiles/presets/codex-only.json), and
 [claude-only](profiles/presets/claude-only.json). Each is exactly

package/docs/installation.md

@@ -51,7 +51,7 @@ profiles/presets/codex-only.json
 profiles/presets/claude-only.json
 ```
 
-Each has exactly `{ "version": 1, "roles": [...] }` with the same 23 stable
+Each has exactly `{ "version": 1, "roles": [...] }` with the same 24 stable
 role IDs. Installation writes `<skills-dir>/axstack/roles.json` as
 `{ "version": 1, "preset": "<selected preset>", "roles": [...] }` and records
 its ownership hash like every other installed skill asset. There is no second
@@ -118,9 +118,10 @@ The complete bundle is validated before writes:
 - each preset is a real JSON file with version 1, a non-empty `roles` array,
   the filename's selected identity supplied by the caller, and the same role-ID
   set as its peers;
-- every role has valid preserved fields, while the mixed checker and, in each
-  single-provider preset, the unavailable adviser and its matching arena judge
-  seat explicitly permit `model: null`;
+- every role has valid preserved fields, while the mixed checker and the mixed
+  `axstack-research-x` launch-by-agent-id route explicitly permit `model: null`;
+  in each single-provider preset, the unavailable adviser and its matching arena
+  judge seat explicitly permit `model: null`, as does `axstack-research-x`;
 - obsolete runtime configuration flags fail before mutation with migration
   guidance.
 
@@ -147,13 +148,17 @@ to rewrite them.
 
 ## Role behavior after installation
 
-The runtime reads `roles.json` relative to the actually loaded `axstack` skill.
-A new run records the selected preset plus all 23 role rows. An active run keeps
+The runtime reads `roles.json` from the installed shared root `skills/axstack/`.
+A new run records the selected preset plus all 24 role rows. An active run keeps
 that snapshot after a later preset install unless the user explicitly changes
 it and accepts the resulting evidence invalidation.
 
 The mixed checker has `model: null`; checker dispatch is held and never inherits
-a provider default. The single-provider presets configure the checker. Their
+a provider default. Mixed `axstack-research-x` has `model: null` because Orca exposes
+no `--model` override for `grok`; its explicit note authorizes launch by agent ID,
+and the run record snapshots the model reported by the TUI. The single-provider
+presets configure the checker and keep `axstack-research-x` as an intentional
+absence. Their
 unavailable adviser and its matching arena judge seat remain explicit
 same-provider `model: null` roles, which do not make installation unready;
 Align and Spec still hold until both Astra and Fable can return independent

package/docs/workflows.md

@@ -10,9 +10,9 @@ Axstack implements that skill's specialist capability.
 
 ## Routing and scope identity
 
-`axstack` classifies the request and loads only the applicable phase plus shared
-references for routing, lifecycle, Orca runtime boundaries, role/model/risk
-contracts, the run record, and PR shape.
+The directly invoked phase loads the applicable shared references for routing,
+lifecycle, Orca runtime boundaries, role/model/risk contracts, the run record,
+and PR shape.
 
 Direct routes need no spec ceremony:
 
@@ -40,7 +40,7 @@ only affected work.
 
 Installation requires one explicit canonical preset. The three bundle files
 under `profiles/presets/` each contain exactly
-`{ "version": 1, "roles": [...] }` and the same 23 stable IDs.
+`{ "version": 1, "roles": [...] }` and the same 24 stable IDs.
 
 The current chat drives on whatever model runs it; no preset carries a driver
 role.
@@ -53,7 +53,7 @@ role.
 
 The installed `<skills-dir>/axstack/roles.json` adds the selected preset name:
 `{ "version": 1, "preset": "<name>", "roles": [...] }`. The runtime reads it
-relative to the actually loaded `axstack` skill and records the whole table for
+from the installed shared root `skills/axstack/` and records the whole table for
 a new run. Active runs retain their snapshot after later installation changes.
 
 Peer roles keep the stable IDs `axstack-reviewer-primary` and
@@ -64,7 +64,9 @@ The unavailable adviser in each single-provider preset stays explicitly
 `model: null` within that provider's bounds. Installer readiness accepts that
 intentional absence, but Align and Spec hold because both independent receipts
 are required. The mixed checker also stays explicitly `model: null`; checker work holds instead of
-launching a provider default. Missing or unavailable roles hold only affected
+launching a provider default. Launch-by-agent-id routes for which Orca exposes no
+`--model` override (today: `grok`) record `model: null` with an explicit note and are
+launchable; the run record snapshots the model the TUI reports. Missing or unavailable roles hold only affected
 work. Model, effort, and permission values express requested intent until real
 Orca receipts establish the effective session. Stored `modeId` is not permission
 parity or a sandbox. No route is inferred from subscription, quota, harness,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -91,6 +91,15 @@
       "thinkingOptionId": "low",
       "notes": "Research web reader: gathers primary-source facts efficiently. Validate configured availability at launch; hold affected work without fallback."
     },
+    {
+      "id": "axstack-research-x",
+      "name": "Axstack research X (unavailable)",
+      "provider": "claude",
+      "model": null,
+      "modeId": "bypassPermissions",
+      "thinkingOptionId": "high",
+      "notes": "Intentional single-provider absence: X/Twitter research via Grok is unavailable in claude-only. The explicit null holds this route without provider substitution."
+    },
     {
       "id": "axstack-explainer",
       "name": "Axstack explainer",

package/profiles/presets/codex-only.json

@@ -91,6 +91,15 @@
       "thinkingOptionId": "low",
       "notes": "Research web reader: gathers primary-source facts efficiently. Validate configured availability at launch; hold affected work without fallback."
     },
+    {
+      "id": "axstack-research-x",
+      "name": "Axstack research X (unavailable)",
+      "provider": "codex",
+      "model": null,
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Intentional single-provider absence: X/Twitter research via Grok is unavailable in codex-only. The explicit null holds this route without provider substitution."
+    },
     {
       "id": "axstack-explainer",
       "name": "Axstack explainer",

package/profiles/presets/mixed.json

@@ -91,6 +91,15 @@
       "thinkingOptionId": "low",
       "notes": "Research web reader: gathers primary-source facts efficiently. Validate configured availability at launch; hold affected work without fallback."
     },
+    {
+      "id": "axstack-research-x",
+      "name": "Axstack research X",
+      "provider": "grok",
+      "model": null,
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "X/Twitter-only research branch: Grok can read X; use for questions where posts, threads, announcements, or sentiment on X are answer-changing evidence. Cites post URLs and dates; never the sole source for a verified claim; report-only, no writes. Launch by agent id grok; model selected by the Grok TUI default."
+    },
     {
       "id": "axstack-explainer",
       "name": "Axstack explainer",

package/skills/axstack/references/contracts.md

@@ -4,11 +4,11 @@ Apply these authority, scope, and model rules before consequential action.
 
 ## Required lifecycle load
 
-Except for `axstack-audit` itself, every independently called phase must load
-and follow [Shared lifecycle](lifecycle.md) before acting. When a substantive
-run ends or reaches a meaningful checkpoint, apply the lifecycle audit hook.
-The audit phase loads these contracts, writes its assigned record, and stops;
-it never audits itself.
+Except for `axstack-audit` and `axstack-relay`, every independently called phase
+must load and follow [Shared lifecycle](lifecycle.md) before acting. When a
+substantive run ends or reaches a meaningful checkpoint, apply the lifecycle
+audit hook. The audit phase loads these contracts, writes its assigned record,
+and stops; it never audits itself.
 
 ## Scope identity (conditional — see routing and lifecycle)
 

package/skills/axstack/references/lifecycle.md

@@ -1,25 +1,23 @@
 # Shared lifecycle and receipts
 
-Phases load through [Standing contracts](contracts.md)' mandatory edge.
-Substantive delegated or resumable work uses a driver-owned [Run record](run-record.md)
+Phases load through [Standing contracts](contracts.md).
+Delegated or resumable work uses a driver-owned [Run record](run-record.md)
 binding state and receipts to exact revisions.
 
 ## Roster (compact)
 
 - Driver: current chat; owns scope, decisions, cross-PR dependencies, Linear
   mutations, and integration.
-- Owner (`axstack-owner`): one persistent owner per PR; launches its author,
-  reviewers and watches; may perform authorized PR-scoped publication within user authority.
-  Human merge is default.
+- Owner: driver owns loop PRs; `axstack-owner` only for standalone watch/review
+  without live driver. It may perform PR-scoped publication within user authority. Human
+  merge is default.
 - Author: exactly one writer per candidate; accepted fixes return there.
   Workers launch no recursive teams.
 - Reviewers: peer = two independent `axstack-reviewer-primary` and
   `axstack-reviewer-secondary` sessions with identical brief and isolated first
   pass; authored = one eligible configured reviewer from actual author
   provenance. Owner and author never review.
-- Driver/monitor/watchdog: the driver every 15 minutes dispatches and exits as
-  a mutating owner; the watchdog is model-free and read-only, has no gate, and
-  records `watchdog.log`; there is no watch deadline for automations.
+- Automation driver/monitor/watchdog: see [Watch health](#watch-health).
 - Auditor (`axstack-auditor`): report-only; never edits, merges, activates, or
   audits itself.
 
@@ -78,10 +76,17 @@ Store concise receipt references, not raw worker output, in the [Run record](run
 ## Execution tracking
 
 The driver consumes native Orca completion and escalation deliveries for the
-active Run. Process each whole delivery before acknowledgment and validate its
-Task, Dispatch, sender, authority, revisions, and receipts before advancing the
-run record. Duplicate deliveries are deduplicated by runtime identity. Healthy
-unchanged observations produce no user-facing update.
+active Run. A driver turn does not end while a Dispatch is unsettled unless one
+completion wait from the orchestration guide is armed (background where the
+harness supports it, foreground otherwise) and re-armed on timeout; sleep or
+poll loops are forbidden. An explicitly invoked phase dispatches its configured
+roles through Orca and closes with the lifecycle close-out; in-chat execution
+covers only ordinary reading, writing, and local checks. Heartbeat deliveries
+are acknowledged with no user-facing text. Process each whole delivery before
+acknowledgment and validate its Task, Dispatch, sender, authority, revisions,
+and receipts before advancing the run record. Duplicate deliveries are
+deduplicated by runtime identity. Healthy unchanged observations produce no
+user-facing update.
 
 Detect completed-but-unadvanced work, failed sessions, unresolved launch
 receipts, and stalls through the version-matched orchestration guide. Never
@@ -98,7 +103,9 @@ Tracking grants no merge, release, model-substitution, or scope authority.
 
 The default 24-hour deadline covers standalone task-owned timers. Stop them at
 deadline and preserve remaining work; there is no watch deadline for
-automations. Merge-ready differs from merged; human merges.
+automations. A PR is merge-ready only with the applicable review receipt(s) at
+its exact head; green CI or tests alone never make it merge-ready. Merge-ready
+differs from merged; human merges.
 
 ## Watch health
 
@@ -110,24 +117,25 @@ no watch deadline for automations. Build no custom scheduler and use no legacy
 fallback. Details live in
 [Watch runtime](../../axstack-watch/references/watch-runtime.md).
 
-## Audit hook (end of run and meaningful checkpoints)
-
-Auditing defaults on for every substantive run at its end and meaningful
-checkpoints such as material deviation or repeated repair. Load the bundled [audit skill](../../axstack-audit/SKILL.md)
-and dispatch its auditor. An `axstack-audit` run is excluded: it writes its
-record and launches no children.
-
-The auditor reads the [Run record](run-record.md) for scope, outcomes, and
-metric counts/denominators; reports evidenced PASS/FAIL/UNKNOWN; and invents no
-numbers or cost. Proposals change nothing. Accepted proposals return as
-tested, independently reviewed work with a regression scenario and unchanged
-holdout checks. No automatic self-edit, merge, or activation. Records stay
-private; publication needs separate authority.
-
-## Idle-complete archive and retain
-
-After required PRs merge or hand off, timers stop, and receipts verify, mark
-the same [Run record](run-record.md) `Archived` in place. Preserve
-scope, revisions, evidence, receipts, and expiries. Archive only idle-complete
-records: never active/waiting workers, unrelated host state, or ownership merely
-because it is idle.
+## Audit hook (close-out and meaningful checkpoints)
+
+Audit measurement is enabled by default for every substantive run; dispatch
+follows [Close-out](#close-out) or a material-deviation/repeated-repair
+checkpoint. An `axstack-audit` run is excluded; it launches no children.
+Load [axstack-audit](../../axstack-audit/SKILL.md). Accepted proposals
+require a regression scenario and unchanged holdout checks; they change
+nothing without tested independent review.
+
+## Close-out
+
+PRs merge by forge state—not branch ancestry; close out: (1) settle every worker
+terminal; (2) compact record with counts and denominators—user
+interventions/deviations from plan/repairs; (3) `axstack-auditor`: settle
+non-zero/requested, else `counts zero`; an unavailable auditor leaves close-out
+pending, never skipped silently; (4) release merged run worktrees and branches;
+close Linear tickets; (5) mark the [Run record](run-record.md) `Archived`.
+`Archived`—one each:
+settlement receipt; compact record path; auditor decision plus settlement
+receipt or `counts zero`; release and ticket receipts; archive timestamp.
+`active`/receipt-incomplete record: close-out pending, never done. One-step
+lookups exempt.

package/skills/axstack/references/orca-runtime.md

@@ -22,15 +22,17 @@ daemon, scheduler, database, or escalation engine.
 
 ## Bind the configured role
 
-Read `roles.json` relative to the actually loaded `axstack` skill. The installed
+Read `roles.json` from the installed shared root `skills/axstack/`. The installed
 shape is `{ "version": 1, "preset": "<name>", "roles": [...] }`. Bundled
 profiles are setup inputs shaped as
 `{ "version": 1, "roles": [...] }`. A new run records the selected preset and
-all 23 role rows once. An active run keeps the exact snapshot until the user
+all 24 role rows once. An active run keeps the exact snapshot until the user
 explicitly changes it.
 
 Select the requested role by stable ID. A missing or null model holds only that role;
-never launch a provider default. Validate provider, model, and effort
+never launch a provider default. Launch-by-agent-id routes for which Orca exposes no
+`--model` override (today: `grok`) record `model: null` with an explicit note and are
+launchable; the run record snapshots the model the TUI reports. Validate provider, model, and effort
 against the guide and actual launch capability. Stored `modeId` and other
 permission fields are conservative intent, not proof of effective permission
 parity or a security boundary. Requested settings, input acceptance, effective

package/skills/axstack/references/routing.md

@@ -11,7 +11,7 @@ only with exactly one unambiguous preset; missing or contradictory sources are
 a setup gap: hold. Never infer from live profiles or `list_profiles`, harness,
 tools, credentials, quota, subscription, or default to `mixed`.
 
-At run start, capture one **routing snapshot**: the complete map of all 23 role
+At run start, capture one **routing snapshot**: the complete map of all 24 role
 IDs with provider/model/mode/effort, absent or unconfigured roles recorded
 explicitly, and no invented provider default. An absent or unconfigured role
 holds only that role's work, not the run. A role installed or changed later
@@ -47,11 +47,12 @@ Role IDs:
   only gate-authorized health escalations.
 - `axstack-debug-investigator-1..4` each probe one L1 brief.
 
-Provenance is matched on provider/model ID; record effort but never use it to
-create a mapping. Provenance absent from the preset's table row is
-unsupported and `INCOMPLETE`; report the exact gap and ask the user. Never
-derive a reverse pairing from slot position, driver, owner, or provider.
-Author and owner never review their own work.
+Provenance is matched on provider/model ID; effort never maps. Missing table-row
+provenance is unsupported and `INCOMPLETE`; report it and ask the user. Never
+infer from slot, driver, owner, or provider. Author and owner never review.
+
+The `axstack-implement` loop requires `mixed`; single-provider presets hold at
+step (3) for user routing, with no substitution or same-provider review.
 
 ## Direct routes (no spec ceremony)
 
@@ -76,12 +77,11 @@ Author and owner never review their own work.
   handoff guide, and require explicit recipient acceptance before ownership
   changes. Missing capability is a setup gap; never invent one.
 - Colleague PR review -> `axstack-review`, peer mode.
-- Own PR maintenance or monitoring -> `axstack-review` in authored mode,
-  `axstack-watch` for adoption.
-
-Research, explanation, improvement discovery, debugging, handoff, peer review,
-and adopted maintenance need no alignment, spec, or ticket map; authority and
-intent boundaries still apply.
+- A status question about an own open PR or stack ("check now", "what's left",
+  "are we done", or "is it approved") -> `axstack-watch` in observation-only
+  mode. Explicit "address", "patch", or "fix" grants authorized maintenance.
+- Other own PR work -> `axstack-review` authored mode or `axstack-watch`
+  adoption.
 
 ## Proportional scope identity
 
@@ -126,5 +126,4 @@ not alone a formal spec trigger. Hold affected unsafe work while reassessing.
   author provenance — then use `axstack-review` and `axstack-watch` without
   repeated approval or new spec ceremony. Never infer the author from the
   orchestrator or assume an imported own PR's author.
-- Direct later phase: start there and pass that phase's identity check; entry
-  never admits work a deeper phase rejects.
+- Direct later phase: start there and pass that phase's identity check.

package/skills/axstack-align/SKILL.md

@@ -18,8 +18,15 @@ This preserves the required contracts -> lifecycle -> audit load edge.
 
 1. **Research and map dependencies.** Inspect the available code, docs, and
    tools before asking the user. Separate facts from preferences, name evidence
-   gaps, and map which decisions unlock others. Unresolved research blocks only
-   its dependent branch while safe fact work and independent branches continue.
+   gaps, and map which decisions unlock others. When a fact needed for the
+   frontier is not derivable from the local repo or docs by ordinary reading,
+   dispatch `axstack-research` branches through Orca by source type:
+   requirements, code, web, and, once configured, X. Give one owner per branch,
+   use cross-harness routes where the roles allow, and require a cited note per
+   the research skill's source standards. The driver folds verified claims into
+   the frontier and records the receipts. Ordinary reading stays in-chat; a
+   single factual lookup never dispatches. Unresolved research blocks only its
+   dependent branch while safe fact work and independent branches continue.
 2. **Prioritize the ready frontier.** Rank questions whose prerequisites are
    settled by consequence, uncertainty, and the branches they unlock. Probe
    vague terms, assumptions, success criteria, exclusions, failures, and edge
@@ -161,5 +168,5 @@ approval; record chosen document names and paths once per run.
    actual dispatch. Alignment completion never dispatches a recipient.
 
 Alignment stops for both sizes only when the handoff is usable, its next scope
-identity is explicit, and execution has not started. The user invokes `axstack`
-to execute.
+identity is explicit, and execution has not started. The user invokes
+`axstack-implement` to execute.

package/skills/axstack-implement/SKILL.md

@@ -5,11 +5,10 @@ description: When an approved task is ready to build or repair, use axstack-impl
 
 # Implement
 
-Deliver one reviewable candidate at an exact revision. Normal behavior changes
-have real red -> green -> refactor evidence; a narrowly accepted
-structure-preserving change has old-green characterization evidence. Name
-unverified boundaries and keep ownership unambiguous. Review and merge are
-later phases.
+From an accepted scope identity, drive its task/PR map through author -> review
+-> repair until every required PR is merge-ready or held. Keep exact revisions,
+strict TDD evidence, ownership, and unverified boundaries explicit. The human
+merges; the same run later reconciles those merges and closes out.
 
 ## 1. Admit the work
 
@@ -34,6 +33,9 @@ Independently confirm the applicable
   failure) returns to the author and does not increment the bug's fix ledger.
 - An adopted own-PR repair has its accepted maintenance snapshot.
 
+If substantial work lacks an approved spec or matching ticket map, report that
+exact gap, name `axstack-align` as the next route, and stop.
+
 Pin the exact base and current candidate revision. A missing, mismatched, or
 materially changed but unaccepted identity holds affected work; safe
 investigation may continue under the standing contracts. Proceed only with a
@@ -42,11 +44,9 @@ valid recorded identity and revisions; otherwise report the hold and exact gap.
 ## 2. Establish one owner and one writer
 
 For substantive delegated or resumable work, use the shared
-[run record](../axstack/references/run-record.md). On restart, reconcile it
-against actual Orca Tasks, Dispatches, sessions, Git revisions, GitHub state, the approved scope,
-Linear issue state, and watch registrations. Reuse the existing owner and
-author when valid. Ambiguous launch state is a hold on creating another writer,
-not evidence that the old writer disappeared.
+[run record](../axstack/references/run-record.md). Reconcile it on restart with
+the approved scope, Orca and forge state, exact revisions, tickets, and watches.
+Reuse valid owners and authors; ambiguity holds a replacement writer.
 
 At execution start, bind work to the driver-owned Orca Run and one authoritative
 Task/Dispatch attempt. Preserve the actual IDs and process completion deliveries
@@ -57,30 +57,22 @@ Immediately before an actual role dispatch, read and follow the
 [Orca runtime boundary](../axstack/references/orca-runtime.md). Ordinary local
 reading and writing does not require that launch reference.
 
-One persistent owner remains accountable for the PR, fixes, evidence, and
-monitoring. Exactly one author writes a candidate at a time; accepted review
-repairs return to that author when its evidence is still usable. When the owner
-delegates writing, the owner does not edit that candidate concurrently. An
-ownership transfer occurs only when explicitly requested; follow the shared
-lifecycle's native capability preflight for that transfer. An ordinary restart
-or resume reconciles the existing sessions and run record without creating a
-fresh recipient.
-
-There is no fixed active-PR count. Fanout is dependency- and capacity-driven
-within configured host resource and spending limits, while one host owns the
-run and one writer owns each candidate. The driver queues conflicting or
-dependent work and coordinates dependent PRs through `gh stack`. Routine shape,
-split, fanout, and exception choices are autonomous driver decisions within the
-approved spec; size alone never requires user approval. A dependent candidate
-starts from its reviewed parent. When a reviewed parent changes, hold reliance
-on stale child evidence and child merge readiness. Rebase the child onto the
-new parent revision, re-run affected checks, and remeasure shape against the new
-actual base. Re-record the shape and re-check its level-matching rationale; size
-growth alone is not an automatic hold. A green parent does not prove the
-combined stack, but the parent need not wait for an independently reviewed
-child. Dispatch only when ownership, worktree, dependency revisions, writer
-exclusivity, and configured capacity agree with live state. Escalation occurs
-only if a split exposes an existing shared-contract hold.
+One persistent owner remains accountable for each PR. Exactly one author writes
+it; accepted repairs return there while its evidence is usable, and the owner
+never edits concurrently. Only an explicit accepted transfer changes ownership;
+ordinary resume reconciles the same sessions and record.
+
+Fanout follows dependencies and capacity within configured limits. Queue
+conflicts and dependent work; use `gh stack`, starting each child from its
+reviewed parent. When the reviewed parent changes, hold reliance on
+stale child evidence and child merge readiness; rebase onto the new parent revision,
+re-run affected checks, and remeasure shape against it.
+Size growth alone is not an automatic hold.
+A parent need not wait for an
+independently reviewed child. Dispatch only when ownership, worktree, dependency
+revisions, writer exclusivity, and capacity agree with live state. Shape, split,
+fanout, and exceptions are autonomous driver decisions within the approved scope.
+Size alone never requires user approval.
 
 ## 3. Establish test-first evidence
 
@@ -95,11 +87,6 @@ restating source text or mirroring the intended implementation. Execute the
 check before changing production behavior and capture the expected behavioral
 failure. A missing-module error or unrelated setup failure is not red.
 
-For example, retry the same payment ID and observe one charge through the
-public interface. Counting internal helper calls alone would not prove that
-behavior. This illustrates the boundary test; it does not require a payment
-scenario in unrelated work.
-
 If no meaningful test-first check can be established, report why and hold
 dependent implementation for a scoped decision. Historical tests added after
 code remain noncompliant; they never become retroactive TDD evidence.
@@ -142,7 +129,7 @@ evidence when relevant. Name every unavailable OS, harness, credential, or
 other boundary instead of implying coverage.
 
 After the last change, pin the exact candidate revision and return this compact
-implementation receipt to the owner or driver:
+implementation receipt to the driver:
 
 ```text
 Record: <progress.md path or tiny-task brief>
@@ -158,7 +145,55 @@ Next: <owner reconciles receipt, uses gh stack to push exact revision, confirms
 remote readback, then routes it to axstack-review>
 ```
 
-The author stops at that receipt and does not push. The owner follows the
-candidate-publication boundary without editing the candidate, and review starts
-only after remote readback confirms the exact revision. This grants no merge
-authority; the human merges by default.
+The author stops at that receipt and does not push. The driver reconciles it,
+uses `gh stack` to publish, confirms remote readback, and continues the loop
+without editing the candidate. No step grants merge authority.
+
+## 6. Loop until merge-ready
+
+Inputs are one snapshotted small-change intent or an approved spec and ticket
+map. The unit is that accepted task/PR map: run independent PRs in parallel
+within the fanout rule; run a dependent `gh stack` bottom-up, each child from
+its reviewed parent. The driver is owner, sole record writer, dispatcher,
+publisher, and wait-holder for every loop PR it creates. Resume preserves an
+existing live owner absent an accepted transfer.
+
+For each PR:
+
+1. Dispatch `axstack-author` under §§3-5 and consume its strict-TDD receipt.
+2. Publish through candidate-publication and read back the exact SHA.
+3. Dispatch and consume the authored-mode `axstack-review` selected from actual
+   author provenance.
+4. Route the verdict. `APPROVE` at that head plus `axstack-watch` §5's full
+   predicate—required checks, all feedback, approvals, mergeability, and
+   exact-revision receipts—records `merge-ready`. With required checks pending,
+   use the forge-native blocking check wait, bounded and used once per revision, then
+   re-evaluate. Timeout, error, or missing wait capability records `held` at
+   that revision with reason and resume condition; it never triggers author
+   repair. Notify “checks pending, resume when green”, not “decision needed”.
+   `REQUEST_CHANGES`, a failed required check, or post-readiness feedback returns
+   findings to the same author for a new revision, increments `repairs`, and
+   returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model, serious
+   risk, or the third `REQUEST_CHANGES` on one PR records `held`. A changed
+   parent sends its child back to step 1.
+
+One run-level completion wait covers every unsettled Dispatch; the bounded
+forge check wait is the only other wait. End a turn only when every required PR
+is `merge-ready` or `held`, after notification (b) or (a). Raise serious risk
+(c) immediately when found. Notifications use `axstack-relay` under the recorded
+Notification policy: (a) a user-decision hold, (b) the merge-ready set and the
+all-merged event—two per run—and (c) serious risk; never progress.
+
+Merge-ready is the human boundary: the user merges, bottom-up for a stack. The
+driver resumes on the user's next message or `/axstack-watch`; no Orca merge
+wake exists today. Re-read forge state: record forge-merged PRs as `merged`;
+changed heads or feedback return to step 1; release nothing before Close-out.
+Run Close-out once only after every required PR is forge-merged and acceptance
+passes. It settles workers, records counts, makes the auditor decision and
+settlement, releases worktrees, closes eligible tickets, and archives the run.
+
+The loop requires the `mixed` two-provider authored-review row. `codex-only` or
+`claude-only` holds at step (3) for an explicit user routing choice, with no
+substitution or same-provider review. Derived PR states are `authoring |
+published | in-review | repairing(n) | merge-ready | merged | held`. The run is
+done only when every required PR is forge-merged and Close-out has receipts.

package/skills/axstack-research/SKILL.md

@@ -36,6 +36,7 @@ is part of research.
    - `axstack-research-requirements`: requirements and intent.
    - `axstack-research-code`: code behavior.
    - `axstack-research-web`: web and external sources.
+   - `axstack-research-x`: X (Twitter) posts and threads via Grok — only when X evidence is answer-changing; cite post URLs and dates.
    - `axstack-explore-codebase`: broad codebase mapping.
    - `axstack-explore-execution`: execution and runtime traces.
 

package/skills/axstack-review/SKILL.md

@@ -39,7 +39,7 @@ head and current base, and writing authority are recorded.
 
 Independently check the
 [proportional scope identity](../axstack/references/routing.md#proportional-scope-identity)
-before an approval or merge-ready declaration:
+before an approval or [merge-ready declaration](#authored-mode-own-pr):
 
 - Substantial new work: confirm the approved spec identity and matching ticket
   map.
@@ -49,9 +49,12 @@ before an approval or merge-ready declaration:
   author provenance. Never assume an imported own PR's author. That
   snapshot is accepted without repeated approval.
 
-The mode is ready when the applicable identity matches the candidate and no
-material scope change remains unaccepted. Readonly investigation may continue
-while an identity gap holds declarations.
+The mode is ready when the applicable identity matches the candidate, no
+material scope change remains unaccepted, and an independent review receipt
+records `APPROVE` from the required non-author, non-owner reviewer at the exact
+current head. Green CI, passing tests, or an older-head receipt leave readiness
+`UNKNOWN`, never merge-ready. Readonly investigation may continue while an
+identity gap holds declarations.
 
 Resolve actual author provenance from authoring session receipts and candidate
 history. The orchestrator model, provider, profile, or owner name is not author
@@ -244,7 +247,8 @@ Escalate to user: <yes | no> — <criterion> — <reason>
 At any point, promptly raise credible serious security issues, possible
 downtime or data loss, and major design concerns without waiting for every
 mode-required reviewer. Present evidence, likely impact, options, and the user
-decision needed. An urgent hold blocks approval, merge-ready declarations, and
+decision needed. An urgent hold blocks approval,
+[merge-ready declarations](#authored-mode-own-pr), and
 dependent dangerous actions, but does not block safe investigation, unrelated
 work, or reporting validated risk as `REQUEST_CHANGES`. Disagreement and
 silence leave the hold open.
@@ -267,7 +271,7 @@ without waiting; `proceed` never overrides a validated blocking finding.
 ## Publishing rule
 
 Mode-required exact-revision completeness gates external approval,
-merge-ready declarations, and authorized submission. It never gates returning
+[merge-ready declarations](#authored-mode-own-pr), and authorized submission. It never gates returning
 evidence, limitations, validated risk, or an internal `INCOMPLETE` report.
 
 - Peer mode requires both current reviews and no unresolved material finding

package/skills/axstack-watch/SKILL.md

@@ -6,7 +6,8 @@ description: When babysitting an existing PR, use axstack-watch to monitor or ma
 # Watch
 
 Leave each adopted PR with one accountable owner, current readiness evidence,
-and a bounded watch that ends cleanly or preserves enough state to resume.
+and user-facing updates that name its current milestone and next wake or
+condition.
 
 Before acting, load [Standing contracts](../axstack/references/contracts.md).
 Its required edge loads [Shared lifecycle](../axstack/references/lifecycle.md),
@@ -69,7 +70,8 @@ model-free and read-only, has no gate, and records `watchdog.log`; there is no
 watch deadline for automations. The driver is the automation session itself,
 with no `axstack-monitor` or `axstack-owner` role row; `axstack-monitor` stays
 an optional read-only observer that never sends. One read-only PR observation
-needs neither.
+needs neither. The publishing driver is the live owner for a status check;
+materialize no `axstack-owner` and start no automation for a read-only check.
 
 For standalone adoption, materialize `axstack-owner` only when no live owner
 exists. Once it exists, the current chat is not a competing coordinator. Only
@@ -78,14 +80,17 @@ no children or recursive teams, and the adoption watcher is never the writer.
 
 A live watch has verified role and timer receipts, handshakes, watched scope,
 wake ownership, and a common expiry. A missing runtime capability is a setup gap,
-not a reason to invent a call or create a duplicate registration. Wait through
-native wake-ups; no model remains active between events.
+not a reason to invent a call or create a duplicate registration. Native
+wake-ups drive observation; never poll or keep a model active between events.
 
 ## 4. Route each wake
 
 Re-read the remote head and base, then reconcile the event against acknowledged
 IDs and the recorded mode. A changed head, CI result, or review comment is an
 event, not repair authority. Stale or ambiguous observations authorize nothing.
+Every user-facing update is actionable: name the current milestone, the next
+wake or condition, and an ETA when the forge exposes one, such as CI median.
+A healthy unchanged observation produces no user-facing message.
 
 Observation-only and peer wakes produce a read-only report and stop. For an
 authorized maintenance wake that may require a repair or public reply, read and
@@ -157,3 +162,6 @@ Resume: <known commands or verified refs needed to reconcile from this revision>
 
 The watch ends only when registrations are stopped, receipts are recorded, and
 the PR is either merged or represented by this resumable state.
+When every required PR is merged, follow the lifecycle
+[Close-out](../axstack/references/lifecycle.md#close-out) before reporting the
+run as done.

package/src/installer.js

@@ -247,12 +247,14 @@ export async function validateBundle(bundleDir, selectedPreset = null) {
 
   const files = [];
   for (const dir of skillDirs) {
-    const skillMark = join(skillsRoot, dir.name, 'SKILL.md');
-    try {
-      const s = await stat(skillMark);
-      if (!s.isFile()) throw new Error();
-    } catch {
-      throw new Error(`skill ${dir.name} is missing SKILL.md`);
+    if (dir.name !== 'axstack') {
+      const skillMark = join(skillsRoot, dir.name, 'SKILL.md');
+      try {
+        const s = await stat(skillMark);
+        if (!s.isFile()) throw new Error();
+      } catch {
+        throw new Error(`skill ${dir.name} is missing SKILL.md`);
+      }
     }
     await walkSkills(join(skillsRoot, dir.name), skillsRoot, files);
   }
@@ -508,7 +510,7 @@ export async function installBundle({
     }
     instructionPlan = planInstruction({
       text: existingInstructionsRaw,
-      block: renderInstructionBlock(skillsRoot),
+      block: renderInstructionBlock(),
       ownership: boundInstructions.path === instructionsFile ? boundInstructions : null,
       force,
     });

package/src/instructions.js

@@ -1,14 +1,14 @@
 // Pure planning and byte-preserving edits for the Axstack-owned routing block.
 import { hashContent } from './manifest.js';
-import { join } from './posixpath.js';
 
 const BEGIN = '<!-- axstack:begin v1 -->';
 const END = '<!-- axstack:end -->';
 
-export function renderInstructionBlock(skillsDir) {
+export function renderInstructionBlock() {
   return [
     BEGIN,
-    `Use Axstack for engineering work. Load \`${join(skillsDir, 'axstack', 'SKILL.md')}\` to route the request.`,
+    'Use Axstack for engineering work: invoke the matching `axstack-*` skill directly.',
+    '`axstack-implement` loops author -> review -> repair until every PR is merge-ready.',
     'Route every subagent, delegated worker, reviewer, and cross-harness dispatch through Orca orchestration via the `orca` CLI and its `orca-cli` / `orchestration` skills so the work stays visible.',
     'Do not use a harness native subagent tool for delegated work.',
     END,

package/src/roles.js

@@ -1,5 +1,5 @@
 const PROVIDER_BOUNDS = Object.freeze({
-  mixed: new Set(['codex', 'claude']),
+  mixed: new Set(['codex', 'claude', 'grok']),
   'codex-only': new Set(['codex']),
   'claude-only': new Set(['claude']),
 });
@@ -64,8 +64,9 @@ export function assessRoleReadiness(roles, preset) {
   const gaps = [];
   const isIntentionalAbsence = (role) => role.model === null && (
     (preset === 'mixed' && role.id === 'axstack-checker') ||
-    (preset === 'codex-only' && ['axstack-advisor-fable', 'axstack-arena-judge-fable'].includes(role.id)) ||
-    (preset === 'claude-only' && ['axstack-advisor-astra', 'axstack-arena-judge-astra'].includes(role.id))
+    (preset === 'mixed' && role.id === 'axstack-research-x' && role.provider === 'grok') ||
+    (preset === 'codex-only' && ['axstack-advisor-fable', 'axstack-arena-judge-fable', 'axstack-research-x'].includes(role.id)) ||
+    (preset === 'claude-only' && ['axstack-advisor-astra', 'axstack-arena-judge-astra', 'axstack-research-x'].includes(role.id))
   );
   for (const role of roles) {
     if (!bounds.has(role.provider)) {

package/skills/axstack/SKILL.md

@@ -1,81 +0,0 @@
----
-name: axstack
-description: When routing an engineering run through Axstack, use axstack to select the applicable phase and scope identity.
----
-
-# Axstack entry
-
-Route the current request to one Axstack phase with the right scope identity.
-The current chat remains the driver; Orca owns runtime orchestration.
-
-For an explicit relay message or transport test, use
-[axstack-relay](../axstack-relay/SKILL.md) directly. No engineering scope
-identity or decision workflow is needed for that send. The same skill handles
-urgent or blocking notifications under an explicit standing instruction.
-
-## Route the request
-
-1. Classify the request with [Shared routing](references/routing.md). Direct
-   research, explanation, improvement discovery, peer-review, adopted-watch,
-   and handoff routes need no spec
-   ceremony. Only an explicit user-requested ownership transfer can use the
-   capability-gated native route in
-   [Lifecycle and receipts](references/lifecycle.md#native-handoff-and-resume),
-   not an Axstack handoff phase. Preparation completion, watch expiry, and
-   ordinary resume update or reconcile the run record without launching it.
-2. For new engineering work, validate scope identity before invoking any phase.
-   Record `small`, `substantial`, or `unclear` plus a brief reason, then apply the
-   [proportional scope identity](references/routing.md#proportional-scope-identity).
-   A small clear change proceeds from its snapshotted small-change intent.
-   Substantial work proceeds only from an approved spec and matching ticket
-   map. Clarify unclear size before dispatch.
-3. Only after validation passes, invoke exactly the selected phase. A directly
-   invoked later phase starts there and must pass its own identity check. When
-   substantial work lacks an approved spec or matching ticket map, return that
-   exact gap, name `axstack-align` as the next route, and stop the current
-   invocation; do not invoke align, spec, or tickets. Apply the same stop to a
-   mismatched or invalidated identity. Never admit work that a deeper phase
-   would reject.
-
-The route is settled when one applicable phase is named with its valid scope
-identity, or the exact preparation/setup gap is reported with affected work
-held.
-
-## Load at the action boundary
-
-- Every independently called phase loads [Standing contracts](references/contracts.md),
-  which requires lifecycle and audit loading before action.
-- Before an actual Axstack role dispatch, delivery, settlement, or handoff, load
-  [Orca runtime](references/orca-runtime.md). Ordinary reading, writing, and
-  local checks do not require launch discovery.
-- Substantive delegated or resumable work uses the
-  [Local run record](references/run-record.md).
-- When the current session is an Orca PR automation (driver or watchdog), load
-  [Automation sessions](references/automations.md) before any discovery,
-  review, gate, or mutation.
-- When review escalation or watch notification is eligible and the brief has a
-  `Notification policy`, use the optional
-  [axstack-relay](../axstack-relay/SKILL.md); otherwise keep notification in
-  the current Orca conversation.
-
-## Lifecycle
-
-This is a phase map, not an automatic dispatch sequence.
-
-1. `axstack-align` settles substantial scope and decisions.
-2. `axstack-spec` creates the single user-approved execution baseline.
-3. `axstack-tickets` maps capabilities, tasks, and dependencies, then
-   preparation stops with a resumable handoff.
-4. `axstack-implement` produces owned candidates with strict TDD.
-5. `axstack-review` gives peer PRs the two configured independent same-brief
-   reviewer roles; authored PRs get one complete eligible non-author/non-owner
-   review based on actual author provenance and the routing snapshot.
-6. `axstack-watch` monitors within the shared deadline and hands off remaining
-   work.
-7. The human merges by default, bottom-up for a stack. Review approval never
-   grants merge authority.
-
-Autonomous progress, model holds, serious-risk handling, mutation authority,
-and the one-host ownership contract live in
-[Standing contracts](references/contracts.md). Load only the selected phase
-and the references its action requires.