axstack 0.20.11 → 0.20.13

package/README.md

@@ -112,8 +112,8 @@ eligible peer-review requests, and the other monitors your open PRs and handles
 authorized repair events.
 
 The lanes use staggered 15-minute schedules. Each pass uses a fresh finite
-session in an isolated workspace and admits at most five executing PR jobs per
-lane, fewer under resource pressure. Waiting PRs remain tracked without consuming
+session in an isolated workspace and admits eligible actionable PR events within
+measured host capacity. Waiting PRs remain tracked without consuming
 execution slots, so a large open-PR backlog does not require an idle agent per PR.
 Completed passes save continuity and retire their own verified resources.
 Held jobs preserve evidence, use private worktree-local temporary paths, and

package/docs/workflows.md

@@ -192,9 +192,9 @@ read-only observer for standalone watches and never sends.
 The accepted contract has exactly two logical native manager lanes: review at
 minutes `0,15,30,45` and watch at `7,22,37,52`. Each scheduled pass uses a
 fresh finite session in a new isolated workspace, scans complete
-discovery pages, and admits at most five executing
-PR jobs. Waiting PRs stay covered and consume no slot after owned descendants
-settle. Each job uses one repository-parented worktree; managers never check out
+discovery pages, and admits eligible actionable PR events within measured host
+capacity across both lanes. Waiting PRs stay covered and consume no slot after
+owned descendants settle. Each job uses one repository-parented worktree; managers never check out
 PR branches in their own workspaces.
 
 Every pass reconciles saved, GitHub, and native Orca state across all same-lane

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.20.11",
+  "version": "0.20.13",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -150,11 +150,15 @@ all scanned; those ten occupy zero slots.
 
 ## Admission and fairness
 
-Each manager admits at most five concurrently executing PR tasks across ticks.
-The review manager admits at most five, and the watch manager admits at most
-five. Their caps are separate; never borrow unused capacity from the other
-lane. Admit fewer when the whole worker tree would put the host under resource
-pressure.
+The review manager and watch manager admit all eligible actionable PR events
+that measured host capacity can support across ticks. Before each admission,
+inspect available memory, CPU load, and active worker trees across both lanes;
+account for the whole proposed worker tree, dependencies, spending limits, and
+exclusive ownership. Report unavailable metrics as unknown; use the remaining
+host evidence rather than treating a missing metric alone as a blocker. Defer
+an event when observed pressure or uncertain headroom cannot support its whole
+tree, record the reason, and remeasure on the next pass. Do not use a fixed
+PR-job count or reserve capacity for either lane.
 
 A slot covers one bounded PR event and remains occupied while its author,
 reviewers, or other owned descendants are active or unsettled. Leaf workers do
@@ -163,8 +167,10 @@ frees the slot even while the PR stays open.
 
 Inspect all eligible PRs before admission. Preserve unserved work in the
 compact run record and select the oldest actionable unserved event first, with
-ascending repository and PR-number tie breaks. A sixth event is admitted after
-a slot settles; repeatedly changing PRs cannot starve older unserved work.
+ascending repository and PR-number tie breaks. Continue admitting eligible
+events while measured capacity supports their whole worker trees. Reconsider
+deferred events as trees settle or host capacity changes; repeatedly changing
+PRs cannot starve older unserved work.
 
 ## Per-PR jobs
 
@@ -238,9 +244,12 @@ or send outcome, not pending CI. Waiting state belongs in GitHub and the compact
 record, never in an idle model, per-PR timer, or polling loop.
 Follow the [private evidence archive](evidence-archive.md) when evidence is the
 only local state to preserve; archive success does not relax any other guard.
-For a completed, forge-merged PR-job, classified reviewer scratch may instead
-follow [axstack-cleanup](../../axstack-cleanup/SKILL.md)'s compact receipt and
-exact-path guards. This does not release active jobs or manager pass workspaces.
+For a completed PR-job, including one whose PR remains open, archive classified
+reviewer scratch through the [private evidence archive](evidence-archive.md),
+read back the archive and compact receipt, then follow
+[axstack-cleanup](../../axstack-cleanup/SKILL.md)'s exact-path guards to retire
+the reviewer checkout before merge. This does not release active jobs or manager
+pass workspaces.
 
 ## Review and repair authority
 
@@ -310,8 +319,8 @@ terminals, unknown liveness, `user_takeover`, and ambiguous publication state.
 Never classify all dirt as evidence. If explicitly classified evidence is the
 last retention reason, apply and verify the [private evidence archive](evidence-archive.md),
 update durable continuity, and read it back before native retirement.
-The completed, forge-merged PR-job reviewer scratch exception above uses
-axstack-cleanup; it never changes manager pass preservation or retirement guards.
+Completed PR-job reviewer scratch uses axstack-cleanup after archive and readback;
+it never changes manager pass preservation or retirement guards.
 
 For the manager pass only, verify native run/workspace identity, exclusive
 automation ownership, no unsettled descendants, and a fresh terminal inventory

package/skills/axstack/references/evidence-archive.md

@@ -1,14 +1,14 @@
 # Private evidence archive
 
 Use this only when local review or coordinator evidence is the last reason a
-finished automation-owned worktree cannot be retired. It archives evidence; it
+finished Orca-owned worktree cannot be retired. It archives evidence; it
 never decides that a terminal or worktree is safe to remove and never performs
 native cleanup.
 
 ## Eligibility
 
 First prove the exact repository, PR or Run/Task, 40-character head SHA, Dispatch,
-workspace, terminal incarnation, automation ownership, descendant settlement,
+workspace, terminal incarnation, Orca ownership, descendant settlement,
 and liveness from current native state. A manual chat, `user_takeover`, an
 active or unknown task terminal, an unsettled descendant, unpushed commits,
 dirty source, ambiguous publication, or an unknown file remains protected.
@@ -51,6 +51,14 @@ identities in durable lane continuity, then read the continuity and archive
 manifest back before cleanup. If either readback differs or is unavailable,
 preserve the worktree.
 
+For a reviewer checkout with another Dispatch's scratch, archive and read back
+each Dispatch's complete file set independently. The installed helper's retire
+operation may reject another Dispatch's scratch as unclassified dirt. After
+full union classification and verified per-Dispatch archives, use
+[axstack-cleanup](../../axstack-cleanup/SKILL.md)'s exact per-prefix dry-run and
+clean recovery; never force, use a broad target, or treat archive success as
+removal authority.
+
 ## Native retirement
 
 Retire descendants before their parent. For each positively identified unused
@@ -83,10 +91,12 @@ to matching listed files and never removes directories.
 Record the retirement receipt's `removed`, `alreadyAbsent`, and `pending` file
 sets. A repeat invocation reconciles already absent files without changing the
 manifest. A partial or failed invocation preserves the archive; resolve its
-exact hold and retry the same operation until `pending` is empty. Never replace
-this operation with a shell loop, broad deletion, force, or a waiver.
+exact hold and retry the same operation until `pending` is empty. The verified
+multiple-Dispatch recovery above uses only axstack-cleanup's exact per-prefix
+path. Never replace either path with a shell loop, broad deletion, force, or a
+waiver.
 
-Re-read Git and native state after successful retirement. Any remaining or
+Re-read Git and native state after successful evidence removal. Any remaining or
 uncertain dirt holds worktree removal. Settlement, liveness/no-writer proof,
 useful-work and publication checks, evidence classification, and removal
 authority remain driver decisions; archive or retirement success proves none of

package/skills/axstack/references/lifecycle.md

@@ -113,8 +113,9 @@ differs from merged; human merges.
 ## Watch health
 
 Native review and watch lanes use fresh finite sessions in isolated per-pass
-workspaces on staggered 15-minute schedules. Each admits at most five executing PR jobs;
-waiting PRs remain covered without reserving slots. Bounded PR jobs own their
+workspaces on staggered 15-minute schedules. Each admits eligible actionable PR
+events within measured host capacity; waiting PRs remain covered without
+reserving slots. Bounded PR jobs own their
 events, use per-PR worktrees, and settle after descendants settle. Build no
 custom scheduler, state engine, or legacy fallback. Details live in
 [Watch runtime](../../axstack-watch/references/watch-runtime.md).

package/skills/axstack/references/orca-runtime.md

@@ -78,8 +78,9 @@ authorized retry so no duplicate writer starts.
 
 Give each reviewer a separate Orca-managed child worktree under the candidate's
 worktree, including report-only reviews and rechecks; never share the author's
-checkout or another reviewer's checkout. Reuse that reviewer's own child only
-after its previous Dispatch has settled. Use the runtime-owned worktree guide,
+checkout or another reviewer's checkout. A later review gets a fresh Orca-managed
+child worktree after the prior settled review's evidence and cleanup are
+reconciled. Use the runtime-owned worktree guide,
 not a raw Git worktree or temporary clone. Before dispatch, verify a detached
 checkout of the exact candidate SHA and the pinned base in that child.
 
@@ -95,11 +96,11 @@ owner. Remove only that exact validated owned path, with no glob or parent-root
 deletion; never wipe a general cache. Uncertain temporary files are preserved
 for later reconciliation. Incidental tool-managed caches are not review evidence.
 Before removing a reviewer worktree, preserve its report and supporting evidence
-in the driver's Orca workspace and update the run record's paths. For a settled
-merged run with a confirmed forge merge, the compact durable receipt in
-[axstack-cleanup](../../axstack-cleanup/SKILL.md) satisfies this preservation
-rule only after its classification, readback, and removal guards pass. Preserve
-active or unmerged review evidence and unique evidence whose bytes must survive;
+in the private evidence archive outside the disposable checkout, verify manifest
+readback, and update the run record's paths. A settled reviewer Dispatch can be
+cleaned before PR merge through [axstack-cleanup](../../axstack-cleanup/SKILL.md)
+only after its classification, readback, and removal guards pass. Preserve
+active or unknown review evidence and unique evidence whose bytes must survive;
 uncertain ownership or evidence holds. Terminal release alone is not permission
 to discard evidence or remove the worktree.
 

package/skills/axstack/references/review-manager-prompt.md

@@ -4,8 +4,9 @@ You are a fresh finite review-manager session in its isolated per-pass Orca work
 through the installed `axstack-review` skill; that skill loads its packaged
 `../axstack/references/automations.md` contract by relative reference. Discover
 every eligible peer-review event and invoke the skill through Orca for each
-admitted bounded PR job. Keep complete coverage separate from the five-job
-execution cap, preserve exact ownership and receipts, settle completed trees,
+admitted bounded PR job. Keep complete coverage and admit actionable events
+within measured host capacity, preserve exact ownership and receipts, settle
+completed trees,
 and stay quiet when nothing changed. Reconcile before admission, save durable
 continuity outside this workspace, then retire only this pass workspace as the
 final action under the contract's ownership guards. Reconcile the whole lane,

package/skills/axstack/references/watch-manager-prompt.md

@@ -4,9 +4,9 @@ You are a fresh finite watch-manager session in its isolated per-pass Orca works
 through the installed `axstack-watch` skill; that skill loads its packaged
 `../axstack/references/automations.md` contract by relative reference. Discover
 every eligible own-PR event and invoke the skill through Orca for each admitted
-bounded PR job. Keep complete coverage separate from the five-job execution
-cap, preserve exact ownership, candidates, holds, and receipts, settle
-completed trees, and stay quiet when nothing changed. Reconcile before
+bounded PR job. Keep complete coverage and admit actionable events within
+measured host capacity, preserve exact ownership, candidates, holds, and receipts,
+settle completed trees, and stay quiet when nothing changed. Reconcile before
 admission, save durable continuity outside this workspace, then retire only this
 pass workspace as the final action under the contract's ownership guards.
 Reconcile the whole lane, not just this workspace. Never check out a PR branch here.

package/skills/axstack-cleanup/SKILL.md

@@ -64,21 +64,30 @@ removing any source copy or workspace.
 Archive success proves only preservation of the listed bytes. It does not prove
 settlement, exit, ownership, a clean worktree, publication, or removal safety.
 
-For a settled merged run whose forge merge is confirmed, generated reviewer
-scratch is disposable after a compact durable receipt is written outside the
-review worktree and read back. Bind that receipt to the exact repository, Run,
+For a settled reviewer Dispatch, the reviewer worktree can be retired while its
+PR remains open, before merge, after its report and supporting evidence are
+archived privately and read back. Generated reviewer scratch is disposable
+after a compact durable receipt is written outside the review worktree and read
+back. Bind that receipt to the exact repository, Run,
 Task, Dispatch, reviewer workspace and terminal, exact head SHA and base SHA,
 review verdict, coverage and limitations, test and CI result pointers, and the
 user authorization and scope for cleanup. A raw reviewer report may be discarded
 after its verdict and limitations are compacted into that read-back receipt;
-use the private evidence archive for unique evidence whose exact bytes must
-survive. Raw reproducible probes and logs need not be archived solely to retire
-a completed review worktree.
-
-Use only a named run-owned scratch prefix recorded with the Dispatch. Require
-`git status --porcelain=v1 -z --untracked-files=all` to show all dirt as
-untracked files inside that run-owned scratch prefix; any tracked, staged,
-unmerged or unpushed work, dirty source, or dirt outside it holds. Validate that
+use the private evidence archive for the report and supporting evidence. Verify
+each Dispatch archive and manifest readback independently. Preserve the separate
+author candidate with useful unmerged work; reviewer cleanup never removes it.
+
+Use only a named run-owned scratch prefix recorded with the Dispatch. Multiple
+Dispatches in the same reviewer worktree are recovery for missed earlier
+cleanup; after independent archives and readback, use per-prefix removal. Two or
+more review passes in the same reviewer worktree may leave distinct prefixes;
+each named run-owned scratch prefix must belong to an accepted settled Dispatch
+in the Run. Require `git status --porcelain=v1 -z --untracked-files=all`
+to show all dirt as untracked files inside a run-owned scratch prefix. Prove
+every remaining untracked file individually belongs to one of those named
+run-owned scratch prefixes; any tracked, staged, unmerged or unpushed work,
+dirty source, or dirt outside them holds. Check ignored files across the whole
+worktree too; unknown or ignored content holds. Validate that
 the detached checkout still matches the reviewed head and check local commits
 against recorded remote refs; unknown divergence holds. Validate that
 the exact reviewed scratch prefix names the recorded directory inside the exact
@@ -87,17 +96,25 @@ descendant for symlinks, hard links, special files, unknown content, user-owned
 files, or ignored files; any mismatch holds. Active or `user_takeover` terminals
 also hold.
 
-List the exact scoped path and all descendants with their types, confirm each
-belongs to generated reviewer scratch, and record that inventory. Dry-run the
-exact scoped path from the reviewer worktree root with
+For each prefix, list the exact scoped path and all descendants with their
+types, confirm each belongs to generated reviewer scratch, and record that
+inventory. For each prefix, perform an exact-path dry-run and exact-path deletion
+separately. Dry-run the exact scoped path from the reviewer worktree root with
 `git clean -nd -- <exact reviewed scratch prefix>`
 with the concrete reviewed relative prefix substituted for the angle-bracket
 notation. Compare its sole target to the classified directory; an empty,
-partial, or different result holds. Re-read the compact receipt, complete Git
-status, directory contents, native ownership and liveness immediately before
-removal; any change holds. Then run `git clean -fd -- <same exact prefix>` with
-the identical concrete path and recheck clean Git status, recording the path and
-outcome. Use no unresolved variable as a destructive target. Never use `-x`, a
+partial, or different result holds. Immediately before each deletion, including
+each next deletion, re-read the compact receipt, complete Git status with
+whole-worktree dirt and ignored files, every remaining prefix inventory, and
+native ownership and liveness. Compare these reads against the expected
+post-deletion state: previously deleted proven prefixes and their files are
+absent, while remaining classified prefixes and outside content still match.
+Only unexpected changes hold. Then run
+`git clean -fd -- <same exact prefix>` with the identical concrete path, record
+that path and outcome, and repeat for the next proven prefix. Recheck clean Git status
+after the last deletion. Require final clean Git status before native
+exact-workspace removal without force. Use no unresolved variable as a destructive target.
+Never use `-x`, a
 glob, a repository-root target, extra force, or broad clean.
 This scratch decision does not waive any other preservation or native removal
 guard.
@@ -119,15 +136,27 @@ Treat these operations as separate decisions and receipts:
 3. **Worktree removal.** Re-read Git status, branch/upstream divergence,
    unpushed commits, forge merge/publication state, children, terminals, and
    archived evidence immediately before the native exact-workspace removal.
-   When archived evidence is the last dirt, use the evidence archive helper's
-   manifest-bound retirement operation and require an empty pending set; never
-   unlink through prose or a shell loop. Verify the effective Archive Script
+   When archived evidence is the last dirt for one Dispatch, use the evidence
+   archive helper's manifest-bound retirement operation and require an empty
+   pending set. If multiple Dispatch scratch prefixes remain in one checkout,
+   the helper may reject the other Dispatch's files as unclassified; after
+   independently verified per-Dispatch archives and full union classification,
+   use the exact per-prefix dry-run and clean above. Never unlink through prose
+   or a shell loop. Verify the effective Archive Script
    provenance before native removal: an unknown or required-but-untrusted hook
    holds. Record its native outcome as `unconfigured`, `passed`, `failed`, or
    `unknown`; only `unconfigured` or trusted `passed` may advance. Account for
    branch-deletion side effects explicitly, then re-list both native workspaces
-   and Git refs. A failed or unknown hook outcome or uncertain response preserves
-   the resource; never force or substitute shell deletion.
+   and Git refs. Read back each remaining local review ref against its recorded
+   name and tip. Any branch with unknown origin, unique commits, an active
+   worktree, or a remote counterpart must be preserved. Only when provenance
+   proves a ref was created for the removed reviewer checkout and its tip is
+   already reachable from the preserved author candidate or confirmed remote PR
+   head, permit
+   exact-ref expected-old ref deletion and read back its absence. Never delete
+   the author branch or use generic force. A failed or unknown hook outcome or
+   uncertain response preserves the resource; never force or substitute shell
+   deletion.
 4. **Chat archival.** Attempt it only if the version-matched runtime guide
    advertises a distinct supported operation and the scoped chat is eligible.
    Otherwise record chat archival as unsupported. Process exit, worker release,

package/skills/axstack-implement/SKILL.md

@@ -163,7 +163,11 @@ For each PR:
 1. Dispatch `axstack-author` under §§3-5 and consume its strict-TDD receipt.
 2. Publish through candidate-publication and read back the exact SHA.
 3. Dispatch and consume the authored-mode `axstack-review` selected from actual
-   author provenance.
+   author provenance. After each settled review, run `axstack-cleanup` for its
+   exact reviewer resources before PR merge, preserving and reading back the
+   private evidence archive before eligible worktree retirement. A later review
+   uses a fresh child checkout. Keep the author candidate until merge and
+   Close-out; a cleanup hold preserves only the affected reviewer resource.
 4. Route the verdict. `APPROVE` at that head plus `axstack-watch` §5's full
    predicate—required checks, all feedback, approvals, mergeability, and
    exact-revision receipts—records `merge-ready`. With required checks pending,
@@ -187,7 +191,7 @@ all-merged event—two per run—and (c) serious risk; never progress.
 Merge-ready is the human boundary: the user merges, bottom-up for a stack. The
 driver resumes on the user's next message or `/axstack-watch`; no Orca merge
 wake exists today. Re-read forge state: record forge-merged PRs as `merged`;
-changed heads or feedback return to step 1; release nothing before Close-out.
+changed heads or feedback return to step 1; retain useful author work before Close-out.
 Run Close-out once only after every required PR is forge-merged and acceptance
 passes. It settles workers, records counts, makes the auditor decision and
 settlement, releases worktrees, closes eligible tickets, and archives the run.

package/skills/axstack-watch/references/watch-runtime.md

@@ -18,8 +18,8 @@ The separate native watch manager lane follows the
 uses a new isolated workspace and fresh finite session at minutes `7,22,37,52`.
 Continuity survives outside disposable workspaces; admission reconciles the
 whole lane across workspaces. It scans every eligible own PR and
-admits at most five bounded actionable-event jobs. Waiting PRs stay covered
-without reserving slots. Each job uses its own repository-parented worktree and
+admits bounded actionable-event jobs within measured host capacity. Waiting PRs
+stay covered without reserving slots. Each job uses its own repository-parented worktree and
 settles with all descendants; no model, per-PR timer, or polling loop waits for
 CI, review, a user decision, or merge.