axstack 0.20.13 → 0.20.15

package/README.md

@@ -20,7 +20,7 @@ scheduler, or runtime database to operate. Orca is the only supported runtime.
 | Turn agreed scope into a specification | `axstack-spec` |
 | Break a specification into executable tickets | `axstack-tickets` |
 | Build an approved task with tests and independent review | `axstack-implement` |
-| Review a pull request | `axstack-review` |
+| Review a pull request or bounded existing code | `axstack-review` |
 | Monitor or maintain an existing PR | `axstack-watch` |
 | Diagnose a bug and establish a failing check | `axstack-debug` |
 | Answer a bounded question with sources | `axstack-research` |
@@ -46,7 +46,8 @@ need to manually coordinate every agent or repeat an approval that is still vali
 ## Quick start
 
 You need Bun >=1.3.14, Git, the GitHub CLI (`gh`), the `gh stack` extension,
-and a running Orca with its `orca-cli` and `orchestration` guides available.
+and a running Orca with its `orca-cli`, `orchestration`, and `orca-linear`
+guides available.
 The agents selected by your preset must also be available in Orca.
 
 Install the CLI and skills for your harness. For example, for Codex:
@@ -68,7 +69,9 @@ Then open an Orca chat and ask for the relevant skill:
 $axstack-align Help me scope account recovery.
 $axstack-implement Build the task we agreed on.
 $axstack-review Review this pull request: <PR URL>
+$axstack-review Find issues in <paths> at <commit SHA>.
 $axstack-watch Monitor this PR without making changes: <PR URL>
+$axstack-watch Watch every PR raised by this chat until all merge or close
 ```
 
 Use `--harness claude`, `opencode`, or `antigravity` for another supported
@@ -107,11 +110,10 @@ model is unavailable. See [workflow and routing details](docs/workflows.md).
 ## Optional PR automation
 
 Manual review and watch work independently of scheduled automation.
-For recurring use, Axstack defines two native Orca manager lanes: one discovers
-eligible peer-review requests, and the other monitors your open PRs and handles
-authorized repair events.
+For recurring peer review, Axstack defines one optional native Orca review manager.
+Own-PR observation and authorized repair remain user-driven through `axstack-watch`. Its chat-run mode can use one optional same-host native Orca observer per Run, about every ten minutes, to report new PR events internally to the original chat. The chat alone directs repairs and publication. Activation needs a live host canary; source and install checks do not prove it is running.
 
-The lanes use staggered 15-minute schedules. Each pass uses a fresh finite
+The review manager uses a 15-minute schedule. Each pass uses a fresh finite
 session in an isolated workspace and admits eligible actionable PR events within
 measured host capacity. Waiting PRs remain tracked without consuming
 execution slots, so a large open-PR backlog does not require an idle agent per PR.
@@ -121,8 +123,7 @@ release capacity only after native descendant settlement. Uncertain execution
 teardown pauses the lane; settled evidence cleanup does not occupy a slot.
 
 Scheduling is opt-in and requires host-specific runtime validation before
-activation. Installing Axstack does not turn it on. Repairs are limited to
-explicitly allowed repositories; automation never merges for you.
+activation. Installing Axstack does not turn it on. The review automation never merges for you.
 See [PR-manager setup and safety](skills/axstack/references/automations.md).
 
 ## Documentation

package/docs/installation.md

@@ -6,7 +6,8 @@ does not dispatch agents, edit Orca settings, run a scheduler, or maintain a
 workflow database.
 
 Requirements: Bun >=1.3.14, Git, `gh`, the `gh stack` extension, and a running
-Orca whose version-matched `orchestration` and `orca-cli` guides are available.
+Orca whose version-matched `orchestration`, `orca-cli`, and `orca-linear`
+guides are available.
 There are no runtime dependencies. Filesystem access uses Bun-backed `node:fs`
 and `node:fs/promises`; no other Node runtime contract is introduced.
 
@@ -83,7 +84,8 @@ axstack check [--bundle <dir>] [--instructions <file>] [--skills-dir <dir>|--har
 ```
 
 The check separates Bun/Git/`gh stack` availability, resolved Orca executable,
-runtime readiness, required runtime-owned guide discovery, and bundle validity.
+runtime readiness, required `orchestration`, `orca-cli`, and `orca-linear`
+guide discovery, and bundle validity.
 With an instruction target, it separately reports whether the marker block is
 owned, missing, unowned, edited, or bound to a different path.
 It must honor Orca's executable-resolution rules, including the Linux screen
@@ -227,15 +229,16 @@ not prove that a running harness reloaded them.
 ## Runtime guide discovery
 
 The installed Axstack bundle does not own or copy Orca's guides. At an action
-boundary, the skill resolves one Orca executable and loads that binary's
-version-matched `orchestration` and `orca-cli` guides. Automation guidance is
-loaded only for the watch branch. Missing discovery is a setup gap, not a reason
-to fall back or invent commands.
-
-Native watch activation is currently held: provider selection exists, but
-model, effort, permission, and bounded-expiry support do not preserve the
-accepted contract. Installation creates no production schedule and adds no
-custom scheduler.
+boundary, the skill resolves one Orca executable and loads the operation's
+version-matched `orchestration`, `orca-cli`, or `orca-linear` guide. Review
+automation guidance is loaded only for the scheduled review branch. Missing
+discovery is a setup gap, not a reason to fall back or invent commands. Guide
+discovery does not prove an operation works; Linear documents, provider/model
+routing, and live automation behavior need separate preflights.
+
+Installation creates no production schedule and adds no custom scheduler. Chat-run PR watch requires a separately validated same-host native Orca automation, installed preset and effective observer model/effort, same-Run report delivery, safe original-driver wake, and own-automation stop/readback. Installed bytes alone do not activate it.
+The optional review manager requires a separate native canary before activation;
+installed guidance does not prove live behavior.
 
 ## Historical migration
 

package/docs/workflows.md

@@ -21,6 +21,11 @@ Direct routes need no spec ceremony:
   behavior; complex visuals receive exact-artifact QA where applicable.
 - `axstack-improve` returns a small ranked set of evidenced improvement
   candidates without editing code.
+- Manual `axstack-review` can inspect existing code at an exact revision within
+  a named scope. Both configured peer reviewers inspect six lenses independently;
+  the driver reports validated defects and risks, improvement opportunities,
+  unverified leads, and `COMPLETE` or `INCOMPLETE` coverage. This report does
+  not approve a PR or publish findings.
 - `axstack-debug` builds a red loop, diagnoses to root cause, escalates hard
   bugs through adviser-directed investigator fan-out, and hands off a
   classified repair without landing a change.
@@ -79,9 +84,12 @@ provider defaults, or installed tools, and no model is substituted silently.
 
 Immediately before dispatch, delivery processing, settlement, recovery, or
 handoff, load the shared `skills/axstack/references/orca-runtime.md`. It resolves
-one Orca executable, loads that binary's version-matched `orchestration` and
-`orca-cli` guides, and follows their advertised schemas. Axstack does not vendor
-the guides or restate a competing command protocol.
+one Orca executable, then loads only the version-matched guide needed by the
+operation: `orchestration` for Run/Task/Dispatch supervision, `orca-cli` for
+worktrees, automations, handoff, and publication, and `orca-linear` for Linear
+issues. Axstack follows current command help and named conditional references;
+guide availability is not exercised runtime support. It does not vendor the
+guides or restate a competing command protocol.
 
 All subagent, delegated-worker, reviewer, and cross-harness work goes through Orca
 orchestration via the `orca` CLI (`orca-cli` / `orchestration` guides). Do not use a
@@ -123,7 +131,10 @@ session and evidence remain valid.
 - `axstack-spec` writes observable acceptance, exclusions, decisions, and one
   user-approved revision baseline. Linear is the default authoritative store;
   GitHub Issues and repository Markdown are explicit alternatives. A GitHub
-  baseline pins the issue URL and approved body digest.
+  baseline pins the issue URL and approved body digest. Linear document
+  operations preflight the current `orca-linear` guide and command help; a
+  missing native operation holds only that operation without MCP fallback or a
+  store switch.
 - `axstack-tickets` maps user-visible capabilities to dependency-aware internal
   tasks. Linear is the default selected store with access preflight; GitHub
   Issues is an explicit external-tracker alternative and repository Markdown
@@ -135,17 +146,17 @@ session and evidence remain valid.
   confirms the remote SHA before review. Local green and CI green remain
   separate evidence.
 - `axstack-review` gives peer PRs two isolated same-brief reviewers and authored
-  PRs one eligible cross-family/preset-mapped reviewer. All cover security,
+  PRs one eligible cross-family/preset-mapped reviewer. Every reviewer runs in
+  a separate candidate-child worktree, with private evidence preserved before
+  removal. All cover security,
   correctness, integration, requirements, design, and simplicity. Report-only
   never publishes; authorized submission binds the exact commit.
 - `axstack-watch` adopts an existing PR under observation-only, peer, or
   authorized-maintenance scope. A changed head or comment is an event, not
-  repair authority. Repairs return to the original author only for a
-  run-launched session and receive refreshed authored review before scoped
-  `gh stack` publication. `gh stack` publication does not apply to manager
-  repairs: the bounded PR job repairs in its per-PR child worktree, the local
-  SHA receives the actual-author-provenance review, and the exact candidate
-  lands by fast-forward `git push` after final readback.
+  repair authority. Within an implementation run, fixes return to the original
+  author and follow its publish-before-review loop. Manual adopted-PR repair
+  reviews the exact local SHA and reply bodies before `gh stack` publication
+  and remote readback.
 - `axstack-audit` separates execution outcome, procedure, and measurement
   coverage with evidenced denominators; it proposes but never self-edits.
 - `axstack-cleanup` distinguishes settled-Dispatch release, exact unused-shell
@@ -176,8 +187,10 @@ keeps the current owner and a resumable record.
 
 Serious security, downtime, data-loss, and major-design risks are raised in a
 prompt immediately and hold dependent dangerous work. This is not a runtime
-gate. An applicable `Notification policy` may use `axstack-relay`; otherwise the
-current Orca conversation is the fallback. The relay normally delivers one-way
+gate. An applicable `Notification policy` may use `axstack-relay` for serious
+risk immediately or a genuine blocker needing user intervention after bounded
+safe recovery. Questions, spec approvals, progress, CI pending, merge-ready,
+merged, and completion stay in Orca. The relay normally delivers one-way
 through native `hermes send`: it checks CLI lookup and the configured target,
 binds the recipient, deduplicates on the run record, and records the returned
 `message_id`. PR-manager notifications point the user to GitHub or a durable
@@ -187,15 +200,20 @@ authority. Delivery failure never clears the underlying hold.
 Healthy watch observations remain quiet. The optional `axstack-monitor` is a
 read-only observer for standalone watches and never sends.
 
-## Native watch automations
+## Chat-run PR watch
 
-The accepted contract has exactly two logical native manager lanes: review at
-minutes `0,15,30,45` and watch at `7,22,37,52`. Each scheduled pass uses a
-fresh finite session in a new isolated workspace, scans complete
+Use `axstack-watch` chat-run mode to watch every PR raised by this chat's Run, including later verified publications and PRs the driver explicitly adopts. One same-host native Orca automation observes about every ten minutes in fresh finite read-only sessions and reports new current-state events to the original Run. The initiating chat alone routes repairs, review, publication, and notifications. Independent PRs can repair in parallel with one writer per PR; stack ancestor changes invalidate child evidence. Unchanged complete passes stay quiet. An incomplete scan leaves readiness `UNKNOWN`.
+
+The watch lasts until all member PRs merge or close, or you cancel it. Stop requires readback that its own automation is disabled; worker settlement and run archive are separate driver steps. Run-created implementation candidates are published and read back before independent authored review. Adopted own-PR maintenance candidates receive independent exact-local-SHA review before driver publication and remote readback. The human merges. Source and installed instructions do not prove scheduled observation, driver wake, or live activation; those require same-host native canary receipts.
+
+## Optional native peer-review automation
+
+The optional native review manager runs at minutes `0,15,30,45`. Each
+scheduled pass uses a fresh finite session in a new isolated workspace, scans complete
 discovery pages, and admits eligible actionable PR events within measured host
-capacity across both lanes. Waiting PRs stay covered and consume no slot after
-owned descendants settle. Each job uses one repository-parented worktree; managers never check out
-PR branches in their own workspaces.
+capacity. Waiting PRs stay covered and consume no slot after
+owned descendants settle. Each job uses one repository-parented worktree; the
+manager never checks out PR branches in its own workspace.
 
 Every pass reconciles saved, GitHub, and native Orca state across all same-lane
 workspaces before admission. A
@@ -203,9 +221,10 @@ confirmed same-lane manager makes the new duplicate do no work or shared-record
 write and close only itself. Normal teardown settles descendants, saves durable
 continuity and decisions outside disposable workspaces, then retires its own
 verified isolated pass workspace as the final action. It never bulk-closes a
-shared manager workspace or a PR-job worktree, or cleans preserved candidates,
+shared manager workspace or a PR-job worktree, or cleans preserved
 evidence, user sessions, unknown liveness, `user_takeover`, or ambiguous
-publication state. Manual review/watch remains outside this scheduled lifecycle.
+publication state. Manual review and user-driven `axstack-watch` remain outside
+this scheduled lifecycle.
 
 One natively ordered successor may recover an exact positively completed
 predecessor whose terminal survived, but only after matching its automation,
@@ -229,18 +248,17 @@ teardown pauses the lane; retained evidence or cleanup metadata does not consume
 a slot after positive full-tree settlement. Once settled, an unchanged held
 event remains deduplicated while unrelated eligible PRs continue.
 
-Requested reviews cover any accessible repository; automatic repairs retain
-their `defi-com/monorepo` and `defi-com/mobile` scope. Orca owns schedules,
+Requested peer reviews cover any accessible repository. Orca owns schedules,
 sessions, Tasks, and Dispatches. Axstack adds no custom scheduler, queue engine,
 cursor files, polling loop, or historical runtime fallback.
 
-## Automations
+## Review automation
 
-The review and watch managers use short packaged prompts that load the current
-relative contract and invoke `axstack-review` or `axstack-watch`. Bounded jobs
-publish ordinary exact-head review verdicts or reviewed fast-forward repairs;
-the human merges. Exceptional security, permanent-on-chain, or architectural
-decisions remain actionable in GitHub or a durable user-owned conversation
+The review manager uses one short packaged prompt that loads the current
+relative contract and invokes `axstack-review`. Bounded jobs publish ordinary
+exact-head review verdicts; the human merges. Manual adopted-PR maintenance
+uses `axstack-watch` with local-SHA review before authorized publication.
+Exceptional security, permanent-on-chain, or architectural decisions remain actionable in GitHub or a durable user-owned conversation
 after manager self-close, with an authorized deduplicated Telegram notification.
 The current operational contract is
 `skills/axstack/references/automations.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.20.13",
+  "version": "0.20.15",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -152,7 +152,7 @@
       "model": "claude-sonnet-5",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "low",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/codex-only.json

@@ -152,7 +152,7 @@
       "model": "gpt-6-sol",
       "modeId": "full-access",
       "thinkingOptionId": "low",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/mixed.json

@@ -152,7 +152,7 @@
       "model": "claude-opus-5-5",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "medium",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/skills/axstack/references/automations.md

@@ -1,17 +1,12 @@
-# Native PR managers
+# Native peer-review manager
 
-Read this only for the two native Orca PR-manager automations. The historical
+Read this for the optional native Orca peer-review automation. The historical
 automation specs and plans describe retired designs and are not instructions.
 
 ## Topology and schedules
 
-There are exactly two logical manager lanes:
-
-- **Review manager:** runs at minutes `0,15,30,45` and invokes
-  [axstack-review](../../axstack-review/SKILL.md) for eligible peer reviews.
-- **Watch manager:** runs at minutes `7,22,37,52` and invokes
-  [axstack-watch](../../axstack-watch/SKILL.md) for eligible own-PR watch or
-  repair events.
+The review manager runs at minutes `0,15,30,45` and invokes
+[axstack-review](../../axstack-review/SKILL.md) for eligible peer reviews.
 
 Use a new isolated workspace for every scheduled pass, with one fresh finite
 manager session. Configure native repo-created worktree mode against the
@@ -21,8 +16,8 @@ launch; the manager must not move itself from a shared launch workspace.
 Keep lane continuity and evidence outside disposable manager workspaces at
 the configured durable absolute paths. A manager never checks out a PR branch
 in its pass workspace. Missed slots do not replay a backlog; the next ordinary pass
-discovers current state. The two short packaged prompts sit beside this file
-and discover these rules by relative link instead of copying them.
+discovers current state. The short packaged review prompt sits beside this file
+and discovers these rules by relative link instead of copying them.
 
 Provision one explicit absolute continuity path per automation ID in the
 scheduled prompt. Follow [Run record](run-record.md) for its contents; the
@@ -136,32 +131,26 @@ only when its body ends with
 or a retained legacy receipt proves that provenance; otherwise never replace
 it automatically.
 
-The watch manager covers every open non-draft PR authored by self. It may
-repair only `defi-com/monorepo` and `defi-com/mobile`; PRs elsewhere remain
-observed but read-only. Preserve deploy-on-push exclusions, lowest-first stack
-dependencies, and existing ownership boundaries. Peer code is always
-read-only.
-
 Coverage is not execution. Waiting for CI, a reviewer, a user decision, or a
 merge occupies no execution slot after owned work and descendants settle.
-Watch membership never reserves a slot and no job stays active merely until a
+Review waiting state never reserves a slot and no job stays active merely until a
 PR merges or closes. Thirty open PRs, including ten settled waiting PRs, are
 all scanned; those ten occupy zero slots.
 
 ## Admission and fairness
 
-The review manager and watch manager admit all eligible actionable PR events
+The review manager admits all eligible actionable PR events
 that measured host capacity can support across ticks. Before each admission,
-inspect available memory, CPU load, and active worker trees across both lanes;
+inspect available memory, CPU load, and active worker trees across the host;
 account for the whole proposed worker tree, dependencies, spending limits, and
 exclusive ownership. Report unavailable metrics as unknown; use the remaining
 host evidence rather than treating a missing metric alone as a blocker. Defer
 an event when observed pressure or uncertain headroom cannot support its whole
 tree, record the reason, and remeasure on the next pass. Do not use a fixed
-PR-job count or reserve capacity for either lane.
+PR-job count or reserve a fixed slot.
 
-A slot covers one bounded PR event and remains occupied while its author,
-reviewers, or other owned descendants are active or unsettled. Leaf workers do
+A slot covers one bounded PR event and remains occupied while its reviewers
+or other owned descendants are active or unsettled. Leaf workers do
 not create recursive teams. Settlement of the PR job and every descendant
 frees the slot even while the PR stays open.
 
@@ -180,10 +169,12 @@ writer for the same PR. Reuse an existing valid per-PR worktree, owner, and
 unchanged receipts before creating anything. Otherwise create one separate
 Orca worktree per PR job, parented to that repository's primary worktree, and
 pin the observed head and base. The bounded PR coordinator loads the
-appropriate skill, launches only the reviewers or author that skill owns,
+review skill, launches only the reviewers that skill owns,
 handles the current actionable event, returns exact receipts, then settles.
 Settlement returns continuity to the manager rather than retaining an idle PR
-coordinator. Reviewers retain the isolation required by `axstack-review`.
+coordinator. Reviewers retain the isolation required by `axstack-review`:
+each runs in a separate Orca child worktree, keeps its probes and evidence
+inside that worktree, and preserves required evidence before removal.
 
 Give each job a private job-local temporary directory under its per-PR
 worktree, following the ownership, containment, and cleanup checks in the
@@ -194,12 +185,12 @@ containment is uncertain.
 
 An unchanged exact head and unchanged event identity creates no job; an
 unchanged exact head with a new event identity remains actionable. Event
-identity includes the applicable review ID and body digest, check identity and
-result, or other current GitHub event receipt. Dedupe from current GitHub state,
+identity includes the applicable review ID and body digest, request identity, or other current GitHub event
+receipt. Dedupe from current GitHub state,
 native Orca Task and Dispatch state, and the existing compact run record; do
 not create machine cursor files or a queue engine. Record enough to resume: PR,
-head, base, event identity, mode, owner and worker receipts, candidate,
-publication receipt, hold, and next action. GitHub remains authoritative for
+head, base, event identity, mode, owner and worker receipts, verdict,
+submission receipt, hold, and next action. GitHub remains authoritative for
 open state, revisions, reviews, checks, and merge state.
 
 ## Held job settlement
@@ -236,10 +227,10 @@ lane before another pass can admit work rather than accumulating active passes
 or claiming capacity from an uncertain process tree.
 
 When the current event is handled, settle and release owned native resources.
-Preserve dirty worktrees, unpushed candidates, unarchived review evidence, pending
+Preserve dirty worktrees, unarchived review evidence, pending
 external results, and user-owned work until durability and ownership are
 proven. Unknown liveness, `user_takeover`, and ambiguous publication likewise
-forbid cleanup. Here a pending external result means an unconfirmed publication
+forbid cleanup. Here a pending external result means an unconfirmed review submission
 or send outcome, not pending CI. Waiting state belongs in GitHub and the compact
 record, never in an idle model, per-PR timer, or polling loop.
 Follow the [private evidence archive](evidence-archive.md) when evidence is the
@@ -251,7 +242,7 @@ read back the archive and compact receipt, then follow
 the reviewer checkout before merge. This does not release active jobs or manager
 pass workspaces.
 
-## Review and repair authority
+## Review authority
 
 Peer review follows `axstack-review` peer mode: two isolated configured
 reviewers inspect the exact head and base. Complete review may publish the
@@ -269,21 +260,8 @@ private or local artifacts. Write the local HTML copy under the established
 `review-PR-<num>.html` reserved for `defi-com/monorepo`. Never publish a
 `COMMENT` review. An ambiguous submission is looked up before retry.
 
-An own PR becomes actionable for repair only when a failing check has a base
-check-run with the same name and producing app identity observed passing (or a
-legacy status has the same context), or when a new current-head
-`CHANGES_REQUESTED` review has both an unhandled review ID and an unhandled body
-digest. Missing, pending, or same-name/different-app base evidence holds repair.
-A new head or generic event grants no repair authority by itself.
-
-Authorized own-PR repair follows `axstack-watch`: produce the smallest repair
-in the per-PR worktree, obtain the actual-author-provenance reviewer pairing,
-and publish only a reviewed fast-forward repair push after exact-current
-candidate, head, base, event, allowlist, deploy, and remote readback receipts.
-Reconcile an ambiguous review or push result before any retry.
-
 No manager, coordinator, or worker may merge, close, force-push, rebase,
-restack, broaden scope, or use `gh stack` mutation. Human merge remains the
+restack, broaden scope, or mutate a PR branch. Human merge remains the
 boundary.
 
 ## Exceptional decisions and notifications
@@ -314,7 +292,7 @@ self-close. Waiting PRs still occupy zero slots once their owned trees settle.
 
 Cleanup of PR-job setup shells stays scoped to positively identified owned unused
 setup shells: use the native exact-terminal close operation for each only.
-Preserve dirty worktrees, unpushed candidates, unarchived review evidence, user-owned
+Preserve dirty worktrees, unarchived review evidence, user-owned
 terminals, unknown liveness, `user_takeover`, and ambiguous publication state.
 Never classify all dirt as evidence. If explicitly classified evidence is the
 last retention reason, apply and verify the [private evidence archive](evidence-archive.md),

package/skills/axstack/references/candidate-publication.md

@@ -30,16 +30,13 @@ remote confirmation. Reviewers inspect a detached immutable checkout of the
 confirmed candidate SHA and pinned base, never only the movable branch name.
 Any author repair creates a new revision and repeats this boundary.
 
-## Automation repair exception
+## Immutable checkout shape
 
-For a manager PR repair under
-[Native PR managers](automations.md), the candidate is a local immutable
-commit SHA in the per-PR child worktree, not a published remote ref. The
-reviewer confirms that exact local SHA with `git rev-parse` in the worktree
-instead of remote equality, and inspects a detached checkout of it with the
-pinned base. The remote ref is expected to still be the pre-repair head; record
-it as the expected-old remote SHA rather than requiring it to equal the
-candidate. Remote equality is re-checked at the publication readback of the
-watch skill's repair-publication reference immediately before the fast-forward
-push. Ordinary workflows keep the remote confirmation above; the
-exception never applies outside a manager PR job.
+The immutable checkout is an Orca worktree of the already-registered repo:
+`ORCA worktree create --repo id:<repoId> --name review-<pr>-<sha7> --json`,
+then `git checkout --detach <candidate SHA>` inside it. Never materialize it
+as a `git clone` into a temp directory followed by `orca repo add`; each
+`repo add` registers a duplicate top-level repo and leaves a stale record once
+the directory is gone. Release preparation uses a `release/<version>` worktree
+of the same registered repo the same way. Release the checkout with
+`ORCA worktree rm` after its receipt is recorded.

package/skills/axstack/references/lifecycle.md

@@ -13,25 +13,25 @@ binding state and receipts to exact revisions.
   merge is default.
 - Author: exactly one writer per candidate; accepted fixes return there.
   Workers launch no recursive teams.
-- Reviewers: peer = two independent `axstack-reviewer-primary` and
-  `axstack-reviewer-secondary` sessions with identical brief and isolated first
-  pass; authored = one eligible configured reviewer from actual author
-  provenance. Owner and author never review.
-- Automation review/watch managers and optional monitor: see
-  [Watch health](#watch-health).
+- Reviewers: peer = two configured roles with the same brief and isolated first
+  pass; authored = one eligible role from author provenance. Each uses a
+  separate Orca child worktree, keeps evidence there, and preserves it before
+  removal. Owner and author never review.
+- Automation review manager and monitors: see
+  [Review automation health](#review-automation-health).
 - Auditor (`axstack-auditor`): report-only; never edits, merges, activates, or
   audits itself.
 
-Prefer parallel independent bounded work; no redundant workers.
-Per [standing contracts](contracts.md), fanout is dependency/capacity-driven
-with no fixed count within host/spending limits. [PR shape](pr-shape.md)
-covers theme/size; queue via `gh stack`.
+Prefer parallel independent bounded work; no redundant workers. Fanout is dependency- and
+capacity-driven within host/spending limits. [PR shape](pr-shape.md) covers
+theme/size; queue dependencies through `gh stack`.
 
 ## Ownership
 
-The PR owner remains accountable for candidate, fixes, evidence, monitoring;
-peer code stays read-only. Missing or idle sessions never transfer ownership.
-Owned implementation enters review through the revision-bound
+The PR owner is accountable for candidate, fixes, evidence, monitoring; a
+chat-run observer reports only to its driver. Peer code stays read-only.
+Missing or idle sessions never transfer ownership.
+Owned work enters review via the revision-bound
 [candidate-publication boundary](candidate-publication.md).
 
 ## Native handoff and resume
@@ -63,12 +63,13 @@ receipts/timers, unresolved decisions, next action, and transfer ownership/gap.
 Store receipt references, not raw output, in the [Run record](run-record.md).
 
 - Session receipt: actual agent/workspace IDs, requested provider/model and
-  role; reuse on resume rather than spawn a replacement.
+  role; reuse on resume.
 - Acceptance receipt: sender/recipient, accepted scope/authority, timestamp,
   and ownership session receipt.
-- Review receipt: mode, applicable provenance, reviewer, SHA/base,
+- Review receipt: mode, provenance, reviewer, SHA/base,
   verdict (`APPROVE | REQUEST_CHANGES | INCOMPLETE`), coverage, limitations and
-  findings. Changed code needs a receipt for its new revision.
+  findings. Changed code needs a new receipt. Codebase: revision/scope,
+  `COMPLETE | INCOMPLETE` coverage, no PR verdict.
 - Submission receipt: actual commit, review, remote confirmation; ambiguity
   requires external lookup before retry.
 - Audit receipt: scope, evidenced PASS/FAIL/UNKNOWN counts/denominators and
@@ -99,21 +100,21 @@ On `consumer_fenced`, reconcile the active coordinator rather than borrowing an
 identity. Respect settlement protection including `user_takeover`.
 
 No execution heartbeat or substitute scheduler is created by Axstack. Native
-watch automation follows [Watch health](#watch-health).
+review automation follows [Review automation health](#review-automation-health).
 Tracking grants no merge, release, model-substitution, or scope authority.
 
 ## Deadline (one rule for every owned timer)
 
 The default 24-hour deadline covers standalone task-owned timers. Stop them at
-deadline and preserve remaining work; there is no watch deadline for
-automations. A PR is merge-ready only with the applicable review receipt(s) at
+deadline and preserve remaining work; the review automation has no task-owned
+deadline. A PR is merge-ready only with the applicable review receipt(s) at
 its exact head; green CI or tests alone never make it merge-ready. Merge-ready
 differs from merged; human merges.
 
-## Watch health
+## Review automation health
 
-Native review and watch lanes use fresh finite sessions in isolated per-pass
-workspaces on staggered 15-minute schedules. Each admits eligible actionable PR
+The native review manager uses fresh finite sessions in isolated per-pass
+workspaces on a 15-minute schedule. It admits eligible actionable PR
 events within measured host capacity; waiting PRs remain covered without
 reserving slots. Bounded PR jobs own their
 events, use per-PR worktrees, and settle after descendants settle. Build no

package/skills/axstack/references/orca-runtime.md

@@ -13,12 +13,24 @@ Resolve one Orca executable for the session and reuse it. Prefer
 terminals, and otherwise `orca`. If the selected executable fails, report that
 exact gap; never switch binaries silently.
 
-Before supervised work, load the selected executable's version-matched
-`skills get orchestration --json` and `skills get orca-cli --json` guides.
-Follow returned schemas and their named conditional references rather than
-copying their command procedures into Axstack. Missing guide discovery is a
-setup gap. It does not authorize legacy runtime use or an Axstack dispatcher,
-daemon, scheduler, database, or escalation engine.
+Load only the selected executable's version-matched guides needed by the
+operation through `skills get orchestration --json`,
+`skills get orca-cli --json`, and `skills get orca-linear --json`.
+`orchestration` owns Run, Task,
+Dispatch, messaging, supervision,
+settlement, and recovery. `orca-cli` owns worktrees, terminals, automations,
+handoffs, and artifact publication; load its named conditional reference at
+the matching action gate. `orca-linear` owns Linear issue reads and writes.
+Follow returned schemas and current command help rather than copying their
+procedures into Axstack. Guide discovery does not prove runtime support for a
+particular operation: preflight that operation and report an advertised gap.
+Missing discovery never authorizes legacy runtime use, a silent integration or
+store fallback, or an Axstack dispatcher, daemon, scheduler, database, or
+escalation engine.
+
+Orca artifacts publish public-by-link output. They are not private evidence
+storage and must never receive private evidence by default; sharing requires
+explicit publication authority and the `orca-cli` publishing reference.
 
 ## Bind the configured role
 
@@ -43,6 +55,15 @@ readiness failure; because Align and Spec require both adviser receipts, either
 null adviser still holds those phases. The current chat is the driver and has
 no role row in any preset.
 
+## Materialize checkouts as worktrees of the registered repo
+
+Every reviewer, release, or worker checkout is `ORCA worktree create --repo
+id:<repoId> ...` under the repo Orca already registers. `ORCA repo add` is a
+one-time import of a new repository; running it on a clone of a registered
+repo creates a second top-level repo record, so it never materializes a
+checkout. See [Candidate publication](candidate-publication.md) for the
+detached immutable review checkout.
+
 ## Supervise one authoritative attempt
 
 For supervised work, use the orchestration guide's native Run, Task, and
@@ -63,6 +84,11 @@ running worker. Lineage is presentation and reconciliation state, never
 authority: it grants nothing, and a correct parent never substitutes for the
 Task, Dispatch, and receipt evidence above.
 
+Every reviewer gets a separate Orca child worktree parented to the candidate.
+Keep that reviewer's probes and private evidence inside its worktree, with no
+first-pass cross-read. Preserve the required evidence in the private run record
+before removal; untracked files never prove a reviewer worktree disposable.
+
 An `input_accepted` stage proves only that input reached the terminal. Require
 `turn_started` plus runtime/session inspection before treating the agent as
 started, and verify the requested role independently before trusting its work.