axstack 0.20.14 → 0.20.16

package/README.md

@@ -20,7 +20,7 @@ scheduler, or runtime database to operate. Orca is the only supported runtime.
 | Turn agreed scope into a specification | `axstack-spec` |
 | Break a specification into executable tickets | `axstack-tickets` |
 | Build an approved task with tests and independent review | `axstack-implement` |
-| Review a pull request | `axstack-review` |
+| Review a pull request or bounded existing code | `axstack-review` |
 | Monitor or maintain an existing PR | `axstack-watch` |
 | Diagnose a bug and establish a failing check | `axstack-debug` |
 | Answer a bounded question with sources | `axstack-research` |
@@ -46,7 +46,8 @@ need to manually coordinate every agent or repeat an approval that is still vali
 ## Quick start
 
 You need Bun >=1.3.14, Git, the GitHub CLI (`gh`), the `gh stack` extension,
-and a running Orca with its `orca-cli` and `orchestration` guides available.
+and a running Orca with its `orca-cli`, `orchestration`, and `orca-linear`
+guides available.
 The agents selected by your preset must also be available in Orca.
 
 Install the CLI and skills for your harness. For example, for Codex:
@@ -68,7 +69,9 @@ Then open an Orca chat and ask for the relevant skill:
 $axstack-align Help me scope account recovery.
 $axstack-implement Build the task we agreed on.
 $axstack-review Review this pull request: <PR URL>
+$axstack-review Find issues in <paths> at <commit SHA>.
 $axstack-watch Monitor this PR without making changes: <PR URL>
+$axstack-watch Watch every PR raised by this chat until all merge or close
 ```
 
 Use `--harness claude`, `opencode`, or `antigravity` for another supported
@@ -108,13 +111,13 @@ model is unavailable. See [workflow and routing details](docs/workflows.md).
 
 Manual review and watch work independently of scheduled automation.
 For recurring peer review, Axstack defines one optional native Orca review manager.
-Own-PR observation and authorized repair remain user-driven through `axstack-watch`.
+Own-PR observation and authorized repair remain user-driven through `axstack-watch`. Its chat-run mode can use one optional same-host native Orca observer per Run, about every ten minutes, to report new PR events internally to the original chat. The chat alone directs repairs and publication. Activation needs a live host canary; source and install checks do not prove it is running.
 
 The review manager uses a 15-minute schedule. Each pass uses a fresh finite
-session in an isolated workspace and admits eligible actionable PR events within
+session in one dedicated existing workspace and admits eligible actionable PR events within
 measured host capacity. Waiting PRs remain tracked without consuming
 execution slots, so a large open-PR backlog does not require an idle agent per PR.
-Completed passes save continuity and retire their own verified resources.
+Completed passes save compact continuity and close only their own exact terminal.
 Held jobs preserve evidence, use private worktree-local temporary paths, and
 release capacity only after native descendant settlement. Uncertain execution
 teardown pauses the lane; settled evidence cleanup does not occupy a slot.

package/docs/installation.md

@@ -6,7 +6,8 @@ does not dispatch agents, edit Orca settings, run a scheduler, or maintain a
 workflow database.
 
 Requirements: Bun >=1.3.14, Git, `gh`, the `gh stack` extension, and a running
-Orca whose version-matched `orchestration` and `orca-cli` guides are available.
+Orca whose version-matched `orchestration`, `orca-cli`, and `orca-linear`
+guides are available.
 There are no runtime dependencies. Filesystem access uses Bun-backed `node:fs`
 and `node:fs/promises`; no other Node runtime contract is introduced.
 
@@ -83,7 +84,8 @@ axstack check [--bundle <dir>] [--instructions <file>] [--skills-dir <dir>|--har
 ```
 
 The check separates Bun/Git/`gh stack` availability, resolved Orca executable,
-runtime readiness, required runtime-owned guide discovery, and bundle validity.
+runtime readiness, required `orchestration`, `orca-cli`, and `orca-linear`
+guide discovery, and bundle validity.
 With an instruction target, it separately reports whether the marker block is
 owned, missing, unowned, edited, or bound to a different path.
 It must honor Orca's executable-resolution rules, including the Linux screen
@@ -227,11 +229,14 @@ not prove that a running harness reloaded them.
 ## Runtime guide discovery
 
 The installed Axstack bundle does not own or copy Orca's guides. At an action
-boundary, the skill resolves one Orca executable and loads that binary's
-version-matched `orchestration` and `orca-cli` guides. Review automation guidance is loaded only for the scheduled review branch. Missing discovery is a setup gap, not a reason
-to fall back or invent commands.
-
-Installation creates no production schedule and adds no custom scheduler.
+boundary, the skill resolves one Orca executable and loads the operation's
+version-matched `orchestration`, `orca-cli`, or `orca-linear` guide. Review
+automation guidance is loaded only for the scheduled review branch. Missing
+discovery is a setup gap, not a reason to fall back or invent commands. Guide
+discovery does not prove an operation works; Linear documents, provider/model
+routing, and live automation behavior need separate preflights.
+
+Installation creates no production schedule and adds no custom scheduler. Chat-run PR watch requires a separately validated same-host native Orca automation, installed preset and effective observer model/effort, same-Run report delivery, safe original-driver wake, and own-automation stop/readback. Installed bytes alone do not activate it.
 The optional review manager requires a separate native canary before activation;
 installed guidance does not prove live behavior.
 

package/docs/workflows.md

@@ -21,6 +21,11 @@ Direct routes need no spec ceremony:
   behavior; complex visuals receive exact-artifact QA where applicable.
 - `axstack-improve` returns a small ranked set of evidenced improvement
   candidates without editing code.
+- Manual `axstack-review` can inspect existing code at an exact revision within
+  a named scope. Both configured peer reviewers inspect six lenses independently;
+  the driver reports validated defects and risks, improvement opportunities,
+  unverified leads, and `COMPLETE` or `INCOMPLETE` coverage. This report does
+  not approve a PR or publish findings.
 - `axstack-debug` builds a red loop, diagnoses to root cause, escalates hard
   bugs through adviser-directed investigator fan-out, and hands off a
   classified repair without landing a change.
@@ -79,9 +84,12 @@ provider defaults, or installed tools, and no model is substituted silently.
 
 Immediately before dispatch, delivery processing, settlement, recovery, or
 handoff, load the shared `skills/axstack/references/orca-runtime.md`. It resolves
-one Orca executable, loads that binary's version-matched `orchestration` and
-`orca-cli` guides, and follows their advertised schemas. Axstack does not vendor
-the guides or restate a competing command protocol.
+one Orca executable, then loads only the version-matched guide needed by the
+operation: `orchestration` for Run/Task/Dispatch supervision, `orca-cli` for
+worktrees, automations, handoff, and publication, and `orca-linear` for Linear
+issues. Axstack follows current command help and named conditional references;
+guide availability is not exercised runtime support. It does not vendor the
+guides or restate a competing command protocol.
 
 All subagent, delegated-worker, reviewer, and cross-harness work goes through Orca
 orchestration via the `orca` CLI (`orca-cli` / `orchestration` guides). Do not use a
@@ -123,7 +131,10 @@ session and evidence remain valid.
 - `axstack-spec` writes observable acceptance, exclusions, decisions, and one
   user-approved revision baseline. Linear is the default authoritative store;
   GitHub Issues and repository Markdown are explicit alternatives. A GitHub
-  baseline pins the issue URL and approved body digest.
+  baseline pins the issue URL and approved body digest. Linear document
+  operations preflight the current `orca-linear` guide and command help; a
+  missing native operation holds only that operation without MCP fallback or a
+  store switch.
 - `axstack-tickets` maps user-visible capabilities to dependency-aware internal
   tasks. Linear is the default selected store with access preflight; GitHub
   Issues is an explicit external-tracker alternative and repository Markdown
@@ -135,7 +146,9 @@ session and evidence remain valid.
   confirms the remote SHA before review. Local green and CI green remain
   separate evidence.
 - `axstack-review` gives peer PRs two isolated same-brief reviewers and authored
-  PRs one eligible cross-family/preset-mapped reviewer. All cover security,
+  PRs one eligible cross-family/preset-mapped reviewer. Every reviewer runs in
+  a separate candidate-child worktree, with private evidence preserved before
+  removal. All cover security,
   correctness, integration, requirements, design, and simplicity. Report-only
   never publishes; authorized submission binds the exact commit.
 - `axstack-watch` adopts an existing PR under observation-only, peer, or
@@ -174,8 +187,10 @@ keeps the current owner and a resumable record.
 
 Serious security, downtime, data-loss, and major-design risks are raised in a
 prompt immediately and hold dependent dangerous work. This is not a runtime
-gate. An applicable `Notification policy` may use `axstack-relay`; otherwise the
-current Orca conversation is the fallback. The relay normally delivers one-way
+gate. An applicable `Notification policy` may use `axstack-relay` for serious
+risk immediately or a genuine blocker needing user intervention after bounded
+safe recovery. Questions, spec approvals, progress, CI pending, merge-ready,
+merged, and completion stay in Orca. The relay normally delivers one-way
 through native `hermes send`: it checks CLI lookup and the configured target,
 binds the recipient, deduplicates on the run record, and records the returned
 `message_id`. PR-manager notifications point the user to GitHub or a durable
@@ -185,39 +200,36 @@ authority. Delivery failure never clears the underlying hold.
 Healthy watch observations remain quiet. The optional `axstack-monitor` is a
 read-only observer for standalone watches and never sends.
 
+## Chat-run PR watch
+
+Use `axstack-watch` chat-run mode to watch every PR raised by this chat's Run, including later verified publications and PRs the driver explicitly adopts. One same-host native Orca automation observes about every ten minutes in fresh finite read-only sessions and reports new current-state events to the original Run. The initiating chat alone routes repairs, review, publication, and notifications. Independent PRs can repair in parallel with one writer per PR; stack ancestor changes invalidate child evidence. Unchanged complete passes stay quiet. An incomplete scan leaves readiness `UNKNOWN`.
+
+The watch lasts until all member PRs merge or close, or you cancel it. Stop requires readback that its own automation is disabled; worker settlement and run archive are separate driver steps. Run-created implementation candidates are published and read back before independent authored review. Adopted own-PR maintenance candidates receive independent exact-local-SHA review before driver publication and remote readback. The human merges. Source and installed instructions do not prove scheduled observation, driver wake, or live activation; those require same-host native canary receipts.
+
 ## Optional native peer-review automation
 
 The optional native review manager runs at minutes `0,15,30,45`. Each
-scheduled pass uses a fresh finite session in a new isolated workspace, scans complete
+scheduled pass uses a fresh finite session in one dedicated existing workspace, scans complete
 discovery pages, and admits eligible actionable PR events within measured host
 capacity. Waiting PRs stay covered and consume no slot after
 owned descendants settle. Each job uses one repository-parented worktree; the
 manager never checks out PR branches in its own workspace.
 
-Every pass reconciles saved, GitHub, and native Orca state across all same-lane
-workspaces before admission. A
-confirmed same-lane manager makes the new duplicate do no work or shared-record
-write and close only itself. Normal teardown settles descendants, saves durable
-continuity and decisions outside disposable workspaces, then retires its own
-verified isolated pass workspace as the final action. It never bulk-closes a
-shared manager workspace or a PR-job worktree, or cleans preserved
-evidence, user sessions, unknown liveness, `user_takeover`, or ambiguous
-publication state. Manual review and user-driven `axstack-watch` remain outside
-this scheduled lifecycle.
-
-One natively ordered successor may recover an exact positively completed
-predecessor whose terminal survived, but only after matching its automation,
-run, workspace, and terminal incarnation and proving zero unsettled descendants.
-It saves and reads back the cleanup claim before exact native close, then proves
-the full process tree exited before ownership release or guarded worktree removal.
-Age, status, or idle state alone never authorizes cleanup. Conflicting successors,
-identity mismatch, unknown or protected state, `user_takeover`, unexpected
-terminals, dirty or unpushed work, and unarchived evidence hold cleanup; an
-unchanged failure is deduplicated. Native ordering is not an atomic lock, so the
-overlap canary remains an activation requirement.
-
-Each bounded job uses a private `0700` temporary directory inside its own
-worktree. Cleanup targets only the validated owned path: no `TMPDIR` globs,
+Every pass reconciles saved, GitHub, and native Orca state across the lane before
+admission. A confirmed same-lane manager makes the new duplicate do no work or
+shared-record write; it closes only its own exact terminal. The pass settles
+descendants,
+releases worker terminals, archives private evidence and reads it back, then
+uses `axstack-cleanup` guards to remove reviewer and PR-job worktrees. A merged
+or closed PR does not keep a clean job worktree waiting for a user decision.
+Dirty source, unpushed commits, `user_takeover`, unknown liveness, and ambiguous
+publication remain cleanup holds. The manager saves compact continuity, then
+closes its own exact terminal as the final action. Manual review and user-driven
+`axstack-watch` remain outside this scheduled lifecycle.
+
+Manager and job commands set `TMPDIR` to a private directory inside their owning
+workspace. Each bounded job uses a private `0700` directory. Cleanup targets
+only the validated owned path: no `TMPDIR` globs,
 shared-root sweeps, or general cache wipes, and uncertain files remain for
 reconciliation. Permission prompts and provider safety refusals are incomplete
 holds, never bypass or cross-model retry signals. The coordinator preserves the
@@ -238,7 +250,7 @@ relative contract and invokes `axstack-review`. Bounded jobs publish ordinary
 exact-head review verdicts; the human merges. Manual adopted-PR maintenance
 uses `axstack-watch` with local-SHA review before authorized publication.
 Exceptional security, permanent-on-chain, or architectural decisions remain actionable in GitHub or a durable user-owned conversation
-after manager self-close, with an authorized deduplicated Telegram notification.
+after the manager session ends, with an authorized deduplicated Telegram notification.
 The current operational contract is
 `skills/axstack/references/automations.md`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.20.14",
+  "version": "0.20.16",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -152,7 +152,7 @@
       "model": "claude-sonnet-5",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "low",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/codex-only.json

@@ -152,7 +152,7 @@
       "model": "gpt-6-sol",
       "modeId": "full-access",
       "thinkingOptionId": "low",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/profiles/presets/mixed.json

@@ -152,7 +152,7 @@
       "model": "claude-opus-5-5",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "medium",
-      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet."
+      "notes": "Optional independent read-only observer for a standalone PR watch. Reads GitHub, feedback, and checks, persists event IDs, and wakes the owner only for a new actionable event. Never sends, authors, reviews, replies, or acts as either reusable PR manager. Healthy snapshots stay quiet. Chat-run mode: one same-host native read-only observer per Run; fresh finite passes report precise deltas internally to the original Run/driver and may disable/read back only their own automation at verified stop. No repair, dispatch, public notification, or replacement coordinator. Effective scheduled model/effort and wake require live proof."
     },
     {
       "id": "axstack-auditor",

package/skills/axstack/references/automations.md

@@ -8,21 +8,18 @@ automation specs and plans describe retired designs and are not instructions.
 The review manager runs at minutes `0,15,30,45` and invokes
 [axstack-review](../../axstack-review/SKILL.md) for eligible peer reviews.
 
-Use a new isolated workspace for every scheduled pass, with one fresh finite
-manager session. Configure native repo-created worktree mode against the
-designated manager repository; never target an existing shared workspace.
-Do not use `--reuse-session`. The scheduler creates the pass workspace before
-launch; the manager must not move itself from a shared launch workspace.
-Keep lane continuity and evidence outside disposable manager workspaces at
-the configured durable absolute paths. A manager never checks out a PR branch
-in its pass workspace. Missed slots do not replay a backlog; the next ordinary pass
+Use one dedicated existing Orca workspace owned by this automation. Configure
+native existing-workspace mode with `--fresh-session`, never `--reuse-session`;
+each pass gets a fresh finite manager session. Keep lane continuity and evidence
+at configured durable absolute paths. A manager never checks out a PR branch
+in its workspace. Missed slots do not replay a backlog; the next ordinary pass
 discovers current state. The short packaged review prompt sits beside this file
 and discovers these rules by relative link instead of copying them.
 
 Provision one explicit absolute continuity path per automation ID in the
-scheduled prompt. Follow [Run record](run-record.md) for its contents; the
-repository's absolute Git common directory is a valid durable root, but a pass
-worktree is not. Missing or non-durable continuity configuration holds admission.
+scheduled prompt. The repository's absolute Git common directory is a valid
+durable root; missing or non-durable configuration holds admission. Keep
+continuity bounded and archive old pass history per [Run record](run-record.md).
 
 This is prompt policy, not proof that Orca starts a fresh session or prevents
 overlapping passes. Before activation a native canary must prove fresh-session
@@ -33,14 +30,14 @@ effects. A firing timestamp proves neither delivery nor useful completion.
 ## Session admission
 
 Reconcile saved state, current GitHub state, and native Orca Tasks, Dispatches,
-sessions, and liveness across all workspaces belonging to the same automation
-before discovery or admission; never infer lane ownership from an empty local
-workspace. Bind the lane to the automation ID and pass to its native run ID,
-workspace ID, and terminal identity, not a title or directory-name guess.
+sessions, and liveness across all workspaces belonging to the lane before
+discovery or admission; never infer lane ownership from an empty local workspace.
+Bind the lane to the automation ID and pass to its native run ID, workspace ID,
+and terminal identity, not a title or directory-name guess.
 A confirmed live manager for the same lane remains authoritative.
 The new duplicate does no PR work, makes no shared-record write, touches
-nothing owned by the live manager, and closes only itself as its final action
-by the same guarded isolated-workspace retirement below, not a tab-only close.
+nothing owned by the live manager, and closes only its own exact terminal as
+its final action under the guard below.
 Unknown liveness blocks admission and shared-record writes; it does not
 authorize takeover, cleanup, or a duplicate manager. Preserve `user_takeover`
 and other user-owned sessions.
@@ -54,66 +51,14 @@ Read every page of native runs, workers, and workspace inventory; truncated or
 failed inventory holds admission and cleanup rather than implying absence.
 
 A prior manager does not retain the lane merely because its automation run
-status says failed or dispatched. Require confirmed native process exit for its
-exact terminal incarnation, saved continuity, and settlement of all owned jobs
-and descendants before releasing its lane ownership. Absence or saved retirement
-intent alone is insufficient. Conversely a completed run row does not prove exit.
+status says failed or dispatched. Reconcile a surviving prior terminal using
+exact identity and proven completion from native state before treating it as
+live or releasing ownership. Require confirmed process exit for its exact
+terminal incarnation, saved continuity, and settlement of all owned jobs and
+descendants before ownership release. A completed run row alone does not prove exit.
 If these facts remain unknown, report the hold at the durable decision location;
 do not silently stand down forever or replace a potentially live owner.
 
-### Guarded completed-predecessor recovery
-
-A successor may retire a positively completed predecessor whose manager terminal
-survived only through this narrow recovery path. Eligibility requires an exact
-automation ID, run ID, workspace ID, and terminal incarnation match, a positive
-completion receipt bound to that incarnation, zero active or unsettled descendants,
-and every owned Task and Dispatch settled. A completed row or saved retirement
-intent alone is not positive completion. Age, status, and idle state are never
-cleanup authority. Active, unknown, protected, identity-mismatched,
-`user_takeover`, unexpected-terminal, permission-held, or otherwise unverifiable
-state preserves the predecessor and pauses admission; this path never takes over
-its PR work.
-
-Exactly one successor, selected by native run ordering, may write the cleanup
-claim. Immediately before writing, re-read the complete lane inventory and
-ordering; then save and read back claimant identity, predecessor identity,
-completion, and zero-descendant continuity before the exact native workspace
-close. A later successor reconciles that claim and performs no cleanup mutation.
-Missing ordering or a conflicting claim holds both cleanup and admission. This
-ordering is not an atomic lock; activation still depends on the overlap canary
-proving that two successors cannot both mutate one predecessor.
-
-Use the version-matched native workspace close against the receipt's complete
-workspace ID, never an individually guessed terminal or broad selector. After
-close, re-list native runs, workspaces, terminals, Tasks, and Dispatches and prove
-the full predecessor process tree exited before ownership release. Save and read
-back the exit and release receipts, then use native worktree cleanup only when the
-workspace has no children, dirty or unknown files, unpushed commits, unarchived
-evidence, or user-owned work. Preserve every failed or uncertain close, exit,
-release, or removal with its exact resume condition and pause the lane. An
-unchanged cleanup failure gets no destructive retry or duplicate notification.
-
-Before PR admission, reconcile old pass resources and reclaim every safely
-removable earlier pass workspace under the retirement guards below. This is
-routine cleanup on every admitted pass; do not wait for the three-workspace
-threshold to start cleanup. Save confirmed exit and ownership-release receipts
-before removing each workspace. Preserve dirty, unpushed, evidence-bearing,
-user-owned, active, or uncertain resources; the threshold never relaxes these guards.
-Explicitly classified evidence may cease to block cleanup only after the
-[private evidence archive](evidence-archive.md) is verified and its receipt is
-read back from durable continuity. This never makes other dirt disposable.
-After cleanup, re-list and count only the earlier pass workspaces still remaining.
-If three or more unreclaimed
-earlier pass workspaces remain, disable only this automation through the native
-CLI, verify the disabled setting, save/report the cleanup hold, and admit no new
-PR jobs. Also pause on a confirmed earlier-manager retirement failure or
-unresolved lane ownership. A settled PR-job worktree retained for evidence is a
-cleanup hold, not unsettled execution or lane ownership.
-Already-dispatched passes still reconcile and retire only their own safe resources;
-this threshold is a stop condition, not an atomic hard cap on in-flight creations.
-An uncertain disable is a reported failure, not proof scheduling stopped. Resume
-only after ownership/cleanup is verified and explicit activation authority exists.
-
 ## Discovery and coverage
 
 Resolve self on every tick with `gh api user --jq .login`; never hardcode the
@@ -172,14 +117,17 @@ pin the observed head and base. The bounded PR coordinator loads the
 review skill, launches only the reviewers that skill owns,
 handles the current actionable event, returns exact receipts, then settles.
 Settlement returns continuity to the manager rather than retaining an idle PR
-coordinator. Reviewers retain the isolation required by `axstack-review`.
-
-Give each job a private job-local temporary directory under its per-PR
-worktree, following the ownership, containment, and cleanup checks in the
-[runtime boundary](orca-runtime.md#reviewer-workspaces-and-evidence). Never
-delete through a broad `TMPDIR` glob, sweep a shared temporary root, or wipe a
-general cache. Preserve evidence and any temporary path whose ownership or
-containment is uncertain.
+coordinator. Reviewers retain the isolation required by `axstack-review`:
+each runs in a separate Orca child worktree, keeps its probes and evidence
+inside that worktree, and preserves required evidence before removal.
+
+Set `TMPDIR` for manager and job commands to a private directory inside each
+command's owning workspace. Follow ownership, containment, and cleanup checks
+in the [runtime boundary](orca-runtime.md#reviewer-workspaces-and-evidence).
+Never write temporary files under `/` or another shared root. Never delete
+through a broad `TMPDIR` glob, sweep a shared temporary root, or wipe a general
+cache. Preserve evidence and any temporary path with uncertain ownership or
+containment.
 
 An unchanged exact head and unchanged event identity creates no job; an
 unchanged exact head with a new event identity remains actionable. Event
@@ -220,12 +168,12 @@ hold, preserve the workspace, and let unrelated eligible PRs continue.
 
 An active, unknown, protected, or unverifiable coordinator or descendant is
 different: preserve its evidence and keep its slot occupied. Unresolved
-execution teardown, or failure to retire the manager pass itself, pauses the
-lane before another pass can admit work rather than accumulating active passes
-or claiming capacity from an uncertain process tree.
+execution teardown pauses the lane before another pass can admit work rather
+than claiming capacity from an uncertain process tree.
 
-When the current event is handled, settle and release owned native resources.
-Preserve dirty worktrees, unarchived review evidence, pending
+When the current event is handled, settle the PR job and descendants, then use
+native `worker-release` for their worker terminals. Preserve dirty source,
+unpushed commits, unarchived review evidence, pending
 external results, and user-owned work until durability and ownership are
 proven. Unknown liveness, `user_takeover`, and ambiguous publication likewise
 forbid cleanup. Here a pending external result means an unconfirmed review submission
@@ -233,12 +181,13 @@ or send outcome, not pending CI. Waiting state belongs in GitHub and the compact
 record, never in an idle model, per-PR timer, or polling loop.
 Follow the [private evidence archive](evidence-archive.md) when evidence is the
 only local state to preserve; archive success does not relax any other guard.
-For a completed PR-job, including one whose PR remains open, archive classified
-reviewer scratch through the [private evidence archive](evidence-archive.md),
-read back the archive and compact receipt, then follow
-[axstack-cleanup](../../axstack-cleanup/SKILL.md)'s exact-path guards to retire
-the reviewer checkout before merge. This does not release active jobs or manager
-pass workspaces.
+For a settled PR job, archive classified scratch through the
+[private evidence archive](evidence-archive.md), read back its archive and
+compact receipt, then use [axstack-cleanup](../../axstack-cleanup/SKILL.md)'s
+exact-path guards to retire reviewer and PR-job worktrees in the same pass.
+A merged or closed PR must never keep a job worktree waiting for a user decision;
+resolve that hold by archive and cleanup. Preserve genuine protections: dirty
+source, unpushed commits, `user_takeover`, unknown liveness, and ambiguous publication.
 
 ## Review authority
 
@@ -283,50 +232,23 @@ or separate model gate.
 ## Finite-session teardown
 
 After admission closes, settle every owned PR job and all descendants before the
-manager session ends; active or unknown descendants keep their PR slot occupied
-and must be reconciled rather than trusted from saved status. Then save durable
-continuity, evidence locations, pending receipts, and user decisions before
-self-close. Waiting PRs still occupy zero slots once their owned trees settle.
-
-Cleanup of PR-job setup shells stays scoped to positively identified owned unused
-setup shells: use the native exact-terminal close operation for each only.
-Preserve dirty worktrees, unarchived review evidence, user-owned
-terminals, unknown liveness, `user_takeover`, and ambiguous publication state.
-Never classify all dirt as evidence. If explicitly classified evidence is the
-last retention reason, apply and verify the [private evidence archive](evidence-archive.md),
-update durable continuity, and read it back before native retirement.
-Completed PR-job reviewer scratch uses axstack-cleanup after archive and readback;
-it never changes manager pass preservation or retirement guards.
-
-For the manager pass only, verify native run/workspace identity, exclusive
-automation ownership, no unsettled descendants, and a fresh terminal inventory
-containing only this manager and its proven unused setup shells. No other pass
-may target this workspace. If an unexpected terminal or user takeover is present,
-do not bulk-close; preserve the workspace and report the hold at its durable
-decision location. Never bulk-close a shared manager workspace or a PR-job worktree.
-
-After saving continuity, use the version-matched native workspace retirement:
-`terminal close --worktree id:<exact-native-workspace-id> --all --json`.
-Copy the complete ID from the run/workspace receipt; never use a name, branch,
-path-only selector, or `active` for this destructive operation.
-Self-close is the final action; perform no record write or cleanup afterward.
-A failed or uncertain close is not proof of retirement. The next admitted pass
-reconciles prior retirement from native state before trusting saved intent.
-Retire only positively identified completed pass resources; do not kill another
-live or unknown manager. Remove an old pass worktree only with native cleanup
-after terminal retirement is confirmed and it has no unpushed commits,
-unarchived evidence, children, user-owned work, unknown files, or unexplained
-dirty source. A verified evidence archive does not require otherwise clean Git
-state, but every remaining change must still be positively classified and safe;
-unknown dirt blocks removal. Never use recursive shell deletion. Failed cleanup
-remains recorded, not silently forgotten. Failed PR-job workspace cleanup stays
-a cleanup hold after execution settles; failed or unverifiable manager-pass
-retirement pauses the lane instead of allowing active passes to accumulate.
-
-The activation canary must additionally prove distinct workspace IDs per pass,
-cross-workspace lane admission, self-retirement and absence after client reconnect,
-and bounded retained worktrees over repeated passes. A shell-only close test does
-not prove agent resume-record retirement. Do not activate on source checks alone.
+manager session closes; active or unknown descendants keep their PR slot occupied
+and must be reconciled from native state. Release settled worker terminals and
+complete guarded evidence archival and worktree cleanup in this pass. Save
+continuity, open decisions, and the last pass summary and read back the save.
+Use the exact native terminal close for this pass's own terminal from its run
+receipt: `orca terminal close --terminal <exact-handle> --json`. Terminal close
+is the final action. Never use `--all`, a broad or name selector, or another
+terminal in the dedicated workspace; uncertain identity or close outcome holds
+the lane for native reconciliation, never a guessed retry.
+Waiting PRs still occupy zero slots once their owned trees settle. A failed
+cleanup remains a recorded hold with its exact resume condition, but does not
+keep settled execution active.
+
+The activation canary must prove fresh sessions in the dedicated workspace,
+same-lane overlap admission, recovery after session loss, nested dispatch depth,
+process and memory effects, and terminals in the dedicated workspace bounded
+over repeated passes. Do not activate on source checks alone.
 
 ## Recovery and limits
 

package/skills/axstack/references/candidate-publication.md

@@ -29,3 +29,14 @@ its required checks complete. Review may run in parallel with CI only after the
 remote confirmation. Reviewers inspect a detached immutable checkout of the
 confirmed candidate SHA and pinned base, never only the movable branch name.
 Any author repair creates a new revision and repeats this boundary.
+
+## Immutable checkout shape
+
+The immutable checkout is an Orca worktree of the already-registered repo:
+`ORCA worktree create --repo id:<repoId> --name review-<pr>-<sha7> --json`,
+then `git checkout --detach <candidate SHA>` inside it. Never materialize it
+as a `git clone` into a temp directory followed by `orca repo add`; each
+`repo add` registers a duplicate top-level repo and leaves a stale record once
+the directory is gone. Release preparation uses a `release/<version>` worktree
+of the same registered repo the same way. Release the checkout with
+`ORCA worktree rm` after its receipt is recorded.