axstack 0.20.20 → 0.20.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.20.20",
+  "version": "0.20.21",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks Orca capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/lifecycle.md

@@ -56,7 +56,7 @@ Only an explicit user request to transfer ownership enters this branch.
    prior owner seeing a different valid accepted owner stops.
 
 Complete record: goal, authority, intent, IDs, revisions, evidence, pending
-receipts/timers, unresolved decisions, next action, and transfer ownership/gap.
+receipts/timers, unresolved decisions, next action, and transfer status.
 
 ## Receipts (bind each decision to evidence)
 
@@ -87,8 +87,8 @@ covers only ordinary reading, writing, and local checks. Heartbeat deliveries
 are acknowledged with no user-facing text. Process each whole delivery before
 acknowledgment and validate its Task, Dispatch, sender, authority, revisions,
 and receipts before advancing the run record. Duplicate deliveries are
-deduplicated by runtime identity. Healthy unchanged observations produce no
-user-facing update. After accepting worker, Task, or Run completion, the driver
+deduplicated by runtime identity. Healthy unchanged passes are silent.
+After accepting worker, Task, or Run completion, the driver
 invokes [axstack-cleanup](../../axstack-cleanup/SKILL.md) inline; it never
 dispatches cleanup work.
 
@@ -99,8 +99,8 @@ session liveness, delivery, and verified advancement are distinct evidence.
 On `consumer_fenced`, reconcile the active coordinator rather than borrowing an
 identity. Respect settlement protection including `user_takeover`.
 
-No execution heartbeat or substitute scheduler is created by Axstack. Native
-review automation follows [Review automation health](#review-automation-health).
+Axstack creates no execution heartbeat or substitute scheduler. See
+[Review automation health](#review-automation-health).
 Tracking grants no merge, release, model-substitution, or scope authority.
 
 ## Deadline (one rule for every owned timer)
@@ -131,15 +131,16 @@ nothing without tested independent review.
 
 ## Close-out
 
-PRs merge by forge state—not branch ancestry; close out: (1) settle every worker
+PRs merge by forge state; close out: (1) settle every worker
 terminal; (2) compact record with counts and denominators—user
 interventions/deviations from plan/repairs; (3) `axstack-auditor`: settle
 non-zero/requested, else `counts zero`; an unavailable auditor leaves close-out
 pending, never skipped silently; (4) release merged run worktrees and branches;
-use `axstack-cleanup` and close selected external-tracker tickets when applicable;
+use `axstack-cleanup`, remove the run's own automations under
+[Workspace hygiene](workspace-hygiene.md), and close selected external-tracker tickets;
 (5) mark the
 [Run record](run-record.md) `Archived`. `Archived`—one each:
 settlement receipt; compact record path; auditor decision plus settlement
-receipt or `counts zero`; release and ticket receipts; archive timestamp.
+receipt or `counts zero`; automation, release, and ticket receipts; archive timestamp.
 `active`/receipt-incomplete record: close-out pending, never done. One-step
 lookups exempt.

package/skills/axstack/references/workspace-hygiene.md

@@ -33,8 +33,8 @@ and Dispatch decides; parent/child display lineage does not. The creator closes
 what it created at ordinary settlement; the cross-run sweep below may retire
 its settled leftovers. A finite scheduled pass closes only its own exact terminal as
 its final action. Manual chats, automation dedicated workspaces, and genuine
-`user_takeover` sessions are never removed. Deleting a session means closing
-its terminal; agent chat history is not deleted.
+`user_takeover` sessions are never removed by ordinary settlement or sweep.
+Deleting a session means closing its terminal; agent chat history is not deleted.
 
 If native exact terminal close returns `runtime_error` for a provably finished
 agent, send `/quit` + Enter to that exact terminal, wait about 5 seconds, then
@@ -45,6 +45,30 @@ leaves its terminal for the next pass, without treating that expected failure
 as a hold. At pass start, clear only provably finished predecessor terminals
 of the same automation in its dedicated workspace by this exact-handle path.
 
+## Owned automation retirement
+
+At Close-out, reconcile the run record with native inventory: the recorded
+owning Run must have created the exact automation IDs selected for retirement.
+The sweeping pass uses that recorded owning Run, not its own Run, for cross-run
+watches. A cross-run sweep may retire a disabled per-run watch only when its
+owning run is closed or every watched PR is merged or closed. Uncertain recorded
+ownership, watch state, or disable result holds the affected automation.
+
+For each eligible automation, disable it and verify native readback before
+`orca automations remove <id>` on its exact ID, and verify absence by native
+readback. The observer only disables and reports; the driver removes its own
+run's automation. Only a retired owned per-run watch's workspace may be removed
+under these guards. Never remove the durable review manager and its dedicated
+workspace or a user-created automation and its dedicated workspace.
+
+Remove that dedicated workspace only after confirming its exact ownership, no
+live terminal, a clean worktree, and a head on the remote. Recheck ownership and
+liveness immediately before workspace removal. If dirty or unpublished, use the
+salvage and bundle verification below before removal; failed verification or
+uncertain liveness is a hold. The current scheduled pass cannot remove its own
+workspace while its terminal is live; the driver or a later sweep finishes that
+step. Record separate automation and workspace receipts.
+
 ## Preserve before removal
 
 Workers write reports, probes, logs, evidence, and scratch to the private

package/skills/axstack-watch/SKILL.md

@@ -137,8 +137,9 @@ observed state distinct from merged, and the human merges by default.
 ## 6. End and preserve continuity
 
 End a chat-run watch only after all members merged or closed or user
-cancellation, with own-automation disable/readback and driver-owned cleanup
-receipts in [Watch runtime](references/watch-runtime.md#chat-run-watch).
+cancellation, with own-automation disable/readback and driver-owned automation
+removal and workspace cleanup receipts in
+[Watch runtime](references/watch-runtime.md#chat-run-watch).
 
 End a standalone watch early when all required PRs merge, at cancellation, or
 at its shared default 24 h deadline. In every case, stop all owned

package/skills/axstack-watch/references/watch-runtime.md

@@ -10,7 +10,10 @@ A standalone PR owner remains accountable through the default 24-hour window.
 current GitHub state, persists event IDs, wakes the owner only for a new
 actionable event, and never sends or mutates. Healthy observations update
 quietly. Reuse prior watch identity rather than registering a duplicate, and
-stop task-owned registrations at completion, cancellation, or expiry.
+stop task-owned registrations at completion, cancellation, or expiry. The owner
+must disable and read back its own automation, then remove it by exact ID under
+[Workspace hygiene](../../axstack/references/workspace-hygiene.md#owned-automation-retirement).
+Remove its dedicated workspace only after the terminal and preservation guards pass.
 
 ## Chat-run watch
 
@@ -109,8 +112,11 @@ Stop only when all members merged or closed, or on user cancellation recorded
 by the driver in the run record. Re-read membership and confirm no ambiguous
 publication or unsettled pass; cancellation
 prevents new work but does not prove running workers exited. The observer may
-disable only its own automation and must verify native disable/readback. A
-failed or uncertain disable is a hold. Report the stop receipt to the driver.
+disable only its own automation and must verify native disable/readback. A failed
+or uncertain disable is a hold. Report the stop receipt to the driver; the
+driver removes the automation by exact ID, verifies absence, and removes the
+dedicated workspace after the observer terminal closes under
+[Workspace hygiene](../../axstack/references/workspace-hygiene.md#owned-automation-retirement).
 The driver separately settles workers, preserves evidence, and archives the run;
 an unavailable driver leaves those steps pending. The standalone 24-hour expiry
 and peer observation contracts are unchanged.