axstack 0.20.29 → 0.20.31

package/skills/axstack/references/autopilot.md

@@ -0,0 +1,108 @@
+# Autopilot
+
+This reference applies to authorized engineering-delivery runs. The original
+driver remains the sole run-record writer and phase router in the same chat;
+phase completion is not a native ownership handoff. Explicit planning-only,
+read-only, stop-after-phase, observation-only, and peer requests retain their
+selected boundary. A status question such as "what's left" is observation,
+not a mode change.
+
+## Advance and hold
+
+Advance only after the finishing phase returns its completed identity (a
+small-change intent, approved spec, matching ticket map, merge-ready or merged
+state) and the run record has no open hold. A hold from any phase stops the run:
+record its reason, owner, and resume condition, then take no dependent action.
+That covers tracker access, adviser or arena-seat availability, diligence
+FINDINGS when the phase records a hold, CI-wait timeout, readiness UNKNOWN,
+dismissed approval, wake or cleanup uncertainty, single-provider routing, an
+existing tag or version, and failed publish. Diligence FINDINGS during implement
+follow its §6 repair route; at spec, tickets, or release preparation the driver
+resolves them before advancing, and only a recorded hold pauses autopilot.
+
+Record `Autopilot: on | paused (<hold>; resume: <condition>) | off (cancelled
+<ts>)` and the next step in the private run record. A user answer to the hold
+resumes after reconciliation; silence does not.
+Awaiting human spec approval records `Autopilot: paused (spec approval; resume:
+human approval)` as a decision hold eligible under the Notification policy.
+
+## Phase sequence
+
+- Small: Align read-back, small-change intent, implement, watch in maintain
+  mode, human merge. An opted-in Align refinement is part of read-back.
+- Substantial: Align, spec draft with advisers and diligence, human spec
+  approval at gate 1, tickets with diligence, implement, watch in maintain mode,
+  merge-ready, human merge. An opted-in Align refinement is part of gate 1.
+
+Do not seek another phase-start instruction after a completed identity.
+Spec approval is always the human's decision. Every PR merge is the human's,
+including a release PR and each PR in a stack, bottom-up.
+
+## Implement into maintain watch
+
+When implement publishes the run's first PR, arm exactly one `axstack-watch`
+chat-run in authorized maintain mode. Use the 10-minute harness wake, with the
+existing Orca fallback when unavailable. Later run PRs join after verified
+publication readback; an explicitly adopted PR joins only with its maintenance
+snapshot. The original driver alone routes work; one author writes each
+candidate. Until a PR is merge-ready, wakes feed implement §6 step 4. After
+merge-ready, watch §5 maintenance repairs feedback, rebases when the base moves,
+keeps CI green, and checks approvals without re-requesting human review.
+
+Maintain is the default mode for run-created PRs. End the chat-run watch when
+every watched PR is merged or closed and the run's release step is settled or
+not applicable, or when the user cancels. Expiry is a recorded stop with
+resumable state, never a silent renewal. A required PR closed without merging
+is incomplete scope; it does not make the run release-eligible. On wake expiry
+record `Autopilot: paused (wake expired; resume: user reauthorizes a wake)` and
+notify under the recorded Notification policy when user action is needed.
+
+## Release and install, when applicable
+
+Detect applicability once at Align or spec time. Record `Release: <AGENTS.md
+file:line + tag-triggered workflow path + named install hosts> | not applicable
+(<reason>)`. The predicate is an AGENTS.md release rule naming an existing
+tag-triggered workflow. A partial match is not applicable and its reason is
+noted. Install hosts come only from explicit targets; an absent host list is a
+decision hold, not permission to infer hosts. A missing install host list at
+Align or spec time is a decision hold before release authority is presented.
+
+Show the `Release:` line in the spec for human approval at gate 1, or the small
+work Align read-back. Copy that decision to `Authority:` in the run record.
+This authority is per run and never carries over to another run or repository.
+The small-work Align read-back names the existing Release and host-mutation
+authority and explicit hosts; silence cannot fill a missing authority or target.
+
+After all required feature PRs merge, open one release PR. Default to a patch
+version, or minor if a `feat` commit landed since the last tag. This normal run
+PR gets authored review and diligence of its body against merged PRs, reaches
+merge-ready, then waits for human merge. Once the forge confirms that merge,
+tag and wait for the staged publish. Human npm stage approval is a decision
+hold: agents never run `npm stage approve`. A wake verifies the registry reports
+the expected package and version. Install on the named hosts, verify version
+and roles, then run Close-out last with release and install receipts and the
+installed version.
+
+An existing version or tag, failed publish, pending approval, uncertain
+registry result, missing host access, or failed install verification is a
+resumable hold, never success. Tagging, publishing, installation, and host
+mutation require the recorded per-run authority and their existing checks.
+
+## Resume, cancel, and notify
+
+At every entry (user message, wake, compaction, or new chat), reconcile the
+owner, authoritative Dispatch, approved revision, PR membership, uncertain
+tags, wakes, publications, and completed receipts under lifecycle and
+run-record before advancing. Only the original driver advances. Wakes do not
+reset attempt budgets and do not grant approvals. Cancel sets `Autopilot: off`,
+stops new actions, and ends the watch under watch §6 with guarded settlement.
+Cancellation does not cancel a running author Dispatch by inference; let it
+report, then settle that exact Dispatch under lifecycle guards without new
+publication.
+
+Use the run's recorded Notification policy through `axstack-relay`.
+Decision holds, including spec and npm approval, are always eligible. Across
+implementation and release, merge-ready and merged notifications together are
+capped at two per run; deduplicate by purpose and revision. Healthy ticks stay
+quiet. A failed or uncertain delivery preserves the underlying hold. A relay
+message is only a notification, never authority to approve, merge, or publish.

package/skills/axstack/references/candidate-publication.md

@@ -6,6 +6,11 @@ Within recorded PR-scoped publication authority, the owner reconciles that
 receipt against the actual local candidate SHA and base. The owner does not edit
 the author's candidate; required code changes return to the author.
 
+Before publication, dispatch `axstack-diligence` under
+[Diligence](diligence.md) to check the author receipt against its evidence
+folder: red/green logs exist, and counts, SHAs, and paths match. Resolve
+`FINDINGS` with the same author before publishing.
+
 Publish the existing commits through `gh stack`. Prefer a fast-forward push.
 Before a history rewrite, confirm the expected-old remote SHA and use lease
 protection; a mismatch holds publication. If the push outcome is ambiguous,
@@ -40,3 +45,7 @@ as a `git clone` into a temp directory followed by `orca repo add`; each
 the directory is gone. Release preparation uses a `release/<version>` worktree
 of the same registered repo the same way. Release the checkout with
 `ORCA worktree rm` after its receipt is recorded.
+
+For a release PR, dispatch `axstack-diligence` under
+[Diligence](diligence.md) to check the release PR body
+against the merged PRs before publication.

package/skills/axstack/references/contracts.md

@@ -40,7 +40,11 @@ Validate the configured provider and model at actual launch. If it is
 unavailable or exhausted, pause affected work, record the gap, and ask the
 user. Never infer a route from quota state or subscription entitlement. Every
 substitution requires the user's decision: configured alternatives and native
-fallback prose are not defaults.
+fallback prose are not defaults. The only within-class exception is explicit
+model rejection before the first turn: Codex may retry with `--retry-of` using
+the next eligible version in the same class, provider, and effort, recording
+the failed ID, error, and fallback ID. Claude rejection holds. Timeout, quota,
+and auth failures hold.
 
 ## Driver and adviser split
 

package/skills/axstack/references/diligence.md

@@ -0,0 +1,23 @@
+# Diligence
+
+Dispatch `axstack-diligence` through Orca with a pinned brief and evidence paths.
+It is read-only, never authors or edits, and returns `PASS` or `FINDINGS`
+with locations, observed evidence, and limits. A stale or missing receipt is
+not a pass. Keep its first pass independent of other reviewers and workers.
+
+For a PR, compare every changed line with the accepted intent and exclusions:
+is it intended and in scope? Check that no contract, rule, or obligation was
+silently weakened or dropped by rewording. Compare the PR body, commit messages,
+and author receipt with the diff: numbers, IDs, versions, test counts, sizes,
+paths, and stale references. Bind the result to the exact head and base.
+
+For research, reopen cited sources for answer-changing claims before the
+driver folds verified claims. For a draft spec, compare it with Align decisions
+before user approval: flag anything dropped, added, or softened. For tickets,
+map every spec acceptance item to a capability's acceptance. Before candidate
+publication, compare the author receipt with its evidence folder: red/green
+logs exist, and counts, SHAs, and paths match. For release preparation, compare
+the release PR body with the merged PRs.
+
+`FINDINGS` identifies a mismatch for the driver to resolve at the owning phase;
+it does not edit the artifact or create another review round by itself.

package/skills/axstack/references/lifecycle.md

@@ -107,8 +107,8 @@ Tracking grants no merge, release, model-substitution, or scope authority.
 
 The default 24-hour deadline covers standalone task-owned timers. Stop them at
 deadline and preserve remaining work; the review automation has no task-owned
-deadline. A PR is merge-ready only with the applicable review receipt(s) at
-its exact head; green CI or tests alone never make it merge-ready. Merge-ready
+deadline. Merge-ready requires applicable review receipt(s) and current diligence
+`PASS` at the exact head; CI/tests alone are insufficient. Merge-ready
 differs from merged; human merges.
 
 ## Review automation health

package/skills/axstack/references/orca-runtime.md

@@ -38,23 +38,42 @@ Read `roles.json` from the installed shared root `skills/axstack/`. The installe
 shape is `{ "version": 1, "preset": "<name>", "roles": [...] }`. Bundled
 profiles are setup inputs shaped as
 `{ "version": 1, "roles": [...] }`. A new run records the selected preset and
-all 28 role rows once. An active run keeps the exact snapshot until the user
-explicitly changes it.
-
-Select the requested role by stable ID. A missing or null model holds only that role;
-never launch a provider default. Launch-by-agent-id routes for which Orca exposes no
+all 32 role rows once. For each role record class, resolved exact ID, source,
+and time. An active run keeps the exact snapshot; resume reuses it without
+re-resolution until the user explicitly changes it.
+
+Select the requested role by stable ID. A missing class and missing or null
+model holds only that role; never launch a provider default. Resolve Codex
+classes with `scripts/resolve-models.js`, passing the catalog path explicitly;
+missing or malformed catalogs hold. The first launch of each Claude class uses
+its alias. Read the exact ID from the first assistant turn's `message.model` in
+that worker's own session transcript at
+`~/.claude/projects/<worktree-path-slug>/*.jsonl`; the worktree path slug
+replaces each non-alphanumeric character with `-`. Identify the file by the
+worker's session ID, or use the newest file created after launch. Later launches
+of that class use the recorded exact ID. Before read-back record `alias,
+unresolved`; record an unknown read-back as unknown and hold
+provenance-dependent work. A worker self-report is a labeled last
+resort. Launch-by-agent-id routes for which Orca exposes no
 `--model` override (today: `grok`, `antigravity`) record `model: null` with an explicit note and are
 launchable; the run record snapshots the model the TUI reports. Validate provider, model, and effort
 against the guide and actual launch capability. Stored `modeId` and other
 permission fields are conservative intent, not proof of effective permission
 parity or a security boundary. Requested settings, input acceptance, effective
 settings, and completed work are separate evidence. An unsupported or
-unavailable value holds affected work for the user's decision without fallback.
+unavailable value holds affected work for the user's decision except the narrow
+retry below.
 The single-provider preset's null adviser and round-2 seat are intentional installation data, not
 readiness failure; because Align and Spec require both adviser receipts, either
 null adviser still holds those phases. The current chat is the driver and has
 no role row in any preset.
 
+Only explicit model rejection before the first turn permits a Codex
+`--retry-of` with the next eligible ID in the same class, provider, and effort.
+Fence the rejected Dispatch and record tried ID, error, and fallback ID in the
+snapshot and reply. Timeout, quota, auth, and other failures hold; Claude
+rejection holds. Apply this to every role, including advisers and judges.
+
 ## Materialize checkouts as worktrees of the registered repo
 
 Every reviewer, release, or worker checkout is `ORCA worktree create --repo

package/skills/axstack/references/role-roster.md

@@ -0,0 +1,37 @@
+# Role roster
+
+- Chat drives (no role ID); `axstack-owner` owns one PR and
+  `axstack-author` its sole writer.
+- `axstack-reviewer-primary` and `axstack-reviewer-secondary` are the ordered
+  peer pair. Peer review uses both; authored review uses this table:
+
+  | Preset | Author class | Reviewer (class/effort) |
+  | --- | --- | --- |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
+  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+  | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
+- `axstack-advisor-astra`/`axstack-advisor-opus` advise and author candidates;
+  `axstack-arena-candidate-grok`/
+  `axstack-arena-candidate-antigravity` add families.
+  `axstack-arena-judge-opus` judges round 1; `axstack-escalation-fable`/`axstack-arena-judge-astra` judge round 2.
+  High-stakes/trigger: fresh [contract](contracts.md) session.
+  `axstack-auditor` audits; `axstack-checker` reports discrepancies.
+- `axstack-explainer`/`axstack-explainer-review`: explain/review.
+- `axstack-diligence`: read-only [diligence checks](diligence.md) for every PR
+  review round and bounded research, spec, ticket, receipt, and release claims.
+- `axstack-ui-verifier`: [UI checks](ui-verification.md).
+- `axstack-auditor`/`axstack-research-requirements`/
+  `axstack-research-code`/`axstack-research-web`/
+  `axstack-explore-execution`/`axstack-monitor`:
+  `claude/sonnet` high in mixed/claude-only.
+  `axstack-monitor`: standalone watch never sends; chat-run watch: bounded
+  internal reports to its Run and original driver.
+- Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
+  `axstack-explore-execution-sol`: `codex/sol` high in
+  mixed/codex-only; intentionally absent in claude-only. Dispatch each
+  independently from its Sonnet seat on the same bounded brief without
+  cross-reading. The driver reconciles findings per claim, never averages.
+  Record intentional absence and continue with Sonnet alone; a configured
+  but unavailable seat holds only its affected work.
+- `axstack-debug-investigator-1..4` probe L1 briefs.

package/skills/axstack/references/routing.md

@@ -11,45 +11,33 @@ skills root, or an explicit user selection in the run record. Missing or contrad
 a setup gap: hold. Never infer from live profiles or `list_profiles`, harness,
 tools, credentials, quota, subscription, or default to `mixed`.
 
-At start, snapshot all 28 role IDs with provider/model/mode/effort; absent
+At start, snapshot all 32 role IDs with provider/modelClass/model/mode/effort; absent
 or unconfigured roles are recorded explicitly; never default.
 Such a role holds only its work. Later installed or changed roles need an
 explicit user decision to enter the snapshot. Live profiles
 are authoritative at snapshot time and for availability; bundled presets are setup
 inputs, not runtime proof.
+For each role record class, resolved exact ID, source (catalog, transcript, or
+pin), and time. Codex classes resolve through
+`skills/axstack/scripts/resolve-models.js` with an explicit catalog
+path; missing or malformed catalog holds. Claude classes start as `alias,
+unresolved` until transcript read-back. Resume must reuse the snapshot and
+never re-resolve it.
 
 Preset changes apply to new runs only; an active run keeps its snapshot.
 Changing it or replacing a session needs an explicit user decision and
 revalidation. Unavailable models, efforts, roles, or overrides hold only affected
 work; no automatic fallback, quota routing, subscription inference, or silent
-provider/model/effort substitution.
-
-- Chat drives (no role ID); `axstack-owner` owns one PR and
-  `axstack-author` its sole writer.
-- `axstack-reviewer-primary` and `axstack-reviewer-secondary` are the ordered
-  peer pair. Peer review uses both; authored review uses this table:
-
-  | Preset | Author | Reviewer (model/effort) |
-  | --- | --- | --- |
-  | `mixed` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`claude/claude-opus-5-5` medium) |
-  | `mixed` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-primary` (`codex/gpt-6-sol` high) |
-  | `codex-only` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`codex/gpt-6-luna` xhigh) |
-  | `claude-only` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-secondary` (`claude/claude-sonnet-5-5` high) |
-- `axstack-advisor-astra`/`axstack-advisor-opus` advise and author candidates;
-  `axstack-arena-candidate-grok`/
-  `axstack-arena-candidate-antigravity` add families.
-  `axstack-arena-judge-opus` judges round 1; `axstack-escalation-fable`/`axstack-arena-judge-astra` judge round 2.
-  High-stakes/trigger: fresh [contract](contracts.md) session.
-  `axstack-auditor` audits; `axstack-checker` reports discrepancies.
-- `axstack-explainer`/`axstack-explainer-review`: explain/review.
-- `axstack-ui-verifier`: [UI checks](ui-verification.md).
-- `axstack-research-requirements`/`axstack-research-web`/`axstack-monitor`:
-  Sonnet 5.5 high in mixed/claude-only.
-  `axstack-monitor`: standalone watch never sends; chat-run watch: bounded
-  internal reports to its Run and original driver.
-- `axstack-debug-investigator-1..4` probe L1 briefs.
-
-Provenance is matched on provider/model ID; effort never maps. Missing table-row
+provider/model/effort substitution. Only
+explicit model rejection before the first turn permits Codex `--retry-of` with
+the next eligible ID in the same class, provider, and effort. Fence the failed
+Dispatch and record tried ID, error, and fallback ID in the snapshot and reply.
+Timeout, quota, auth, and other failures hold; Claude rejection holds.
+
+Load the [Role roster](role-roster.md) for configured roles and authored-review pairings.
+
+Provenance is matched on provider/model class derived from the recorded exact ID;
+effort never maps. Missing table-row
 provenance is unsupported and `INCOMPLETE`; report it and ask the user. Never
 infer from slot, driver, owner, or provider. Author and owner never review.
 
@@ -98,7 +86,7 @@ reason in the run record, or in the brief for tiny direct work.
   Require an approved spec plus a ticket map tied to that exact spec
   revision, with acceptance checks and dependencies in the explicitly selected
   Markdown, GitHub Issues, or Linear store. Prepare via `axstack-align` -> `axstack-spec`
-  (one approval) -> `axstack-tickets` -> handoff, then stop.
+  (one approval) -> `axstack-tickets` -> handoff, then continue under autopilot when eligible.
 - **Small:** clear, bounded one-PR work. The driver captures the named
   **small-change intent** from the current request or user-chosen existing
   issue plus explicit acceptance checks and exclusions, snapshots it once, and
@@ -119,7 +107,7 @@ not alone a formal spec trigger. Hold affected unsafe work while reassessing.
 ## Lifecycle routes (mode-specific scope identity required)
 
 - Preparation: substantial work follows the align -> spec -> tickets ->
-  handoff path above, then stops; small work uses the driver-captured
+  handoff path above, then continues under autopilot when eligible; small work uses the driver-captured
   small-change intent.
 - Execution: with its identity present, `axstack-implement` ->
   `axstack-review` -> `axstack-watch`.

package/skills/axstack/references/run-record.md

@@ -151,6 +151,8 @@ Authority: <who authorized which mutation>
 Intent: <approved spec rev | small-change intent | adopted snapshot | peer/read-only mode>
 Routing: <preset + source + snapshot ref>
 Notification policy: <none | transport/target label/host/instructions path>
+Autopilot: on | paused (<hold>; resume: <condition>) | off (cancelled <ts>); next: <step>
+Release: <AGENTS.md file:line + tag-triggered workflow path + named install hosts> | not applicable (<reason>)
 Source base: <exact revision or source identity>
 IDs: <repo/project + workspace/agent receipt pointers>
 Worktrees in other repositories: <per-run repository and worktree IDs or none>

package/skills/axstack/scripts/resolve-models.js

@@ -0,0 +1,46 @@
+import { readFileSync } from 'node:fs';
+
+const args = process.argv.slice(2);
+const option = (name) => {
+  const index = args.indexOf(name);
+  return index < 0 ? null : args[index + 1];
+};
+const path = option('--catalog');
+const modelClass = option('--class');
+const effort = option('--effort');
+
+try {
+  if (!path || !['astra', 'sol', 'luna'].includes(modelClass) || !effort) {
+    throw new Error('expected --catalog path --class astra|sol|luna --effort level');
+  }
+  const catalog = JSON.parse(readFileSync(path, 'utf8'));
+  if (!Array.isArray(catalog.models) || typeof catalog.client_version !== 'string'
+    || typeof catalog.fetched_at !== 'string') {
+    throw new Error('malformed catalog');
+  }
+  const classPattern = new RegExp(`^gpt-(\\d+(?:\\.\\d+)*)-${modelClass}$`);
+  const candidates = catalog.models
+    .filter((entry) => entry && entry.visibility === 'list'
+      && typeof entry.slug === 'string'
+      && classPattern.test(entry.slug)
+      && Array.isArray(entry.supported_reasoning_levels)
+      && entry.supported_reasoning_levels.some((level) => level?.effort === effort))
+    .map((entry) => entry.slug)
+    .sort((left, right) => {
+      const a = left.slice(4, -(modelClass.length + 1)).split('.').map(Number);
+      const b = right.slice(4, -(modelClass.length + 1)).split('.').map(Number);
+      for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const difference = (b[i] ?? 0) - (a[i] ?? 0);
+        if (difference) return difference;
+      }
+      return 0;
+    });
+  if (!candidates.length) throw new Error(`no eligible ${modelClass} model in catalog`);
+  console.log(JSON.stringify({
+    provider: 'codex', modelClass, effort, model: candidates[0], candidates,
+    catalog: { path, client_version: catalog.client_version, fetched_at: catalog.fetched_at },
+  }));
+} catch (error) {
+  console.error(`model catalog resolution hold: ${error.message}`);
+  process.exitCode = 1;
+}

package/skills/axstack-align/SKILL.md

@@ -5,6 +5,9 @@ description: When exploring or planning engineering work, use axstack-align to s
 
 # Align
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 On driver entry, sweep under [Workspace hygiene](../axstack/references/workspace-hygiene.md); dispatched workers do not sweep.
 For every dispatch brief, name its private `<run dir>/evidence/<dispatch>/` folder.
 
@@ -166,7 +169,7 @@ record or spec. Read-only scope keeps proposed documentation in the permitted
 private record or response. Documentation is neither implementation nor spec
 approval; record chosen document names and paths once per run.
 
-## Read back, classify, and stop
+## Read back, classify, and route
 
 1. Read back the decisions, constraints, exclusions, and remaining evidence
    gaps. For substantial work, this summary becomes part of the draft spec in
@@ -189,6 +192,7 @@ approval; record chosen document names and paths once per run.
    [Orca runtime](../axstack/references/orca-runtime.md) immediately before
    actual dispatch. Alignment completion never dispatches a recipient.
 
-Alignment stops for both sizes only when the handoff is usable, its next scope
-identity is explicit, and execution has not started. The user invokes
-`axstack-implement` to execute.
+Alignment completes for both sizes only when the handoff is usable and its next
+scope identity is explicit. An eligible delivery run continues under Autopilot;
+an explicit stop-after-Align request ends here. Substantial work continues to
+Spec, and small work continues from its small-change intent to Implement.

package/skills/axstack-audit/SKILL.md

@@ -28,8 +28,13 @@ immediately before an actual auditor profile or session dispatch. Ordinary
 audit reading and record writing do not load it, and the auditor never
 dispatches.
 
-Core owns the `axstack-auditor` profile (codex/gpt-6-luna xhigh) and its
-invocation. This skill governs what that auditor reads, measures, and proposes.
+Core owns the `axstack-auditor` profile (claude/sonnet high in
+mixed/claude-only; codex/luna xhigh in codex-only) and its invocation.
+This skill governs what that auditor reads, measures, and proposes.
+Dispatch `axstack-auditor` and `axstack-auditor-sol` independently on the same
+bounded brief, without cross-reading. The driver reconciles findings per claim;
+never average verdicts. Record an intentionally absent Sol seat and continue
+with the base auditor alone; a configured but unavailable seat holds its work.
 The user-chosen improvement mode is a tested, independently reviewed PR that a
 human merges.
 
@@ -86,6 +91,14 @@ counts with denominators plus the evidence behind the count:
   evidence path is absent, or `UNKNOWN` with the reason when its records are
   unavailable.
 - Independent exact-revision review status and unresolved findings.
+  For authored PRs, measure the selected reviewer against this class pairing:
+
+  | Preset | Author class | Reviewer (class/effort) |
+  | --- | --- | --- |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
+  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+  | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 - Simplification applicability determinations evidenced / total candidate diffs,
   and complete simplification receipts / total candidates, broken down as
   `applied`, `not-applicable`, or `UNKNOWN` with the reason. This measures

package/skills/axstack-implement/SKILL.md

@@ -5,6 +5,9 @@ description: When an approved task is ready to build or repair, use axstack-impl
 
 # Implement
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 On driver entry, sweep under [Workspace hygiene](../axstack/references/workspace-hygiene.md); dispatched workers do not sweep.
 For every dispatch brief, name its private `<run dir>/evidence/<dispatch>/` folder.
 Include [Safe deletion](../axstack/references/workspace-hygiene.md#safe-deletion) in author briefs.
@@ -206,27 +209,43 @@ For each PR:
    `REQUEST_CHANGES`, a failed required check, or post-readiness feedback returns
    findings to the same author for a new revision, increments `repairs`, and
    returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model, serious
-   risk, or the third `REQUEST_CHANGES` on one PR records `held`. A changed
-   parent sends its child back to step 1.
+   risk, or the third review round with `REQUEST_CHANGES` and/or diligence
+   `FINDINGS` on one PR records `held`. A changed parent sends its child back
+   to step 1.
+   Merge-ready also requires a current diligence `PASS` at that head; diligence
+   `FINDINGS` return to the same author within the review round.
+   A round with reviewer `REQUEST_CHANGES` and/or diligence `FINDINGS` increments
+   `repairs` once and counts once toward the third-round hold.
 
 One run-level completion wait covers every unsettled Dispatch; the bounded
-forge check wait is the only other wait. End a turn only when every required PR
+forge check wait is the only other implementation wait. The eligible run arms
+one maintain-mode chat-run watch at its first published PR; that watch owns its
+10-minute harness wake or Orca fallback. End a turn only when every required PR
 is `merge-ready` or `held`. Under the recorded Notification policy,
-`axstack-relay` sends only a serious risk immediately or a genuine blocked
-operation that needs user intervention after bounded safe recovery. Questions,
-spec approvals, progress, CI pending, merge-ready, merged, and completion stay
+`axstack-relay` sends only a serious risk immediately, a genuine blocked
+operation needing user intervention after bounded safe recovery, or the
+decision holds and capped milestones named by the recorded Notification policy.
+Routine questions stay in Orca. Progress, CI pending, and completion always stay
 in Orca.
+Only the bounded categories—user-decision holds (including spec approval),
+serious-risk holds, and at most two merge-ready/merged milestones per run—may
+be relayed under the recorded Notification policy.
 
 Merge-ready is the human boundary: the user merges, bottom-up for a stack. The
-driver resumes on the user's next message or `/axstack-watch`; no Orca merge
-wake exists today. Re-read forge state: record forge-merged PRs as `merged`;
+driver resumes on the user's next message, `/axstack-watch`, or the armed
+chat-run watch wake; no Orca merge wake exists today.
+Re-read forge state: record forge-merged PRs as `merged`;
 changed heads or feedback return to step 1; retain useful author work before Close-out.
-Run Close-out once only after every required PR is forge-merged and acceptance
-passes. It settles workers, records counts, makes the auditor decision and
+Run Close-out once only after every required PR is forge-merged, the run's
+Release step is settled or not applicable, and acceptance passes. It settles
+workers, records counts, makes the auditor decision and
 settlement, releases worktrees, closes eligible tickets, and archives the run.
+Without an Autopilot or Release record, the Release step is not applicable for
+both Close-out and run completion.
 
 The loop requires the `mixed` two-provider authored-review row. `codex-only` or
 `claude-only` holds at step (3) for an explicit user routing choice, with no
 substitution or same-provider review. Derived PR states are `authoring |
 published | in-review | repairing(n) | merge-ready | merged | held`. The run is
-done only when every required PR is forge-merged and Close-out has receipts.
+done only when every required PR is forge-merged, the run's Release step is
+settled or not applicable, and Close-out has receipts.

package/skills/axstack-improve/SKILL.md

@@ -19,6 +19,11 @@ role dispatch, load the [Orca runtime
 sequence](../axstack/references/orca-runtime.md). Use existing
 `axstack-explore-codebase` or `axstack-research-code` roles only when their
 specialization materially helps; create no new profile.
+When dispatching `axstack-research-code`, dispatch `axstack-research-code-sol`
+independently on the same bounded brief without cross-reading. The driver
+reconciles findings per claim and never averages them. Record an intentionally
+absent Sol pair and proceed with the base seat alone; a configured but
+unavailable pair holds its work.
 
 ## 1. Bound discovery
 

package/skills/axstack-relay/SKILL.md

@@ -5,6 +5,9 @@ description: When the user requests a relay message or test, or an authorized no
 
 # Relay
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 Send normal messages, transport tests, and authorized notifications to the
 user through Hermes' native one-way `hermes send`. This is an inline caller
 procedure: it creates no driver, team, owner, auditor, monitor, child session,
@@ -25,8 +28,12 @@ Choose the applicable message type:
   in the caller's private notification policy. State the issue, impact, and the
   answer or action needed.
 - **Routine run events:** questions, spec approvals, progress, CI pending,
-  merge-ready, merged, and completion stay in Orca. They never become proactive
-  relay messages merely because the run is waiting.
+  merge-ready, merged, and completion stay in Orca unless the recorded
+  Notification policy names it. A policy may name only user-decision holds and
+  at most two merge-ready/merged milestones per run; deduplicate across implementation
+  and release. Progress, CI pending, and completion are never eligible merely
+  because a policy exists. They never become proactive relay messages merely
+  because the run is waiting.
 
 Verify the transport, execution host, and intended recipient from the user's
 request, trusted caller context, or an existing private notification policy.

package/skills/axstack-research/SKILL.md

@@ -29,8 +29,9 @@ is part of research.
 
 2. **Fan out research:** A single factual lookup stays in the current chat.
    Every other research run dispatches every configured research branch through
-   Orca: requirements (Claude), code (Codex), web (Claude), web-google
-   (Gemini/Antigravity, with Google Search built in), and X (Grok).
+   Orca: requirements, code, and web (Sonnet high in mixed/claude-only;
+   Codex in codex-only), web-google (Gemini/Antigravity, with Google Search
+   built in), and X (Grok).
    Give each branch one owner, allow no cross-reading, and require a cited note
    with a URL and access date per claim; re-open sources and never trust a search
    summary. The driver reconciles agreements/disagreements per claim.
@@ -41,16 +42,27 @@ is part of research.
 
    - `axstack-research-requirements`: requirements and intent.
    - `axstack-research-code`: code behavior.
+   - `axstack-research-code-sol`: independent Sol code investigation.
    - `axstack-research-web`: web and external sources.
    - `axstack-research-web-google`: Google-Search-grounded web sources via Gemini/Antigravity.
    - `axstack-research-x`: X (Twitter) posts and threads via Grok; cite post URLs and dates.
    - `axstack-explore-codebase`: broad codebase mapping.
    - `axstack-explore-execution`: execution and runtime traces.
+   - `axstack-explore-execution-sol`: independent Sol execution investigation.
+
+   When dispatching `axstack-research-code` or `axstack-explore-execution`,
+   dispatch its `-sol` pair independently on the same bounded brief without
+   cross-reading. The driver reconciles agreement and disagreement per claim,
+   never averaging findings. Record an intentionally absent pair and proceed
+   with the base seat alone; a configured but unavailable seat holds its work.
 
 3. **Gather primary source evidence.** Inspect the actual documentation, code,
    or tool output for every answer-changing claim. Apply the source standards
    for citations, freshness, revisions, and access dates. Continue until each
    material claim has direct evidence or a named evidence gap.
+   Before the driver folds verified claims, dispatch `axstack-diligence` under
+   [Diligence](../axstack/references/diligence.md) to reopen cited sources for
+   answer-changing claims and flag mismatches.
 
 4. **Form the verdict.** Mark every material claim as **verified**,
    **inference**, or **unverified** using the source standards. Derive