axstack 0.20.29 → 0.20.31

package/skills/axstack-review/SKILL.md

@@ -204,15 +204,18 @@ This section applies to peer and authored PR modes.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
-     | Preset | Actual author provider/model | Reviewer role (configured model/effort) |
+     | Preset | Actual author provider/class | Reviewer role (configured class/effort) |
      | --- | --- | --- |
-     | `mixed` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`claude/claude-opus-5-5` medium) |
-     | `mixed` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-primary` (`codex/gpt-6-sol` high) |
-     | `codex-only` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`codex/gpt-6-luna` xhigh) |
-     | `claude-only` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-secondary` (`claude/claude-sonnet-5-5` high) |
+     | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+     | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
+     | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+     | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 
-     Provenance is matched on provider/model ID; record effort, but never use
-     effort to create a mapping. Any other author provenance for the
+     The diligence receipt is separate and does not count as a reviewer receipt.
+
+     From the recorded exact model ID, derive its class and match provenance
+     on provider/class; record effort, but never use effort to create a mapping.
+     An ID with no class is `INCOMPLETE`. Any other author provenance for the
      selected preset is unsupported and `INCOMPLETE`, including its secondary
      reviewer model, Astra, Luna, or Fable. Report the exact provenance gap and
      ask the user. Never derive a reverse pairing from slot position. The
@@ -231,9 +234,19 @@ This section applies to peer and authored PR modes.
    effort and spawn no redundant final reviewer. If a required reviewer is
    unavailable, report that exact model gap, mark review `INCOMPLETE`, and ask
    the user; do not lower effort or choose any automatic fallback.
+   The only within-class exception is explicit model rejection before the first
+   turn: Codex may use
+   `--retry-of` with the next eligible ID in the same class, provider, and
+   effort; fence and record the rejected attempt. Timeout, quota, and auth
+   failures hold; Claude rejection holds. Never cross class or provider.
 
    Continue only when session receipts prove the required models, non-author
    independence, actual author provenance where applicable, and exact brief.
+   In peer and authored PR review rounds, dispatch `axstack-diligence`
+   independently alongside the configured reviewer(s) on the same exact revision
+   and base. Follow [Diligence](../axstack/references/diligence.md). A diligence
+   `FINDINGS` receipt returns validated findings to the same author in the same
+   round; it is not an extra `REQUEST_CHANGES` round.
 3. **Inspect all six angles.** In peer mode each reviewer covers every angle;
    in authored mode the one reviewer covers all six angles:
    1. Security and trust boundaries.
@@ -321,12 +334,14 @@ These verdicts apply only to PR modes. Codebase findings use coverage status.
   covering the whole brief, all six angles, and applicable acceptance.
 - **Complete verdict:** validated blocking defects permit `REQUEST_CHANGES`;
   complete evidence with no blocker permits `APPROVE`.
+- **Diligence:** a current `PASS` is required with reviewer approval for
+  merge-ready; `FINDINGS` return to the author in that round.
 - **Incomplete or stale:** use `INCOMPLETE`; never fabricate `APPROVE` or
   `REQUEST_CHANGES`.
 
 The owner verifies and synthesizes the mode-required evidence without voting.
-A peer receipt count of one is incomplete; an authored receipt count other
-than one is not the selected mode. Passing tests or reviewer unanimity grants
+A peer reviewer receipt count of one is incomplete; an authored reviewer
+receipt count other than one is not the selected mode. Passing tests or reviewer unanimity grants
 no merge authority.
 
 ## Template: candidate review brief
@@ -397,10 +412,11 @@ Mode-required exact-revision completeness gates external approval,
 [merge-ready declarations](#authored-mode-own-pr), and authorized submission. It never gates returning
 evidence, limitations, validated risk, or an internal `INCOMPLETE` report.
 
-- Peer mode requires both current reviews and no unresolved material finding
-  beyond the validated defects reported by `REQUEST_CHANGES`.
-- Authored mode requires its one current eligible configured review and applicable
-  scope identity to remain valid.
+- Peer mode requires both current reviews, a separate current diligence receipt,
+  and no unresolved material finding beyond the validated defects reported by
+  `REQUEST_CHANGES`.
+- Authored mode requires its one current eligible configured reviewer receipt and
+  a separate current diligence receipt; applicable scope identity must remain valid.
 - A missing, mismatched, stale, or materially changed input blocks approval and
   merge-ready declarations while readonly investigation continues.
 

package/skills/axstack-spec/SKILL.md

@@ -5,6 +5,9 @@ description: When agreed work needs an approved baseline, use axstack-spec to wr
 
 # Specification baseline
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 On driver entry, sweep under [Workspace hygiene](../axstack/references/workspace-hygiene.md); dispatched workers do not sweep.
 For every dispatch brief, name its private `<run dir>/evidence/<dispatch>/` folder.
 
@@ -54,6 +57,9 @@ and the lifecycle's [audit skill](../axstack-audit/SKILL.md) hook.
    session to return plain AGREE. Present one
    reviewable, identified revision for this checkpoint. Its user approval
    creates the execution baseline.
+   Before user approval, dispatch `axstack-diligence` under
+   [Diligence](../axstack/references/diligence.md) to check the draft against
+   the Align decisions for anything dropped, added, or softened.
 5. **Snapshot the baseline.** Record the approved revision identity and a
    concise repository Markdown counterpart. In Linear mode, the native
    document remains authoritative. In GitHub mode, the approved issue body is
@@ -72,7 +78,8 @@ Material change: <none | description + affected PRs/tasks + hold state>
    The snapshot is ready for ticketing when its authoritative revision,
    counterpart, and preserved ref resolve to the approved content. Return that
    exact identity; routine execution of the settled plan needs no repeat adviser
-   consultation or spec approval.
+   consultation or spec approval. In an eligible delivery run with no hold,
+   continue to Tickets in the same driver chat.
 
 ## Material revisions
 

package/skills/axstack-tickets/SKILL.md

@@ -5,12 +5,15 @@ description: When an approved capability needs executable tasks, use axstack-tic
 
 # Tickets
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 On driver entry, sweep under [Workspace hygiene](../axstack/references/workspace-hygiene.md); dispatched workers do not sweep.
 For every dispatch brief, name its private `<run dir>/evidence/<dispatch>/` folder.
 
 Produce an executable capability map tied to the exact approved spec revision.
 Keep user-visible capabilities in the selected store, keep implementation detail
-in the repository, reconcile lifecycle state, and stop before implementation.
+in the repository, reconcile lifecycle state, and return a map for continuation.
 
 Before mapping, load [Standing contracts](../axstack/references/contracts.md).
 Follow its required edge to [Shared lifecycle](../axstack/references/lifecycle.md),
@@ -54,6 +57,9 @@ an actual checker dispatch, not for ordinary mapping or state reconciliation.
    rationale with the task; actual measurement and exception evidence follow in
    the implement receipt. Mapping time requires no actual SHAs or line counts.
    Every capability ends with the fields below and an explicit dependency list.
+   Before accepting the map, dispatch `axstack-diligence` under
+   [Diligence](../axstack/references/diligence.md) to confirm every spec
+   acceptance item maps to a capability's acceptance.
    These routine mapping and split choices are autonomous driver decisions
    within the approved spec; size alone never requires user approval.
 
@@ -97,5 +103,5 @@ Recommendation: <move to In Review | keep open | close | other> (driver verifies
 
 5. **Return the mapping.** Report the pinned spec revision, selected store, map
    references, mutations performed by the driver, recorded gaps, and unresolved
-   decisions. Stop with a map ready for lifecycle continuation; implementation
-   has not started.
+   decisions. With a complete map and no hold, an eligible delivery run
+   continues to Implement in the same driver chat.

package/skills/axstack-watch/SKILL.md

@@ -5,6 +5,9 @@ description: When babysitting an existing PR, use axstack-watch to monitor or ma
 
 # Watch
 
+For authorized delivery runs, follow [Autopilot](../axstack/references/autopilot.md)
+for phase continuation and holds.
+
 On driver entry, sweep under [Workspace hygiene](../axstack/references/workspace-hygiene.md); dispatched workers do not sweep.
 For every dispatch brief, name its private `<run dir>/evidence/<dispatch>/` folder.
 
@@ -49,7 +52,8 @@ authority is unverified, record the hold and continue read-only.
 
 Choose one mode from the user's authority and record it before dispatch:
 
-- **Chat-run watch:** the initiating chat remains the only driver and record
+- **Chat-run watch:** authorized maintain mode is the default for run-created
+  PRs. The initiating chat remains the only driver and record
   writer for every PR raised in its Run, including later verified publications
   and explicitly adopted members. Follow [Chat-run watch runtime](references/watch-runtime.md#chat-run-watch)
   for its scheduled driver wake and Orca fallback. This mode has no replacement `axstack-owner` or
@@ -121,11 +125,16 @@ A handled wake has an acknowledged event ID, an observation or action bound to
 the current revision, and a recorded hold or next owner where work remains.
 
 Under a recorded `Notification policy`, the owner may use the optional
-[axstack-relay](../axstack-relay/SKILL.md) only for a serious risk immediately
-or a genuine blocked operation needing user intervention after bounded safe
-recovery. Questions, spec approvals, progress, CI pending, merge-ready, merged,
-and completion stay in Orca. The standalone monitor never sends; the chat-run
-observer reports only internally. Deduplicate authorized notifications;
+[axstack-relay](../axstack-relay/SKILL.md) only for a serious risk immediately,
+a genuine blocked operation needing user intervention after bounded safe
+recovery, or decision holds and capped milestones named by the recorded policy.
+Routine questions stay in Orca. Progress, CI pending, and completion always stay
+in Orca.
+Only the bounded categories—user-decision holds (including spec approval),
+serious-risk holds, and at most two merge-ready/merged milestones per run—may
+be relayed under the recorded Notification policy.
+The standalone monitor never sends; the chat-run observer reports only
+internally. Deduplicate authorized notifications;
 absent policy or failed relay uses the current Orca conversation and leaves
 the existing hold open.
 
@@ -135,6 +144,7 @@ The owner checks current required checks, all feedback, approvals, mergeability,
 and exact-revision receipts before any merge-ready statement. API errors leave
 readiness `UNKNOWN`; review approval alone is not merge-ready. Merge-ready is an
 observed state distinct from merged, and the human merges by default.
+A current diligence `PASS` at the exact head is required before any merge-ready statement.
 Under authorized own-PR maintenance, keep repairing and rebasing onto the base
 when it moves, then re-run checks, until the head is rebased on the current base,
 every review comment and thread is addressed, at least one human team member's
@@ -147,10 +157,14 @@ human approval remain allowed.
 
 ## 6. End and preserve continuity
 
-End a chat-run watch after all members merged or closed, user cancellation, or
-the recorded wake expires. Stop the chosen wake and verify its stop receipt;
-a failed or uncertain harness wake stop is a hold.
-the Orca fallback also needs own-automation disable/readback and driver-owned automation
+End a chat-run watch after all members merged or closed and the run's release
+step is settled or not applicable, user cancellation, or the recorded wake
+expires. Without an Autopilot or Release record, the release step is not
+applicable to this watch. A required PR closed without merging records a
+decision hold and the wake remains active while unexpired until the user
+resolves scope, cancels, or the wake expires. Stop the chosen wake and verify
+its stop receipt; a failed or uncertain harness wake stop is a hold.
+The Orca fallback also needs own-automation disable/readback and driver-owned automation
 removal and workspace cleanup under
 [Watch runtime](references/watch-runtime.md#chat-run-watch).
 
@@ -182,6 +196,6 @@ Resume: <known commands or verified refs needed to reconcile from this revision>
 
 The watch ends only when registrations are stopped, receipts are recorded, and
 the PR is either merged or represented by this resumable state.
-When every required PR is merged, follow the lifecycle
-[Close-out](../axstack/references/lifecycle.md#close-out) before reporting the
-run as done.
+When every required PR is merged and the run's Release step is settled or not
+applicable, follow the lifecycle [Close-out](../axstack/references/lifecycle.md#close-out)
+before reporting the run as done.

package/skills/axstack-watch/references/watch-runtime.md

@@ -90,8 +90,10 @@ busy, missing, fenced, protected, or permission-held driver is never interrupted
 or replaced.
 
 The driver records one Notification policy: `axstack-relay` Telegram home only
-for a user-decision hold, first merge-ready and fully merged milestones (at most
-two), or serious-risk hold. Quiet ticks never notify.
+for a user-decision hold (including spec and npm approval), merge-ready or
+merged milestones (at most two across implementation and release), or a
+serious-risk hold.
+Quiet ticks never notify.
 
 The driver alone routes repair. Re-read remote head/base and native ownership.
 Independent PRs may repair in parallel in separate Orca child worktrees within
@@ -116,8 +118,13 @@ re-read all feedback and approvals at the current head before readiness.
 Re-reading approvals checks current state, not re-requesting review from a
 human who already approved.
 
-Stop the chosen wake only when every watched PR is merged or closed, the user cancels,
-or it expires. The driver stops a harness-native wake and verifies its stop receipt;
+Stop the chosen wake only when every watched PR is merged or closed and the
+run's release step is settled or not applicable, the user cancels, or it
+expires. Without an Autopilot or Release record, the release step is not
+applicable to this watch. A required PR closed without merging records a
+decision hold and the wake remains active while unexpired until the user
+resolves scope, cancels, or the wake expires; the run is not release-eligible.
+The driver stops a harness-native wake and verifies its stop receipt;
 a failed or uncertain stop is a hold. Re-read membership and confirm no ambiguous
 publication or unsettled pass; cancellation
 prevents new work but does not prove running workers exited. The observer may

package/src/installer.js

@@ -635,8 +635,16 @@ export async function installBundle({
           const newIds = new Set(bundle.bundleRoles.map((role) => role.id));
           const addedRoleIds = bundle.bundleRoles.filter((role) => !oldIds.has(role.id)).map((role) => role.id);
           const removedRoleIds = old.roles.filter((role) => role?.id && !newIds.has(role.id)).map((role) => role.id);
+          const oldById = new Map(old.roles.filter((role) => role?.id).map((role) => [role.id, role]));
+          const changedRoleModels = bundle.bundleRoles.flatMap((role) => {
+            const previous = oldById.get(role.id);
+            if (!previous) return [];
+            const fields = ['modelClass', 'model'].filter((field) => previous[field] !== role[field]);
+            return fields.length ? [`${role.id} (${fields.join(', ')})`] : [];
+          });
           summary.addedRoleIds = addedRoleIds;
           summary.removedRoleIds = removedRoleIds;
+          summary.changedRoleModels = changedRoleModels;
         }
       } catch { /* No reliable role-ID diff for malformed prior bytes. */ }
     }

package/src/roles.js

@@ -4,19 +4,33 @@ const PROVIDER_BOUNDS = Object.freeze({
   'claude-only': new Set(['claude']),
 });
 
+const CLASS_PROVIDERS = Object.freeze({
+  fable: 'claude', opus: 'claude', sonnet: 'claude', haiku: 'claude',
+  astra: 'codex', sol: 'codex', luna: 'codex',
+});
+
+export function deriveModelClass(model) {
+  if (typeof model !== 'string') return null;
+  return model.match(/^gpt-(\d+(?:\.\d+)*)-(astra|sol|luna)$/)?.[2]
+    ?? model.match(/^claude-(fable|opus|sonnet|haiku)-/)?.[1]
+    ?? null;
+}
+
 const AUTHORED_ROUTES = Object.freeze({
   mixed: {
-    'codex/gpt-6-sol': ['axstack-reviewer-secondary', 'claude/claude-opus-5-5', 'medium'],
-    'claude/claude-opus-5-5': ['axstack-reviewer-primary', 'codex/gpt-6-sol', 'high'],
+    'codex/sol': ['axstack-reviewer-secondary', 'claude/opus', 'medium'],
+    'claude/opus': ['axstack-reviewer-primary', 'codex/sol', 'high'],
   },
   'codex-only': {
-    'codex/gpt-6-sol': ['axstack-reviewer-secondary', 'codex/gpt-6-luna', 'xhigh'],
+    'codex/sol': ['axstack-reviewer-secondary', 'codex/luna', 'xhigh'],
   },
   'claude-only': {
-    'claude/claude-opus-5-5': ['axstack-reviewer-secondary', 'claude/claude-sonnet-5-5', 'high'],
+    'claude/opus': ['axstack-reviewer-secondary', 'claude/sonnet', 'high'],
   },
 });
 
+const roleClass = (role) => role.modelClass ?? deriveModelClass(role.model);
+
 export function assertBundleRoles(roles) {
   if (!Array.isArray(roles) || roles.length === 0) {
     throw new Error('invalid bundle roles: expected a non-empty roles array');
@@ -36,12 +50,22 @@ export function assertBundleRoles(roles) {
     }
     if (ids.has(role.id)) throw new Error(`invalid bundle roles: duplicate role ID ${role.id}`);
     ids.add(role.id);
-    if (!Object.hasOwn(role, 'model')) {
+    const hasClass = Object.hasOwn(role, 'modelClass');
+    if (hasClass && (typeof role.modelClass !== 'string' || !Object.hasOwn(CLASS_PROVIDERS, role.modelClass))) {
+      throw new Error(`invalid bundle roles: ${role.id} has an unsupported modelClass`);
+    }
+    if (hasClass && role.provider !== CLASS_PROVIDERS[role.modelClass]) {
+      throw new Error(`invalid bundle roles: ${role.id} model class does not match provider`);
+    }
+    if (!hasClass && !Object.hasOwn(role, 'model')) {
       throw new Error('invalid bundle roles: model must be a non-empty string or explicit null');
     }
-    if (role.model !== null && (typeof role.model !== 'string' || role.model.trim() === '')) {
+    if (Object.hasOwn(role, 'model') && role.model !== null && (typeof role.model !== 'string' || role.model.trim() === '')) {
       throw new Error('invalid bundle roles: model must be a non-empty string or explicit null');
     }
+    if (hasClass && typeof role.model === 'string' && deriveModelClass(role.model) !== role.modelClass) {
+      throw new Error(`invalid bundle roles: ${role.id} model pin does not match model class`);
+    }
     for (const field of ['icon', 'color', 'modeId', 'thinkingOptionId', 'notes']) {
       if (role[field] !== undefined && typeof role[field] !== 'string') {
         throw new Error(`invalid bundle roles: ${field} must be a string when present`);
@@ -69,13 +93,13 @@ export function assessRoleReadiness(roles, preset) {
     (preset === 'mixed' && role.id === 'axstack-arena-candidate-grok' && role.provider === 'grok') ||
     (preset === 'mixed' && role.id === 'axstack-arena-candidate-antigravity' && role.provider === 'antigravity') ||
     (preset === 'codex-only' && ['axstack-advisor-opus', 'axstack-escalation-fable', 'axstack-arena-judge-opus', 'axstack-research-web-google', 'axstack-research-x', 'axstack-arena-candidate-grok', 'axstack-arena-candidate-antigravity'].includes(role.id)) ||
-    (preset === 'claude-only' && ['axstack-advisor-astra', 'axstack-arena-judge-astra', 'axstack-research-web-google', 'axstack-research-x', 'axstack-arena-candidate-grok', 'axstack-arena-candidate-antigravity'].includes(role.id))
+    (preset === 'claude-only' && ['axstack-advisor-astra', 'axstack-arena-judge-astra', 'axstack-research-web-google', 'axstack-research-x', 'axstack-arena-candidate-grok', 'axstack-arena-candidate-antigravity', 'axstack-auditor-sol', 'axstack-research-code-sol', 'axstack-explore-execution-sol'].includes(role.id))
   );
   for (const role of roles) {
     if (!bounds.has(role.provider)) {
       gaps.push(`${role.id} provider ${JSON.stringify(role.provider)} is outside ${preset} bounds (${[...bounds].join('|')})`);
     }
-    if (!isIntentionalAbsence(role) && (typeof role.model !== 'string' || role.model.trim() === '')) {
+    if (!isIntentionalAbsence(role) && !Object.hasOwn(role, 'modelClass') && (typeof role.model !== 'string' || role.model.trim() === '')) {
       gaps.push(`${role.id} requires a configured model`);
     }
   }
@@ -86,7 +110,11 @@ export function assessRoleReadiness(roles, preset) {
   const primary = byId.get('axstack-reviewer-primary');
   const secondary = byId.get('axstack-reviewer-secondary');
   if (primary && secondary) {
-    if (primary.model === secondary.model) gaps.push('reviewer pair must use two distinct models');
+    const bothResolved = typeof primary.model === 'string' && typeof secondary.model === 'string';
+    const sameReviewer = bothResolved
+      ? primary.model === secondary.model
+      : roleClass(primary) !== null && roleClass(primary) === roleClass(secondary);
+    if (sameReviewer) gaps.push('reviewer pair must use two distinct models');
     if (preset === 'mixed' && primary.provider === secondary.provider) {
       gaps.push('mixed reviewer pair must use different providers');
     }
@@ -94,14 +122,14 @@ export function assessRoleReadiness(roles, preset) {
 
   const author = byId.get('axstack-author');
   if (author) {
-    const authorRoute = `${author.provider}/${author.model}`;
+    const authorRoute = `${author.provider}/${roleClass(author) ?? author.model}`;
     const route = AUTHORED_ROUTES[preset]?.[authorRoute];
     if (!route) {
       gaps.push(`authored routing gap: unsupported axstack-author route ${authorRoute}`);
     } else {
       const [reviewerId, reviewerRoute, effort] = route;
       const reviewer = byId.get(reviewerId);
-      if (!reviewer || `${reviewer.provider}/${reviewer.model}` !== reviewerRoute || reviewer.thinkingOptionId !== effort) {
+      if (!reviewer || `${reviewer.provider}/${roleClass(reviewer)}` !== reviewerRoute || reviewer.thinkingOptionId !== effort) {
         gaps.push(`authored routing gap: ${reviewerId} must be ${reviewerRoute}/${effort} for author ${authorRoute}`);
       }
     }