axstack 0.20.30 → 0.21.0

package/skills/axstack/references/evidence-archive.md

@@ -1,17 +1,18 @@
 # Private evidence archive
 
 Use this only when local review or coordinator evidence is the last reason a
-finished Orca-owned worktree cannot be retired. It archives evidence; it
-never decides that a terminal or worktree is safe to remove and never performs
+finished T3-owned worktree cannot be retired. It archives evidence; it
+never decides that a thread or worktree is safe to remove and never performs
 native cleanup.
 
 ## Eligibility
 
-First prove the exact repository, PR or Run/Task, 40-character head SHA, Dispatch,
-workspace, terminal incarnation, Orca ownership, descendant settlement,
-and liveness from current native state. A manual chat, genuine `user_takeover`,
-an active or unknown task terminal, an unsettled descendant, ambiguous
-publication, or an unknown file remains protected. Completed non-author
+Follow [T3 runtime](t3-runtime.md). First prove exact projectId, attempt key,
+repository, PR or run/task identity, 40-character head SHA, threadId/runId or
+taskId/childThreadId/childRunId, checkout path, ownership, descendant settlement
+and liveness from current native state. A user-created or user-taken-over thread,
+an active or unknown run, an unsettled descendant, ambiguous publication, or an
+unknown file remains protected. Completed non-author
 worktrees with dirty source or unpushed commits use the
 [Workspace hygiene](workspace-hygiene.md) salvage path before removal; this
 archive helper never treats source changes as evidence-only cleanup.
@@ -24,7 +25,7 @@ continues to block cleanup.
 ## Archive and verify
 
 Choose a configured absolute private archive root outside every disposable
-worktree and outside public Orca artifacts. The root must be owned for this
+worktree and outside public artifacts. The root must be owned for this
 purpose and inaccessible to group/other users. From the installed `axstack`
 skill directory, run:
 
@@ -33,12 +34,17 @@ bun scripts/archive-evidence.js \
   --source-root <absolute-worktree-or-evidence-root> \
   --archive-root <absolute-private-archive-root> \
   --repo <owner/repository> --pr <number> --head <40-character-sha> \
-  --dispatch <exact-dispatch-id> \
+  --dispatch <exact-native-run-id> \
   --file <classified-relative-file> [--file <classified-relative-file> ...]
 ```
 
 For a supervised resource without a PR identity, replace `--pr <number>` with
-`--run <exact-run-id> --task <exact-task-id>`. The two identity forms are
+`--run <exact-native-run-id> --task <exact-native-task-or-thread-id>`.
+Pass the delegated childRunId or launched runId to `--dispatch`, never the colon-separated attempt key.
+For non-PR archives use that same native run ID for `--run` and the delegated
+taskId or launched writer threadId for `--task`. Record the full attempt key and
+its native identity mapping in the durable receipt; helper identity labels add
+no runtime. The two identity forms are
 mutually exclusive; never invent a PR number. Existing PR archives retain their
 path, manifest bytes, and receipt interface.
 
@@ -49,26 +55,25 @@ bytes, and emits a JSON receipt containing the archive directory, manifest path,
 manifest hash, and file count. Repeating the same command verifies the immutable
 archive and returns the same receipt; it does not overwrite it.
 
-Record the receipt plus the exact repo/PR or Run/Task/head/Dispatch/workspace/terminal
+Record the receipt plus the exact repo/PR or run/task/head/attempt/checkout/thread/run
 identities in durable lane continuity, then read the continuity and archive
 manifest back before cleanup. If either readback differs or is unavailable,
 preserve the worktree.
 
-For a reviewer checkout with another Dispatch's scratch, archive and read back
-each Dispatch's complete file set independently. The installed helper's retire
-operation may reject another Dispatch's scratch as unclassified dirt. After
-full union classification and verified per-Dispatch archives, use
+For a reviewer checkout with another task's scratch, archive and read back
+each task's complete file set independently. The installed helper's retire
+operation may reject another task's scratch as unclassified dirt. After
+full union classification and verified per-task archives, use
 [axstack-cleanup](../../axstack-cleanup/SKILL.md)'s exact per-prefix dry-run and
 clean recovery; never force, use a broad target, or treat archive success as
 removal authority.
 
 ## Native retirement
 
-Retire descendants before their parent. For each positively identified unused
-setup shell, use the native exact-terminal close operation, then re-list native
-state and require exit proof for that exact terminal incarnation. A task
-terminal, manual chat, unexpected terminal, failed close, or uncertain exit
-remains protected.
+Retire descendants before their parent under [Workspace hygiene](workspace-hygiene.md).
+Require terminal run evidence and read back private receipts before thread archival.
+Use `t3_thread_organize` archive only for an eligible exact thread; metadata
+archival does not remove a Git worktree or authorize evidence deletion.
 
 After receipt and continuity readback, invoke the same installed helper with
 the same identity and complete `--file` set, plus the recorded manifest hash:
@@ -78,7 +83,7 @@ bun scripts/archive-evidence.js \
   --source-root <absolute-worktree-or-evidence-root> \
   --archive-root <absolute-private-archive-root> \
   --repo <owner/repository> --pr <number> --head <40-character-sha> \
-  --dispatch <exact-dispatch-id> \
+  --dispatch <exact-native-run-id> \
   --file <classified-relative-file> [--file <classified-relative-file> ...] \
   --operation retire --manifest-hash <recorded-64-character-sha256>
 ```
@@ -95,7 +100,7 @@ Record the retirement receipt's `removed`, `alreadyAbsent`, and `pending` file
 sets. A repeat invocation reconciles already absent files without changing the
 manifest. A partial or failed invocation preserves the archive; resolve its
 exact hold and retry the same operation until `pending` is empty. The verified
-multiple-Dispatch recovery above uses only axstack-cleanup's exact per-prefix
+multiple-task recovery above uses only axstack-cleanup's exact per-prefix
 path. Never replace either path with a shell loop, broad deletion, force, or a
 waiver.
 
@@ -105,14 +110,14 @@ useful-work and publication checks, evidence classification, and removal
 authority remain driver decisions; archive or retirement success proves none of
 them.
 
-Before native worktree removal, verify the effective **Archive Script**
-provenance. An unknown hook or a required hook whose provenance is not trusted
-holds removal. Record its native outcome as exactly `unconfigured`, `passed`,
-`failed`, or `unknown`; only `unconfigured` or a trusted `passed` outcome may
-advance, while `failed` and `unknown` preserve the resource.
-
-Only then use the version-matched Orca guide's native worktree cleanup operation
-with the exact workspace identity. Never use shell recursive deletion and never
-treat archive success as ownership, settlement, exit, or cleanup proof. Record
-and verify native absence before advancing continuity; failure or uncertainty
-preserves the resource.
+Before archival and exact Git worktree removal, verify any effective removal
+hook provenance.
+An unknown removal hook or a required hook whose provenance is not trusted holds removal; preserve the worktree.
+
+After preservation and salvage checks, archive the exact eligible T3 thread
+with `t3_thread_organize`, then remove its exact recorded checkout path using
+`git worktree remove <path>` without force. Verify absence with
+`git worktree list --porcelain`; retire only eligible local-only branches with
+`git branch -d` under workspace hygiene. Never use shell recursive deletion or
+treat archive success as ownership, settlement, liveness or cleanup proof.
+Failure or uncertainty preserves the resource.

package/skills/axstack/references/lifecycle.md

@@ -16,7 +16,7 @@ binding state and receipts to exact revisions.
   Workers launch no recursive teams.
 - Reviewers: peer = two configured roles with the same brief and isolated first
   pass; authored = one eligible role from author provenance. Each uses a
-  separate Orca child worktree and private per-Dispatch evidence folder. Owner and author never review.
+  separate driver-made detached checkout and private per-attempt evidence folder. Owner and author never review.
 - Automation review manager and monitors: see
   [Review automation health](#review-automation-health).
 - Auditor (`axstack-auditor`): report-only; never edits, merges, activates, or
@@ -40,18 +40,17 @@ Preparation completion/watch expiry writes a record. Ordinary resume
 reconciles it, keeps the current owner, and launches no native handoff.
 Only an explicit user request to transfer ownership enters this branch.
 
-1. Reconcile the [Run record](run-record.md) with Orca Tasks, Dispatches,
-   sessions, Git revisions, forge, pending receipts, and timer expiries; live
-   owners and authoritative Dispatches beat stale state.
-2. Load the [Orca runtime boundary](orca-runtime.md), then follow its
-   version-matched runtime-owned handoff guidance. Never guess calls, paths,
-   roles, or fallback models. Guide discovery does not prove capability.
-3. If the native capability is missing, report the exact setup gap and
-   keep the current owner; no replacement or ownership transfer launches.
-   Read-only reconciliation may continue.
-4. Record recipient/pending receipt before launch. If uncertain, reconcile the
-   actual workspace/session before retry and block duplicates.
-5. Launch is not ownership. Record the recipient's explicit acceptance receipt
+1. Reconcile the [Run record](run-record.md) with T3 threads, runs, Git revisions,
+   forge state, pending receipts and scheduled-task expiries; live owners and
+   current attempt identities beat stale state.
+2. Load [T3 runtime](t3-runtime.md) for native resume and transfer. Keep the same
+   owner, author, attempt and worktree on ordinary resume; never guess tools,
+   roles, paths or fallback models. Capability discovery is not execution proof.
+3. Missing capability holds transfer with the current owner retained; read-only
+   reconciliation may continue. Record the recipient and pending receipt before
+   launch; reconcile exact-title thread inventory and Git worktrees before retry
+   to block duplicates.
+4. Launch is not ownership. Record the recipient's explicit acceptance receipt
    before changing ownership; current owner remains accountable until then. A
    prior owner seeing a different valid accepted owner stops.
 
@@ -62,7 +61,7 @@ receipts/timers, unresolved decisions, next action, and transfer status.
 
 Store receipt references, not raw output, in the [Run record](run-record.md).
 
-- Session receipt: actual agent/workspace IDs, requested provider/model and
+- Session receipt: actual projectId, threadId/runId or taskId/childThreadId/childRunId, attempt key and checkout path, requested provider/model and
   role; reuse on resume.
 - Acceptance receipt: sender/recipient, accepted scope/authority, timestamp,
   and ownership session receipt.
@@ -77,30 +76,43 @@ Store receipt references, not raw output, in the [Run record](run-record.md).
 
 ## Execution tracking
 
-The driver consumes native Orca completion and escalation deliveries for the
-active Run. A driver turn does not end while a Dispatch is unsettled unless one
-completion wait from the orchestration guide is armed (background where the
-harness supports it, foreground otherwise) and re-armed on timeout; sleep or
-poll loops are forbidden. An explicitly invoked phase dispatches its configured
-roles through Orca and closes with the lifecycle close-out; in-chat execution
-covers only ordinary reading, writing, and local checks. Heartbeat deliveries
-are acknowledged with no user-facing text. Process each whole delivery before
-acknowledgment and validate its Task, Dispatch, sender, authority, revisions,
-and receipts before advancing the run record. Duplicate deliveries are
-deduplicated by runtime identity. Healthy unchanged passes are silent.
-After accepting worker, Task, or Run completion, the driver
-invokes [axstack-cleanup](../../axstack-cleanup/SKILL.md) inline; it never
-dispatches cleanup work.
-
-Detect completed-but-unadvanced work, failed sessions, unresolved launch
-receipts, and stalls through the version-matched orchestration guide. Never
-duplicate a writer; idle is not complete. `input_accepted`, `turn_started`,
-session liveness, delivery, and verified advancement are distinct evidence.
-On `consumer_fenced`, reconcile the active coordinator rather than borrowing an
-identity. Respect settlement protection including `user_takeover`.
-
-Axstack creates no execution heartbeat or substitute scheduler. See
-[Review automation health](#review-automation-health).
+Follow [T3 runtime](t3-runtime.md) for native completion, questions, launch
+recovery and run-watch waits. Delegated notifications wake the driver; a launched
+writer sends its marker with `t3_thread_send` using `mode: queue` to the recorded driver thread.
+Delegated completion requires persisted `task_status` before `t3_thread_read`, terminal `completed`, `result_available`, `hasPendingChildRuns:false`, and final `AXSTACK-DONE`.
+Writer completion requires `AXSTACK-DONE` plus terminal `t3_thread_wait` on the recorded run and candidate checks: non-empty diff, clean tree, and named red/green logs.
+Completion must match the current attempt key and candidate SHA; an older attempt never completes a newer one.
+Process the whole delivery before advancement, validating sender, scope,
+authority, revisions and artifacts. Deduplicate by native task/thread/run identity.
+A question marker stays incomplete; failure, interruption, permission prompts
+and refusals hold with preserved evidence. Receipt messages alone are progress.
+Healthy unchanged passes are silent.
+An explicitly invoked phase dispatches its configured roles through T3 and
+closes with the lifecycle close-out; in-chat execution covers only ordinary
+reading, writing and local checks.
+
+For a required change with an empty base-to-head diff or missing named artifact,
+retain the incomplete state, return to the same author once, and hold on repeat.
+Dispatch each unblocked dependent after verifying scope, authority, owner,
+revisions and dependencies in the same driver turn; record why others are not
+ready. An unreachable predecessor holds. Update one `Next:` line on each
+transition with owner, last receipt time, next action and hold; reconcile it for
+status questions. Stale receipts remain evidence only.
+
+End a driver turn with an unsettled launched thread only while the bound run watch is armed; each wake reconciles all unsettled runs.
+Use terminal `t3_thread_wait` and the recorded watch as the runtime contract
+requires, re-arming waits on timeout; sleep or poll loops are forbidden. Delete the watch by exact ID and
+verify absence once nothing remains unsettled. After each delegated completion,
+verify the driver's HEAD and status unchanged before advancing. Input acceptance,
+run start, effective configuration, terminal success and verified advancement
+are distinct evidence. Detect completed-but-unadvanced work, failed runs,
+unresolved launch receipts and stalls through native state. Idle is not complete; never duplicate a writer. Reconcile
+thread/run identity mismatches rather than borrowing identities. Retain a
+user-taken-over thread without cleanup commands.
+
+After accepting task or run completion, the driver invokes
+[axstack-cleanup](../../axstack-cleanup/SKILL.md) inline; it never dispatches cleanup work.
+Axstack creates no heartbeat or substitute scheduler.
 Tracking grants no merge, release, model-substitution, or scope authority.
 
 ## Deadline (one rule for every owned timer)
@@ -113,12 +125,12 @@ differs from merged; human merges.
 
 ## Review automation health
 
-The native review manager uses fresh finite sessions in one dedicated existing
-Orca workspace on a 15-minute schedule. It admits actionable PR events within
-measured host capacity; waiting PRs remain covered without reserving slots.
-Bounded PR jobs use per-PR worktrees and settle after descendants. Build no
-custom scheduler, state engine, or legacy fallback. See
-[Review manager](automations.md).
+The native review manager uses fresh finite T3 pass threads from its dedicated
+lane project on a 15-minute T3 scheduled task. It admits actionable PR events
+within measured host capacity; waiting PRs remain covered without reserving slots.
+Bounded PR jobs use driver-made detached checkouts and settle after descendants.
+Build no custom scheduler, state engine or legacy fallback. See
+[Review manager](automations.md) for binding, canary, capacity and schedule health.
 
 ## Audit hook (close-out and meaningful checkpoints)
 
@@ -131,16 +143,18 @@ nothing without tested independent review.
 
 ## Close-out
 
-PRs merge by forge state; close out: (1) settle every worker
-terminal; (2) compact record with counts and denominators—user
+PRs merge by forge state; close out: (1) settle every T3 worker run and archive eligible threads; (2) compact record with counts and denominators—user
 interventions/deviations from plan/repairs; (3) `axstack-auditor`: settle
-non-zero/requested, else `counts zero`; an unavailable auditor leaves close-out
-pending, never skipped silently; (4) release merged run worktrees and branches;
-use `axstack-cleanup`, remove the run's own automations under
+non-zero/requested, else `counts zero`. A base auditor preflight rejection
+(no delegated task started) records `auditor: UNKNOWN (unlaunchable)` with the
+attempted route and error as the archive receipt; no substitution. A launched
+auditor task must settle; (4) release merged run worktrees and branches;
+use `axstack-cleanup`, remove the run's own scheduled tasks under
 [Workspace hygiene](workspace-hygiene.md), and close selected external-tracker tickets;
 (5) mark the
 [Run record](run-record.md) `Archived`. `Archived`—one each:
 settlement receipt; compact record path; auditor decision plus settlement
-receipt or `counts zero`; automation, release, and ticket receipts; archive timestamp.
+receipt, `counts zero`, or the unlaunchable UNKNOWN archive receipt; scheduled-task,
+release, and ticket receipts; archive timestamp.
 `active`/receipt-incomplete record: close-out pending, never done. One-step
 lookups exempt.

package/skills/axstack/references/review-manager-prompt.md

@@ -1,13 +1,15 @@
 # Review manager prompt
 
-You are a fresh finite review-manager session in the automation's dedicated
-existing Orca workspace. Enter through the installed `axstack-review` skill; that skill loads its packaged
-`../axstack/references/automations.md` contract by relative reference. Discover
-every eligible peer-review event and invoke the skill through Orca for each
-admitted bounded PR job. Keep complete coverage and admit actionable events
-within measured host capacity, preserve exact ownership and receipts, settle
-completed trees, and stay quiet when nothing changed. Reconcile before admission,
-save durable continuity using `run-record.md#review-manager-continuity-template`
-and read it back, then exact close of your own terminal as
-the final action under the contract. Reconcile the whole lane, not just this
-workspace. Never check out a PR branch here.
+You are a fresh finite T3 review-manager pass in project `axstack-review-lane`
+on the VPS's existing `axatbhardwaj/axstack` clone. Fetch first; this unbound
+pass worktree starts from `origin/main`. Enter through installed `axstack-review`,
+which loads `../axstack/references/automations.md` relatively. Read that contract
+and [T3 runtime](t3-runtime.md). Verify your configuration against the recorded
+`axstack-owner` binding before admission. Reconcile the whole lane, discover
+all eligible peer-review events and admit within measured host capacity.
+Use host-clone detached per-PR checkouts; preserve exact ownership and receipts.
+Retire settled predecessors, report retained worktree count, and disable the
+schedule and hold past its authorized limit. Save and read back continuity at
+`~/.local/share/axstack/runs/review-manager/progress.md` using
+`run-record.md#review-manager-continuity-template`; settle descendants and end
+the finite turn. Stay quiet when unchanged. Never check out a PR branch here.

package/skills/axstack/references/role-roster.md

@@ -5,12 +5,12 @@
 - `axstack-reviewer-primary` and `axstack-reviewer-secondary` are the ordered
   peer pair. Peer review uses both; authored review uses this table:
 
-  | Preset | Author | Reviewer (model/effort) |
+  | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`claude/claude-opus-5-5` medium) |
-  | `mixed` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-primary` (`codex/gpt-6-sol` high) |
-  | `codex-only` | Codex / Sol (`codex/gpt-6-sol`) | `axstack-reviewer-secondary` (`codex/gpt-6-luna` xhigh) |
-  | `claude-only` | Claude / Opus (`claude/claude-opus-5-5`) | `axstack-reviewer-secondary` (`claude/claude-sonnet-5-5` high) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
+  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+  | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 - `axstack-advisor-astra`/`axstack-advisor-opus` advise and author candidates;
   `axstack-arena-candidate-grok`/
   `axstack-arena-candidate-antigravity` add families.
@@ -24,14 +24,24 @@
 - `axstack-auditor`/`axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`/`axstack-monitor`:
-  `claude-sonnet-5-5` high in mixed/claude-only.
+  `claude/sonnet` high in mixed/claude-only.
   `axstack-monitor`: standalone watch never sends; chat-run watch: bounded
   internal reports to its Run and original driver.
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
-  `axstack-explore-execution-sol`: `codex/gpt-6-sol` high in
+  `axstack-explore-execution-sol`: `codex/sol` high in
   mixed/codex-only; intentionally absent in claude-only. Dispatch each
   independently from its Sonnet seat on the same bounded brief without
   cross-reading. The driver reconciles findings per claim, never averages.
-  Record intentional absence and continue with Sonnet alone; a configured
-  but unavailable seat holds only its affected work.
+  Record intentional absence and continue with Sonnet alone.
+- Optional seats: `axstack-arena-candidate-grok`,
+  `axstack-arena-candidate-antigravity`, `axstack-research-web-google`,
+  `axstack-research-x`, `axstack-checker`, `axstack-research-code-sol`,
+  `axstack-explore-execution-sol`, `axstack-auditor-sol`.
+  Always dispatch optional seats when configured and available. Only a
+  launch failure, trust/login prompt, or prompt block makes one absent:
+  fence the attempt, record `absent (<reason>)`, name it once in the next
+  read-back, and skip it without a relay or substitution. An uncertain
+  dispatch is reconciled, not called absent. A mixed fan-out still includes
+  at least one Codex and one Claude seat; otherwise hold that fan-out.
+  Intentional absences in codex-only and claude-only remain unchanged.
 - `axstack-debug-investigator-1..4` probe L1 briefs.

package/skills/axstack/references/routing.md

@@ -8,25 +8,40 @@ Driver entry sweep follows [Workspace hygiene](workspace-hygiene.md).
 Presets: `mixed`, `codex-only`, `claude-only`. For new runs, use
 `profiles.preset` from `.axstack-manifest.json` at the actually loaded
 skills root, or an explicit user selection in the run record. Missing or contradictory sources are
-a setup gap: hold. Never infer from live profiles or `list_profiles`, harness,
+a setup gap: hold. Never infer from live profiles, harness,
 tools, credentials, quota, subscription, or default to `mixed`.
 
-At start, snapshot all 32 role IDs with provider/model/mode/effort; absent
-or unconfigured roles are recorded explicitly; never default.
-Such a role holds only its work. Later installed or changed roles need an
-explicit user decision to enter the snapshot. Live profiles
-are authoritative at snapshot time and for availability; bundled presets are setup
-inputs, not runtime proof.
-
+At start, snapshot all role IDs from installed `skills/axstack/roles.json`,
+including provider/modelClass/model/mode/effort and intentional absences.
+Absent or unconfigured roles are recorded explicitly; such a role holds only
+its work under the required/optional seat rules.
+Later installed or changed roles need an explicit user decision to enter the snapshot.
+For each role record class, resolved exact ID, source (`capabilities`), and time.
+Read the [T3 runtime boundary](t3-runtime.md) before dispatch, receipt consumption
+or recovery; use its permitted-write role split, completion checks and run watch.
+Resolve Codex and Claude classes with
+`skills/axstack/scripts/resolve-models.js --provider <provider> --capabilities <path>`
+using saved T3 capabilities JSON; missing or malformed capabilities holds.
+Claude exact IDs come from capabilities, replacing transcript read-back.
+Use an explicit model as given; for `model:null` without a class, only grok and
+antigravity use the provider's first listed model from saved capabilities and
+record its exact ID.
+A Codex or Claude role with neither model nor class is an intentional absence
+and holds.
+Resume must reuse the saved capabilities and role snapshot with no re-resolution; changes require the user’s explicit decision.
+An unavailable provider, model, role, mode or effort holds that role with no substitution.
 Preset changes apply to new runs only; an active run keeps its snapshot.
-Changing it or replacing a session needs an explicit user decision and
-revalidation. Unavailable models, efforts, roles, or overrides hold only affected
-work; no automatic fallback, quota routing, subscription inference, or silent
-provider/model/effort substitution.
+Replacing a session needs an explicit user decision and revalidation.
+Timeout, quota, auth and rejection hold affected work.
+[Model discipline](contracts.md#model-discipline) governs optional seats,
+auditor preflight, and required holds; [Role roster](role-roster.md) governs
+single-provider absence and mixed Codex+Claude fan-out.
+Bundled presets are setup inputs, not runtime readiness proof.
 
 Load the [Role roster](role-roster.md) for configured roles and authored-review pairings.
 
-Provenance is matched on provider/model ID; effort never maps. Missing table-row
+Provenance is matched on provider/model class derived from the recorded exact ID;
+effort never maps. Missing table-row
 provenance is unsupported and `INCOMPLETE`; report it and ask the user. Never
 infer from slot, driver, owner, or provider. Author and owner never review.
 
@@ -46,14 +61,14 @@ step (3) for user routing: no substitution or same-provider review.
   off a classified repair (explain: how; debug: what's wrong).
 - Code quality/refactor discovery -> `axstack-improve`: rank bounded
   candidates with evidence; report only, no source edits.
-- Accepted worker/Task/Run completion or bounded backlog request -> driver invokes
+- Accepted worker/task/run completion or bounded backlog request -> driver invokes
   `axstack-cleanup` inline; never dispatch it.
 - Preparation completion, watch expiry, resume, or reconciliation -> the
   [lifecycle](lifecycle.md#native-handoff-and-resume): reconcile run record,
   keep owner, launch no native handoff.
 - Explicit user-requested ownership transfer -> the same lifecycle section.
-  Load the [Orca runtime boundary](orca-runtime.md), follow the runtime-owned
-  handoff guide, and require explicit recipient acceptance before ownership
+  Load the [T3 runtime boundary](t3-runtime.md), follow its ownership-transfer
+  contract, and require explicit recipient acceptance before ownership
   changes. Missing capability is a setup gap; never invent one.
 - Colleague PR review -> `axstack-review`, peer mode.
 - Codebase review -> `axstack-review` codebase mode, report only.
@@ -75,7 +90,7 @@ reason in the run record, or in the brief for tiny direct work.
   Require an approved spec plus a ticket map tied to that exact spec
   revision, with acceptance checks and dependencies in the explicitly selected
   Markdown, GitHub Issues, or Linear store. Prepare via `axstack-align` -> `axstack-spec`
-  (one approval) -> `axstack-tickets` -> handoff, then stop.
+  (one approval) -> `axstack-tickets` -> handoff, then continue under autopilot when eligible.
 - **Small:** clear, bounded one-PR work. The driver captures the named
   **small-change intent** from the current request or user-chosen existing
   issue plus explicit acceptance checks and exclusions, snapshots it once, and
@@ -96,7 +111,7 @@ not alone a formal spec trigger. Hold affected unsafe work while reassessing.
 ## Lifecycle routes (mode-specific scope identity required)
 
 - Preparation: substantial work follows the align -> spec -> tickets ->
-  handoff path above, then stops; small work uses the driver-captured
+  handoff path above, then continues under autopilot when eligible; small work uses the driver-captured
   small-change intent.
 - Execution: with its identity present, `axstack-implement` ->
   `axstack-review` -> `axstack-watch`.

package/skills/axstack/references/run-record.md

@@ -40,14 +40,26 @@ The driver is the sole record writer. Workers send concise receipts; they do
 not edit `progress.md`. This is a prompt contract, not a lock or runtime
 coordination mechanism. Each task names the actual owner session and worktree,
 or a receipt pointer containing both; a role label alone is insufficient.
+Read the [T3 runtime boundary](t3-runtime.md) for native identity and receipt checks.
+Record driver threadId, projectId, host, T3 version, installed Axstack SHA,
+capabilities JSON path and scheduledTaskIds for every watch and manager schedule.
+Per dispatch record key, mechanism, requested target and read-back,
+taskId/childThreadId/childRunId or threadId/runId/worktree/branch/base SHA,
+checkout path with candidate/base SHAs, evidence folder, scope/authority,
+owner, pending receipts, hold and Next.
+Each dispatch row must record the provider/model echo, configuration read-back, and post-completion HEAD/porcelain check result.
 
 Update before dispatch and after each verified transition. On resume,
-reconcile the record with actual Orca sessions and Dispatches, exact revisions, forge/PR
+reconcile the record with actual T3 threads and runs, exact revisions, forge/PR
 state, and the approved intent. Prevent a duplicate writer, mark approval or
 evidence for an older revision stale, and distinguish task completion from a
 capability being merged.
+Maintain one `Next:` line after each accepted receipt or hold transition. It
+names the driver or task owner, last receipt time, next concrete action, and
+any hold with its affected dependency and resume condition. Use it to answer
+status questions after reconciling current evidence.
 
-The record is derived progress, not authority. Orca sessions and Dispatches, Git revisions,
+The record is derived progress, not authority. T3 threads and runs, Git revisions,
 forge/PR state, and the approved spec remain sources of truth. The driver
 verifies exact SHAs and receipts before recording a transition; a worker claim
 alone is not verification.
@@ -63,7 +75,7 @@ About 60 lines is the normal budget, not a truncation rule. Open holds and
 watermarks are never dropped to meet that budget.
 
 Before changing `Driver` or a task `Owner`, verify that the prior driver is
-inactive against actual Orca session and Dispatch state, or that an explicit accepted transfer
+inactive against actual T3 thread and run state, or that an explicit accepted transfer
 permits reassignment. Idle alone never reassigns ownership.
 Uncertain state or a live conflict holds the transfer; never overwrite the
 field to seize control. A prior driver that sees a different valid accepted
@@ -75,18 +87,17 @@ The driver records `paused` on a user request or a hold; idle alone is neither.
 
 ## Handoff and resumption
 
-Keep handoff state in this same record, never a second wrapper record. Before a
-native handoff launch, add the intended recipient and a pending launch-receipt
-pointer. Record the actual agent/workspace receipt once verified, then the
+Keep handoff state in this same record, never a second wrapper record. Before an
+explicit transfer, add the intended recipient and a pending acceptance-receipt
+pointer. Record the actual thread/worktree identity once verified, then the
 recipient's explicit acceptance receipt before changing ownership. Preserve
 pending external receipt pointers and timer expiries so an uncertain launch,
 send, or watch can be looked up before any retry.
 
 Resume from compact pointers to commands or evidence, not copied transcripts.
-For chat-run watch, record the chosen wake mechanism and its identity or command
-(including the workspace for an Orca fallback),
-member PR publication/adoption receipts, exact driver session, observation/report
-IDs, disposition, wake and stop receipts in this same record. The driver alone writes it; a later same-Run publication joins the membership only after remote readback. Reconcile named sessions, revisions, PR state, watches, and deliveries before
+For chat-run watch, record the bound T3 schedule and scheduledTaskId,
+member PR publication/adoption receipts, exact driver threadId/runId, observation/report
+IDs, disposition, wake and stop receipts in this same record. The driver alone writes it; a later same-Run publication joins the membership only after remote readback. Reconcile named threads/runs, revisions, PR state, watches, and deliveries before
 creating or redelivering anything. Outside the bounded driver-start orphan
 sweep, touch only this run; no unscoped global sweep, runtime database, or
 scheduler follows from the record.
@@ -127,8 +138,8 @@ in the adjacent history file, not below this template.
 # Review-manager continuity
 
 ## Lane state
-- Automation ID, native run ID, workspace and exact terminal receipt: <IDs>
-- Active PR jobs and descendants: <PR, Task/Dispatch, owner, revision, state>
+- scheduledTaskId, threadId/runId, workspace and exact terminal receipt: <IDs>
+- Active PR jobs and descendants: <PR, taskId/childThreadId/runId, owner, revision, state>
 
 ## Open holds
 - <PR or lane, reason, evidence, owner, resume condition; or none>
@@ -144,18 +155,24 @@ in the adjacent history file, not below this template.
 
 ```text
 Run: <UTCdate>-<slug>[-<collision suffix>]
-Driver: <session ID> (sole writer)
+Driver: <threadId/runId> (sole writer)
 Goal: <bounded task goal>
 Scope: <repo + accepted bounds>
 Authority: <who authorized which mutation>
 Intent: <approved spec rev | small-change intent | adopted snapshot | peer/read-only mode>
 Routing: <preset + source + snapshot ref>
 Notification policy: <none | transport/target label/host/instructions path>
+Autopilot: on | paused (<hold>; resume: <condition>) | off (cancelled <ts>)
+Next: <owner; last receipt time; next action; hold or none>
+PR digest watermarks: <repo -> absolute path inside this private run record> | none
+Release: <AGENTS.md file:line + tag-triggered workflow path + named install hosts> | not applicable (<reason>)
 Source base: <exact revision or source identity>
-IDs: <repo/project + workspace/agent receipt pointers>
+IDs: <projectId + driver threadId/runId + dispatch identity receipt pointers>
+Runtime: <host + T3 version + installed Axstack SHA + capabilities JSON path>
+Schedules: <scheduledTaskIds of every watch and manager schedule>
 Worktrees in other repositories: <per-run repository and worktree IDs or none>
 Evidence: <check/review/submission/audit receipt pointers>
-Pending: <launch/acceptance/external receipts + timer execution heartbeat actual ID + handshake + deadline>
+Pending: <launch/acceptance/external receipts + scheduledTaskIds + runIds + deadline>
 Unresolved: <decision -> next owner + next action>
 Learnings: <root cause, gotcha, or pattern -> evidence ref>
 Resume: <commands or evidence refs bound to exact revisions>
@@ -168,6 +185,10 @@ Resume: <commands or evidence refs bound to exact revisions>
 | --- | --- | --- | --- | --- | --- |
 | <task> | <task IDs or none> | <role + session ID + worktree, or receipt ref> | <pending/in progress/complete/blocked> | <SHA + check/receipt refs> | <action + owner> |
 
+| Dispatch key | Provider/model echo | Configuration read-back | Completion receipt | Post-completion HEAD/porcelain check result |
+| --- | --- | --- | --- | --- |
+| <key> | <actual provider/model + evidence ref> | <options/runtimeMode + evidence ref> | <marker + IDs + evidence ref> | <compared HEAD/status + pass/hold + evidence ref> |
+
 Status: <active/paused/held/complete/Archived>
 Updated: <UTC timestamp>
 ```