axstack 0.20.31 → 0.22.0

package/skills/axstack/references/automations.md

@@ -1,81 +1,70 @@
 # Native peer-review manager
 
-Read this for the optional native Orca peer-review automation. The historical
+Read this for the optional native T3 peer-review schedule. The historical
 automation specs and plans describe retired designs and are not instructions.
 
+For optional weekly test audits, use the separate packaged
+[Weekly test-audit prompt](test-audit-weekly.md).
+The native canary below is also required before weekly activation.
+
 ## Topology and schedules
 
-The review manager runs at minutes `0,15,30,45` and invokes
-[axstack-review](../../axstack-review/SKILL.md) for eligible peer reviews.
-
-Use one dedicated existing Orca workspace owned by this automation. Configure
-native existing-workspace mode with `--fresh-session`, never `--reuse-session`;
-each pass gets a fresh finite manager session. Keep lane continuity and evidence
-at configured durable absolute paths. A manager never checks out a PR branch
-in its workspace. Missed slots do not replay a backlog; the next ordinary pass
-discovers current state. The short packaged review prompt sits beside this file
-and discovers these rules by relative link instead of copying them.
-
-Provision one explicit absolute continuity path per automation ID in the
-scheduled prompt. The repository's absolute Git common directory is a valid
-durable root; missing or non-durable configuration holds admission. Follow the
-[Run record](run-record.md). Each pass
-uses the [Review-manager continuity template](run-record.md#review-manager-continuity-template),
-overwrites its four current-state sections, and archives superseded history once
-in the adjacent history file. A no-change pass appends at most one history line.
-
-This is prompt policy, not proof that Orca starts a fresh session or prevents
-overlapping passes. Before activation a native canary must prove fresh-session
-launch, overlapping-pass behavior, recovery after session loss, nested
-dispatch depth for coordinator-launched leaves, and total process and memory
-effects. A firing timestamp proves neither delivery nor useful completion.
-
-Do not write `~/.claude.json` except through the packaged `trust-path.js`
-preflight for an exact Orca-registered repository root or worktree before a
-Claude launch. The helper changes only that path's trust flag; it does not
-answer any dialog.
+The T3 project `axstack-review-lane` uses the VPS's existing
+`axatbhardwaj/axstack` clone with `origin` and `main`.
+Unbound pass worktrees branch from `origin/main` and each pass fetches first.
+Continuity stays at `~/.local/share/axstack/runs/review-manager/progress.md`,
+outside every worktree.
+A missing, non-durable or unreadable continuity path holds admission.
+Follow the [Run record](run-record.md) and use the
+[Review-manager continuity template](run-record.md#review-manager-continuity-template):
+overwrite its four current-state sections and archive superseded history once
+beside it. A no-change pass appends at most one history line.
+
+Configure the lane thread via `t3_thread_configure` with the `axstack-owner`
+binding and verify its read-back. Then `schedule_task` uses the packaged prompt,
+`everyMs:900000`, `bindToCurrentThread:false`, and a stable `clientRequestId`.
+Record the schedule ID, project, lane binding and pass thread/run identities.
+Each pass compares its own `t3_thread_configuration` with the recorded binding.
+A binding mismatch holds admission.
+Read [T3 runtime](t3-runtime.md) for capability, provider/effort, prompt, dispatch,
+completion and cleanup boundaries; a manager never checks out a PR branch in
+its pass worktree. Missed slots do not replay a backlog.
+
+T3 sessions are exempt from Claude trust preflight.
 
 ## Session admission
 
-Perform the pass-start predecessor cleanup and sweep in
-[Finite-session teardown](#finite-session-teardown) before discovery or admission.
-Reconcile saved state, current GitHub state, and native Orca Tasks, Dispatches,
-sessions, and liveness across all workspaces belonging to the lane before
-discovery or admission; never infer lane ownership from an empty local workspace.
-Bind the lane to the automation ID and pass to its native run ID, workspace ID,
-and terminal identity, not a title or directory-name guess.
+Perform guarded predecessor retirement in [Finite-session teardown](#finite-session-teardown).
+Lane identity requires exact thread/run identity, never a title or directory-name
+guess; never infer lane ownership from an empty local workspace.
+Reconcile saved state, current GitHub state, and native T3 threads, runs,
+delegated tasks and liveness across the whole lane before discovery or admission.
+Discovery reads every page of PRs and native threads.
+A truncated or failed inventory holds admission and cleanup.
+A pass never admits a PR owned by a live or uncertain earlier pass.
 A confirmed live manager for the same lane remains authoritative.
+The earlier pass wins only when ordering evidence exists.
+Missing ordering or ownership evidence holds admission and never guesses a winner.
+
 Once identified as a duplicate, the new pass does no PR work, makes no further
-shared-record write, touches no live or unsettled resource owned by the live
-manager, and closes only its own exact terminal as its final action under the
-guard below.
-A duplicate pass admits nothing and runs read-only discovery into its own pass
-note in its private evidence folder, recording new eligible events and the unserved count.
-If a duplicate pass finds the live owner's coordinator idle at its prompt, its
-final agent turn ended without `worker_done` for more than five minutes (nudged
-or not), as in [Per-PR jobs](#per-pr-jobs), record the stalled owner in its own
-pass note and send one deduplicated notification under the recorded
-`Notification policy`.
+shared-record write and touches no live or unsettled resource owned by the
+live manager. A duplicate pass admits nothing and runs read-only discovery
+into its own pass note in its private evidence folder, recording new eligible
+events and the unserved count. If a duplicate finds a stalled owner idle at its
+prompt with a final turn lacking a completion receipt for more than five
+minutes (nudged or not), record it in that private note and send one deduplicated
+notification under the recorded `Notification policy`.
 Unknown liveness blocks admission and shared-record writes; it does not
-authorize takeover, cleanup, or a duplicate manager. Preserve `user_takeover`
-and other user-owned sessions.
-
-When two new passes overlap, reconcile native run ordering before either admits
-work; the earlier unsettled pass retains the lane. Missing ordering or ownership
-evidence holds admission, never guesses a winner. This is not an atomic lock:
-activation requires an overlap canary proving only one pass admits work. Count
-all unsettled PR jobs and descendants across the lane, not just this workspace.
-Read every page of native runs, workers, and workspace inventory; truncated or
-failed inventory holds admission and cleanup rather than implying absence.
-
-A prior manager does not retain the lane merely because its automation run
-status says failed or dispatched. Reconcile a surviving prior terminal using
-exact identity and proven completion from native state before treating it as
-live or releasing ownership. Require confirmed process exit for its exact
-terminal incarnation, saved continuity, and settlement of all owned jobs and
-descendants before ownership release. A completed run row alone does not prove exit.
-If these facts remain unknown, report the hold at the durable decision location;
-do not silently stand down forever or replace a potentially live owner.
+permit takeover or cleanup. Preserve user-taken-over threads.
+This is prompt policy, not an atomic lock: the overlap canary must demonstrate
+one admission owner before activation. Count all unsettled PR jobs and descendants.
+
+A failed scheduled run alone proves neither predecessor exit nor release.
+Predecessor exit requires exact thread/run identity and terminal run evidence;
+a completed run row alone does not prove the work settled.
+Require reconciled continuity and settlement of every descendant before releasing ownership.
+Unknown facts hold at the durable decision location; never replace a
+potentially live owner.
 
 ## Discovery and coverage
 
@@ -126,40 +115,41 @@ PRs cannot starve older unserved work.
 
 ## Per-PR jobs
 
-At PR-job and reviewer dispatch, apply [Readable sidebar](workspace-hygiene.md#readable-sidebar).
 Include [Safe deletion](workspace-hygiene.md#safe-deletion) in PR-job briefs.
 
 The logical manager lane owns ongoing discovery and continuity across finite
 sessions; the bounded PR coordinator owns only its admitted event. Do not create a second live owner or
 writer for the same PR. Reuse an existing valid per-PR worktree, owner, and
-unchanged receipts before creating anything. Otherwise create one separate
-Orca worktree per PR job, parented to that repository's primary worktree, and
-pin the observed head and base. The bounded PR coordinator loads the
+unchanged receipts before creating anything. Otherwise create one separate detached checkout
+per PR job from its existing
+host clone: `git -C <host clone> worktree add --detach <run>/checkouts/<key> <sha>`;
+pin the observed head and base. A repository without a host clone is a held job. The bounded
+PR coordinator loads the
 review skill, launches only the reviewers that skill owns,
 handles the current actionable event, returns exact receipts, then settles.
-Check the admitted coordinator soon after start and while waiting, using native
-terminal and Dispatch inspection. If an idle coordinator's final agent turn ended
-without `worker_done` and it is at its prompt, nudge it once by typed terminal
-input restating its brief.
-For this lane, the nudge is the one brief confirmation, and a second ask follows
-this stop rule, not an open-ended hold; see [Orca runtime](orca-runtime.md) for
-the confirmation boundary.
-If still idle because its next turn ended without `worker_done` or it stays idle
-at its prompt five minutes after the nudge, use native `worker-stop`, reconcile
-its Task, Dispatch, and descendants, and record the event unserved (INCOMPLETE,
-re-admissible).
-A started coordinator waiting on its reviewers (a live reviewer Dispatch or a
-running wait) is not idle and is never stopped by this rule.
-Once the tree is settled, continue discovery and admission;
-an uncertain stop or live descendant retains the slot and holds admission.
+Check admitted delegated jobs with persisted `task_status` before thread reads
+under [T3 runtime](t3-runtime.md). For a worker's own brief question, confirm the
+brief once.
+A second brief ask follows the five-minute stop rule, never an open-ended hold.
+An idle final turn without a valid completion
+receipt is incomplete, not successful. A started coordinator waiting on its
+reviewers (a live reviewer task or running wait) is not idle and is never
+stopped for waiting. Reconcile terminal failure and all descendants before
+recording an event unserved and re-admissible.
+Steer an idle PR job once with `t3_thread_send`.
+If it is still idle without a valid completion receipt five minutes after the steer,
+stop the owned job with `t3_thread_interrupt` or `task_cancel` as applicable,
+reconcile the coordinator and every descendant, and record the event unserved and re-admissible.
+Uncertain liveness retains the slot only within that five-minute bound;
+unverified settlement after the stop holds lane admission.
 Settlement returns continuity to the manager rather than retaining an idle PR
-coordinator. Reviewers retain the isolation required by `axstack-review`:
-each runs in a separate Orca child worktree, writes probes and evidence to
-its private per-Dispatch run folder, and reads back evidence before removal.
+coordinator. Each reviewer uses a separate driver-made detached checkout and
+private evidence folder, with evidence read-back before removal.
 
-Set `TMPDIR` for manager and job commands to each Dispatch's 0700 private
-`<run dir>/evidence/<dispatch>/` folder under
-[Workspace hygiene](workspace-hygiene.md).
+Set `TMPDIR` for manager and job commands to an owned 0700 directory under the
+system temp directory, named from the dispatch key and recorded in the receipt,
+following [Workspace hygiene](workspace-hygiene.md).
+Evidence files stay in the private `<run dir>/evidence/<dispatch>/` folder.
 Never write temporary files under `/` or another shared root. Never delete
 through a broad `TMPDIR` glob, sweep a shared temporary root, or wipe a general
 cache. Preserve evidence and any temporary path with uncertain ownership or
@@ -169,7 +159,7 @@ An unchanged exact head and unchanged event identity creates no job; an
 unchanged exact head with a new event identity remains actionable. Event
 identity includes the applicable review ID and body digest, request identity, or other current GitHub event
 receipt. Dedupe from current GitHub state,
-native Orca Task and Dispatch state, and the existing compact run record; do
+native T3 task and thread/run state, and the existing compact run record; do
 not create machine cursor files or a queue engine. Record enough to resume: PR,
 head, base, event identity, mode, owner and worker receipts, verdict,
 submission receipt, hold, and next action. GitHub remains authoritative for
@@ -178,16 +168,16 @@ open state, revisions, reviews, checks, and merge state.
 ## Held job settlement
 
 Use native runtime inspection, not saved prose or silence, to identify an
-actual hold and bind it to the exact Task, Dispatch, terminal, event, and
+actual hold and bind it to the exact task, thread/run, event, and
 evidence. Permission prompts and provider safety refusals are incomplete held
 outcomes: do not answer or bypass them, retry their content through another
-model, or claim completion. Do not forge `worker_done`. Record the held event
+model, or claim completion. Do not forge `AXSTACK-DONE`. Record the held event
 identity and its resume condition in durable continuity. An unchanged hold creates no new job, no
 retry, and no repeated notification; a changed event is reconsidered against
 the original authority rather than assumed safe.
 
-Preserve the prompt or refusal evidence, then follow the version-matched
-orchestration recovery and cleanup guidance for every owned descendant. Use
+Preserve the prompt or refusal evidence, then follow the [T3 runtime](t3-runtime.md)
+recovery and cleanup guidance for every owned descendant. Use
 only supported native lifecycle actions and receipt-supplied next actions;
 saved status, contact loss, and a coordinator narrative do not settle a worker.
 Unknown or user-owned work is never a kill target. Do not release the PR slot
@@ -196,7 +186,7 @@ Unrelated eligible PRs continue after the tree is verified settled, while the
 held PR waits durably for its resume condition.
 
 Execution settlement and cleanup retention are separate. Positive full-tree
-process exit plus native Task and Dispatch settlement frees the slot. Retained
+process exit plus native task and thread/run settlement frees the slot. Retained
 metadata does not occupy an execution slot: preserve it and its evidence for
 reconciliation without reviving the failed job. Likewise, an archive hold
 blocks workspace removal, not settled execution capacity; record the cleanup
@@ -208,7 +198,7 @@ execution teardown pauses the lane before another pass can admit work rather
 than claiming capacity from an uncertain process tree.
 
 When the current event is handled, settle the PR job and descendants, then use
-native `worker-release` for their worker terminals. For a completed non-author
+`t3_thread_organize` to settle their terminal threads after verifying terminal run evidence. For a completed non-author
 PR-job worktree with dirty source or unpushed commits, use the
 [Workspace hygiene](workspace-hygiene.md) salvage path before removal.
 Preserve review evidence not yet durable, pending external results, and user-owned
@@ -270,48 +260,57 @@ or separate model gate.
 
 ## Finite-session teardown
 
-At pass start, clear finished predecessor terminals of the same automation in
-the dedicated workspace only after proving completion, by the exact-handle
-fallback in [Workspace hygiene](workspace-hygiene.md).
-Then run the driver-start orphan sweep for repositories listed in this lane's
-run record plus registered repositories on this host containing eligible settled resources
-of any Axstack run on this host, under the same guards. The sweep is silent when nothing was removed;
-record sweep results and holds in the continuity record's Open holds table.
-
-After admission closes, settle every owned PR job and all descendants before the
-manager session closes; active or unknown descendants keep their PR slot occupied
-and must be reconciled from native state. Release settled worker terminals and
-complete guarded evidence archival and worktree cleanup in this pass. Save
-continuity, open decisions, and the last pass summary using the linked template;
-read back all four sections and the save before closing.
-Use the exact native terminal close for this pass's own terminal from its run
-receipt: `orca terminal close --terminal <exact-handle> --json`. Terminal close
-is the final action. Never use `--all`, a broad or name selector, or another
-terminal in the dedicated workspace; uncertain identity or close outcome holds
-the lane for native reconciliation, never a guessed retry.
-If its own close returns `runtime_error`, leave the terminal for the next pass;
-this expected close failure is not a hold.
-Waiting PRs still occupy zero slots once their owned trees settle. A failed
-cleanup remains a recorded hold with its exact resume condition, but does not
-keep settled execution active.
-
-The activation canary must prove fresh sessions in the dedicated workspace,
-same-lane overlap admission, recovery after session loss, nested dispatch depth,
-process and memory effects, and terminals in the dedicated workspace bounded
-over repeated passes. Do not activate on source checks alone.
+Each pass retires settled predecessor passes and reports the retained worktree
+count. Retirement requires terminal run evidence and settled descendants,
+durable continuity, evidence read-back and verified salvage where needed;
+follow [Workspace hygiene](workspace-hygiene.md) and [T3 runtime](t3-runtime.md).
+Then run the driver-start orphan sweep under Workspace hygiene; the sweep is
+silent when nothing was removed. Record sweep results and holds in continuity's
+Open holds table.
+The orphan sweep covers the run record's repositories plus registered repositories on this host.
+`t3_thread_organize` settle/archive changes metadata only; exact guarded Git
+worktree removal remains separate. Unknown, active or user-taken-over threads,
+ambiguous publication and failed salvage stay preserved.
+
+A review-manager pass may retire a predecessor pass's local `t3code/*` branch
+with exact `git branch -D <branch>` only when ALL hold: the predecessor pass is
+settled and proven run/lane-owned by recorded identity, its descendants and
+evidence are settled, no worktree has the branch checked out, no remote
+counterpart exists, its tip equals the recorded tip, and its tip is an ancestor
+of the verified remote default branch. Otherwise hold; all other `git branch -d`
+rules remain unchanged.
+
+Past the authorized storage limit (default 20 retained lane worktrees), disable the schedule
+with `update_scheduled_task` using `enabled:false` and hold.
+Read back the disabled schedule with `list_scheduled_tasks`; uncertainty holds.
+
+After admission closes, settle every owned PR job and all descendants before
+the manager pass ends. Complete guarded evidence archival and worktree cleanup.
+Save continuity, open decisions, and the last pass summary using the linked
+template; read back all four sections and the save before ending the finite turn.
+Waiting PRs occupy zero slots after their trees settle. Cleanup retention holds
+removal, not settled execution capacity. The next pass retires this settled pass.
+
+## Activation canary
+
+The canary runs two overlapping `run_scheduled_task_now` passes and proves one
+admission owner per PR. The canary reviews or correctly no-ops one real PR event.
+The canary reconciles a killed predecessor.
+With a temporary limit equal to the current count, the canary disables the
+schedule and verifies that the following interval creates zero new pass worktrees.
+The previous review-manager automation is disabled, never deleted, only after all four T3 canary checks pass.
+A firing timestamp proves neither delivery nor useful completion.
+Source checks alone do not prove launch, overlap, recovery, or growth behavior.
 
 ## Recovery and limits
 
-On a lost manager session, native recovery first reconciles actual Orca
-workers and Dispatches, GitHub state, and the compact run record. Reuse valid
-unchanged receipts. Unknown ownership blocks only the affected PR, as does
-unknown liveness, approval, or publication outcome; recovery never copies old
-capability, replaces a live writer, or takes over live user work. Other
-unambiguous work may proceed.
+On a lost manager session, reconcile native T3 workers, task status, thread/run
+state, GitHub state, and the compact run record. Reuse valid unchanged receipts.
+Unknown ownership blocks only the affected PR; unknown liveness, approval or
+publication outcome preserves its hold. Recovery never replaces a live writer
+or takes over user work. Other unambiguous work can proceed.
 
-Use only native schedules and Orca orchestration. Add no daemon, shell precheck,
+Use only native T3 schedules and orchestration. Add no daemon, shell precheck,
 watchdog script, custom scheduler, cursor or pending sidecar, runtime database,
 workflow state machine, decision interpreter, or programmatic escalation gate.
-The live VPS activation, native fresh-session and overlapping-pass behavior, recovery path,
-nested dispatch depth for coordinator-launched leaves, and resource ceiling
-remain unverified until the canary succeeds.
+Live VPS activation and the four canary outcomes remain unverified until exercised.

package/skills/axstack/references/autopilot.md

@@ -11,38 +11,51 @@ not a mode change.
 
 Advance only after the finishing phase returns its completed identity (a
 small-change intent, approved spec, matching ticket map, merge-ready or merged
-state) and the run record has no open hold. A hold from any phase stops the run:
-record its reason, owner, and resume condition, then take no dependent action.
-That covers tracker access, adviser or arena-seat availability, diligence
-FINDINGS when the phase records a hold, CI-wait timeout, readiness UNKNOWN,
-dismissed approval, wake or cleanup uncertainty, single-provider routing, an
-existing tag or version, and failed publish. Diligence FINDINGS during implement
+state) and no hold affects the next action. Record each hold's reason, owner,
+scope, and resume condition. Run-wide holds for authority, scope, cancellation,
+or run-spanning serious risk stop the run. A task, PR, resource, or operation hold
+blocks only its dependants; continue independent authorized work. Unclear impact
+holds the potentially affected work until its boundary is resolved. For example,
+tracker access, adviser or arena-seat availability, CI-wait timeout, readiness
+UNKNOWN, dismissed approval, wake or cleanup uncertainty, single-provider routing,
+an existing tag or version, and failed publish hold the work that needs them.
+Diligence FINDINGS during implement
 follow its §6 repair route; at spec, tickets, or release preparation the driver
 resolves them before advancing, and only a recorded hold pauses autopilot.
 
 Record `Autopilot: on | paused (<hold>; resume: <condition>) | off (cancelled
-<ts>)` and the next step in the private run record. A user answer to the hold
-resumes after reconciliation; silence does not.
+<ts>)` and the next step in `Next:`. Keep `on` for scoped holds
+while independent work proceeds; use `paused` when no authorized action can
+advance. A user answer to the hold resumes affected work after reconciliation;
+silence does not.
+The driver records each verified `Autopilot:` transition in the private run
+record, which remains authoritative.
 Awaiting human spec approval records `Autopilot: paused (spec approval; resume:
 human approval)` as a decision hold eligible under the Notification policy.
 
 ## Phase sequence
 
 - Small: Align read-back, small-change intent, implement, watch in maintain
-  mode, human merge. An opted-in Align refinement is part of read-back.
+  mode, human merge. An opted-in Align refinement is part
+  of read-back.
 - Substantial: Align, spec draft with advisers and diligence, human spec
   approval at gate 1, tickets with diligence, implement, watch in maintain mode,
-  merge-ready, human merge. An opted-in Align refinement is part of gate 1.
+  merge-ready, merge under the watch §5 predicate. An opted-in Align refinement
+  is part of gate 1.
 
 Do not seek another phase-start instruction after a completed identity.
-Spec approval is always the human's decision. Every PR merge is the human's,
-including a release PR and each PR in a stack, bottom-up.
+Spec approval is always the human's decision. Audit self-improvement PRs follow
+the same merge predicate. Only the original chat-run driver with the approved
+ticket map may auto-merge PRs satisfying `axstack-implement` §6's approved
+ticket-map membership and `integration` base conditions. The user merges peer
+PRs and PRs into `deploying` bases. Managers, workers, reviewers, automations,
+and standalone watches never merge. A stack follows its guarded bottom-up rule.
 
 ## Implement into maintain watch
 
 When implement publishes the run's first PR, arm exactly one `axstack-watch`
-chat-run in authorized maintain mode. Use the 10-minute harness wake, with the
-existing Orca fallback when unavailable. Later run PRs join after verified
+chat-run in authorized maintain mode. Read the [T3 runtime boundary](t3-runtime.md) and use its bound
+`schedule_task` wake (`everyMs:600000`), recording the scheduledTaskId. Later run PRs join after verified
 publication readback; an explicitly adopted PR joins only with its maintenance
 snapshot. The original driver alone routes work; one author writes each
 candidate. Until a PR is merge-ready, wakes feed implement §6 step 4. After
@@ -91,13 +104,13 @@ mutation require the recorded per-run authority and their existing checks.
 ## Resume, cancel, and notify
 
 At every entry (user message, wake, compaction, or new chat), reconcile the
-owner, authoritative Dispatch, approved revision, PR membership, uncertain
+owner, authoritative attempt, approved revision, PR membership, uncertain
 tags, wakes, publications, and completed receipts under lifecycle and
 run-record before advancing. Only the original driver advances. Wakes do not
 reset attempt budgets and do not grant approvals. Cancel sets `Autopilot: off`,
 stops new actions, and ends the watch under watch §6 with guarded settlement.
-Cancellation does not cancel a running author Dispatch by inference; let it
-report, then settle that exact Dispatch under lifecycle guards without new
+Cancellation does not cancel a running author run by inference; let it
+report, then settle that exact attempt under lifecycle guards without new
 publication.
 
 Use the run's recorded Notification policy through `axstack-relay`.

package/skills/axstack/references/candidate-publication.md

@@ -37,14 +37,19 @@ Any author repair creates a new revision and repeats this boundary.
 
 ## Immutable checkout shape
 
-The immutable checkout is an Orca worktree of the already-registered repo:
-`ORCA worktree create --repo id:<repoId> --name review-<pr>-<sha7> --json`,
-then `git checkout --detach <candidate SHA>` inside it. Never materialize it
-as a `git clone` into a temp directory followed by `orca repo add`; each
-`repo add` registers a duplicate top-level repo and leaves a stale record once
-the directory is gone. Release preparation uses a `release/<version>` worktree
-of the same registered repo the same way. Release the checkout with
-`ORCA worktree rm` after its receipt is recorded.
+The driver creates the immutable review checkout with `git worktree add --detach <run>/checkouts/<key> <sha>` at the confirmed candidate SHA and pinned base.
+Follow [T3 runtime](t3-runtime.md) for async `delegate_task` and exact attempt
+identity. The checkout is disposable, made from the existing repository; never
+register a duplicate repository or replace it with a movable branch checkout.
+Delegated reviewers must `cd` into their separate detached checkout; tracked candidate files remain read-only and outputs go to their private evidence folder.
+Snapshot driver HEAD and full status, including untracked entries, before dispatch.
+After each delegated completion, compare the driver HEAD and `git status --porcelain` with their pre-dispatch values; any change holds advancement.
+Each peer reviewer has a separate checkout and evidence folder with no first-pass
+cross-read. Later review gets a fresh checkout.
+Before removing a reviewer checkout, read back its report and supporting evidence, then use exact `git worktree remove <run>/checkouts/<key>` without force.
+Verify Git worktree absence under [Workspace hygiene](workspace-hygiene.md);
+reviewer retirement preserves the separate author candidate until merge or closure.
+Release checks use the same driver-made SHA-pinned detached-checkout procedure.
 
 For a release PR, dispatch `axstack-diligence` under
 [Diligence](diligence.md) to check the release PR body

package/skills/axstack/references/contracts.md

@@ -39,24 +39,25 @@ the revised scope and plan.
 Validate the configured provider and model at actual launch. If it is
 unavailable or exhausted, pause affected work, record the gap, and ask the
 user. Never infer a route from quota state or subscription entitlement. Every
-substitution requires the user's decision: configured alternatives and native
-fallback prose are not defaults. The only within-class exception is explicit
-model rejection before the first turn: Codex may retry with `--retry-of` using
-the next eligible version in the same class, provider, and effort, recording
-the failed ID, error, and fallback ID. Claude rejection holds. Timeout, quota,
-and auth failures hold.
+substitution requires the user's decision: configured alternatives are not
+defaults. Rejection, timeout, quota and auth failures hold affected work.
+Read the [T3 runtime boundary](t3-runtime.md) before dispatch, receipt consumption
+or recovery; resolve models from the saved capabilities snapshot and verify
+requested and effective settings separately.
+Optional seats follow [Role roster](role-roster.md), while required seats,
+including resolved `model: null` bindings, hold without substitution except that a base auditor
+preflight rejection follows [Close-out](lifecycle.md#close-out).
 
 ## Driver and adviser split
 
-The current chat is the driver, whatever model runs it; there is no driver
+The current T3 thread is the driver, whatever model runs it; there is no driver
 profile. Record the driver's provider and model in the run record.
 
 For Align and Spec, the driver forms an independent assessment first, then
 consults `axstack-advisor-astra` and `axstack-advisor-opus` independently with
-the same bounded evidence and question. The one exception is an arena-grade
-Align question: there the driver frames the brief and rubric, the advisers
-author candidates, and the driver assesses only after the candidates and judge
-verdicts return. The driver synthesizes disagreements,
+the same bounded evidence and question. The exception covers every brainstorm: the driver frames
+its brief and rubric and assesses only after the candidates and required judge
+rounds return. The driver synthesizes disagreements,
 owns the decision, and the user still approves the spec. Reuse each valid
 unchanged receipt; changed evidence, scope, or question requires a fresh
 receipt. If either adviser is unavailable, Align and Spec hold without model or
@@ -102,7 +103,7 @@ gate.
 
 - The driver owns run scope, cross-PR coordination, integration, and every
   selected external-tracker mutation. The checker reports discrepancies only.
-- One Orca execution host owns a run. There is no fixed active-PR count;
+- One T3 host/server owns a run. There is no fixed active-PR count;
   fanout is dependency- and capacity-driven within configured host resource and
   spending limits. The driver reduces fanout when the run record shows rework,
   review backlog, or resource pressure, queues conflicting or dependent work,

package/skills/axstack/references/design-lens.md

@@ -15,15 +15,15 @@ sketch through the scope identity.
   not reclassify work: Rung 1 can stay small. An unsettled material design
   question still makes routing reassess size.
 - **Rung 2 — arena.** A Rung 1 design that also meets the existing ADR test:
-  a meaningful, hard-to-reverse, non-obvious trade-off. Use Align's all-family
-  arena for that question.
+  a meaningful, hard-to-reverse, non-obvious trade-off. Use [Brainstorm](../../axstack-brainstorm/SKILL.md)
+  with its Rung 2 judge rounds for that question.
 
 There is no numeric threshold, file-count gate, or class-count gate.
 
 ## Questions in order
 
 Ask only unresolved areas in numbered `Qn` rounds of one to three. Give each a
-recommendation, reason, and trade-off; use Align's adviser critique. Design and
+recommendation, reason, and trade-off; use Align's inline brainstorm synthesis. Design and
 arena questions share its unchanged budget: 20 normally, a justified extension
 to 35, then opted-in refinement of at most five.
 

package/skills/axstack/references/diligence.md

@@ -1,6 +1,8 @@
 # Diligence
 
-Dispatch `axstack-diligence` through Orca with a pinned brief and evidence paths.
+Read the [T3 runtime boundary](t3-runtime.md) before dispatch.
+Dispatch `axstack-diligence` with async `delegate_task` in the driver worktree,
+using a pinned brief and private evidence paths.
 It is read-only, never authors or edits, and returns `PASS` or `FINDINGS`
 with locations, observed evidence, and limits. A stale or missing receipt is
 not a pass. Keep its first pass independent of other reviewers and workers.