axstack 0.24.0 → 0.25.0

package/skills/axstack-review/SKILL.md

@@ -13,7 +13,9 @@ Manual review keeps the user’s chat and workspace open.
 
 Produce evidence-bound findings for an exact revision using the review count
 and model routing required by its mode. Report within the requested authority;
-the human merges PRs unless separately authorized otherwise.
+for own PRs, automatic merge is the default under the
+[watch predicate](../axstack-watch/SKILL.md#5-state-readiness-precisely).
+Reviewers never merge.
 
 When the current session is a fresh review-manager session, load
 [Native PR managers](../axstack/references/automations.md) and follow only its
@@ -35,6 +37,27 @@ carry the required escalation field and every eligible peer PR takes a binding
 
 For performance claims only, load [Performance checklist](../axstack/references/performance-checklist.md).
 
+## Finding severity
+
+Rate every review and diligence finding as `high`, `medium`, or `low` under
+this shared rubric.
+
+- `high` = correctness, security, data-loss, or contract defect with real impact.
+- `medium` = material behaviour, test, or maintainability defect, a softened or
+  dropped obligation, or an evidence-integrity mismatch (SHAs, counts, missing red/green logs).
+- `low` = polish that does not change behaviour.
+
+The reviewer rates each finding.
+Round uncertain ratings up.
+Only diligence can raise a rating.
+Nobody can lower a rating.
+`medium` and `high` findings block `APPROVE`.
+Fix and re-review every `medium` or `high` finding.
+`low` findings do not block approval or merge.
+The owner records all low findings in one follow-up issue in the repository's
+tracker (GitHub Issues, or Linear for `defi-com`), linked from the PR.
+The follow-up issue never gates merge.
+
 ## Codebase findings mode
 
 Use this manual mode for existing code at a pinned exact source revision and a
@@ -197,10 +220,9 @@ This section applies to peer and authored PR modes.
    private per-dispatch artifacts. Each reviewer uses a separate driver-made disposable detached checkout;
    preserve its private evidence before removal.
    - **Peer:** exactly two independent final reviewers,
-     `axstack-reviewer-primary` and `axstack-reviewer-secondary`, materialized
-     from the routing snapshot. Send both the identical six-angle brief with no
-     first-pass cross-read: neither reads the other's initial findings or
-     creates children.
+     `axstack-reviewer-primary` and `axstack-reviewer-peer` from the routing snapshot.
+     Send both the identical six-angle brief, with no first-pass cross-read or children.
+     Mixed peer reviewers share a model, with independence from separate sessions, the identical brief and an isolated first pass.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
@@ -222,10 +244,9 @@ This section applies to peer and authored PR modes.
      reviewer covers the complete brief alone. No author or owner session may
      review, even if its role or provider label changes.
 
-   Mixed preset review is cross-provider. Single-provider review uses the
-   configured different models and is not cross-provider independence. The
-   claude-only Sonnet explanation author/reviewer exception is session
-   independence only: separate `axstack-explainer` at high and
+   Mixed authored review is cross-provider. Single-provider review uses different
+   models, not cross-provider independence. The claude-only Sonnet explanation
+   exception is session independence only: separate `axstack-explainer` and
    `axstack-explainer-review` at high. It never permits same-model code review.
 
    For the existing high-stakes Opus high author / Sol high checkpoint route,
@@ -265,6 +286,12 @@ This section applies to peer and authored PR modes.
    inspect the named keepers. Removing a test without a named keeper or
    vacuity/obsolescence evidence is a finding. Peer mode remains report-only.
 
+   The authored reviewer checks the `Revert` line against the diff.
+   Follow [Revert line](../axstack/references/candidate-publication.md#revert-line)
+   for its format and classification.
+   Record the `Revert` line in the review receipt.
+   Rate a wrong or missing `Revert` line at least `medium` under [Finding severity](#finding-severity).
+
    Under angle 6, verify the recorded shape against the pinned head and base.
    A mismatch between the recorded and measured total is a finding. Apply the
    level matching the measured total. The rationale band requires only its
@@ -382,7 +409,9 @@ Evidence: <run dir>/evidence/<dispatch>/ (report and probe paths)
 Verdict: <APPROVE | REQUEST_CHANGES | INCOMPLETE>
 Coverage: <angles + acceptance + executable evidence checked>
 Limitations: <unverified boundaries + why>
-Findings: <evidence + consequence each>
+Findings: <severity + evidence + consequence each>
+Revert: <declared line + diff-based assessment in authored mode>
+Agent-authored comment and thread IDs: <receipt-recorded IDs or none>
 Safety fact: <the one fact the change is safe because of> — <ladder step + proof | unproven>
 Escalate to user: <yes | no> — <criterion> — <reason>
 ```
@@ -426,7 +455,9 @@ evidence, limitations, validated risk, or an internal `INCOMPLETE` report.
 - A missing, mismatched, stale, or materially changed input blocks approval and
   merge-ready declarations while readonly investigation continues.
 
-The human merges by default. Review approval never supplies merge authority.
+The recorded owning watch thread applies watch §5's guarded merge and card rules.
+Review approval alone never supplies merge authority. Peer PRs stay user-merged.
+User merges are bottom-up for a stack.
 
 ## Report-only scope
 

package/skills/axstack-watch/SKILL.md

@@ -141,63 +141,142 @@ the existing hold open.
 
 The owner checks the full predicate below before declaring merge-ready. API or
 permission errors leave readiness `UNKNOWN`; review approval alone is not
-merge-ready. Merge-ready is an observed state distinct from merged. The human
-merges by default; only the chat-run driver may use the guarded merge path in
-`axstack-implement` §6. Standalone watch and peer PRs retain human merge.
+merge-ready. Merge-ready is an observed state distinct from merged.
+Automatic merge is the default for own PRs under a chat-run watch or a standalone
+watch in authorized maintenance mode, including small and adopted work.
+The merge actor is the recorded owning thread of that watch (`axstack-owner`
+for standalone maintenance).
+A missing or idle owner never transfers merge authority, because the reconcile and
+explicit-transfer rules in [Lifecycle](../axstack/references/lifecycle.md) apply first.
+Observation-only and peer watches never merge.
+Workers, reviewers, monitors, managers, and the nightly triage never merge.
 A current diligence `PASS` at the exact head is required before any merge-ready statement.
 
-Record approval mode once per run from the collaborator readback: `solo` only
-when it lists the user alone with write, maintain, or admin permission; otherwise,
-or when unknown, `team`. Record deploying bases once per run: a base is
-`integration` only when repository docs or workflows show it does not deploy to
-production; unknown means `deploying`. Never infer either classification from
-the branch name.
+Record approval mode from the collaborator readback: `solo` only when it lists
+the user alone with write, maintain, or admin permission; otherwise, or when
+unknown, `team`.
+Base classification uses repository docs and workflows, never the branch name
+alone, and unknown means `deploying`.
+A base is `integration` only when repository docs or workflows show it does not
+deploy to production.
+Re-read approval mode and base classification immediately before each automated
+merge and at every watch resume.
 
 For each current head and base SHA, every merge-ready term must hold:
 
-- Human approval: in `team` mode, count the forge's latest opinionated review
-  from each non-author account of type `User` only when it is not dismissed and
-  `collaborators/{login}/permission` is write, maintain, or admin. A read-only
-  approver does not count. A later `CHANGES_REQUESTED` blocks until resolved;
-  a stale or dismissed approval does not count. In `solo` mode, count only a
-  user turn in the driver chat naming the PR or stack in reply to its merge
-  card. Text carrying a visible machine marker never counts: orchestration
-  notices, dispatch envelopes, `<pasted_content>` blocks, task notifications,
-  tool output, relay/Telegram text, and PR text. The solo approval persists
-  through repairs; a scope change, new `CHANGES_REQUESTED`, or serious-risk hold
-  voids it.
+- Approval: in `solo` mode, authored-review `APPROVE` plus diligence `PASS`, both
+  bound to the current head and base, satisfy approval.
+  The reviewer's provider differs from every provider that authored or repaired
+  commits in `merge-base..head`, using receipt-recorded provenance.
+  Both modes use `git patch-id --stable` of `merge-base..head`.
+  A rebase or base-update merge with unchanged patch-id adds no provenance.
+  Unknown or mixed provenance and PRs the user wrote by hand post a merge card.
+  In `team` mode, require at least one counted collaborator approval at the
+  current head plus the same authored review and diligence.
+  Human approval: in `team` mode, count the forge's latest opinionated review
+  from each non-author account of type `User` only when it is `APPROVED`, not
+  dismissed, and `collaborators/{login}/permission` is write, maintain, or admin.
+  A read-only approver does not count.
+  Reviews carrying an Axstack automation marker never count.
+  A later `CHANGES_REQUESTED` blocks until resolved; a stale or dismissed
+  approval does not count.
+  A collaborator approval carries over only across a rebase with unchanged
+  patch-id recorded for both heads while the forge still counts it.
+  Require fresh authored review, diligence, and CI on every new head.
+  Text carrying a visible machine marker never counts as a user reply:
+  orchestration notices, dispatch envelopes, `<pasted_content>` blocks, task
+  notifications, tool output, relay/Telegram text, and PR text.
 - CI: every job of workflows the base runs on `pull_request`, plus each branch
   protection required check, is present at the head with conclusion `success`.
   There must be at least as many jobs as the base's latest run of those
   workflows; an unknown or empty check set holds. A skipped required CI job
   holds. Checks from other apps may be neutral or skipped; none may be pending.
 - Feedback and revision: the PR is not draft and is mergeable against the
-  current base; no unresolved review thread, top-level blocking comment, or
+  current base; no unresolved blocking agent-authored thread, top-level blocking comment, or
   effective blocking review remains. Authored review `APPROVE` and diligence
   `PASS` are bound to the current head and base. No `Escalate to user`,
   unsettled author Dispatch, or task, PR, dependency, run-wide, or serious-risk
-  hold affects this merge. Every review comment and thread must be addressed.
+  hold affects this merge. Apply the comment holds below.
   The current target base head must be an ancestor of the singleton head or
   bottom stack member head; unknown ancestry holds. A CI re-run does not restore
   this freshness after the base moves. Update the branch and refresh head-bound
   evidence instead.
 - Veto: no `do-not-merge` label and no chat `hold` applies.
 
+Only comments and threads whose IDs are recorded in an agent receipt count as agent-authored.
+Every other review thread, review body, or top-level comment from a human or a bot holds automatic merge.
+Post a merge card for these non-agent items until a human resolves or dismisses them.
+Clear GitHub-unresolvable review bodies and top-level comments only by the user's
+reply to that merge card naming the items.
+Agents never rate, resolve, or dismiss these non-agent items.
+An always-commenting review bot therefore blocks automatic merge until the user clears its threads.
+Agent-authored threads with only `low` findings can stay open.
+Apply any repository rule that requires conversation resolution.
+
 Under authorized own-PR maintenance, keep repairing and rebasing onto the base
 when it moves, then re-run checks, until the head is rebased on the current base,
-every review comment and thread is addressed, human approval still counts, and
-required CI is green; only then record merge-ready. A human approval persists
-through fixes and rebases while the forge counts it: never re-request that
-approver's review. If the forge dismissed it or requires last-push approval,
-hold and tell the user without auto-requesting re-review. Initial review
-requests before any human approval remain allowed.
-
-Post a merge card when every term except human approval holds. Bind it to the
-PR head and base SHA; list CI, authored review and diligence at those SHAs,
-counted human approvals and bot votes with each vote's SHA and stale flag.
-In `solo` mode the card is a user-decision hold under the recorded Notification
-policy with one relay; relay text never supplies approval. A changed head or
-base requires a refreshed card.
+the comment holds above are cleared, the approval term holds, and required CI is
+green; only then record merge-ready.
+Never re-request a collaborator's review while its approval still counts under
+the carryover rule above.
+If the forge dismissed it or requires last-push approval, hold and tell the user
+without auto-requesting re-review.
+Initial review requests before any human approval remain allowed.
+
+### Automatic merge eligibility and cards
+
+Team mode targets only `dev` when repository docs or workflows prove it is
+non-production.
+Solo mode targets `main` or any other `integration` base.
+For a `gh stack`, only the bottom member's base must be eligible.
+Each other member's base must be the next-lower member's branch at its reviewed head.
+Every member must meet every other term and exclusion.
+A stack holds until every member of its approved plan (the ticket map or the
+adopted stack's recorded members) is published.
+Reviewed members are never retargeted to become eligible.
+
+Never auto-merge PRs authored by anyone other than the user or the user's agents.
+Never auto-merge promotion PRs (`dev` to `staging`, `staging` to `prod`).
+Never auto-merge PRs with a `deploying` or unknown base.
+Never auto-merge release PRs.
+Never auto-merge PRs changing anything under `.github/`.
+Never auto-merge PRs changing a file a workflow step invokes by path.
+Never auto-merge PRs changing the package manifest or lockfile.
+Never auto-merge PRs changing test-runner config.
+Never auto-merge PRs changing branch-protection or ruleset config.
+Never auto-merge PRs changing `CODEOWNERS`.
+Test sources stay eligible.
+Never auto-merge PRs changing Axstack merge-authority text (examples, not a closed
+list): `contracts.md`, `autopilot.md`, `lifecycle.md`, `routing.md`, `role-roster.md`,
+`t3-runtime.md`, `diligence.md`, `profiles/presets/*.json`, `axstack-watch`,
+`axstack-implement`, `axstack-review`, and `AGENTS.md`.
+Never auto-merge PRs whose revert line is not `clean`.
+Read the revert gate from the declaration whose line starts with `Revert:`
+at line start in the PR description.
+A quoted format inside a bullet never counts as the declaration.
+Never auto-merge PRs held under the comment rules above.
+`--admin` and rule bypass are never used.
+`Auto-merge: off` for a run or PR makes the merge card wait, and it waits for the user.
+
+Post a merge card for every nonqualifying approval, base, exclusion, or off case.
+Bind it to the PR head and base SHA; list CI, authored review and diligence at
+those SHAs, counted collaborator approvals and bot votes with each vote's SHA
+and stale flag, and the causes holding this merge.
+A card that needs the user's decision is a decision hold under the recorded
+Notification policy with one deduplicated relay; relay text never supplies approval.
+A changed head or base requires a refreshed card.
+For an own PR on an `integration` base, the user's reply to the card authorizes
+the merge actor to merge under the guarded path, subject to the exceptions below.
+In `solo` mode the user's merge-card reply authorizes the guarded merge of
+user-written PRs or PRs with unknown or mixed provenance.
+In `team` mode a reply never replaces counted collaborator approval.
+In `team` mode the reply only clears an ineligible base, auto-merge turned off,
+and an open human or bot comment.
+PRs in the CI, manifest, merge-authority, or non-`clean` revert categories are
+merged by the user on the forge.
+Promotion, release, `deploying`-base, and peer PRs are merged by the user on the
+forge, and the card only reports readiness.
+User merges are bottom-up for a stack.
 
 Immediately before each automated merge, re-read every term from the forge.
 Confirm merge commits are allowed, `delete_branch_on_merge` is false, and the
@@ -228,22 +307,25 @@ merge result is a run-wide hold on further automated merges until resolved.
 
 ## 6. End and preserve continuity
 
-End a chat-run watch after all members merged or closed and the run's release
-step is settled or not applicable, user cancellation, or the recorded wake
-expires. Without an Autopilot or Release record, the release step is not
+End a chat-run watch only after all members merged or closed, launched work is settled,
+and the run's release step is settled or not applicable, or user cancellation.
+Without an Autopilot or Release record, the release step is not
 applicable to this watch. A required PR closed without merging records a
-decision hold and the wake remains active while unexpired until the user
-resolves scope, cancels, or the wake expires. Stop the chosen wake and verify
+decision hold and the wake remains active until the user resolves scope or cancels.
+Stop the chosen wake and verify
 its stop receipt; a failed or uncertain schedule deletion is a hold.
 Delete only the recorded schedule and verify absence with `list_scheduled_tasks` under
 [Watch runtime](references/watch-runtime.md#chat-run-watch).
 
+Run Close-out after the watch ends, subject to its existing acceptance conditions.
+Keep merge-card replies and `hold` in the driver thread.
+
 End a standalone watch early when all required PRs merge, at cancellation, or
 at its shared default 24 h deadline. In every case, stop all owned
 registrations and verify their receipts.
 
 At every end condition, leave the compact state below in the private run record
-and report it in the current chat, even when work remains. Expiry grants neither
+and report it in the current chat, even when work remains. Standalone expiry grants neither
 silent renewal nor ownership-transfer authority.
 
 Transfer ownership through the runtime-owned T3 transfer route only when the
@@ -259,7 +341,8 @@ Owner: <profile + session> Worktree: <path>
 Scope: <approved rev, small-change intent, or maintenance snapshot>
 Capability: <issue + lifecycle state>
 CI/review: <current states + evidence refs>
-Watch: <chosen wake mechanism, native id or command, stop receipt + expiry>
+Watch: <chosen wake mechanism, native id or command, native schedule lifetime + re-arm receipts + stop receipt>
+Standalone watch: <shared expiry>
 Remaining: <next actions + owner>
 Resume: <known commands or verified refs needed to reconcile from this revision>
 ```

package/skills/axstack-watch/references/repair-publication.md

@@ -63,3 +63,6 @@ confirming the intended operation is absent.
 Publication ends with a remote receipt proving that the reviewed revision and
 exact replies landed once, or a recorded hold naming the unmatched input and
 next owner.
+
+After verified publication of an own PR, the owner must follow
+[PR previews](../../axstack/references/preview.md) to decide on or restart its preview.

package/skills/axstack-watch/references/watch-runtime.md

@@ -2,6 +2,9 @@
 
 Read this before starting, resuming, or stopping automated PR observation.
 
+For each own PR, the owner must follow [PR previews](../../axstack/references/preview.md)
+when deciding on a preview, restarting it after a head change, or tearing it down.
+
 ## Standalone watch
 
 A standalone PR owner remains accountable through the default 24-hour window.
@@ -22,14 +25,24 @@ is verified while watching, plus explicitly adopted PRs with accepted
 maintenance snapshots. An unrelated self-authored PR is outside this Run. Retain
 merged/closed members in the record; scan reopened members. Ambiguous membership
 or publication holds completion. Draft members stay watched but cannot be
-merge-ready. A PR raised after the watch stops needs a new invocation.
+merge-ready. An own PR published after the watch stops arms a new watch under
+[Autopilot](../../axstack/references/autopilot.md#own-pr-publication-into-maintain-watch)
+after verified readback, subject to the user's explicit publication boundary.
 
 The initiating T3 thread remains the sole driver and `progress.md` writer.
 Use the bound run watch from [T3 runtime](../../axstack/references/t3-runtime.md):
 `schedule_task` with `bindToCurrentThread:true`, `everyMs:600000`, a stable
 `clientRequestId`, and the authorized watch prompt. Record the schedule ID,
-driver thread, chosen mechanism and expiry; the watch inherits the driver binding.
+driver thread, chosen mechanism and native schedule lifetime; the watch inherits the driver binding.
 One bound schedule serves both the run watch and the chat-run watch; never create a second watch.
+The chat-run watch never expires or waits for re-authorization while PRs remain open.
+If the native schedule has a lifetime, the driver re-arms it at a wake.
+Use `update_scheduled_task` on the recorded schedule ID for cadence changes and re-arming.
+After 7 days with no event on any watched PR, and only with no unsettled launched work,
+change the wake cadence from 10 to 60 minutes.
+On the next event on a watched PR, restore the wake cadence to 10 minutes.
+If launched work becomes unsettled, restore the 10-minute cadence.
+Read back each schedule update and record its receipt; an uncertain update holds affected work.
 Each wake reconciles all unsettled runs before running the authorized maintenance loop.
 A failed run holds incomplete work even when its writer sent no receipt.
 A missing schedule capability holds activation. Delegated roles follow T3 runtime;
@@ -81,7 +94,11 @@ merged milestones (at most two across implementation and release), or a
 serious-risk hold.
 Quiet ticks never notify.
 
-The driver alone routes repair. Re-read remote head/base and T3 ownership.
+The driver alone routes repair.
+The driver routes rebases and review feedback to the PR's author for repair.
+For an adopted PR whose author this run did not launch, use a new author attempt under the adoption rules.
+The watch never writes candidate source.
+Re-read remote head/base and T3 ownership.
 Independent PRs may repair in parallel in separate T3 writer worktrees within
 measured host capacity. Two issues on the same PR use one author and one
 candidate; never create competing writers. A stack parent change invalidates
@@ -91,7 +108,10 @@ then rebase and revalidate children. Run-launched implementation PRs follow
 review. Explicitly adopted own PRs follow [Repair and
 publication](repair-publication.md): independent exact-local-SHA review precedes
 driver-owned `gh stack` publication and remote readback. The driver never
-self-reviews; the human merges. Observation alone grants no repair or
+self-reviews.
+For own PRs, automatic merge is the default under the
+[watch predicate](../SKILL.md#5-state-readiness-precisely).
+Observation alone grants no repair or
 public-reply authority.
 
 On new comments, failed checks, or base movement, repeat repair, the
@@ -104,19 +124,19 @@ re-read all feedback and approvals at the current head before readiness.
 Re-reading approvals checks current state, not re-requesting review from a
 human who already approved.
 
-Stop the chosen wake only when every watched PR is merged or closed and the
-run's release step is settled or not applicable, the user cancels, or it
-expires. Without an Autopilot or Release record, the release step is not
+Stop the chosen wake only when every watched PR is merged or closed,
+launched work is settled, and the run's release step is settled or not applicable,
+or the user cancels. Without an Autopilot or Release record, the release step is not
 applicable to this watch. A required PR closed without merging records a
-decision hold and the wake remains active while unexpired until the user
-resolves scope, cancels, or the wake expires; the run is not release-eligible.
+decision hold and the wake remains active until the user resolves scope or cancels;
+the run is not release-eligible.
 Delete only the recorded watch with `delete_scheduled_task` and read back its absence with
 `list_scheduled_tasks`.
 An uncertain delete preserves the hold and recorded schedule ID.
 Re-read membership and confirm no ambiguous publication or unsettled pass;
 cancellation prevents new work but does not prove running workers exited.
-For a chat-run watch, keep the bound run watch armed until every watched PR is merged or closed
-and the release step is settled or not applicable, or until user cancellation or expiry.
+For a chat-run watch, keep the bound run watch armed until every watched PR is merged or closed,
+launched work is settled, and the release step is settled or not applicable, or until user cancellation.
 For a chat-run watch, defer the T3 runtime's "nothing remains unsettled" deletion until those chat-run stop conditions.
 The driver separately settles workers, preserves evidence, and archives the run;
 an unavailable driver leaves those steps pending. The standalone 24-hour expiry