axstack 0.24.1 → 0.25.0

package/README.md

@@ -42,9 +42,9 @@ implementation. Research, explanation, and peer review can start directly.
 | Failure mode | How Axstack responds |
 | --- | --- |
 | Wrong thing built | Align rounds clarify the request; every brainstorm runs a light arena across configured families. Use judges only for Rung 2 hard-to-reverse choices. |
-| Nobody really reviewed it | Strict TDD checks behavior first; with the mixed preset, cross-provider review checks the exact revision. |
+| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review uses two isolated Sol-high sessions at the exact revision. |
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
-| Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and a human merges. |
+| Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 
 ## Quick start
 
@@ -106,7 +106,9 @@ upgrades, conflicts, and uninstalling.
 - Peer PRs receive two independent reviews. Authored changes receive a reviewer
   selected from the author's configured pairing. Reviews bind to exact revisions.
 - Agents keep accepted decisions and evidence for resume. Missing authority,
-  unavailable models, and serious risks surface as holds. The human merges by default.
+  unavailable models, and serious risks surface as holds. For own PRs, automatic
+  merge is the default under the
+  [watch predicate](skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
 
 Choose one explicit preset (each contains all role IDs): [mixed](profiles/presets/mixed.json)
 (recommended), [codex-only](profiles/presets/codex-only.json), or
@@ -122,21 +124,58 @@ pair seats in `mixed` and `codex-only`; `claude-only` records them as absent.
 
 ## Optional PR automation
 
-Manual review works without a schedule. Own open PRs in chat-run mode use a
-bound T3 schedule to resume the driver thread every 10 minutes. Each wake
-checks feedback, base, CI, and approval. Stop and verify deletion of the watch
-when all watched PRs merge or close and release is settled or not applicable, the user cancels,
-or it expires.
+Manual review works without a schedule.
+Every verified own-PR publication arms or joins the driver's chat-run watch,
+subject to explicit stop-after-publication or observation requests.
+Its bound T3 schedule wakes the driver every 10 minutes by default while open PRs stay watched.
+See [Chat-run PR watch](docs/workflows.md#chat-run-pr-watch) for the lifecycle and quiet cadence.
 
 An optional native T3 review manager runs finite peer-review passes every 15
 minutes; the review automation never merges for you. Activation needs live
 host validation. See [PR-manager setup and safety](skills/axstack/references/automations.md).
 
+
+## Automatic merge boundaries
+
+The recorded owning watch thread applies the full predicate in chat-run or
+standalone authorized maintenance, including small and adopted work. Solo mode
+uses current-head-and-base cross-provider review plus diligence; team mode also
+needs a counted collaborator approval. Team bases are documented non-production
+`dev`; solo bases are documented `integration` branches, including `main`.
+Unknown classification means `deploying`. Whole stacks wait for every planned
+member to be published and reviewed.
+
+Cards name missing approval, ineligible bases, exclusions, or `Auto-merge: off`.
+For own integration-base PRs, the card reply authorizes the guarded actor under
+watch §5's exceptions.
+In solo mode the user's merge-card reply authorizes the guarded merge of
+user-written PRs or PRs with unknown or mixed provenance.
+Team replies never replace collaborator approval. Promotion, release,
+deploying-base, and peer PRs are user-merged, as are CI, manifest, merge-authority,
+and non-`clean` revert changes. Test sources stay eligible. See watch §5 for all
+excluded files and guarded merge mechanics. User merges are bottom-up for a stack.
+This policy grants no release, npm publish,
+or host install authority. Preview authority covers only the preview unit and
+its `tailscale serve` route on the VPS.
+
+Excluded: CLI proxy, account pooling, and IP routing; local CI contention handling
+is deferred. Quota-driven scheduling or model routing is excluded. Automatic
+merge of promotion, release, deploying-base, and peer PRs is excluded. Previews
+outside the VPS, public previews, and production data are excluded. Nightly triage
+never sends relay messages.
+
+Accepted risks: two agents can miss the same defect while CI is green; spec
+approval is the user's main checkpoint. A head guard does not atomically guard
+base freshness; the concurrent-merge race is held by the post-merge push-failure
+rule. A watch waking every 10 minutes (60 when quiet) until PRs land has an accepted
+token cost. Preview code runs under the same VPS user as agents and is not isolated;
+tests already do, so the added risk is small.
+
 ## Some notes
 
 - T3 Code is the only supported active runtime. Axstack adds no daemon or runtime
   database.
-- A human merges by default.
+- The recorded owning watch thread merges eligible own PRs; excluded PRs use a merge card.
 - This is an early project; expect the workflows to evolve.
 
 ## Documentation

package/docs/installation.md

@@ -270,8 +270,9 @@ the affected work. Codex and Claude class resolution reads the saved T3 capabili
 `skills/axstack/scripts/resolve-models.js --provider`; missing or malformed
 catalogs hold. A preset model is used as given; class rows resolve to the newest
 matching catalog ID. Resume retains the recorded snapshot without re-resolution.
-Rejection, timeout, quota, and auth failures hold; no subscription inference,
-quota routing, or alternative-model retry applies.
+Rejection, timeout, quota, and auth failures hold; outside bounded same-provider,
+same-model account selection among one driver's instances via `pick-instance.js`,
+no subscription inference, quota routing, or alternative-model retry applies.
 
 `modeId` and similar permission fields remain conservative declared intent.
 They do not prove effective T3 `runtimeMode`, sandboxing, or permission parity.
@@ -319,10 +320,10 @@ the affected operation. Provider/model routing, Linear documents through the
 executor MCP, and live schedule behavior need separate preflights.
 
 Installation creates no production schedule and adds no custom scheduler.
-Chat-run own-PR watch uses a bound T3 schedule every 10 minutes by default;
-record its ID, driver thread, and expiry. Missing schedule capability holds
-activation. Delete the schedule by its exact ID and verify absence with
-`list_scheduled_tasks` when the watch ends; uncertainty preserves the hold.
+Every verified own-PR publication arms or joins the driver's chat-run watch.
+Its bound T3 schedule resumes the driver every 10 minutes by default while open PRs stay watched.
+See [Chat-run PR watch](workflows.md#chat-run-pr-watch) for authority, schedule identity and stop conditions.
+Missing schedule capability holds activation.
 The optional review manager uses an unbound 15-minute T3 schedule and requires
 its separate native canary before activation. Installed guidance does not prove
 live behavior. See [Review manager](../skills/axstack/references/automations.md).

package/docs/workflows.md

@@ -15,6 +15,21 @@ The directly invoked phase loads the applicable shared references for routing,
 lifecycle, T3 runtime boundaries, role/model/risk contracts, the run record,
 and PR shape.
 
+Before each Claude or Codex dispatch/launch, run
+`bun skills/axstack/scripts/pick-instance.js --provider claude|codex`.
+It prints the enabled same-driver account with the most tier-weighted headroom,
+excluding reached limits or any window at ≥95% usage. Provider, model, class,
+and effort stay fixed. Save `--json` output in private dispatch evidence and
+record its pointer and chosen instanceId. Only error exit 1 permits canonical
+fallback after availability validation. Exit 2 (no eligible provider instances)
+holds the work without fallback. This permits no mid-thread failover.
+`--settings <path>` overrides `~/.t3/userdata/settings.json`.
+Usage is cached for five minutes in `${XDG_CACHE_HOME:-~/.cache}/axstack/usage.json`;
+failed requests use stale usage or a tier-only `unknown` score without cache.
+Codex's plan is unknown until a successful usage response, so its uncached
+failure weight is 1. `AXSTACK_CLAUDE_USAGE_URL` and `AXSTACK_CODEX_USAGE_URL`
+override endpoints for local fixtures; tests use loopback only.
+
 Direct routes need no spec ceremony:
 
 - `axstack-research` answers one bounded source-backed question.
@@ -33,7 +48,7 @@ Direct routes need no spec ceremony:
   authorized, proven cleanup to Implement as structure-preserving work through
   independent review.
 - Manual `axstack-review` can inspect existing code at an exact revision within
-  a named scope. Both configured peer reviewers inspect six lenses independently;
+  a named scope. Both configured codebase reviewers inspect six lenses independently;
   the driver reports validated defects and risks, improvement opportunities,
   unverified leads, and `COMPLETE` or `INCOMPLETE` coverage. This report does
   not approve a PR or publish findings.
@@ -78,7 +93,21 @@ starts later for each repository the user names.
    derives one boundary from test-audit PR history, skips open PRs, overlap with
    live T3 thread/run and worktree ownership, unsafe baselines or empty candidate sets,
    and opens at most one independently reviewed test-only PR per week through
-   the driver. Workers never push; the human merges.
+   the driver. Workers never push; the owning watch thread applies the
+   [watch predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+
+## Nightly PR-triage activation
+
+Use the packaged [nightly prompt](../skills/axstack/references/pr-triage-nightly.md)
+and [setup guidance](../skills/axstack/references/automations.md#nightly-pr-triage-setup).
+Read existing schedules before creating the single unbound native T3 schedule
+at 02:00 host time; reuse it instead of creating a duplicate.
+Keep the host timezone, schedule ID, prompt, and repository set in a durable
+activation record outside run records so Close-out preserves them.
+Each pass reports all own open PRs in its own T3 thread, with forge state or
+`UNKNOWN`, PRs inactive for 7 days, and the top three to act on.
+The pass stays read-only and never declares merge-ready.
+This delivery creates no live schedule; source tests do not prove activation.
 
 ## Role presets
 
@@ -91,7 +120,7 @@ role.
 
 | Preset | Author | Ordered peer reviewers | Astra / Opus advisers | Auditor |
 | --- | --- | --- | --- | --- |
-| `mixed` | Sol high | Sol high; Opus medium | Astra high / Opus xhigh | Sonnet high + Sol high |
+| `mixed` | Sol high | Sol high; Sol high | Astra high / Opus xhigh | Sonnet high + Sol high |
 | `codex-only` | Sol high | Sol high; Luna xhigh | Astra high / unavailable | Luna xhigh + Sol high |
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
@@ -114,9 +143,12 @@ catalog using `skills/axstack/scripts/resolve-models.js --provider`; missing or
 malformed catalogs hold. Active runs and resume reuse their snapshot after
 later installation changes without re-resolution.
 
-Peer roles keep the stable IDs `axstack-reviewer-primary` and
-`axstack-reviewer-secondary`; their provider/class mappings come only from the
-selected preset.
+Peer roles use the stable IDs `axstack-reviewer-primary` and
+`axstack-reviewer-peer`; their provider/class mappings come only from the
+selected preset. The mixed peer coordinator and review-lane binding
+`axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
+is used in the authored mapping and, alongside `axstack-reviewer-primary`,
+in codebase findings mode.
 
 The unavailable adviser in each single-provider preset stays explicitly
 `model: null` within that provider's bounds. Installer readiness accepts that
@@ -128,8 +160,9 @@ in saved T3 capabilities. Empty Antigravity catalogs hold. Missing or
 unavailable roles hold only affected work. Requested model, effort, and
 permission values need actual T3 configuration read-back; stored `modeId` is
 neither permission parity nor a sandbox. Rejection, timeout, quota, and auth
-failures hold; no subscription inference, quota routing, or alternative retry
-applies.
+failures hold; outside bounded same-provider, same-model account selection among
+one driver's instances via `pick-instance.js`, no subscription inference, quota
+routing, or alternative retry applies.
 
 ## T3 runtime boundary
 
@@ -226,8 +259,10 @@ One T3 host/server owns a run, one persistent owner owns each PR, and one
 writer owns each candidate. Fanout has no fixed PR count; it follows real
 dependencies, writer isolation, host capacity, and spending limits. Each PR has
 one theme and a measured size under the shared
-[PR-shape policy](../skills/axstack/references/pr-shape.md). The human merges
-by default; review approval never grants merge authority.
+[PR-shape policy](../skills/axstack/references/pr-shape.md).
+For own PRs, automatic merge is the default under the
+[watch predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+Review approval alone never grants merge authority.
 For the rationale band, the autonomous driver records a cohesion rationale. The exception band
 requires a reasonable split attempt and full exception record. These are
 autonomous driver choices; size alone never requires user approval.
@@ -267,32 +302,94 @@ read-only observer for standalone watches and never sends.
 For authorized engineering delivery, [Autopilot](../skills/axstack/references/autopilot.md)
 continues from Align through the eligible phase sequence in the same chat.
 The human approves substantial specs, release PRs, peer and deploying-base
-merges, and the npm stage. Only the chat-run driver holding the approved ticket
-map may merge its own eligible integration-base PRs under the full
-[watch merge predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely). Managers,
-workers, reviewers, automations, and standalone watches never merge. An open
-hold pauses the run. Implement arms maintain-mode watch
-at its first published PR; release and install run only under recorded per-run
-authority, and Close-out follows their verified receipts.
+merges, and the npm stage. The recorded owning watch thread is the merge actor,
+including `axstack-owner` for standalone authorized maintenance and small or
+adopted work. Apply the full
+[watch merge predicate](../skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
+Managers, workers, reviewers, monitors, and nightly triage never merge.
+Observation-only and peer watches never merge. An open
+hold pauses the run.
+After verified publication readback of every own PR from any Axstack phase,
+the driver arms or joins its chat-run watch in authorized maintain mode.
+Explicit stop-after-publication and observation-only requests still apply.
+Release and install run only under recorded per-run authority.
+Close-out follows their verified receipts and the watch's end.
 
 Use `axstack-watch` chat-run mode to watch every PR raised by this run,
 including later verified publications and PRs explicitly adopted by the driver.
-A bound T3 schedule resumes the driver thread every 10 minutes; record the
-schedule ID and expiry. Each wake reconciles all unsettled dispatch attempts
+A bound T3 schedule resumes the driver thread every 10 minutes by default.
+The run record holds the schedule ID and driver thread.
+Each wake reconciles all unsettled dispatch attempts
 and runs the own-PR maintenance loop: feedback, base movement, required CI,
 and approval. Delegated work follows the T3 runtime contract. There is no
 daemon or polling model between wakes. Independent PRs can repair in parallel
 with one writer per PR; a changed stack ancestor invalidates child evidence.
 An incomplete scan leaves readiness `UNKNOWN`.
 
-The watch lasts until all member PRs merge or close and release is settled or
-not applicable, the user cancels, or its wake expires. Delete the schedule by
+The chat-run watch never expires or waits for re-authorization while PRs remain open.
+The chat-run watch ends only when all watched PRs merge or close, launched work
+is settled, and release is settled or not applicable, or the user cancels.
+A required PR closed without merging keeps its decision hold and wake.
+Follow [Chat-run watch runtime](../skills/axstack-watch/references/watch-runtime.md#chat-run-watch)
+for native lifetime re-arming and quiet cadence changes on the recorded schedule ID.
+Delete the schedule by
 its recorded ID and verify absence through `list_scheduled_tasks`; uncertain
 deletion preserves the hold. Settlement and run archive are separate driver
 steps. Implementation candidates are published and read back before independent
 authored review. Adopted own-PR maintenance receives independent exact-local-SHA
-review before driver publication and remote readback. The human merges by
-default. Installed instructions do not prove scheduled observation or driver wake.
+review before driver publication and remote readback. Watch §5 governs merges. Installed instructions do not prove scheduled observation or driver wake.
+
+
+## Automatic merge boundaries
+
+Solo approval is current-head-and-base cross-provider authored-review `APPROVE`
+plus diligence `PASS`. The reviewer differs from every receipt-recorded provider
+that authored or repaired `merge-base..head` commits. Team approval also needs a
+counted non-author collaborator review at the current head. Axstack automation
+votes never count. Unknown or mixed provenance and manually authored PRs need a
+merge card. New heads need fresh authored review, diligence, and CI. A collaborator
+approval carries over only across an unchanged stable patch-id rebase, recorded
+for both heads, while the forge still counts it.
+
+Team auto-merge targets only documented non-production `dev`; solo targets `main`
+or another documented `integration` base. Unknown classification means
+`deploying`. Re-read approval mode and classification before merging and on resume.
+For a stack, only the bottom base must qualify; every upper base is its next-lower
+branch at the reviewed head. Every planned member must be published and satisfy
+the remaining terms and exclusions. Never retarget reviewed members for eligibility.
+
+Merge cards report cases that fail approval, base, exclusion, or `Auto-merge: off`
+rules. On own integration-base PRs, a user card reply permits the guarded actor to
+merge, subject to watch §5's exceptions.
+In solo mode the user's merge-card reply authorizes the guarded merge of
+user-written PRs or PRs with unknown or mixed provenance.
+In team mode it clears only an ineligible base, auto-merge turned off, and an open
+human or bot comment; it never replaces collaborator approval. CI and manifest changes,
+merge-authority text and non-`clean` revert PRs are user-merged on
+the forge. Promotion, release, deploying-base, and peer PRs are also user-merged.
+Test sources stay eligible; `.github/`, workflow-invoked paths, manifests and
+lockfiles, runner config, branch protection and rulesets, `CODEOWNERS`, and
+merge-authority text are excluded from auto-merge. Non-agent comments hold it
+until human clearance under the packaged comment rules. The revert gate reads the declaration starting
+with `Revert:` at line start; a quoted format inside a bullet is not a declaration.
+
+User merges are bottom-up for a stack.
+This policy grants no release, npm publish, or host install
+authority. Preview authority covers only the preview unit and its `tailscale
+serve` route on the VPS.
+
+Excluded: CLI proxy, account pooling, and IP routing; local CI contention handling
+is deferred. Quota-driven scheduling or model routing is excluded. Automatic
+merge of promotion, release, deploying-base, and peer PRs is excluded. Previews
+outside the VPS, public previews, and production data are excluded. Nightly triage
+never sends relay messages.
+
+Accepted risks: two agents can miss the same defect while CI is green; spec
+approval is the user's main checkpoint. A head guard does not atomically guard
+base freshness; the concurrent-merge race is held by the post-merge push-failure
+rule. A watch waking every 10 minutes (60 when quiet) until PRs land has an accepted
+token cost. Preview code runs under the same VPS user as agents and is not isolated;
+tests already do, so the added risk is small.
 
 ## Optional native peer-review automation
 
@@ -331,7 +428,7 @@ cursor files, or historical runtime fallback.
 
 The review manager uses one short packaged prompt that loads the current
 relative contract and invokes `axstack-review`. Bounded jobs publish ordinary
-exact-head review verdicts; the human merges. Manual adopted-PR maintenance
+exact-head review verdicts; peer PRs are merged by the user. Manual adopted-PR maintenance
 uses `axstack-watch` with local-SHA review before authorized publication.
 Exceptional security, permanent-on-chain, or architectural decisions remain actionable in GitHub or a durable user-owned conversation
 after the manager session ends, with an authorized deduplicated Telegram notification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.24.1",
+  "version": "0.25.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -52,7 +52,16 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "high",
-      "notes": "Secondary reviewer in the ordered claude-only peer pair: Opus medium followed by Sonnet high. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "notes": "Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "modelClass": "sonnet"
+    },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "claude",
+      "modeId": "bypassPermissions",
+      "thinkingOptionId": "high",
+      "notes": "Second reviewer in the ordered claude-only peer pair: Opus medium followed by Sonnet high. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "sonnet"
     },
     {

package/profiles/presets/codex-only.json

@@ -52,7 +52,16 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "xhigh",
-      "notes": "Secondary reviewer in the ordered codex-only peer pair: Sol high followed by Luna xhigh. Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance.",
+      "modelClass": "luna"
+    },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "xhigh",
+      "notes": "Second reviewer in the ordered codex-only peer pair: Sol high followed by Luna xhigh. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "luna"
     },
     {

package/profiles/presets/mixed.json

@@ -22,11 +22,11 @@
     {
       "id": "axstack-owner",
       "name": "Axstack PR owner",
-      "provider": "claude",
-      "modeId": "bypassPermissions",
-      "thinkingOptionId": "medium",
-      "notes": "Persistent PR owner: one owner per PR, accountable for candidate, fixes, verification evidence, and monitoring. May delegate coding but never edits a worker-owned candidate concurrently. Launches eligible independent reviewers. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "opus"
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Persistent PR owner: one owner per PR, accountable for candidate, fixes, verification evidence, and monitoring. May delegate coding but never edits a worker-owned candidate concurrently. Launches eligible independent reviewers. Peer coordinator and review-lane binding; never reviews.",
+      "modelClass": "sol"
     },
     {
       "id": "axstack-author",
@@ -43,7 +43,7 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Sol high. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "sol"
     },
     {
@@ -52,9 +52,18 @@
       "provider": "claude",
       "modeId": "bypassPermissions",
       "thinkingOptionId": "medium",
-      "notes": "Secondary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
+    {
+      "id": "axstack-reviewer-peer",
+      "name": "Axstack reviewer (peer)",
+      "provider": "codex",
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Sol high. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "modelClass": "sol"
+    },
     {
       "id": "axstack-diligence",
       "name": "Axstack diligence checker",

package/skills/axstack/references/automations.md

@@ -7,6 +7,25 @@ For optional weekly test audits, use the separate packaged
 [Weekly test-audit prompt](test-audit-weekly.md).
 The native canary below is also required before weekly activation.
 
+For nightly read-only PR reports, use the separate packaged
+[Nightly PR-triage prompt](pr-triage-nightly.md).
+
+## Nightly PR-triage setup
+
+Follow the weekly test-audit pattern for an unbound native schedule.
+Before creating a schedule, read existing schedules with `list_scheduled_tasks`.
+Reuse the existing triage schedule for the recorded repository set.
+Never create a duplicate triage schedule.
+Use one native T3 `schedule_task`, unbound, nightly at 02:00 host time, with
+`fixed_time`, `timeOfDay:"02:00"`, and `bindToCurrentThread:false`.
+Supply the packaged triage prompt and the durable activation record's location.
+Record the host timezone, schedule ID, prompt, and repository set in a durable
+activation record outside any run records, such as
+`~/.local/share/axstack/pr-triage/activation.md`.
+Preserve the activation record and schedule through Close-out.
+Each scheduled pass reports in its own T3 thread under the read-only prompt.
+Source checks do not prove live schedule delivery or report coverage.
+
 ## Topology and schedules
 
 The T3 project `axstack-review-lane` uses the VPS's existing
@@ -268,7 +287,11 @@ private or local artifacts. Write the local HTML copy under the established
 
 No manager, coordinator, or worker may merge, close, force-push, rebase,
 restack, broaden scope, or mutate a PR branch. Human merge remains the
-boundary.
+boundary for peer PRs.
+User merges are bottom-up for a stack.
+For own PRs, automatic merge is the default under the
+[watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely);
+this manager never becomes that watch's merge actor.
 
 ## Exceptional decisions and notifications
 

package/skills/axstack/references/autopilot.md

@@ -36,7 +36,7 @@ human approval)` as a decision hold eligible under the Notification policy.
 ## Phase sequence
 
 - Small: Align read-back, small-change intent, implement, watch in maintain
-  mode, human merge. An opted-in Align refinement is part
+  mode, merge under the watch §5 predicate. An opted-in Align refinement is part
   of read-back.
 - Substantial: Align, spec draft with advisers and diligence, human spec
   approval at gate 1, tickets with diligence, implement, watch in maintain mode,
@@ -45,30 +45,44 @@ human approval)` as a decision hold eligible under the Notification policy.
 
 Do not seek another phase-start instruction after a completed identity.
 Spec approval is always the human's decision. Audit self-improvement PRs follow
-the same merge predicate. Only the original chat-run driver with the approved
-ticket map may auto-merge PRs satisfying `axstack-implement` §6's approved
-ticket-map membership and `integration` base conditions. The user merges peer
-PRs and PRs into `deploying` bases. Managers, workers, reviewers, automations,
-and standalone watches never merge. A stack follows its guarded bottom-up rule.
-
-## Implement into maintain watch
-
-When implement publishes the run's first PR, arm exactly one `axstack-watch`
-chat-run in authorized maintain mode. Read the [T3 runtime boundary](t3-runtime.md) and use its bound
-`schedule_task` wake (`everyMs:600000`), recording the scheduledTaskId. Later run PRs join after verified
-publication readback; an explicitly adopted PR joins only with its maintenance
-snapshot. The original driver alone routes work; one author writes each
+the same merge predicate.
+For own PRs, automatic merge is the default under the
+[watch predicate](../../axstack-watch/SKILL.md#5-state-readiness-precisely).
+The recorded owning watch thread is the merge actor, including `axstack-owner`
+for authorized standalone maintenance and small or adopted work.
+Managers, workers, reviewers, monitors, and nightly triage never merge.
+Observation-only and peer watches never merge.
+Apply watch §5's approval, base, exclusions, and merge-card rules.
+A stack follows its guarded whole-stack rule.
+User merges are bottom-up for a stack.
+
+## Own PR publication into maintain watch
+
+When any Axstack phase publishes an own PR, after verified publication readback
+the driver arms one chat-run watch in authorized maintain mode or joins the existing watch.
+This covers implement, small change, debug repair, improve, and adopted-PR maintenance.
+Explicit user stop-after-publication and observation-only requests prevail.
+Never require a manual `axstack-watch` invocation.
+The driver remains the single owner and sole run-record writer.
+Never create a per-PR session or an ownership hand-off.
+Read the [T3 runtime boundary](t3-runtime.md) and use its bound
+`schedule_task` wake (`everyMs:600000`), recording the scheduledTaskId.
+An explicitly adopted PR joins only with its maintenance snapshot.
+The original driver alone routes work; one author writes each
 candidate. Until a PR is merge-ready, wakes feed implement §6 step 4. After
 merge-ready, watch §5 maintenance repairs feedback, rebases when the base moves,
 keeps CI green, and checks approvals without re-requesting human review.
 
-Maintain is the default mode for run-created PRs. End the chat-run watch when
-every watched PR is merged or closed and the run's release step is settled or
-not applicable, or when the user cancels. Expiry is a recorded stop with
-resumable state, never a silent renewal. A required PR closed without merging
-is incomplete scope; it does not make the run release-eligible. On wake expiry
-record `Autopilot: paused (wake expired; resume: user reauthorizes a wake)` and
-notify under the recorded Notification policy when user action is needed.
+Maintain is the default mode for run-created PRs.
+End the chat-run watch only when every watched PR is merged or closed,
+launched work is settled, and the run's release step is settled or not applicable,
+or the user cancels.
+A required PR closed without merging is incomplete scope; it does not make the run release-eligible.
+Keep its decision hold and wake until the user resolves scope or cancels.
+The chat-run watch never expires or waits for re-authorization while PRs remain open.
+Follow [Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch)
+for quiet cadence and native schedule re-arming.
+Run Close-out after the watch ends, subject to its existing acceptance conditions.
 
 ## Release and install, when applicable
 

package/skills/axstack/references/candidate-publication.md

@@ -45,6 +45,16 @@ remote confirmation. Reviewers inspect a detached immutable checkout of the
 confirmed candidate SHA and pinned base, never only the movable branch name.
 Any author repair creates a new revision and repeats this boundary.
 
+## Revert line
+
+Every own PR description must contain exactly one `Revert` line:
+`Revert: clean` | `Revert: steps: <manual steps>` | `Revert: irreversible: <why>`.
+Use `clean` only when a single `git revert` of the merge commit restores the
+previous behaviour with CI green.
+A `clean` revert leaves no data, schema, config, external, or published effect behind.
+Otherwise use `steps` or `irreversible`.
+Classify every release PR as `irreversible`.
+
 ## Immutable checkout shape
 
 The driver creates the immutable review checkout with `git worktree add --detach <run>/checkouts/<key> <sha>` at the confirmed candidate SHA and pinned base.

package/skills/axstack/references/contracts.md

@@ -40,9 +40,14 @@ the revised scope and plan.
 
 Validate the configured provider and model at actual launch. If it is
 unavailable or exhausted, pause affected work, record the gap, and ask the
-user. Never infer a route from quota state or subscription entitlement. Every
+user. Only same-provider, same-model account selection among instances of one
+driver may use headroom under [Provider bindings](t3-runtime.md#preflight-and-binding).
+An exhausted account with no eligible sibling still holds; this permits no
+mid-thread failover or provider/model substitution.
+Never infer any other route from quota state or subscription entitlement. Every
 substitution requires the user's decision: configured alternatives are not
 defaults. Rejection, timeout, quota and auth failures hold affected work.
+Substitution here means changing provider or model, excluding that account selection.
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch, receipt consumption
 or recovery; resolve models from the saved capabilities snapshot and verify
 requested and effective settings separately.
@@ -103,19 +108,17 @@ gate.
 
 ## Authority
 
-- The driver owns run scope, cross-PR coordination, integration, and every
-  selected external-tracker mutation. The checker reports discrepancies only.
-- One T3 host/server owns a run. There is no fixed active-PR count;
-  fanout is dependency- and capacity-driven within configured host resource and
-  spending limits. The driver reduces fanout when the run record shows rework,
-  review backlog, or resource pressure, queues conflicting or dependent work,
-  and uses `gh stack` for dependent PRs. Routine shape, split, fanout, and
-  exception choices are autonomous driver decisions within the approved scope;
-  size alone never requires user approval.
-- Exactly one writer per candidate acts at a time, with one persistent owner
-  accountable for each PR. Each PR carries one theme and a measured size under
-  [PR shape](pr-shape.md). Unknown capacity metrics are reported as unknown,
-  never as a telemetry prerequisite or blocker. Parent changes invalidate
-  affected child evidence, which must be refreshed against the new parent.
-- The human merges by default, bottom-up for a stack. Review approval and
-  reviewer votes never grant mutation or merge authority.
+- The driver owns scope, cross-PR coordination, integration, and every selected
+  external-tracker mutation. Checker reports discrepancies only.
+- One T3 host/server owns a run. No fixed active-PR count; fanout is dependency-
+  and capacity-driven within host resource and spending limits. Reduce fanout for
+  recorded rework, review backlog, or resource pressure. Queue conflicts and
+  dependencies; use `gh stack` for dependent PRs. Routine shape, split, fanout, and
+  exception choices within approved scope are autonomous driver decisions; size alone never
+  requires user approval.
+- Exactly one writer per candidate; one persistent accountable PR owner. Each PR has one theme and measured size under [PR shape](pr-shape.md). Report unknown capacity
+  metrics; never a telemetry prerequisite or blocker. Parent changes invalidate
+  affected child evidence; refresh it against the new parent.
+- Own PRs default to automatic merge under [watch §5](../../axstack-watch/SKILL.md).
+  Review approval and reviewer votes alone never grant mutation or merge authority.
+  User merges are bottom-up for a stack.