axstack 0.25.3 → 0.25.5

package/README.md

@@ -10,33 +10,6 @@ Axstack gives your current T3 thread a way to scope work, build it with tests, a
 review the exact result. T3 Code provides worktrees, agent threads, and visible
 coordination. You can start at the phase you need.
 
-## What you can do
-
-| Layer | Skill | What it does |
-| --- | --- | --- |
-| Plan | [axstack-align](skills/axstack-align/SKILL.md) | Settle scope through questions, a design lens sketch, and inline brainstorm validation. |
-| Plan | [axstack-brainstorm](skills/axstack-brainstorm/SKILL.md) | Validate an approach with independent candidates; judges for hard choices. |
-| Plan | [axstack-spec](skills/axstack-spec/SKILL.md) | Write and approve an observable specification. |
-| Plan | [axstack-tickets](skills/axstack-tickets/SKILL.md) | Break approved scope into executable tasks. |
-| Build | [axstack-implement](skills/axstack-implement/SKILL.md) | Build with strict TDD and an author → review → repair loop. |
-| Build | [axstack-debug](skills/axstack-debug/SKILL.md) | Diagnose a bug with a failing check and hand off a bounded repair. |
-| Verify | [axstack-review](skills/axstack-review/SKILL.md) | Review a PR or bounded codebase at an exact revision. |
-| Verify | [axstack-improve](skills/axstack-improve/SKILL.md) | Find evidenced codebase improvements without editing code. |
-| Verify | [axstack-audit](skills/axstack-audit/SKILL.md) | Measure a run's outcomes and evidence gaps. |
-| Verify | [axstack-correct](skills/axstack-correct/SKILL.md) | Report repeated mistakes and propose stronger checks when invoked by the user. |
-| Operate | [axstack-watch](skills/axstack-watch/SKILL.md) | Observe or maintain an existing PR within its authority. |
-| Operate | [axstack-cleanup](skills/axstack-cleanup/SKILL.md) | Retire eligible completed agent resources. |
-| Operate | [axstack-relay](skills/axstack-relay/SKILL.md) | Send an explicit message or authorized notification. |
-| Understand | [axstack-research](skills/axstack-research/SKILL.md) | Answer one bounded question with sources. |
-| Understand | [axstack-explain](skills/axstack-explain/SKILL.md) | Explain a system and separate known behavior from gaps. |
-| Understand | [axstack-diagram](skills/axstack-diagram/SKILL.md) | Draw Mermaid diagrams or verified interactive archify viewers. |
-
-Interactive viewers use [archify](https://github.com/tt-a1i/archify) (MIT).
-
-Small, bounded changes can begin with your request or an existing issue;
-substantial work needs an approved spec and matching tickets before
-implementation. Research, explanation, and peer review can start directly.
-
 ## Why Axstack
 
 | Failure mode | How Axstack responds |
@@ -46,56 +19,75 @@ implementation. Research, explanation, and peer review can start directly.
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
 | Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 
-## Quick start
+## Prerequisites
 
-> [!NOTE]
-> You need Bun >=1.3.14, Git, the GitHub CLI (`gh`) with `gh stack`, and a
-> running T3 Code `0.0.46-nightly.20261003.2610` or newer.
-> The agents selected by your preset must also be available through T3.
+Axstack supports only Linux hosts. You need Bun >=1.3.14, Git, the GitHub
+CLI (`gh`) with `gh stack`, and T3 Code `0.0.46-nightly.20261003.2610` or newer
+on PATH. The providers selected by your preset must be available inside T3.
 
-Install the CLI and skills. This example targets Codex:
+Choose one explicit preset (each contains all role IDs): [mixed](profiles/presets/mixed.json)
+(recommended), [codex-only](profiles/presets/codex-only.json), or
+[claude-only](profiles/presets/claude-only.json). Mixed supports cross-provider
+implementation review; single-provider presets have workflow limits and are
+not automatic cross-class or cross-provider fallbacks when a model is unavailable. See
+[workflow and routing details](docs/workflows.md).
+
+## Quick start
+
+Install the CLI and skills, then check your host. This example targets Codex:
 
 ```sh
 bun add --global axstack
-axstack check --harness codex
+export PATH="$HOME/.bun/bin:$PATH"
 axstack install --harness codex --preset mixed --yes
+axstack check --harness codex
 ```
 
-Open a T3 thread and ask for the phase you need:
+Reload the harness's skills in T3 after installation. A green check verifies
+local capabilities and installed files; it does not prove live provider readiness,
+schedule activation or mobile delivery. See [installation](docs/installation.md)
+for other harnesses, custom paths, upgrades, conflicts and uninstalling.
 
-```text
-$axstack-align Help me scope account recovery.
-$axstack-implement Build the task we agreed on.
-$axstack-review Review this pull request: <PR URL>
-$axstack-review Find issues in <paths> at <commit SHA>.
-$axstack-watch Monitor this PR without making changes: <PR URL>
-$axstack-watch Watch every PR raised by this chat until all merge or close
-```
+### First task
 
-<details>
-<summary>Codex installation notes</summary>
+Open your repository as a T3 project and start a driver thread.
+Codex invokes skills with `$skill`, and Claude uses `/skill`.
+For a small repair, send this request (replace `$` with `/` in Claude):
 
-Codex skills default to the shared `~/.agents/skills` root. The owned
-`AGENTS.md` block stays under `$CODEX_HOME` (default `~/.codex`). A default
-install retires only unchanged manifest-owned legacy skills; `--skills-dir`
-sets an explicit target without automatic migration.
-
-</details>
+```text
+$axstack-implement Fix the empty-state message in the existing list view within one PR, preserve list behavior, and verify the displayed result.
+```
 
-<details>
-<summary>Other harnesses</summary>
+Small, bounded changes can begin with your request or an existing issue;
+substantial work needs an approved spec and matching tickets before
+implementation. Research, explanation, and peer review can start directly.
+The driver returns a candidate revision, test evidence and unverified boundaries.
+You make decisions at holds and substantial-spec approval.
+Follow [getting started](docs/getting-started.md) for the full first-task journey
+and [guides](docs/guides.md) for features, reviews, watches, debugging and releases.
 
-Use `--harness claude`, `opencode`, or `antigravity` with `axstack check` and
-`axstack install`, or provide explicit skill and instruction paths. Installation
-adds an owned instruction block and preserves unrelated content. It does not
-enable schedules or prove that every configured model is available. T3 uses
-its managed Antigravity runtime with separate browser sign-in; the IDE/`agy`
-skill paths do not configure that runtime.
+## What you can do
 
-</details>
+| Layer | Skill | What it does |
+| --- | --- | --- |
+| Plan | [axstack-align](skills/axstack-align/SKILL.md) | Settle scope through questions, a design lens sketch, and inline brainstorm validation. |
+| Plan | [axstack-brainstorm](skills/axstack-brainstorm/SKILL.md) | Validate an approach with independent candidates; judges for hard choices. |
+| Plan | [axstack-spec](skills/axstack-spec/SKILL.md) | Write and approve an observable specification. |
+| Plan | [axstack-tickets](skills/axstack-tickets/SKILL.md) | Break approved scope into executable tasks. |
+| Build | [axstack-implement](skills/axstack-implement/SKILL.md) | Build with strict TDD and an author → review → repair loop. |
+| Build | [axstack-debug](skills/axstack-debug/SKILL.md) | Diagnose a bug with a failing check and hand off a bounded repair. |
+| Verify | [axstack-review](skills/axstack-review/SKILL.md) | Review a PR or bounded codebase at an exact revision. |
+| Verify | [axstack-improve](skills/axstack-improve/SKILL.md) | Find evidenced codebase improvements without editing code. |
+| Verify | [axstack-audit](skills/axstack-audit/SKILL.md) | Measure a run's outcomes and evidence gaps. |
+| Verify | [axstack-correct](skills/axstack-correct/SKILL.md) | Report repeated mistakes and propose stronger checks when invoked by the user. |
+| Operate | [axstack-watch](skills/axstack-watch/SKILL.md) | Observe or maintain an existing PR within its authority. |
+| Operate | [axstack-cleanup](skills/axstack-cleanup/SKILL.md) | Retire eligible completed agent resources. |
+| Operate | [axstack-relay](skills/axstack-relay/SKILL.md) | Send an explicit message or authorized notification. |
+| Understand | [axstack-research](skills/axstack-research/SKILL.md) | Answer one bounded question with sources. |
+| Understand | [axstack-explain](skills/axstack-explain/SKILL.md) | Explain a system and separate known behavior from gaps. |
+| Understand | [axstack-diagram](skills/axstack-diagram/SKILL.md) | Draw Mermaid diagrams or verified interactive archify viewers. |
 
-See [installation](docs/installation.md) for source installs, custom paths,
-upgrades, conflicts, and uninstalling.
+Interactive viewers use [archify](https://github.com/tt-a1i/archify) (MIT).
 
 ## How work stays controlled
 
@@ -110,66 +102,22 @@ upgrades, conflicts, and uninstalling.
   merge is the default under the
   [watch predicate](skills/axstack-watch/SKILL.md#5-state-readiness-precisely).
 
-Choose one explicit preset (each contains all role IDs): [mixed](profiles/presets/mixed.json)
-(recommended), [codex-only](profiles/presets/codex-only.json), or
-[claude-only](profiles/presets/claude-only.json). Mixed supports cross-provider
-implementation review; single-provider presets have workflow limits and are
-not automatic cross-class or cross-provider fallbacks when a model is unavailable. See
-[workflow and routing details](docs/workflows.md).
-
-In `mixed` and `claude-only`, auditing, requirements/code/web research,
-execution exploration, and the optional monitor use the Claude Sonnet class at high effort.
-Auditing, code research, and execution exploration have independent Sol high
-pair seats in `mixed` and `codex-only`; `claude-only` records them as absent.
-
 ## Optional PR automation
 
 Manual review works without a schedule.
 Every verified own-PR publication arms or joins the driver's chat-run watch,
 subject to explicit stop-after-publication or observation requests.
-Its bound T3 schedule wakes the driver every 10 minutes by default while open PRs stay watched.
+See [Host operations](docs/host-operations.md#chat-run-watch-activation) for wake activation and cadence.
 See [Chat-run PR watch](docs/workflows.md#chat-run-pr-watch) for the lifecycle and quiet cadence.
 
 An optional native T3 review manager runs finite peer-review passes every 15
 minutes; the review automation never merges for you. Activation needs live
-host validation. See [PR-manager setup and safety](skills/axstack/references/automations.md).
+host validation. See [PR-manager setup and safety](docs/host-operations.md#optional-native-peer-review-automation).
 
 
 ## Automatic merge boundaries
 
-The recorded owning watch thread applies the full predicate in chat-run or
-standalone authorized maintenance, including small and adopted work. Solo mode
-uses current-head-and-base cross-provider review plus diligence; team mode also
-needs a counted collaborator approval. Team bases are documented non-production
-`dev`; solo bases are documented `integration` branches, including `main`.
-Unknown classification means `deploying`. Whole stacks wait for every planned
-member to be published and reviewed.
-
-Cards name missing approval, ineligible bases, exclusions, or `Auto-merge: off`.
-For own integration-base PRs, the card reply authorizes the guarded actor under
-watch §5's exceptions.
-In solo mode the user's merge-card reply authorizes the guarded merge of
-user-written PRs or PRs with unknown or mixed provenance.
-Team replies never replace collaborator approval. Promotion, release,
-deploying-base, and peer PRs are user-merged, as are CI, manifest, merge-authority,
-and non-`clean` revert changes. Test sources stay eligible. See watch §5 for all
-excluded files and guarded merge mechanics. User merges are bottom-up for a stack.
-This policy grants no release, npm publish,
-or host install authority. Preview authority covers only the preview unit and
-its `tailscale serve` route on the VPS.
-
-Excluded: CLI proxy, account pooling, and IP routing; local CI contention handling
-is deferred. Quota-driven scheduling or model routing is excluded. Automatic
-merge of promotion, release, deploying-base, and peer PRs is excluded. Previews
-outside the VPS, public previews, and production data are excluded. Nightly triage
-never sends relay messages.
-
-Accepted risks: two agents can miss the same defect while CI is green; spec
-approval is the user's main checkpoint. A head guard does not atomically guard
-base freshness; the concurrent-merge race is held by the post-merge push-failure
-rule. A watch waking every 10 minutes (60 when quiet) until PRs land has an accepted
-token cost. Preview code runs under the same VPS user as agents and is not isolated;
-tests already do, so the added risk is small.
+Eligible own PRs use guarded automatic merge; see [merge boundaries, exclusions, account-selection carve-out and accepted risks](docs/workflows.md#automatic-merge-boundaries).
 
 ## Some notes
 
@@ -180,10 +128,18 @@ tests already do, so the added risk is small.
 
 ## Documentation
 
-- [Installation and configuration](docs/installation.md)
-- [Workflows, review policy, and model routing](docs/workflows.md)
-- [PR scope and sizing](skills/axstack/references/pr-shape.md)
-- [Releases](https://github.com/axatbhardwaj/axstack/releases)
+| Page | Use it for |
+| --- | --- |
+| [Getting started](docs/getting-started.md) | Install, understand `check`, and run a first bounded task. |
+| [Concepts](docs/concepts.md) | Driver threads, phases, roles, presets, holds, evidence and account selection. |
+| [Guides](docs/guides.md) | Step-by-step journeys for features, fixes, reviews, watches, debugging and releases. |
+| [Workflows](docs/workflows.md) | Routing, review policy, merge boundaries, exclusions and accepted risks. |
+| [Installation](docs/installation.md) | CLI commands, harness paths, configuration, upgrades and troubleshooting. |
+| [Host operations](docs/host-operations.md) | Configure your host, provider runtimes, remote access and automations. |
+| [Skill writing](docs/skill-writing.md) | Contribute self-contained skills and contract tests. |
+
+See [PR scope and sizing](skills/axstack/references/pr-shape.md) for candidate
+shape and [Releases](https://github.com/axatbhardwaj/axstack/releases) for release history.
 
 ## License
 

package/docs/concepts.md

@@ -0,0 +1,112 @@
+# Concepts
+
+Axstack provides engineering instructions and evidence conventions. T3 Code
+provides the active runtime. Start with [getting started](getting-started.md);
+use [guides](guides.md) to choose a journey and [workflows](workflows.md) for policy.
+
+## Driver thread
+
+Your current T3 conversation is the driver. It owns scope, coordination,
+integration and forge actions. Workers return evidence to it; one author writes
+each candidate in an isolated worktree. A different idle thread does not inherit
+ownership. Explicit transfer requires a recorded recipient acceptance.
+
+## Phases
+
+The delivery path is Align → Spec → Tickets → Implement → Review → Watch.
+Align settles what to build; Spec records an approved baseline; Tickets makes
+that baseline executable. Implement builds and repairs; Review assesses an exact
+revision; Watch reconciles PR state. You can enter directly for research,
+explanation, peer review or a bounded codebase review.
+
+## Small and substantial work
+
+A small, clear one-PR change starts from your request or selected issue. The
+driver snapshots its acceptance checks and exclusions as a small-change intent.
+Substantial work needs an approved spec and matching ticket map before a build.
+An unsettled material design question goes through Align. Ordinary sequential
+test and implementation steps do not turn a small change into substantial work.
+
+## Roles and presets
+
+A role is a named responsibility such as author, reviewer or adviser. A preset
+assigns those roles to provider, model class, effort and permission intent.
+Choose `mixed`, `codex-only` or `claude-only` explicitly at installation.
+The installer writes the selected preset and complete role table to
+`<skills-dir>/axstack/roles.json`. The driver snapshots it for a new run, resolves
+exact models from saved T3 capabilities, and reuses the snapshot on resume.
+The running conversation supplies the driver model; presets have no driver role.
+
+See [Role presets](workflows.md#role-presets) for the role table. Installing a
+preset does not demonstrate that its providers can authenticate or execute.
+
+## Holds
+
+A hold stops affected work when authority, scope, provider availability or
+required evidence is missing. A serious risk stops the dependent dangerous
+action. The driver records the reason and resume condition. Waiting, silence or
+a tool's acceptance response does not prove completion.
+
+## Run record
+
+A substantive or resumable run has a private `progress.md` beneath the absolute
+Git common directory. The driver alone writes its decisions, owners, exact
+revisions and evidence pointers. It is a derived record: T3 state, Git, forge
+state and approved scope remain authoritative. Credentials and private prompts
+do not belong in it.
+
+## T3 runtime boundary
+
+Delegation uses the `t3-code` MCP. Read-only roles use `delegate_task`; authors
+use `t3_thread_launch` with their own pinned worktrees. Configuration read-back,
+run receipts and revision-bound completion are separate from capability
+discovery. Read the [runtime contract](../skills/axstack/references/t3-runtime.md)
+immediately before dispatch, receipt consumption or recovery.
+
+## Account selection
+
+Before each Claude or Codex dispatch or launch, the driver runs
+`bun skills/axstack/scripts/pick-instance.js --provider claude|codex`.
+The picker selects the enabled account of that provider's T3 driver with the
+highest tier-weighted headroom. Save its `--json` output in private evidence
+and record the chosen instance ID. `--settings <path>` overrides
+`~/.t3/userdata/settings.json`.
+
+For known usage, the score equals `(100 − max known window utilization) × tier weight`.
+For unknown utilization, the score equals the tier weight alone.
+The maximum uses the known utilization windows; an unavailable window is not
+assumed to be empty.
+
+| Provider / tier | Weight |
+| --- | --- |
+| Claude Max 20x: `default_claude_max_20x` | 4 |
+| Claude Max 5x: `default_claude_max_5x` | 1 |
+| Codex: `pro` | 4 |
+| Codex: `prolite` | 1 |
+
+For an unknown tier, the weight equals 1.
+An account with any window at ≥95% or a reported limit reached is excluded.
+Accounts with missing credentials are skipped.
+Usage is cached for five minutes. Failed requests use stale usage when present,
+otherwise a tier-only unknown score. Codex's plan is unknown until a successful
+usage response, so an uncached failed Codex request has weight 1.
+
+Exit 0 prints the selected instance or JSON.
+For dispatched roles, only error exit 1 permits fallback to the canonical instance after validating availability.
+The canonical instances are `codex` and `claudeAgent`.
+Exit 2 (no eligible provider instances) must hold the work without fallback.
+If the driver's own current instance is eligible, it must stay despite headroom differences.
+On error exit 1, the driver must keep its current instance.
+At a turn boundary, an excluded driver with an eligible same-provider sibling
+switches its own calling thread and records the change. Provider, model, class
+and effort remain fixed. Dispatched roles never fail over mid-thread.
+See [Provider bindings](../skills/axstack/references/t3-runtime.md#preflight-and-binding)
+for schedule rebinding and the [policy carve-out](workflows.md#automatic-merge-boundaries).
+
+## Account selection environment
+
+`XDG_CACHE_HOME` selects the cache directory; the default is `~/.cache`.
+The usage cache lives at `<cache-dir>/axstack/usage.json`.
+`AXSTACK_CLAUDE_USAGE_URL` is a test-only endpoint override for Claude usage.
+`AXSTACK_CODEX_USAGE_URL` is a test-only endpoint override for Codex usage.
+Local tests use loopback endpoints; these variables are not provider setup steps.

package/docs/getting-started.md

@@ -0,0 +1,75 @@
+# Getting started
+
+Install Axstack, check your host, then ask for one bounded task in T3 Code.
+For the mental model, read [concepts](concepts.md); for other journeys, use
+[guides](guides.md).
+
+## Prepare your host
+
+You need Bun >=1.3.14, Git, the GitHub CLI with its `gh stack` extension, and
+T3 Code `0.0.46-nightly.20261003.2610` or newer. These executables must be on PATH.
+The providers required by your chosen preset must be available inside T3.
+See [installation](installation.md) for harness paths and
+[host operations](host-operations.md) for provider and project setup.
+
+## Install and check
+
+Run this block in a shell. It installs for Codex and explicitly chooses `mixed`:
+
+```sh
+bun add --global axstack
+export PATH="$HOME/.bun/bin:$PATH"
+axstack install --harness codex --preset mixed --yes
+axstack check --harness codex
+```
+
+Installation writes owned skills and instructions, preserving unrelated content,
+and fetches the pinned archify tool. Reload the harness's skills in T3 after
+installation. Use the [installation reference](installation.md) for other
+harnesses, source installs or conflicts.
+
+A successful check exits 0. Its five capability rows mean:
+
+| Row | Meaning |
+| --- | --- |
+| `bun` | The running Bun version meets the floor. |
+| `git` | Git's version command succeeds. |
+| `gh` | The GitHub CLI's version command succeeds. |
+| `gh stack` | The extension's actual help command succeeds. |
+| `t3` | T3's version command succeeds and meets the floor. |
+
+With this harness target, check also validates the archify record/copy/SHA and
+reports the owned instruction binding. Missing Chrome is a warning. Any reported
+gap exits 1; follow [troubleshooting](installation.md#exit-codes-and-troubleshooting) before
+starting a task.
+
+Check does not prove live provider readiness, schedule activation or mobile delivery.
+Inside the driver thread, capability discovery, provider configuration read-back
+and actual execution receipts establish their respective runtime boundaries.
+
+## First bounded task
+
+Open your repository as a T3 project and start a driver thread. Pick a small
+one-PR change with an observable result. For example, ask the agent to repair
+an existing empty-state message and verify its behavior.
+
+Codex invokes skills with `$skill`; Claude uses `/skill`. Send one of these
+equivalent requests in T3:
+
+```text
+$axstack-implement Fix the empty-state message in the existing list view. Keep this to one PR, preserve list behavior, and verify the displayed result.
+```
+
+```text
+/axstack-implement Fix the empty-state message in the existing list view. Keep this to one PR, preserve list behavior, and verify the displayed result.
+```
+
+The driver reads back the small-change intent, acceptance checks, exclusions and
+Release/host authority, then carries the author → review → repair loop forward.
+If the request has an unsettled material design question, it enters Align first.
+For a larger feature, Align and an approved Spec come before implementation.
+
+You make the decisions at holds or substantial-spec approval. Watch follows the
+[canonical merge policy](workflows.md#automatic-merge-boundaries).
+Follow the [small-fix journey](guides.md#small-fix) to see the returned evidence
+and where to look when a task holds.

package/docs/guides.md

@@ -0,0 +1,69 @@
+# Guides
+
+These journeys start in your current T3 driver thread. Use `$skill` in Codex
+or `/skill` in Claude. Replace example descriptions and PR URLs with your own.
+[Concepts](concepts.md) explains the terms; [workflows](workflows.md) owns policy.
+
+## Scope and build a feature
+
+Ask `$axstack-align Help me scope account recovery.` The driver gathers facts,
+settles material design questions and compares configured advisers' findings.
+Invoke `$axstack-spec Write the agreed specification.` to record observable
+acceptance, exclusions and a revision for your approval. After approval,
+`$axstack-tickets Map the approved work into tasks.` prepares the dependency map.
+`$axstack-implement Build the approved tasks.` carries it through authors,
+exact-revision review and repairs. The driver publishes through `gh stack`
+and records each candidate and its evidence.
+
+## Small fix
+
+For a clear one-PR repair, start with
+`$axstack-implement Fix the empty-state message and verify the displayed result.`
+The driver snapshots the request, acceptance checks and exclusions as the
+small-change intent. It presents Release and host authority in that read-back.
+A meaningful failing behavioral check precedes the implementation, then passes
+with the fix. Accepted structure-preserving work instead keeps the same
+characterization check green before and after.
+
+Expect a candidate revision, targeted and full-suite results, and explicit
+unverified boundaries. If scope or a prerequisite holds, the driver names the
+gap and resume condition. You do not need separate planning artifacts solely
+because a small change is new.
+
+## Review a PR
+
+Use `$axstack-review Review this pull request: <PR URL>`.
+Peer review takes the PR description, linked issue and repository rules as intent
+evidence. Configured reviewers inspect isolated checkouts at a pinned revision.
+An authored candidate follows its provider-based review pairing. Findings bind
+to the reviewed head; a changed head needs fresh evidence.
+
+For report-only understanding, use
+`$axstack-review Find issues in <paths> at <commit SHA>`.
+A codebase report names coverage and unverified leads; it does not approve a PR.
+
+## Watch own PRs
+
+Use `$axstack-watch Watch this PR: <PR URL>` to authorize maintenance, or
+`$axstack-watch Monitor this PR without making changes: <PR URL>` for observation.
+To cover publications from this run, ask
+`$axstack-watch Watch every PR raised by this chat until all merge or close.`
+The owner reconciles checks, feedback, exact-head receipts and stack dependencies.
+See [Chat-run PR watch](workflows.md#chat-run-pr-watch) and
+[merge boundaries](workflows.md#automatic-merge-boundaries) for readiness and merge decisions.
+
+## Debug
+
+Use `$axstack-debug Diagnose this failure and establish a failing check: <symptom>`.
+The driver builds a reproducible red loop, investigates the cause and hands off
+a classified repair. Diagnosis alone does not land the change. An accepted
+bounded repair returns to Implement with the original loop and minimized repro.
+
+## Release
+
+Record release and host-install authority with the driver, then follow the
+[release procedure](../skills/axstack/references/autopilot.md#release-and-install-when-applicable).
+It binds the version commit, tag-triggered publication and registry verification
+to evidence. See [merge boundaries](workflows.md#automatic-merge-boundaries)
+for approval gates and [host operations](host-operations.md) for authorized reinstall checks.
+A local test result does not establish registry publication or host installation.

package/docs/host-operations.md

@@ -0,0 +1,165 @@
+# Host operations
+
+Use this page when operating your own T3 host. Axstack installation writes owned
+skills and role data; it does not activate services, pairing, previews or schedules.
+Record the authority for each host change and its actual readback. Installed
+instructions and local tests do not prove live provider readiness or delivery.
+
+## T3 setup
+
+Set `worktreeCleanup` to `off` for every Axstack project before dispatch;
+Axstack preserves author worktrees and salvages evidence before retirement.
+The driver reads back this setting via `t3_project_read` where exposed, or
+records the setup limitation.
+
+For remote and Android access on the existing tailnet, run:
+
+```sh
+t3 serve --tailscale-serve
+t3 pair
+```
+
+Run `t3 serve --tailscale-serve` as a VPS user service and pair the Android
+app with `t3 pair`. T3 Connect is outside this setup. Service installation,
+network access, and pairing require their own authorized host checks.
+
+Install Antigravity through T3 provider settings using its managed runtime,
+then complete the user's browser sign-in before its canary. T3 uses Google's
+Antigravity ACP agent (`agy_acp_server`); the IDE/`agy` CLI skill paths in the
+installation reference are separate installer targets and do not configure this managed runtime.
+Antigravity roles receive self-contained briefs; its runtime does not read
+`~/.agents/skills`. A missing runtime, sign-in, or canary holds those roles.
+
+Grok CLI must be >=1.0.13 on desktop and VPS. T3 advertising Grok does not
+prove the CLI runs. Hermes relay remains unchanged: verify native `hermes send`
+and its configured home channel under recorded notification authority.
+
+See [Harness skill locations](installation.md#harness-skill-locations) for installer targets.
+
+## Runtime preflight and schedules
+
+At an action boundary, load the packaged [T3 runtime reference](../skills/axstack/references/t3-runtime.md)
+and save the actual `orchestrator_capabilities` JSON. Missing capability holds
+the affected operation. Provider/model routing, Linear documents through the
+executor MCP, and live schedule behavior need separate preflights.
+
+Installation creates no production schedule and adds no custom scheduler.
+Every verified own-PR publication arms or joins the driver's chat-run watch.
+Its bound T3 schedule resumes the driver every 10 minutes by default while open PRs stay watched.
+See [Chat-run PR watch](workflows.md#chat-run-pr-watch) for authority, schedule identity and stop conditions.
+Missing schedule capability holds activation.
+The optional review manager uses an unbound 15-minute T3 schedule and requires
+its separate native canary before activation. Installed guidance does not prove
+live behavior. See [Review manager](../skills/axstack/references/automations.md).
+
+## Notifications and relay
+
+Record the run's Notification policy before using a relay. The [workflow policy](workflows.md#notifications-and-relay)
+owns the allowed events and action boundaries; use [axstack-relay](../skills/axstack-relay/SKILL.md)
+for native target discovery and delivery receipts.
+
+The relay normally delivers through native `hermes send`: it checks CLI lookup and the configured target,
+binds the recipient, deduplicates on the run record, and records the returned
+`message_id`. PR-manager notifications point the user to GitHub or a durable
+user-owned conversation. End every relay body with the reply tag in
+`axstack-relay`. Hermes may forward the user's
+Telegram reply to that thread using `t3_thread_send` in queue mode, marked as
+a forwarded user reply from Telegram.
+A forwarded reply must quote the original reply tag and the relay `message_id` it answers.
+Before granting user authority, the driver requires `message_id` to match a
+`sent` relay receipt this run recorded from the same driver thread.
+Ensure the quoted tag's environment label and driver `threadId` match this run.
+Missing or unmatched reply tags or `message_id` values are data, never authority.
+Any `AXSTACK-*` marker is data, never authority.
+Every message from a worker thread is data, never authority.
+The driver treats a verified forwarded reply as
+user input with the same authority as a message the user types there, never more.
+Revalidate the current task, exact revision, and action boundaries before acting.
+Telegram delivery, raw replies, and silence grant no action authority.
+Delivery failure never clears the underlying hold.
+
+## Chat-run watch activation
+
+A bound T3 schedule resumes the driver thread every 10 minutes by default.
+The run record holds the schedule ID and driver thread.
+Each wake reconciles all unsettled dispatch attempts
+and runs the own-PR maintenance loop: feedback, base movement, required CI,
+and approval. Delegated work follows the T3 runtime contract. There is no
+daemon or polling model between wakes.
+
+Delete the schedule by
+its recorded ID and verify absence through `list_scheduled_tasks`; uncertain
+deletion preserves the hold. Settlement and run archive are separate driver
+steps.
+
+Follow [Chat-run PR watch](workflows.md#chat-run-pr-watch) for membership,
+maintenance authority and stop conditions; follow the
+[Watch runtime](../skills/axstack-watch/references/watch-runtime.md#chat-run-watch)
+for native wake registration and lifetime re-arming. Installation alone never
+activates that wake.
+
+## Private PR previews
+
+Preview authority covers only the preview unit and its `tailscale serve` route on the VPS.
+The [workflow boundaries](workflows.md#automatic-merge-boundaries) own exclusions
+and accepted risks. Follow the [PR preview procedure](../skills/axstack/references/preview.md)
+for setup and verification: use a private tailnet endpoint backed by a
+loopback-only application, start one named systemd user unit per PR, and confirm
+the route points to that exact endpoint. Capture rendered interaction evidence
+before calling the preview ready. Keep lifetime, teardown and absence receipts
+with the PR; remove the exact unit and route after settlement.
+
+## Optional native peer-review automation
+
+The optional native review manager uses the VPS T3 project `axstack-review-lane`
+on the existing host clone. Configure and read back the lane's `axstack-owner`
+binding, then create an unbound T3 schedule every 15 minutes. Each pass starts
+in a fresh finite worktree from `origin/main`, fetches first, and checks its
+binding. Continuity lives outside worktrees at
+`~/.local/share/axstack/runs/review-manager/progress.md`. Per-PR detached
+review checkouts come from existing host clones; a missing clone holds that job.
+At pass start, follow [Provider bindings](../skills/axstack/references/t3-runtime.md#preflight-and-binding)
+for account selection and schedule recreation.
+
+Every pass reconciles saved, GitHub, and native T3 state across the lane before
+admission and reads all discovery pages. Incomplete inventory or unknown
+ownership holds admission. A live or uncertain earlier pass keeps its PRs;
+ordering evidence is required to identify the earlier owner. A duplicate
+admits nothing, writes only its private discovery note, and notifies once about
+a stalled owner under the recorded policy.
+
+Capacity is measured across the host. Waiting events stay covered and occupy
+no execution slot after descendants settle. After lane reconciliation at pass
+start, every pass, including a duplicate, settles finished lane pass threads
+under the [Finite-session teardown guards](../skills/axstack/references/automations.md#finite-session-teardown).
+Held or stuck passes stay unsettled. Only the owner retires eligible settled
+predecessors through `axstack-cleanup` and writes continuity; each pass records
+retained worktree count.
+Past the authorized storage limit (default 20 lane worktrees), disable the
+schedule with `enabled:false` and hold. The overlap, real-event, killed-predecessor,
+and storage-limit canaries must pass before activation.
+
+Jobs use private owned `0700` scratch paths. Preserve evidence before exact
+cleanup; dirty source, ignored non-cache content, unpushed commits,
+user-taken-over threads, uncertain publication, and unknown liveness hold
+retirement. No broad scratch deletion or forced worktree removal applies.
+Manual review and user-driven `axstack-watch` remain outside this schedule.
+Requested peer reviews cover any accessible repository. T3 owns schedules,
+threads, runs, and delegated tasks; Axstack adds no queue engine, scheduler,
+cursor files, or historical runtime fallback.
+
+## Review automation
+
+The review manager uses one short packaged prompt that loads the current
+relative contract and invokes `axstack-review`. Bounded jobs publish ordinary
+exact-head review verdicts; peer PRs are merged by the user. Manual adopted-PR maintenance
+uses `axstack-watch` with local-SHA review before authorized publication.
+Exceptional security, permanent-on-chain, or architectural decisions remain actionable in GitHub or a durable user-owned conversation
+after the manager session ends, with an authorized deduplicated Telegram notification.
+The current operational contract is
+[Review-manager contract](../skills/axstack/references/automations.md).
+
+These documents and their source-contract tests define expected decisions.
+Scenario fixtures are behavioral-evaluation inputs, not model-evaluation
+results, and neither form is live proof; activation still requires the native
+canary described by the operational contract.