axstack 0.32.0 → 0.34.0

package/README.md

@@ -15,7 +15,7 @@ coordination. You can start at the phase you need.
 | Failure mode | How Axstack responds |
 | --- | --- |
 | Wrong thing built | Align rounds clarify the request; every brainstorm runs a light arena across configured families. Use judges only for Rung 2 hard-to-reverse choices. |
-| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus low in isolated sessions at the exact revision. |
+| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus medium in isolated sessions at the exact revision. |
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
 | Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 

package/docs/workflows.md

@@ -119,11 +119,11 @@ role.
 
 | Preset | Author | Ordered peer reviewers | Astra / Opus advisers | Auditor |
 | --- | --- | --- | --- | --- |
-| `mixed` | Sol high | Sol high; Opus low | Astra high / Opus xhigh | Sonnet high + Sol high |
+| `mixed` | Sol high | Sol high; Opus medium | Astra high / Opus xhigh | Haiku xhigh + Sol high |
 | `codex-only` | Sol high | Sol high; Luna xhigh | Astra high / unavailable | Luna xhigh + Sol high |
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
-In `mixed` and `claude-only`, `axstack-auditor`, `axstack-research-requirements`,
+In `mixed` and `claude-only`, `axstack-research-requirements`,
 `axstack-research-code`, `axstack-research-web`, and `axstack-explore-execution`
 use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 `axstack-monitor` adopt Haiku 5.5 high, with class `haiku` and exact pin
@@ -131,6 +131,9 @@ use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 holds those roles without substitution. `codex-only` keeps its Codex
 assignments for those roles. Mixed web-google and X retain their source-specific
 Antigravity and Grok routes.
+The mixed `axstack-auditor` uses Haiku 5.5 xhigh, pinned to `claude-haiku-5-5`;
+missing that ID or xhigh effort holds without substitution. The mixed
+`axstack-explainer-review` uses Sol medium; `axstack-explainer` stays Sonnet high.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high
 in `mixed` and `codex-only`; `claude-only` records each as intentionally absent.
 Dispatch the base and Sol seats independently on the same brief, then reconcile
@@ -148,7 +151,7 @@ later installation changes without re-resolution.
 Peer roles use the stable IDs `axstack-reviewer-primary` and
 `axstack-reviewer-peer`; their provider/class mappings come only from the
 selected preset. The mixed cross-provider peer pair is Sol high followed by
-Opus low. The mixed peer coordinator and review-lane binding
+Opus medium. The mixed peer coordinator and review-lane binding
 `axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
 is used in the authored mapping and, alongside `axstack-reviewer-primary`,
 in codebase findings mode.
@@ -289,22 +292,36 @@ keeps the current owner and a resumable record.
 
 Serious security, downtime, data-loss, and major-design risks are raised in a
 prompt immediately and hold dependent dangerous work. This is not a runtime
-gate. An applicable `Notification policy` may use `axstack-relay` only for a
+gate. An applicable `Notification policy` may use `axstack-relay` for a
 user-decision hold (including spec or npm approval and a genuine blocker after
-bounded safe recovery), a serious-risk hold immediately, or at most two merge-ready/merged milestones per run.
+bounded safe recovery) or a serious-risk hold immediately.
 Routine questions stay in the T3 driver thread. Progress, CI pending, and
 completion always stay in the T3 driver thread.
-Only the bounded categories—user-decision holds (including spec approval),
-serious-risk holds, and at most two merge-ready/merged milestones per run—may
-be relayed under the recorded Notification policy. See [Relay operations](host-operations.md#notifications-and-relay) for native
+Proactive relay eligibility is limited to user-decision holds, serious-risk holds, the
+60-minute blocked ping, unresolved-rating notice and capped peer PR milestones
+under the Notification policy.
+Under the recorded Notification policy, `verification not proven` is a
+user-decision hold. The 60-minute blocked ping is a notification-only category
+under the Notification policy. The unresolved-rating notice is a notification-only
+category under the Notification policy, deduplicated per comment and head.
+The unresolved-rating notice grants no reply authority.
+The unresolved-rating notice never clears the hold.
+Never send routine merge-ready or merged relays
+for own PRs. Notifications for peer PRs are unchanged, including at most two
+merge-ready/merged milestones per run, deduplicated across implementation and release.
+See [Relay operations](host-operations.md#notifications-and-relay) for native
 delivery, deduplication, and verified reply handling.
 
+Decision responses must remain separate from proactive Notification policy
+categories.
 Decision responses must be authorized by the user's own reply, outside the
 two-milestone cap and needing no Notification policy entry. Send one
 acknowledgement per forwarded reply before any side effect and one outcome
 per decided card. An explain answer, confirmation card or fresh superseding
 card serves as that reply's acknowledgement. Identical repeat replies get T3-only
 acknowledgement; different later choices get "already decided as N" in Telegram.
+For own PRs, the driver must send the required decision outcome as resolution
+of the bound cause, rather than a routine merge-ready or merged milestone.
 An outcome that is itself merge-ready or merged counts as that milestone and
 is sent once. Queued, acknowledged and done are distinct.
 
@@ -323,7 +340,7 @@ read-only observer for standalone watches and never sends.
 
 For authorized engineering delivery, [Autopilot](../skills/axstack/references/autopilot.md)
 continues from Align through the eligible phase sequence in the same chat.
-The human approves substantial specs, peer and deploying-base merges, and the
+The human approves substantial specs, peer and work deploying-base merges, and the
 npm stage. The recorded owning watch thread is the merge actor,
 including `axstack-owner` for standalone authorized maintenance and small or
 adopted work. Apply the full
@@ -358,6 +375,13 @@ review before driver publication and remote readback. Watch §5 governs merges.
 
 ## Automatic merge boundaries
 
+Record approval mode from the collaborator readback.
+A repository is personal (`solo`) only when it is outside `defi-com` and a
+complete collaborator readback lists the user alone with write, maintain, or
+admin permission. A `defi-com` repository, an extra writer, or an incomplete or
+failed readback classes as work (`team`).
+Every other repository is work (`team`).
+
 Solo approval is current-head-and-base cross-provider authored-review `APPROVE`
 plus diligence `PASS`. The reviewer differs from every receipt-recorded provider
 that authored or repaired `merge-base..head` commits. Team approval also needs a
@@ -367,36 +391,156 @@ merge card. New heads need fresh authored review, diligence, and CI. A collabora
 approval carries over only across an unchanged stable patch-id rebase, recorded
 for both heads, while the forge still counts it.
 
-Team auto-merge targets only documented non-production `dev`; solo targets `main`
-or another documented `integration` base. Unknown classification means
-`deploying`. Re-read approval mode and classification before merging and on resume.
-For a stack, only the bottom base must qualify; every upper base is its next-lower
-branch at the reviewed head. Every planned member must be published and satisfy
-the remaining terms and exclusions. Never retarget reviewed members for eligibility.
-
-Merge cards report cases that fail approval, base, exclusion, or `Auto-merge: off`
-rules. On own integration-base PRs, a user card reply permits the guarded actor to
-merge, subject to watch §5's exceptions.
-In solo mode the user's merge-card reply authorizes the guarded merge of
+Base classification uses repository docs and workflows, never the branch name
+alone, and unknown means `deploying`. A base is `integration` only when
+repository docs or workflows show it does not deploy to production.
+Re-read approval mode and base classification immediately before each automated
+merge and at every watch resume.
+
+### Proven verification
+
+Proven verification is required for every own PR. Use the authored receipt:
+
+- Verification requires `Verdict: APPROVE`, `Coverage: COMPLETE`, and
+  `Escalate to user: no`.
+- Verification requires a `Safety fact` about the change that is not `unproven`.
+- Verification requires diligence `PASS` at the exact head and base.
+- Verification requires `Final-head check: <command> -> <log path>` for a check
+  the reviewer ran at the final head, with its log kept in the run's evidence folder.
+- Each acceptance check requires passing evidence from the ticket or spec
+  criteria, or the PR body for adopted and ticketless PRs.
+  Earlier-head red-to-green evidence in the PR's patch lineage counts only when
+  the reviewer records that it still applies to the final change.
+  An applicable `verify-<app>` passing result is required for the changed behavior.
+- Verification requires no limitation tagged `changed-behavior: unproven`.
+  The reviewer tags every limitation leaving changed behavior unexercised or
+  unverified, in whatever words, `changed-behavior: unproven`.
+  Other limitations do not hold.
+- When the PR removes or weakens a check, test-runner setting or ruleset that
+  gates its own merge, verification requires the reviewer ran the base's checks
+  against the head.
+
+The driver first closes a verification gap itself: run the check, re-dispatch
+review, or return the work to the author. Only a gap the driver cannot close
+becomes a `verification not proven` card bound to head and base.
+The card names what is unproven, why, and the action that would settle it.
+
+For `verification not proven`, the driver must follow [Relay](../skills/axstack-relay/SKILL.md)'s decision-card procedure,
+binding the sent run receipt and each option's scope to the exact PR head and base.
+For a verification decision, a forwarded choice must pass [Relay](../skills/axstack-relay/SKILL.md)'s four reply checks
+and acknowledgement-before-action rule before settling only its bound cause.
+A changed PR head or base must supersede its open verification decision card,
+reissuing only if a decision is still needed.
+
+The user's reply in the driver thread or on the forge clears only that
+verification cause. Record `user-accepted unproven: <item>`, never as a pass.
+Treat the accepted item as settled for this head and base and merge when every
+other gate and hold permits it. A reply never waives `APPROVE`, diligence `PASS`
+or green CI. A new head or base voids the acceptance.
+Settle an `Escalate to user` for the user-accepted verification cause at its
+accepted head and base while other escalation holds still apply.
+In a work repository a reply never replaces counted collaborator approval.
+
+Only comments and threads whose IDs are recorded in an agent receipt count as agent-authored.
+The authored reviewer rates each non-agent review thread, review body, or
+top-level comment from a human or a bot at the current head as `above low`,
+`low`, `addressed` or `uncertain`. Re-rate every non-agent item at each new head.
+Reviewer-rated `low` or `addressed` items do not hold automatic merge.
+An `above low`, unrated or `uncertain` item holds automatic merge.
+Human `CHANGES_REQUESTED` holds automatic merge until resolved.
+A comment arriving after the receipt triggers a fresh review dispatch for rating
+as gap closing.
+An item still unrated or uncertain after one fresh rating dispatch keeps holding
+the merge and posts a report-only decision-style card bound to head and base.
+The rating card names the comment, why it remains unrated or uncertain, and the
+action that settles it: re-rating by the reviewer, the commenter resolving or
+replying, or the author addressing it.
+The report-only rating card is a notification of an unsettled rating,
+deduplicated per comment and head.
+A report-only rating card never offers a user-acceptance path.
+A user reply never clears a comment rating hold.
+Agents never resolve or dismiss non-agent items.
+Agent-authored threads with only `low` findings can stay open.
+Apply any repository rule that requires conversation resolution.
+
+### Escalation
+
+Personal PRs merge when the gates pass and verification is proven or
+user-accepted at this head and base. Personal PRs on any base, including
+promotion, `deploying` and unknown bases, are eligible under the watch predicate.
+Work PRs merge when the gates pass, verification is proven or user-accepted,
+and a counted collaborator approval exists, on an `integration` base.
+Work promotion PRs and `deploying` or unknown bases are merged by the user on
+the forge. The existing serious-risk hold applies at once to both personal and
+work PRs.
+Personal and work PRs remain eligible whatever files they change, including
+`.github/`, workflow-invoked files, package.json, lockfiles, test-runner config,
+branch-protection or ruleset config, `CODEOWNERS`, `AGENTS.md`, and non-clean
+revert lines such as `Revert: steps`.
+
+For a `gh stack`, only the bottom member's base must be eligible.
+Each other member's base must be the next-lower member's branch at its reviewed head.
+Every member must meet every other term.
+A stack holds until every member of its approved plan (the ticket map or the
+adopted stack's recorded members) is published.
+Reviewed members are never retargeted to become eligible.
+
+Never auto-merge PRs authored by anyone other than the user or the user's agents.
+Test sources stay eligible.
+Axstack skill and merge-rule text are eligible under the watch predicate.
+Changes to package.json are eligible under the watch predicate.
+Release PRs are eligible under the watch predicate.
+Read the rollback declaration whose line starts with `Revert:`
+at line start in the PR description.
+A quoted format inside a bullet never counts as the declaration.
+`--admin` and rule bypass are never used.
+`Auto-merge: off` for a run or PR makes the merge card wait, and it waits for the user.
+
+Post a merge card for every nonqualifying approval, base, verification, or off case.
+Bind it to the PR head and base SHA; list CI, authored review and diligence at
+those SHAs, counted collaborator approvals and bot votes with each vote's SHA
+and stale flag, and the causes holding this merge.
+A card that needs the user's decision (work promotion or work deploying/unknown base,
+`Auto-merge: off`, provenance, or an unclosable verification gap) is a decision
+hold under the recorded Notification policy with one deduplicated relay;
+relay text never supplies approval. Person-wait cards follow the clock below.
+A changed head or base requires a refreshed card.
+For an own PR on an `integration` base, the user's reply to the card authorizes
+the merge actor to merge under the guarded path, subject to the exceptions below.
+In `solo` mode the user's merge-card reply authorizes the guarded merge of
 user-written PRs or PRs with unknown or mixed provenance.
-In team mode it clears only an ineligible base, auto-merge turned off, and an open
-human or bot comment; it never replaces collaborator approval.
-PRs changing `.github/`, files a workflow step invokes by path, package.json
-beyond `version` and `files`, lockfiles, test-runner config, branch-protection or
-ruleset config, `CODEOWNERS`, or `AGENTS.md` are user-merged on the forge.
-PRs with a non-`clean` revert line are also user-merged on the forge.
-Promotion, deploying-base, unknown-base, and peer PRs are also user-merged.
-These categories are excluded from auto-merge.
-Test sources stay eligible. Axstack skill and merge-rule text are eligible
-under the watch predicate. Changes to package.json limited to `version` and
-`files` are eligible under the watch predicate. Release PRs are eligible
-under the watch predicate. Npm publication still requires human stage approval;
-agents never run `npm stage approve`.
-Non-agent comments hold auto-merge
-until human clearance under the packaged comment rules. The revert gate reads the declaration starting
-with `Revert:` at line start; a quoted format inside a bullet is not a declaration.
-
+In `team` mode a reply never replaces counted collaborator approval.
+A reply can clear auto-merge turned off; verification acceptance follows the
+head-and-base-bound rule above. It never clears an ineligible work base or a
+reviewer-rated `above low` finding. A user reply never clears a comment rating hold.
+Peer PRs are merged by the user on the forge,
+and the card only reports readiness.
+Work promotion, deploying-base and unknown-base cards only report readiness.
 User merges are bottom-up for a stack.
+
+### Blocked on a person
+
+A PR is ready-except-human when every term other than collaborator approval,
+human `CHANGES_REQUESTED` and open findings from a person holds.
+Each blocker has a key: `approval:<PR>`, `changes:<review id>` or
+`comment:<comment id>`. A missing approval's clock starts at the first observed
+ready-except-human time, including no review requested.
+Other clocks start at the later of that ready-except-human time and the item's
+forge time. A `comment:` clock starts only once the reviewer rates the item
+`above low`. An unrated or uncertain item waits on the reviewer and does not
+count as ready-except-human.
+A clock resets when the PR stops being ready-except-human or its patch-id
+changes. A same-patch-id rebase keeps the clock.
+Each key is sent at most once, even when readiness is lost and regained or the
+patch changes. After 60 minutes, send one relay per key, including simultaneous
+blockers and a new key.
+Send `<repo>#<n> waiting <age> on @<login|no reviewer>: <approval|changes|comment>; ready at <sha7>.`
+The check runs on existing watch wakes with no new schedule.
+The ping is a notification only: when the blocker clears, the PR merges with no reply.
+
+Npm publication still requires human stage approval; agents never run
+`npm stage approve`.
+
 This policy grants no release, npm publish, or host install
 authority. See [Preview authority and operations](host-operations.md#private-pr-previews).
 
@@ -404,7 +548,8 @@ Excluded: CLI proxy, account pooling behind a proxy or shared session, and IP
 routing; local CI contention handling is deferred. Quota-driven scheduling or
 model routing (provider/model substitution) is excluded. Per-dispatch selection
 among the user's own same-provider, same-model accounts is permitted. Automatic
-merge of promotion, deploying-base, unknown-base, and peer PRs is excluded. Previews
+merge of work promotion, deploying-base and unknown-base PRs is excluded.
+Automatic merge of peer PRs is excluded. Previews
 outside the VPS, public previews, and production data are excluded. Nightly triage
 never sends relay messages.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/mixed.json

@@ -43,7 +43,7 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "sol"
     },
     {
@@ -51,7 +51,7 @@
       "name": "Axstack reviewer (secondary)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "medium",
+      "thinkingOptionId": "high",
       "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
@@ -60,8 +60,8 @@
       "name": "Axstack reviewer (peer)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "low",
-      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "thinkingOptionId": "medium",
+      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
     {
@@ -150,9 +150,9 @@
       "name": "Axstack explainer reviewer",
       "provider": "codex",
       "modeId": "full-access",
-      "thinkingOptionId": "xhigh",
-      "notes": "Independent explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
-      "modelClass": "luna"
+      "thinkingOptionId": "medium",
+      "notes": "Independent Sol medium explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
+      "modelClass": "sol"
     },
     {
       "id": "axstack-ui-verifier",
@@ -206,9 +206,10 @@
       "name": "Axstack auditor",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "high",
-      "notes": "Sonnet high read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "thinkingOptionId": "xhigh",
+      "notes": "Haiku 5.5 xhigh read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or xhigh effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor-sol",

package/skills/axstack/references/autopilot.md

@@ -72,7 +72,10 @@ The recorded owning watch thread is the merge actor, including `axstack-owner`
 for authorized standalone maintenance and small or adopted work.
 Managers, workers, reviewers, monitors, and nightly triage never merge.
 Observation-only and peer watches never merge.
-Apply watch §5's approval, base, exclusions, and merge-card rules.
+Apply watch §5's approval, base, proven-verification, escalation, and merge-card rules.
+Personal own PRs, including `deploying` bases, follow automatic merge under
+watch §5. Work promotion PRs and `deploying` or unknown bases are merged by the
+user on the forge. Peer PRs are merged by the user on the forge.
 A stack follows its guarded whole-stack rule.
 User merges are bottom-up for a stack.
 
@@ -166,8 +169,20 @@ instructions, always win.
 Follow [Provider bindings](t3-runtime.md#preflight-and-binding) for driver account re-selection on start, resume and run-watch wakes.
 
 Use the run's recorded Notification policy through `axstack-relay`.
-Decision holds, including spec and npm approval, are always eligible. Across
-implementation and release, merge-ready and merged notifications together are
-capped at two per run; deduplicate by purpose and revision. Healthy ticks stay
+Decision holds, including spec and npm approval, are always eligible.
+Relay eligibility is limited to user-decision holds, serious-risk holds, the
+60-minute blocked ping, unresolved-rating notice and capped peer PR milestones
+under the Notification policy.
+Under the recorded Notification policy, `verification not proven` is a
+user-decision hold. The 60-minute blocked ping is a notification-only category
+under the Notification policy. The unresolved-rating notice is a notification-only
+category under the Notification policy, deduplicated per comment and head.
+The unresolved-rating notice grants no reply authority.
+The unresolved-rating notice never clears the hold.
+Never send routine merge-ready or merged relays
+for own PRs. Notifications for peer PRs are unchanged, including at most two
+merge-ready/merged milestones per run, deduplicated across implementation and release.
+Across implementation and release, peer PR merge-ready and merged notifications
+together are capped at two per run; deduplicate by purpose and revision. Healthy ticks stay
 quiet. A failed or uncertain delivery preserves the underlying hold. A relay
 message is only a notification, never authority to approve, merge, or publish.

package/skills/axstack/references/role-roster.md

@@ -7,12 +7,12 @@
   Only the recorded owning watch thread merges, including `axstack-owner`
   for authorized standalone maintenance. Other roles never acquire merge authority.
 - `axstack-reviewer-primary` and `axstack-reviewer-peer` are the ordered
-  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus low.
+  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus medium.
   Peer review uses both; authored review uses this table:
 
   | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
   | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
@@ -24,15 +24,18 @@
   `axstack-auditor` audits; `axstack-checker` reports discrepancies.
 - `axstack-explainer` authors archify only on an explicit viewer request.
 - `axstack-explainer-review` reviews consequential or complex claims, archify
-  output, or on request.
+  output, or on request; `codex/sol` medium in mixed.
 - `axstack-diligence`: read-only [diligence checks](diligence.md) for every PR
   review round and bounded research, spec, ticket, receipt, and release claims.
 - `axstack-ui-verifier`: owns the inline page interaction pass under [UI checks](ui-verification.md)
   for every interactive page, bound to the exact bytes and SHA-256.
-- `axstack-auditor`/`axstack-research-requirements`/
+- `axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`:
   `claude/sonnet` high in mixed/claude-only.
+- `axstack-auditor`: `claude/haiku` xhigh in mixed, pinned to
+  `claude-haiku-5-5`. Missing that exact model or xhigh effort holds without
+  substitution. `claude/sonnet` high in claude-only; `codex/luna` xhigh in codex-only.
 - `axstack-explore-codebase`/`axstack-monitor`: `claude/haiku` high in
   mixed/claude-only, pinned to `claude-haiku-5-5`. Missing that exact model
   or high effort holds these roles without substitution.
@@ -41,7 +44,7 @@
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
   `axstack-explore-execution-sol`: `codex/sol` high in
   mixed/codex-only; intentionally absent in claude-only. Dispatch each
-  independently from its Sonnet seat on the same bounded brief without
+  independently from its base seat on the same bounded brief without
   cross-reading. The driver reconciles findings per claim, never averages.
   Record intentional absence and continue with Sonnet alone.
 - Optional seats: `axstack-arena-candidate-grok`,

package/skills/axstack/references/t3-runtime.md

@@ -91,6 +91,7 @@ Account switches must happen before exhaustion at the picker's near-limit cutoff
 For plan generation, run
 `scripts/dispatch-plan.js --role <id> --roles <roles.json> --capabilities <saved.json> --picker <picker.json> --kind task|launch`
 using the recorded role snapshot and saved capabilities.
+Plan JSON carries `inputs`, which callers omit when copying `target`/`modelSelection` and `runtimeMode` into `delegate_task`/`t3_thread_launch`; large plan output requires `--out`.
 For claude/codex, the `--picker` JSON must come from saved
 `scripts/pick-instance.js --provider <role provider> --json` output.
 For grok/antigravity, or after a claude/codex picker exit-1 canonical fallback,

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,10 +1,11 @@
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 
-const flags = ['--role', '--roles', '--capabilities', '--picker', '--kind', '--verify'];
+const flags = ['--role', '--roles', '--capabilities', '--picker', '--kind', '--verify', '--out'];
 const nonempty = (value) => typeof value === 'string' && value.trim().length > 0;
 const help = `Usage: bun dispatch-plan.js --role <id> --roles <roles.json>
   --capabilities <saved.json> --picker <picker.json> --kind task|launch
-  [--verify <configuration.json>]
+  [--verify <configuration.json>] [--out <report.json>]
+Example: bun dispatch-plan.js --role axstack-author --roles roles.json --capabilities capabilities.json --picker picker.json --kind launch
 
 --role          Role ID from the supplied snapshot
 --roles         Installed-style roles.json (version 1, roles array)
@@ -12,9 +13,13 @@ const help = `Usage: bun dispatch-plan.js --role <id> --roles <roles.json>
 --picker        Saved picker JSON; uses chosenInstanceId
 --kind          task emits target; launch emits modelSelection
 --verify        Compare t3_thread_configuration JSON; print MATCH or each mismatch
+--out           Write full JSON here and print input/path/omitted-count summary
 --help          Show all flags and exit codes
 
-Read-only: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
+Read-only inputs: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
+Writes only the caller's --out path when supplied; no retained state.
+Results name input paths. Plan output over 4096 bytes requires --out.
+Large verification retains its exit code, prints mismatches and advises --out on stderr.
 Never dispatches or changes snapshots. Reuse recorded exact model pins as given.
 Exit codes: 0 ok, 1 error, 2 hold (including incomplete read-back).
 `;
@@ -27,20 +32,23 @@ function argumentsFrom(args) {
   const options = {};
   for (let i = 0; i < args.length; i += 2) {
     const flag = args[i];
-    if (!flags.includes(flag)) throw new Error(`unexpected argument ${flag}`);
+    if (!flags.includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
     const value = args[i + 1];
-    if (!nonempty(value) || value.startsWith('--')) throw new Error(`expected value after ${flag}`);
-    if (flag in options) throw new Error(`duplicate argument ${flag}`);
+    if (!nonempty(value) || value.startsWith('--')) throw new Error(`expected value after ${flag}; pass ${flag} <value>`);
+    if (flag in options) throw new Error(`duplicate argument ${flag}; pass it once`);
     options[flag] = value;
   }
-  for (const flag of flags.filter((flag) => flag !== '--verify')) {
-    if (!options[flag]) throw new Error(`expected ${flag}`);
+  for (const flag of flags.filter((flag) => !['--verify', '--out'].includes(flag))) {
+    if (!options[flag]) throw new Error(`expected ${flag}; pass ${flag} <value>`);
   }
-  if (!['task', 'launch'].includes(options['--kind'])) throw new Error('expected --kind task|launch');
+  if (!['task', 'launch'].includes(options['--kind'])) throw new Error('expected --kind task|launch; pass --kind task or --kind launch');
   return options;
 }
 
-const readJSON = (path) => JSON.parse(readFileSync(path, 'utf8'));
+function readJSON(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); }
+  catch (error) { throw new Error(`${error.message}; pass a readable, valid JSON file: ${path}`); }
+}
 
 function normalizedOptions(options) {
   const entries = Array.isArray(options) ? options.map((option) => [option?.id, option?.value])
@@ -68,19 +76,36 @@ function verify(configuration, instanceId, provider, model, options) {
   compare('options', options, selection?.options,
     normalizedOptions(options) === normalizedOptions(selection?.options));
   compare('runtimeMode', 'full-access', configuration?.runtimeMode);
-  console.log(mismatches.length ? mismatches.join('\n') : 'MATCH');
-  return mismatches.length ? 2 : 0;
+  return mismatches;
 }
 
-function main() {
-  if (process.argv.slice(2).includes('--help')) {
-    process.stdout.write(help);
+function plan(argv, io) {
+  if (argv.includes('--help')) {
+    io.stdout(help);
     return 0;
   }
-  const args = argumentsFrom(process.argv.slice(2));
+  const args = argumentsFrom(argv);
+  const inputs = Object.fromEntries(Object.entries(args).filter(([flag]) => flag !== '--out').map(([flag, value]) => [flag.slice(2), value]));
+  const emit = (result) => {
+    const full = { inputs, ...result };
+    const inline = result.mismatches
+      ? `${JSON.stringify({ inputs })}\n${result.mismatches.join('\n') || 'MATCH'}\n` : `${JSON.stringify(full)}\n`;
+    if (!args['--out']) {
+      if (new TextEncoder().encode(inline).length > 4096) {
+        if (!result.mismatches) throw new Error('large output; pass --out <report.json> to save full JSON');
+        io.stderr('Large verification output; pass --out <path>.json for the full list\n');
+      }
+      io.stdout(inline);
+      return;
+    }
+    try { writeFileSync(args['--out'], `${JSON.stringify(full, null, 2)}\n`); }
+    catch (error) { throw new Error(`${error.message}; pass --out <writable report.json path>`); }
+    io.stdout(`${JSON.stringify({ inputs, reportPath: args['--out'],
+      omittedPayloadFields: Object.keys(result).length, omittedMismatches: result.mismatches?.length ?? 0 })}\n`);
+  };
   const snapshot = readJSON(args['--roles']);
   if (snapshot?.version !== 1 || !Array.isArray(snapshot.roles)) {
-    throw new Error('roles snapshot must have version 1 and a roles array');
+    throw new Error('roles snapshot must have version 1 and a roles array; pass --roles <valid roles.json>');
   }
   const roles = snapshot.roles.filter((role) => role?.id === args['--role']);
   if (roles.length !== 1) hold(`role ${args['--role']} unavailable or ambiguous`);
@@ -100,7 +125,7 @@ function main() {
   const resolved = Bun.spawnSync([process.execPath, `${import.meta.dir}/resolve-models.js`,
     '--provider', role.provider, '--capabilities', args['--capabilities'],
     '--effort', role.thinkingOptionId, ...modelArgs], { stdout: 'pipe', stderr: 'pipe' });
-  if (resolved.stderr.length) process.stderr.write(resolved.stderr);
+  if (resolved.stderr.length) io.stderr(resolved.stderr.toString());
   if (resolved.exitCode !== 0) return resolved.exitCode === 1 ? 2 : 1;
   const { model, effortOption, providerInstanceId } = JSON.parse(resolved.stdout.toString());
   const chosen = readJSON(args['--capabilities']).providers
@@ -117,18 +142,22 @@ function main() {
   }
   const options = effortOption ? [effortOption] : [];
   if (args['--verify']) {
-    return verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
+    const mismatches = verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
+    emit({ mismatches });
+    return mismatches.length ? 2 : 0;
   }
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: picker.chosenInstanceId,
     model, options };
-  console.log(JSON.stringify({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection,
-    runtimeMode: 'full-access' }));
+  emit({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection, runtimeMode: 'full-access' });
   return 0;
 }
 
-try {
-  process.exitCode = main();
-} catch (error) {
-  console.error(`dispatch-plan ${error.exitCode === 2 ? 'hold' : 'error'}: ${error.message}`);
-  process.exitCode = error.exitCode ?? 1;
+export function main(argv, io = { stdout: (text) => process.stdout.write(text), stderr: (text) => process.stderr.write(text) }) {
+  try { return plan(argv, io); }
+  catch (error) {
+    io.stderr(`dispatch-plan ${error.exitCode === 2 ? 'hold' : 'error'}: ${error.message}\n`);
+    return error.exitCode ?? 1;
+  }
 }
+
+if (import.meta.main) process.exitCode = main(process.argv.slice(2));