axstack 0.33.0 → 0.34.0

package/README.md

@@ -15,7 +15,7 @@ coordination. You can start at the phase you need.
 | Failure mode | How Axstack responds |
 | --- | --- |
 | Wrong thing built | Align rounds clarify the request; every brainstorm runs a light arena across configured families. Use judges only for Rung 2 hard-to-reverse choices. |
-| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus low in isolated sessions at the exact revision. |
+| Nobody really reviewed it | Strict TDD checks behavior first; mixed authored review is cross-provider, and mixed peer review pairs Sol high with Opus medium in isolated sessions at the exact revision. |
 | Design rot | The design lens sketches boundaries before a build; Improve surfaces evidenced changes later. |
 | Agents left a mess | T3 makes delegation visible, one writer owns each PR, cleanup stays bounded, and watched own PRs merge under guarded rules. |
 

package/docs/workflows.md

@@ -119,11 +119,11 @@ role.
 
 | Preset | Author | Ordered peer reviewers | Astra / Opus advisers | Auditor |
 | --- | --- | --- | --- | --- |
-| `mixed` | Sol high | Sol high; Opus low | Astra high / Opus xhigh | Sonnet high + Sol high |
+| `mixed` | Sol high | Sol high; Opus medium | Astra high / Opus xhigh | Haiku xhigh + Sol high |
 | `codex-only` | Sol high | Sol high; Luna xhigh | Astra high / unavailable | Luna xhigh + Sol high |
 | `claude-only` | Opus medium | Opus medium; Sonnet high | unavailable / Opus xhigh | Sonnet high (Sol absent) |
 
-In `mixed` and `claude-only`, `axstack-auditor`, `axstack-research-requirements`,
+In `mixed` and `claude-only`, `axstack-research-requirements`,
 `axstack-research-code`, `axstack-research-web`, and `axstack-explore-execution`
 use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 `axstack-monitor` adopt Haiku 5.5 high, with class `haiku` and exact pin
@@ -131,6 +131,9 @@ use the Claude Sonnet class at high effort. `axstack-explore-codebase` and
 holds those roles without substitution. `codex-only` keeps its Codex
 assignments for those roles. Mixed web-google and X retain their source-specific
 Antigravity and Grok routes.
+The mixed `axstack-auditor` uses Haiku 5.5 xhigh, pinned to `claude-haiku-5-5`;
+missing that ID or xhigh effort holds without substitution. The mixed
+`axstack-explainer-review` uses Sol medium; `axstack-explainer` stays Sonnet high.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high
 in `mixed` and `codex-only`; `claude-only` records each as intentionally absent.
 Dispatch the base and Sol seats independently on the same brief, then reconcile
@@ -148,7 +151,7 @@ later installation changes without re-resolution.
 Peer roles use the stable IDs `axstack-reviewer-primary` and
 `axstack-reviewer-peer`; their provider/class mappings come only from the
 selected preset. The mixed cross-provider peer pair is Sol high followed by
-Opus low. The mixed peer coordinator and review-lane binding
+Opus medium. The mixed peer coordinator and review-lane binding
 `axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
 is used in the authored mapping and, alongside `axstack-reviewer-primary`,
 in codebase findings mode.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/mixed.json

@@ -43,7 +43,7 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
+      "notes": "Primary reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Eligible authored reviewer for an Opus-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated.",
       "modelClass": "sol"
     },
     {
@@ -51,7 +51,7 @@
       "name": "Axstack reviewer (secondary)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "medium",
+      "thinkingOptionId": "high",
       "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
@@ -60,8 +60,8 @@
       "name": "Axstack reviewer (peer)",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "low",
-      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus low. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
+      "thinkingOptionId": "medium",
+      "notes": "Second reviewer in the ordered mixed peer pair: Sol high followed by Opus medium. Never author or owner; review exact SHA and base across all six angles and acceptance. Peer first pass stays isolated. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "opus"
     },
     {
@@ -150,9 +150,9 @@
       "name": "Axstack explainer reviewer",
       "provider": "codex",
       "modeId": "full-access",
-      "thinkingOptionId": "xhigh",
-      "notes": "Independent explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
-      "modelClass": "luna"
+      "thinkingOptionId": "medium",
+      "notes": "Independent Sol medium explanation reviewer: reviews consequential or complex claims, archify output, or on request. Checks the exact artifact for text and source fidelity. The rendered pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
+      "modelClass": "sol"
     },
     {
       "id": "axstack-ui-verifier",
@@ -206,9 +206,10 @@
       "name": "Axstack auditor",
       "provider": "claude",
       "modeId": "bypassPermissions",
-      "thinkingOptionId": "high",
-      "notes": "Sonnet high read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
-      "modelClass": "sonnet"
+      "thinkingOptionId": "xhigh",
+      "notes": "Haiku 5.5 xhigh read-only end-of-run and checkpoint auditor. Collects scope and outcome evidence with counts and denominators and reports PASS, FAIL, or UNKNOWN without inventing numbers. Never edits, merges, activates, or audits itself. T3 uses the exact claude-haiku-5-5 pin from saved capabilities; a Claude rejection holds. Missing model or xhigh effort holds without substitution.",
+      "modelClass": "haiku",
+      "model": "claude-haiku-5-5"
     },
     {
       "id": "axstack-auditor-sol",

package/skills/axstack/references/role-roster.md

@@ -7,12 +7,12 @@
   Only the recorded owning watch thread merges, including `axstack-owner`
   for authorized standalone maintenance. Other roles never acquire merge authority.
 - `axstack-reviewer-primary` and `axstack-reviewer-peer` are the ordered
-  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus low.
+  peer pair. In `mixed`, the cross-provider pair is Sol high followed by Opus medium.
   Peer review uses both; authored review uses this table:
 
   | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
   | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
@@ -24,15 +24,18 @@
   `axstack-auditor` audits; `axstack-checker` reports discrepancies.
 - `axstack-explainer` authors archify only on an explicit viewer request.
 - `axstack-explainer-review` reviews consequential or complex claims, archify
-  output, or on request.
+  output, or on request; `codex/sol` medium in mixed.
 - `axstack-diligence`: read-only [diligence checks](diligence.md) for every PR
   review round and bounded research, spec, ticket, receipt, and release claims.
 - `axstack-ui-verifier`: owns the inline page interaction pass under [UI checks](ui-verification.md)
   for every interactive page, bound to the exact bytes and SHA-256.
-- `axstack-auditor`/`axstack-research-requirements`/
+- `axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`:
   `claude/sonnet` high in mixed/claude-only.
+- `axstack-auditor`: `claude/haiku` xhigh in mixed, pinned to
+  `claude-haiku-5-5`. Missing that exact model or xhigh effort holds without
+  substitution. `claude/sonnet` high in claude-only; `codex/luna` xhigh in codex-only.
 - `axstack-explore-codebase`/`axstack-monitor`: `claude/haiku` high in
   mixed/claude-only, pinned to `claude-haiku-5-5`. Missing that exact model
   or high effort holds these roles without substitution.
@@ -41,7 +44,7 @@
 - Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
   `axstack-explore-execution-sol`: `codex/sol` high in
   mixed/codex-only; intentionally absent in claude-only. Dispatch each
-  independently from its Sonnet seat on the same bounded brief without
+  independently from its base seat on the same bounded brief without
   cross-reading. The driver reconciles findings per claim, never averages.
   Record intentional absence and continue with Sonnet alone.
 - Optional seats: `axstack-arena-candidate-grok`,

package/skills/axstack/scripts/readiness.js

@@ -89,12 +89,19 @@ const definitions = [
   ['security.pr-tests', 'Governance/Security'], ['security.status-checks', 'Governance/Security'], ['security.updates', 'Governance/Security'], ['security.secrets', 'Governance/Security'],
 ];
 
-function packageManager(files) {
+function packageManager(files, pkg) {
   const locks = [
     ['bun', ['bun.lock', 'bun.lockb']], ['npm', ['package-lock.json', 'npm-shrinkwrap.json']],
     ['pnpm', ['pnpm-lock.yaml']], ['yarn', ['yarn.lock']],
   ].filter(([, names]) => names.some(files.has));
-  if (!locks.length) return { reason: 'no lockfile' };
+  if (!locks.length) {
+    const dependencyFields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies', 'bundledDependencies', 'bundleDependencies', 'workspaces'];
+    if (!files.has('pnpm-workspace.yaml') && dependencyFields.every((field) => !pkg?.[field] || Object.keys(pkg[field]).length === 0)) {
+      if (typeof pkg?.packageManager === 'string' && /^bun@[^@\s]+$/.test(pkg.packageManager)) return { name: 'bun', paths: ['package.json: packageManager'] };
+      if (pkg?.packageManager === undefined && typeof pkg?.engines?.bun === 'string' && pkg.engines.bun.trim()) return { name: 'bun', paths: ['package.json: engines.bun'] };
+    }
+    return { reason: 'no lockfile' };
+  }
   if (locks.length > 1) return { reason: 'ambiguous lockfile' };
   const [name, paths] = locks[0];
   if (name === 'yarn' && !/^__metadata:/m.test(files.read('yarn.lock'))) return { reason: 'unsupported package manager' };
@@ -150,7 +157,7 @@ function assess(files) {
   }
   configured('style.pre-commit', has(/(^|\/)(\.pre-commit-config\.ya?ml|lefthook\.ya?ml|\.lefthook\.ya?ml|\.husky\/pre-commit)$/).concat(pkg.husky?.hooks?.['pre-commit'] ? ['package.json'] : []));
   configured('env.lockfile', has(/^(bun\.lockb?|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock)$/));
-  const manager = packageManager(files);
+  const manager = packageManager(files, pkg);
   declaredCommands(files, pkg, manager, set, invalidPackage);
   configured('env.toolchain', has(/^(\.tool-versions|mise\.toml|\.mise\.toml|\.nvmrc|\.devcontainer\.json|\.devcontainer\/(devcontainer\.json|[^/]+\/devcontainer\.json))$/).concat(pkg.engines && Object.keys(pkg.engines).length ? ['package.json'] : []));
   configured('testing.files', has(/(^|\/)((tests?|__tests__)\/.*\.[cm]?[jt]sx?|[^/]+\.(test|spec)\.[cm]?[jt]sx?)$/));
@@ -168,7 +175,7 @@ function assess(files) {
       const steps = Object.values(workflow?.jobs ?? {}).flatMap((job) => job?.steps ?? []);
       const runs = steps.map((step) => step?.run).filter((run) => typeof run === 'string');
       if (steps.some((step) => typeof step?.uses === 'string' && /^github\/codeql-action\//.test(step.uses))) codeql.push(path);
-      const invokes = (run, name) => new RegExp(`(?:^|[\\n;&|])\\s*${name}\\s+${name === 'bun' ? 'run\\s+' : '(?:run\\s+)?'}test(?:\\s|[;&|]|$)`).test(run);
+      const invokes = (run, name) => new RegExp(`(?:^|[\\n;&|])\\s*${name}\\s+(?:run\\s+)?test(?:\\s|[;&|]|$)`).test(run);
       if (pr && runs.some((run) => ['bun', 'npm', 'pnpm', 'yarn'].some((name) => invokes(run, name)))) prCandidate = true;
       if (pr && manager.name && runs.some((run) => invokes(run, manager.name))) prTests = true;
     } catch { invalid = true; }
@@ -194,19 +201,43 @@ export function summarizePillars(criteria) {
   return result;
 }
 
+function parsePages(text) {
+  const pages = [];
+  let start = -1, depth = 0, quoted = false, escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (start < 0) {
+      if (/\s/.test(char)) continue;
+      if (char !== '{' && char !== '[') throw new Error('invalid gh page');
+      start = i;
+    }
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{' || char === '[') depth++;
+    else if (char === '}' || char === ']') depth--;
+    if (depth === 0) {
+      pages.push(JSON.parse(text.slice(start, i + 1)));
+      start = -1;
+    }
+  }
+  if (start >= 0 || !pages.length) throw new Error('incomplete gh response');
+  return pages;
+}
+
 function forgeStatus(origin) {
   const match = /^https:\/\/github\.com\/([\w.-]+\/[\w.-]+)$/.exec(origin);
   const evidence = [];
   const result = (status, reason) => ({ status, reason, evidence: evidence.length ? evidence : ['origin remote'] });
   if (!match) return result('unknown', 'no GitHub origin');
   function api(endpoint) {
-    const argv = [process.env.GH || 'gh', 'api', '--hostname', 'github.com', '--method', 'GET', '--paginate', '--slurp', endpoint];
-    evidence.push(`gh api --method GET --paginate --slurp ${endpoint}`);
+    const argv = [process.env.GH || 'gh', 'api', '--hostname', 'github.com', '--method', 'GET', '--paginate', endpoint];
+    evidence.push(`gh api --method GET --paginate ${endpoint}`);
     const response = Bun.spawnSync(argv, { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
     if (response.exitCode !== 0) throw new Error(response.stderr.toString().trim());
-    const pages = JSON.parse(response.stdout.toString());
-    if (!Array.isArray(pages) || !pages.length) throw new Error('incomplete gh response');
-    return pages;
+    return parsePages(response.stdout.toString());
   }
   try {
     const metadata = api(`repos/${match[1]}`);
@@ -268,7 +299,7 @@ async function report(args, paths) {
   if (args['--run']) {
     let pkg = {};
     try { pkg = JSON.parse(files.read('package.json') || '{}'); } catch { /* Static criteria already record invalid JSON. */ }
-    execution = await executeDeclared(repo, revision, paths, criteria, packageManager(files), pkg, {
+    execution = await executeDeclared(repo, revision, paths, criteria, packageManager(files, pkg), pkg, {
       timeoutMs: Number(args['--timeout-ms'] ?? 120000), logBytes: Number(args['--log-bytes'] ?? 1048576),
     });
     header.network = execution.network;

package/skills/axstack-audit/SKILL.md

@@ -28,8 +28,8 @@ immediately before an actual auditor profile or session dispatch. Ordinary
 audit reading and record writing do not load it, and the auditor never
 dispatches.
 
-Core owns the `axstack-auditor` profile (claude/sonnet high in
-mixed/claude-only; codex/luna xhigh in codex-only) and its invocation.
+Core owns the `axstack-auditor` profile (claude/haiku xhigh in mixed,
+claude/sonnet high in claude-only, codex/luna xhigh in codex-only) and its invocation.
 This skill governs what that auditor reads, measures, and proposes.
 Dispatch `axstack-auditor` and `axstack-auditor-sol` independently on the same
 bounded brief, without cross-reading. The driver reconciles findings per claim;
@@ -107,7 +107,7 @@ counts with denominators plus the evidence behind the count:
 
   | Preset | Author class | Reviewer (class/effort) |
   | --- | --- | --- |
-  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+  | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
   | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |

package/skills/axstack-review/SKILL.md

@@ -223,14 +223,14 @@ This section applies to peer and authored PR modes.
    - **Peer:** exactly two independent final reviewers,
      `axstack-reviewer-primary` and `axstack-reviewer-peer` from the routing snapshot.
      Send both the identical six-angle brief, with no first-pass cross-read or children.
-     The mixed peer pair is cross-provider (Sol high + Opus low), with independence
+     The mixed peer pair is cross-provider (Sol high + Opus medium), with independence
      still from separate sessions, the identical brief and an isolated first pass.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
      | Preset | Actual author provider/class | Reviewer role (configured class/effort) |
      | --- | --- | --- |
-     | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` medium) |
+     | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
      | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
      | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
      | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |

package/src/roles.js

@@ -18,7 +18,7 @@ export function deriveModelClass(model) {
 
 const AUTHORED_ROUTES = Object.freeze({
   mixed: {
-    'codex/sol': ['axstack-reviewer-secondary', 'claude/opus', 'medium'],
+    'codex/sol': ['axstack-reviewer-secondary', 'claude/opus', 'high'],
     'claude/opus': ['axstack-reviewer-primary', 'codex/sol', 'high'],
   },
   'codex-only': {