axstack 0.34.2 → 0.34.4

package/docs/getting-started.md

@@ -1,5 +1,7 @@
 # Getting started
 
+Linux is the only supported host OS.
+
 Install Axstack, check your host, then ask for one bounded task in T3 Code.
 For the mental model, read [concepts](concepts.md); for other journeys, use
 [guides](guides.md).
@@ -24,8 +26,8 @@ axstack check --harness codex
 ```
 
 Installation writes owned skills and instructions, preserving unrelated content,
-and fetches the pinned archify tool for explicit viewer requests. Reload the harness's skills in T3 after
-installation. Use the [installation reference](installation.md) for other
+and fetches the pinned archify tool for explicit viewer requests. Reload the
+harness's skills in T3 after installation. Use the [installation reference](installation.md) for other
 harnesses, source installs or conflicts.
 
 A successful check exits 0. Its five capability rows mean:

package/docs/host-operations.md

@@ -134,10 +134,9 @@ messages under the accepted fleet risk.
 
 ## Chat-run watch activation
 
-A bound T3 schedule resumes the driver thread on a 30-minute fallback while
-native PR watches are armed and work and release are settled.
-Unsettled work or release, unavailable or unarmed native watches for any open
-member, or failed re-arming restore five minutes. Human-only waits use 60 minutes
+A bound T3 schedule wakes the driver thread on a normal 30-minute cadence.
+Unavailable or unarmed native watches for any open member, failed re-arming,
+or a resumed question run restore five minutes. Human-only waits use 60 minutes
 under [Chat-run watch runtime](../skills/axstack-watch/references/watch-runtime.md#chat-run-watch).
 A T3 "stopped watching" notice triggers a PR re-check and native re-arm in that same turn.
 The run record holds the schedule ID and driver thread.

package/docs/installation.md

@@ -1,5 +1,7 @@
 # Installation
 
+Linux is the only supported host OS.
+
 Axstack's Bun CLI installs owned chat skills plus one selected role snapshot and
 checks host capabilities. T3 Code is the only supported active runtime. The CLI
 does not dispatch agents, edit T3 settings, run a scheduler, or maintain a

package/docs/workflows.md

@@ -134,6 +134,7 @@ Antigravity and Grok routes.
 The mixed `axstack-auditor` uses Haiku 5.5 xhigh, pinned to `claude-haiku-5-5`;
 missing that ID or xhigh effort holds without substitution. The mixed
 `axstack-explainer-review` uses Sol medium; `axstack-explainer` stays Sonnet high.
+In `claude-only`, `axstack-auditor` uses the Claude Sonnet class at high effort.
 The new `-sol` auditor, research-code, and explore-execution seats use Sol high
 in `mixed` and `codex-only`; `claude-only` records each as intentionally absent.
 Dispatch the base and Sol seats independently on the same brief, then reconcile
@@ -150,8 +151,7 @@ later installation changes without re-resolution.
 
 Peer roles use the stable IDs `axstack-reviewer-primary` and
 `axstack-reviewer-peer`; their provider/class mappings come only from the
-selected preset. The mixed cross-provider peer pair is Sol high followed by
-Opus medium. The mixed peer coordinator and review-lane binding
+selected preset and the ordered reviewer table above. The mixed peer coordinator and review-lane binding
 `axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
 is used in the authored mapping and, alongside `axstack-reviewer-primary`,
 in codebase findings mode.
@@ -259,7 +259,12 @@ for explicit ownership transfer.
   archive the exact eligible thread, then remove its exact worktree without
   force and delete only eligible local branches. T3 metadata actions do not
   remove worktrees. Accepted writer or delegated completion settles thread
-  metadata only. Author threads and worktrees remain retained and unarchived
+  metadata only after receipt acceptance, which is distinct from T3 sidebar
+  settlement. Every writer follow-up, including rebase, base update, conflict,
+  body and receipt changes, follows same-turn settlement and readback under
+  [Settlement](../skills/axstack/references/workspace-hygiene.md#settlement).
+  Fresh native run inventory gates zero-unsettled and cadence claims; incomplete
+  inventory is UNKNOWN. Author threads and worktrees remain retained and unarchived
   until their PR merges or closes; the current pass, unsettled descendants,
   and user-taken-over threads remain protected.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.34.2",
+  "version": "0.34.4",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",
@@ -34,8 +34,8 @@
   "scripts": {
     "lint": "biome lint . --error-on-warnings",
     "typecheck": "bun node_modules/typescript/bin/tsc --noEmit --project jsconfig.json",
-    "test": "bun test",
-    "test:all": "bun test"
+    "test": "bun skills/axstack/scripts/test-repository.js",
+    "test:all": "bun skills/axstack/scripts/test-repository.js"
   },
   "license": "MIT",
   "devDependencies": {

package/skills/axstack/references/automations.md

@@ -71,7 +71,7 @@ Missing ordering or ownership evidence holds admission and never guesses a winne
 
 Once identified as a duplicate, the new pass does no PR work, makes no further
 shared-record write and touches no PR-job thread or descendant owned by the
-live manager. A duplicate's only mutation is pass-start settlement of eligible
+live manager. Besides its private pass note and authorized notification, a duplicate's only shared mutation is pass-start settlement of eligible
 terminal lane pass threads under [Finite-session teardown](#finite-session-teardown).
 A duplicate pass admits nothing and runs read-only discovery
 into its own pass note in its private evidence folder, recording new eligible
@@ -330,13 +330,16 @@ decision interpreter; the driver maps card replies in its prose checks.
 
 ## Finite-session teardown
 
+Decisions outliving a finite manager pass retain their receipt and hold in durable continuity, with a GitHub user action route or explicit ownership transfer.
+Use the T3 action route for such decisions; a reply to a closed pass never clears a hold, and a successor reissues a card only after reconciling the retained receipt and current authority.
+
 After lane reconciliation at pass start, every pass, including a duplicate,
 uses `t3_thread_organize` to settle finished predecessor and duplicate lane pass
 threads as metadata only, before discovery or admission.
 Settle another lane pass thread only with terminal run evidence, no unsettled
-descendants, no recorded open hold naming it, no user takeover, and exclusion of
+descendants, zero open holds naming it, recorded or directly observed, no user takeover, and exclusion of
 the live owner and current pass.
-Leave held or stuck pass threads unsettled.
+Keep held passes, wedged passes and stalled owners unsettled and visible.
 Settlement is separate from owner-only worktree removal, branch deletion and
 continuity writes.
 
@@ -352,7 +355,7 @@ Then run the driver-start orphan sweep under Workspace hygiene; the sweep is
 silent when nothing was removed. Record sweep results and holds in continuity's
 Open holds table.
 The orphan sweep covers the run record's repositories plus registered repositories on this host.
-Retirement settles remaining duplicate threads with `t3_thread_organize`
+Retirement settles remaining predecessor, duplicate and failed-successor pass threads with `t3_thread_organize`
 (settle/archive changes metadata only) before separate guarded Git worktree removal.
 Unknown, active or user-taken-over threads,
 ambiguous publication and failed salvage stay preserved.

package/skills/axstack/references/autopilot.md

@@ -89,7 +89,7 @@ Never require a manual `axstack-watch` invocation.
 The driver remains the single owner and sole run-record writer.
 Never create a per-PR session or an ownership hand-off.
 Read the [T3 runtime boundary](t3-runtime.md) and use its bound
-`schedule_task` wake (`everyMs:300000`), recording the scheduledTaskId.
+`schedule_task` wake (`everyMs:1800000`), recording the scheduledTaskId.
 Follow [Native PR links and watches](t3-runtime.md#native-pr-links-and-watches)
 alongside that bound schedule.
 Apply [Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch)

package/skills/axstack/references/run-record.md

@@ -136,7 +136,8 @@ Record the reason for each driver-elected repair in `Decisions`.
 
 Record concise IDs, SHAs, URLs, status, timestamps, next actions, and evidence
 references. Private records include the checkout, evidence and worktree paths
-that the schema requires. Include no tokens, transcripts, full worker output,
+that the schema requires. Include no other machine-specific paths in private records.
+Include no tokens, transcripts, full worker output,
 credentials or private prompts. Publication of a sanitized summary needs separate
 authority.
 

package/skills/axstack/references/t3-runtime.md

@@ -238,10 +238,24 @@ the failed attempt's branch is kept until salvage. Unknown liveness holds
 replacement; reconcile the old writer before admitting another.
 
 With an unsettled launched thread, the driver turn must end only while a bound
-`schedule_task` with `bindToCurrentThread:true`, `everyMs:300000` is armed and
-its ID recorded. Each wake must reconcile all unsettled runs, including a
+`schedule_task` with `bindToCurrentThread:true` is armed at the default
+`everyMs:1800000` or for its 5-minute recovery cases in
+[Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch),
+with its ID recorded. Each wake must reconcile all unsettled runs, including a
 writer that died without sending; failed runs hold incomplete work. The watch
 inherits the driver model/workspace and adds no runtime of Axstack's own.
+T3 queues a scheduled wake even while the driver is busy, so copies pile up.
+After a provider error, server restart or Stop, T3 holds the queue: held
+messages do not start, and later queued messages are held too.
+At the start of each run-watch wake, the driver lists every queued message with
+`t3_queue_list` and treats it as stranded.
+The driver must cancel every queued copy of its own run-watch prompt.
+One wake reconciles all those copies.
+For each stranded worker receipt or PR-watch update, the driver must read it
+with `t3_queue_read`, act on it in that wake, then cancel it with `t3_queue_cancel`.
+A queued user message is a pending local action, so the driver must keep every
+queued user message and report it in its reply even on an otherwise unchanged
+wake, because only the user resumes a held queue.
 
 Once nothing remains unsettled the driver must `delete_scheduled_task` for the
 run watch and use `list_scheduled_tasks` to read back its absence; an uncertain
@@ -286,10 +300,10 @@ If re-arming fails, restore the bound 5-minute schedule.
 When the run waits only on a user decision or a human-only step, including a
 user merge, with no unsettled worker and no PR needing watch events, change
 the run watch cadence to 60 minutes at once.
-When work restarts, restore the normal 5-minute cadence.
+When work restarts, restore the normal 30-minute cadence.
 Keep native PR watches.
 For chat-run cadence changes, follow [Chat-run watch runtime](../../axstack-watch/references/watch-runtime.md#chat-run-watch)
-for 30-minute fallback eligibility, 5-minute recovery, and schedule update read-back.
+for the normal 30-minute cadence, 5-minute recovery, and schedule update read-back.
 The schedule still reconciles author and review tasks, readiness, and release.
 When a PR merges or closes, or its watch is torn down, call `unwatch_pull_request`
 and keep its link.

package/skills/axstack/references/ui-verification.md

@@ -1,6 +1,6 @@
 # UI verification
 
-Every Playwright, browser, or rendered-UI check outside the three named author
+Every Playwright, browser, or rendered-UI check outside the three named browser
 exceptions, including a "confirm it in the browser" step, goes through async
 `delegate_task` to `axstack-ui-verifier` from the run's role snapshot. Give it the exact build, URL, or artifact and the private
 dispatch's evidence folder. The verifier is read-only: it never edits source.
@@ -8,21 +8,16 @@ The PR writer remains the sole writer.
 
 Before using a PR preview URL, the UI verifier must read [PR previews](preview.md).
 
-The first named author browser exception is archify `finalize` as a headless build gate.
+The first named browser exception is archify `finalize` as a headless build gate.
 Keep finalize outputs only in the private evidence folder.
 Never replace the verifier's rendered pass with finalize.
 
-The second named author browser exception is the driver's two `html_preview`
+The second named browser exception is the driver's two `html_preview`
 runs at 728px dark and 360px light.
-Scan the exact bytes of every page for remote src, srcset, and href on loaded
-resources, `@import`, `url()`, `fetch`, XHR, WebSocket, EventSource, and meta refresh.
-Reject scan matches except local url(#id) references such as SVG markers and gradients.
-Require correct layout, theme, zero console errors, empty `missingImages`,
-height, network, and word count.
 Never replace the verifier's interaction pass with `html_preview`.
 Follow [Inline pages](../../axstack-explain/references/inline-pages.md) for the page checks.
 
-The third named author browser exception permits dispatched roles to use
+The third named browser exception permits dispatched roles to use
 `html_preview` as a non-publishing self-check.
 Dispatched-role self-checks never replace the driver's two previews or the `axstack-ui-verifier` pass.
 Dispatched roles never call `html_render`.
@@ -36,8 +31,8 @@ Candidate browser and visual checks must run in the delegated `axstack-ui-verifi
 For every interactive page, require a real-browser `axstack-ui-verifier` interaction pass.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.
 The verifier serves the exact bytes on loopback.
-Open the page with `preview_open` using `open:false`.
-Check clicks, keyboard, focus order, screen-reader names, expanded states, and reduced motion.
+The verifier opens the page with `preview_open` using `open:false`.
+The verifier checks clicks, keyboard, focus order, screen-reader names, expanded states, and reduced motion.
 Require that `performance.getEntriesByType('resource')` is empty.
 The detached-checkout rule does not apply to a page without a candidate.
 
@@ -57,7 +52,8 @@ Keep browser recipes tool-neutral for the verifier.
 
 ## Proof standards
 
-Apply these standards to the verifier's candidate checks and inline-page interaction pass.
+Apply these standards wherever referenced, including the verifier's candidate checks
+and inline-page interaction pass.
 
 Drive the real user path.
 Capture the action, the resulting state and its side effects.

package/skills/axstack/references/workspace-hygiene.md

@@ -44,6 +44,15 @@ On forge-confirmed merge or closure, follow [Native PR links and watches](t3-run
 for same-turn author settlement and its required readback.
 A repair turn automatically un-settles the thread, making it visible while working.
 The driver settles the thread again after the next accepted repair completion.
+Every writer follow-up, including rebase, base update, conflict, body and receipt changes, counts as repair for same-turn settlement and readback.
+Immediately before settlement require native state proving the accepted run is current and the latest overall run.
+Before settlement verify zero active, pending or queued work and zero unsettled descendants.
+After settlement verify exact thread/run identity, current activity and protection state; a mismatch or missing readback holds only that dispatch's next advancement.
+These checks are best effort, not atomic; never issue a compensating unsettle.
+Successful receipt acceptance is distinct from T3 sidebar settlement metadata.
+Cancellation disposition is separate from successful acceptance and requires native terminal cancellation, exact attempt identity, a driver reason and preservation pointers.
+Cancellation disposition requires zero live or queued work, zero unsettled descendants, zero user takeover, zero unanswered questions, zero QUESTION or FAILED markers and zero serious-risk holds.
+Never cancel solely to make a thread eligible for settlement.
 Threads with unaccepted completion, FAILED or QUESTION markers, held, failed or interrupted runs, or anything needing the user stay unsettled and visible.
 Retain a user-taken-over T3 thread and never send cleanup commands to it, including `t3_thread_organize` settle or archive.
 Never remove the current driver, current pass, an active or unknown thread, an unsettled descendant, or a resource with ambiguous ownership.
@@ -52,6 +61,8 @@ At final settlement include run-owned worktrees in other repositories of the
 same project and report each remaining resource as a hold with its reason. Recorded
 projectId, threadId/runId, delegated taskId/childThreadId/childRunId, attempt key,
 checkout path and revision decide ownership. Idle alone never proves exit.
+Before any zero-unsettled claim, cadence relaxation, handback or Close-out, read a fresh fully paginated native inventory of run-owned writers, delegated children and known orphans, including already-settled threads with unconsumed results.
+Incomplete inventory or unknown ownership records UNKNOWN and holds only the affected claim or transition.
 
 Read back the durable receipt and evidence manifest before removing source copies or the worktree; missing or differing readback holds removal.
 Evidence already outside the checkout needs no copy; read back its receipt and

package/skills/axstack/scripts/dispatch-plan.js

@@ -12,14 +12,16 @@ Example: bun dispatch-plan.js --role axstack-author --roles roles.json --capabil
 --capabilities  Saved orchestrator_capabilities JSON; reuse the run's saved snapshot
 --picker        Saved picker JSON; uses chosenInstanceId
 --kind          task emits target; launch emits modelSelection
---verify        Compare t3_thread_configuration JSON; print MATCH or each mismatch
---out           Write full JSON here and print input/path/omitted-count summary
+--verify        Compare t3_thread_configuration JSON; print evidence then MATCH or each mismatch
+--out           Save the payload as full JSON here; stdout is an input/path/omitted-count summary
 --help          Show all flags and exit codes
 
 Read-only inputs: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
 Writes only the caller's --out path when supplied; no retained state.
 Results name input paths. Plan output over 4096 bytes requires --out.
 Large verification retains its exit code, prints mismatches and advises --out on stderr.
+An unwritable --out still prints verification mismatches and retains exit 2.
+An omitted provider label is unknown; exact instance/model/options/mode checks still apply.
 Never dispatches or changes snapshots. Reuse recorded exact model pins as given.
 Exit codes: 0 ok, 1 error, 2 hold (including incomplete read-back).
 `;
@@ -76,7 +78,10 @@ function verify(configuration, instanceId, provider, model, options) {
   compare('options', options, selection?.options,
     normalizedOptions(options) === normalizedOptions(selection?.options));
   compare('runtimeMode', 'full-access', configuration?.runtimeMode);
-  return mismatches;
+  return { mismatches, ...(selection?.provider == null ? {
+    providerEvidence: `provider: unknown; expected ${JSON.stringify(provider)}; observed missing; `
+      + 'provider binding checked via instanceId and saved capabilities',
+  } : {}) };
 }
 
 function plan(argv, io) {
@@ -89,17 +94,24 @@ function plan(argv, io) {
   const emit = (result) => {
     const full = { inputs, ...result };
     const inline = result.mismatches
-      ? `${JSON.stringify({ inputs })}\n${result.mismatches.join('\n') || 'MATCH'}\n` : `${JSON.stringify(full)}\n`;
+      ? `${[JSON.stringify({ inputs }), result.providerEvidence, result.mismatches.join('\n') || 'MATCH'].filter(Boolean).join('\n')}\n`
+      : `${JSON.stringify(full)}\n`;
     if (!args['--out']) {
       if (new TextEncoder().encode(inline).length > 4096) {
         if (!result.mismatches) throw new Error('large output; pass --out <report.json> to save full JSON');
-        io.stderr('Large verification output; pass --out <path>.json for the full list\n');
+        io.stderr('Large verification output; pass --out <path>.json for a saved JSON copy\n');
       }
       io.stdout(inline);
       return;
     }
     try { writeFileSync(args['--out'], `${JSON.stringify(full, null, 2)}\n`); }
-    catch (error) { throw new Error(`${error.message}; pass --out <writable report.json path>`); }
+    catch (error) {
+      const message = `${error.message}; pass --out <writable report.json path>`;
+      if (!result.mismatches?.length) throw new Error(message);
+      io.stderr(`dispatch-plan hold: ${message}\n`);
+      io.stdout(inline);
+      return;
+    }
     io.stdout(`${JSON.stringify({ inputs, reportPath: args['--out'],
       omittedPayloadFields: Object.keys(result).length, omittedMismatches: result.mismatches?.length ?? 0 })}\n`);
   };
@@ -134,7 +146,10 @@ function plan(argv, io) {
     || (['grok', 'antigravity'].includes(role.provider) && picker.chosenInstanceId !== providerInstanceId)) {
     hold(`picker instance ${picker.chosenInstanceId} does not bind provider ${role.provider}`);
   }
-  const selectedModel = chosen[0].models?.find((entry) => entry.id === model);
+  if (!Array.isArray(chosen[0].models)) {
+    hold(`malformed models on instance ${picker.chosenInstanceId}; expected an array; observed ${JSON.stringify(chosen[0].models) ?? 'missing'}`);
+  }
+  const selectedModel = chosen[0].models.find((entry) => entry.id === model);
   if (!selectedModel) hold(`model ${model} unavailable on instance ${picker.chosenInstanceId}`);
   if (effortOption && !selectedModel.options?.some((option) => option.id === effortOption.id
     && option.options?.some((value) => value.id === effortOption.value))) {
@@ -142,9 +157,9 @@ function plan(argv, io) {
   }
   const options = effortOption ? [effortOption] : [];
   if (args['--verify']) {
-    const mismatches = verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
-    emit({ mismatches });
-    return mismatches.length ? 2 : 0;
+    const verification = verify(readJSON(args['--verify']), picker.chosenInstanceId, providerInstanceId, model, options);
+    emit(verification);
+    return verification.mismatches.length ? 2 : 0;
   }
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: picker.chosenInstanceId,
     model, options };

package/skills/axstack/scripts/readiness.js

@@ -67,6 +67,12 @@ function snapshot(repo, revision) {
     paths: [...entries.keys()],
     has: (path) => entries.get(path)?.type === 'blob',
     mode: (path) => entries.get(path)?.mode,
+    readKeys(paths) {
+      try {
+        const blobs = readTextBlobs(repo, paths.map((path) => entries.get(path).oid));
+        return new Map(paths.filter((path) => /^100/.test(entries.get(path).mode)).map((path) => [path, blobs.get(entries.get(path).oid)]));
+      } catch { return new Map(); } // Unavailable blobs cannot prove key absence.
+    },
     read(path) {
       if (entries.get(path)?.type !== 'blob') return '';
       text ??= readTextBlobs(repo, ids);
@@ -81,6 +87,19 @@ function jsonc(text) {
   return JSON.parse(stripped.replace(/"(?:\\.|[^"\\])*"|,\s*(?=[}\]])/g, (token) => token.startsWith('"') ? token : ''));
 }
 
+function pemStatus(text) {
+  if (typeof text !== 'string') return 'unknown';
+  if (/-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/.test(text)) return 'fail';
+  let blocks = 0, valid = true;
+  const remainder = text.replace(/-----BEGIN (CERTIFICATE|PUBLIC KEY|RSA PUBLIC KEY)-----\r?\n([A-Za-z0-9+/=\r\n]+)-----END \1-----/g, (_, _label, body) => {
+    blocks++;
+    const encoded = body.replace(/[\r\n]/g, '');
+    if (!encoded || Buffer.from(encoded, 'base64').toString('base64') !== encoded) valid = false;
+    return '';
+  });
+  return blocks && valid && !remainder.trim() ? 'pass' : 'unknown';
+}
+
 const definitions = [
   ['docs.agents', 'Docs'], ['docs.claude', 'Docs'],
   ['style.linter', 'Style'], ['style.formatter', 'Style'], ['style.strict', 'Style'], ['style.pre-commit', 'Style'],
@@ -183,8 +202,15 @@ function assess(files) {
   const workflowReason = prTests ? '' : invalid ? 'invalid workflow YAML' : prCandidate && manager.reason ? manager.reason : 'missing pull_request test step';
   set('security.pr-tests', prTests ? 'pass' : invalid || (prCandidate && manager.reason) ? 'unknown' : 'fail', workflows.length ? workflows.map((path) => `git show ${revision}:${path}`) : [`git ls-tree -r ${revision}: no workflows`], workflowReason);
   configured('security.updates', has(/(^|\/)(\.github\/(dependabot\.ya?ml|codeql\/[^/]+\.ya?ml)|(?:\.?)renovaterc(?:\.json5?)?|renovate\.json5?)$/).concat(codeql));
-  const secrets = has(/(^|\/)(\.env[^/]*|id_(rsa|dsa|ecdsa|ed25519)|[^/]+\.(pem|key|p12|pfx))$/).filter((path) => !/(^|\/)\.env\.(example|sample|template)$/.test(path));
-  set('security.secrets', secrets.length ? 'fail' : 'pass', secrets.length ? [...new Set(secrets)].map((path) => `git show ${revision}:${path}`) : [`git ls-tree -r ${revision}: no tracked env or private keys`], secrets.length ? 'tracked env or private keys' : '');
+  const candidates = has(/(^|\/)(\.env[^/]*|id_(rsa|dsa|ecdsa|ed25519)|[^/]+\.(pem|key|p12|pfx))$/).filter((path) => !/(^|\/)\.env\.(example|sample|template)$/.test(path));
+  const keys = candidates.filter((path) => /\.(pem|key)$/.test(path) && !/(^|\/)\.env/.test(path));
+  const contents = files.readKeys(keys);
+  const classifications = candidates.map((path) => [path, keys.includes(path) ? pemStatus(contents.get(path)) : 'fail']);
+  const secrets = classifications.filter(([, status]) => status === 'fail').map(([path]) => path);
+  const unknown = classifications.filter(([, status]) => status === 'unknown').map(([path]) => path);
+  const keyStatus = secrets.length ? 'fail' : unknown.length ? 'unknown' : 'pass';
+  const evidence = candidates.length ? candidates.map((path) => `git show ${revision}:${path}`) : [`git ls-tree -r ${revision}: no tracked env or private keys`];
+  set('security.secrets', keyStatus, evidence, [secrets.length ? 'tracked env or private keys' : '', unknown.length ? 'key contents unavailable or unrecognized' : ''].filter(Boolean).join('; '));
   return criteria;
 }
 
@@ -438,6 +464,7 @@ export async function main(argv, io = { stdout: (text) => process.stdout.write(t
       reportPath: paths.out, counts, pillars: result.pillars, omittedCriteria: result.criteria.length, omittedCommands: result.commands?.length ?? 0,
       omittedLogBytes: (result.commands ?? []).reduce((total, step) => total + step.omittedBytes, 0),
       incompleteLogs: (result.commands ?? []).filter((step) => step.logIncomplete).length,
+      ...(args['--run'] && { logIncomplete: (result.commands ?? []).some((step) => step.logIncomplete) }),
     })}\n`);
     return code || (result.executionError ? 2 : 0);
   } catch (error) {

package/skills/axstack/scripts/test-repository.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env bun
+// Repository test entry point: keep DAC permission fixtures meaningful as root.
+const args = process.argv.slice(2);
+if (args[0] === '--help') {
+  console.log(`Usage: bun skills/axstack/scripts/test-repository.js [bun test arguments]
+Runs bun test in the current directory, forwarding arguments, environment and exit status.
+Linux root requires setpriv and drops DAC override/read-search capabilities for tests.
+Other users run Bun directly. Unsupported root hosts or missing setpriv exit 2.
+Side effects: runs the selected tests and their fixtures; creates no runner-owned files.
+Set TMPDIR to a fresh owned 0700 directory outside HOME before repository tests.`);
+  process.exit(0);
+}
+
+let command = [process.execPath, 'test', ...args];
+if (process.getuid?.() === 0) {
+  const setpriv = process.platform === 'linux' ? Bun.which('setpriv') : null;
+  if (!setpriv) {
+    console.error('Repository permission tests as root require Linux and setpriv; use a non-root user otherwise.');
+    process.exit(2);
+  }
+  command = [setpriv, '--bounding-set=-dac_override,-dac_read_search', '--', ...command];
+}
+
+try {
+  const child = Bun.spawn(command, { stdin: 'inherit', stdout: 'inherit', stderr: 'inherit' });
+  process.exit(await child.exited);
+} catch (error) {
+  console.error(`Repository test launch failed: ${error.message}`);
+  process.exit(1);
+}

package/skills/axstack-diagram/SKILL.md

@@ -13,7 +13,7 @@ Use archify HTML only on an explicit viewer request.
 The configured `axstack-explainer` authors the viewer; follow [Archify](references/archify.md).
 Use inline SVG or CSS inside inline pages.
 Never use Mermaid in inline pages.
-Use Mermaid for chat fallback, GitHub, and docs.
+Use Mermaid for chat, GitHub, and docs.
 Include `accTitle` and `accDescr` in each Mermaid view.
 Never use theme init in Mermaid.
 Split large Mermaid diagrams into views.
@@ -23,5 +23,6 @@ Explain owns evidence, claim labels, the word cap, dispatch, and delivery.
 Diagram owns format and visual rules.
 Never call explain.
 For direct use, keep fidelity and rendered QA.
+For direct viewer requests, follow [Explain's declared launch path](../axstack-explain/SKILL.md#2-choose-proportional-output).
 
 Ideas: [archify](https://github.com/tt-a1i/archify), [diagram-design](https://github.com/cathrynlavery/diagram-design), [visual-explainer](https://github.com/nicobailon/visual-explainer), [Matt Pocock](https://github.com/mattpocock/skills), and [poteto](https://github.com/poteto/how); guidance uses Axstack's own words.

package/skills/axstack-explain/SKILL.md

@@ -71,11 +71,11 @@ Diagram never calls explain.
    Each card has at most 40 words and cites its source, as defined in
    [Archify](../axstack-diagram/references/archify.md).
    Count node labels, headings, captions, and all non-card text.
-2. Use chat only for an explicit chat request, an answer without a Q2 trigger,
-   or inline-page fallback. Q2 triggers are the conditions in the description.
+2. Use chat only for an explicit chat request, an answer outside the description's conditions,
+   or inline-page fallback.
    Use a compact diagram when useful.
    For chat answers, never dispatch an agent when applying its Mermaid rules inline.
-3. For a Q2 trigger, create an inline page by default.
+3. For the conditions in the description, create an inline page by default.
    Honor an explicitly requested artifact format.
    Use archify only on an explicit viewer request, through the configured
    `axstack-explainer`. The reply adds only what the page omits.

package/skills/axstack-explain/references/inline-pages.md

@@ -48,7 +48,7 @@ Scan for `@import`, `url()`, `fetch`, XHR, WebSocket, EventSource, and meta refr
 Reject scan matches except local `url(#id)` references such as SVG markers and gradients.
 
 Before publishing, run `html_preview` at 728px dark and 360px light.
-The driver's two previews are an author exception to delegated browser checks.
+The driver's two previews are a named browser exception to delegated browser checks.
 Require correct layout, theme, height, network, word count, zero console errors,
 and empty `missingImages`.
 Check every claim against its source.
@@ -59,8 +59,6 @@ For every interactive page, require a real-browser `axstack-ui-verifier` pass
 for clicks, keyboard, and expanded states.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.
 Follow [UI verification](../../axstack/references/ui-verification.md) for that pass.
-The pass covers focus order, screen-reader names, reduced motion, and an empty
-`performance.getEntriesByType('resource')` list.
 
 ## Publish or fall back
 

package/skills/axstack-relay/SKILL.md

@@ -139,6 +139,7 @@ the caller run's T3 driver thread, even for worker sends.
 Keep the tag short and machine-parsable.
 Exclude chat IDs, credentials, and Telegram targets from the reply tag.
 If either identity is unknown or mismatched, hold the send.
+Reply proof is not an authentication boundary: a privileged worker can copy a valid receipt and forge a message.
 
 ## Decision cards and receipts
 

package/skills/axstack-review/SKILL.md

@@ -283,6 +283,7 @@ This section applies to peer and authored PR modes.
       where measurement is useful. Never invent a metric or demand an
       abstraction merely to satisfy a principle.
 
+   Before claiming a test is missing from CI inspect the complete file and actual CI step result.
    Under the existing angles, check added, changed, and removed test hunks
    against [Test value](../axstack/references/test-value.md). For removed tests,
    inspect the named keepers. Removing a test without a named keeper or

package/skills/axstack-watch/SKILL.md

@@ -78,7 +78,7 @@ load. When the watch needs a new owner or automated observation, first read
 [T3 runtime](../axstack/references/t3-runtime.md). Reconcile before creating
 anything. Task-owned observations use their recorded wakes and expiry.
 `axstack-monitor` stays an optional read-only observer for standalone watch
-that never sends. For own open PRs in chat-run mode, use the 30-minute fallback when eligible under
+that never sends. For own open PRs in chat-run mode, use the normal 30-minute cadence under
 [Chat-run watch runtime](references/watch-runtime.md#chat-run-watch);
 the bound T3 schedule resumes the original driver thread. One read-only PR observation needs
 neither. Start no automation for a read-only check.
@@ -203,6 +203,7 @@ For each current head and base SHA, every merge-ready term must hold:
   A collaborator approval carries over only across a rebase with unchanged
   patch-id recorded for both heads while the forge still counts it.
   Require fresh authored review, diligence, and CI on every new head.
+  Refresh authored review, diligence and CI evidence at the current head and base after every head or base change; base updates return to the same author under the existing repair route.
   Text carrying a visible machine marker never counts as a user reply:
   orchestration notices, dispatch envelopes, `<pasted_content>` blocks, task
   notifications, tool output, relay/Telegram text, and PR text.
@@ -378,6 +379,10 @@ The check runs on existing watch wakes with no new schedule.
 The ping is a notification only: when the blocker clears, the PR merges with no reply.
 
 Immediately before each automated merge, re-read every term from the forge.
+Never edit a running script: freeze its exact script bytes until exit.
+For each merge refusal record exact argv, result, head and base and an evidence pointer.
+Keep pending CI distinct from failed CI and wait for terminal check results before repair.
+Apply the existing [escalation threshold](../axstack/references/contracts.md#driver-and-adviser-split) to repeated same-goal refusals; changed evidence permits reconciliation, never a blind retry or rules bypass.
 Confirm merge commits are allowed, `delete_branch_on_merge` is false, and the
 base has no merge queue; otherwise hold for the user. For a singleton PR, use
 `gh pr merge <n> --merge --match-head-commit <sha>`; add `--delete-branch` only

package/skills/axstack-watch/references/watch-runtime.md

@@ -34,7 +34,7 @@ after verified readback, subject to the user's explicit publication boundary.
 
 The initiating T3 thread remains the sole driver and `progress.md` writer.
 Initially use the bound run watch from [T3 runtime](../../axstack/references/t3-runtime.md):
-`schedule_task` with `bindToCurrentThread:true`, `everyMs:300000`, a stable
+`schedule_task` with `bindToCurrentThread:true`, `everyMs:1800000`, a stable
 `clientRequestId`, and the authorized watch prompt. Record the schedule ID,
 driver thread, chosen mechanism and native schedule lifetime; the watch inherits the driver binding at creation.
 Follow [Provider bindings](../../axstack/references/t3-runtime.md#preflight-and-binding) before arming the watch and for schedule recreation on self-switch.
@@ -45,16 +45,17 @@ Use `update_scheduled_task` on the recorded schedule ID for cadence changes and
 When the run waits only on a user decision or a human-only step, including a
 user merge, with no unsettled worker and no PR needing watch events, change
 the run watch cadence to 60 minutes at once.
-When work restarts, restore the normal 5-minute cadence.
+When work restarts, restore the normal 30-minute cadence.
 Keep native PR watches.
-Only while every open watched PR has an armed native `watch_pull_request`, all
-launched work is settled, and the release step is settled or inapplicable, use
-the bound chat-run schedule as a 30-minute fallback (`everyMs:1800000`).
+Because launched writers, delegated tasks and native PR watches deliver their
+own wakes, use the normal 30-minute cadence (`everyMs:1800000`) even while
+launched work or the release step is unsettled.
+A resumed `AXSTACK-QUESTION` child run lacks a native completion wake, so it
+keeps the 5-minute cadence (`everyMs:300000`) until its result is accepted.
 If native `watch_pull_request` is unavailable or unarmed for any open member,
 or re-arming fails, restore the bound chat-run schedule to 5 minutes (`everyMs:300000`).
 On the next event on a watched PR, re-evaluate the wake cadence against the
 fallback conditions in the same turn.
-If launched work or the release step becomes unsettled, restore the 5-minute cadence (`everyMs:300000`).
 Apply these conditions before ending each driver turn, including after initial
 arming or a work restart; the 60-minute human-only wait rule above still applies.
 Read back each schedule update and record its receipt; an uncertain update holds affected work.