axstack 0.46.0 → 0.48.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/autopilot.md

@@ -9,6 +9,8 @@ not a mode change.
 
 ## Advance and hold
 
+Follow [Advised holds](contracts.md#advised-holds) for eligible user-decision holds.
+
 Advance only after the finishing phase returns its completed identity (a
 small-change intent, approved spec, matching ticket map, merge-ready or merged
 state) and no hold affects the next action. Record each hold's reason, owner,

package/skills/axstack/references/contracts.md

@@ -99,6 +99,115 @@ discriminating check. A bare "stuck" claim needs pointers to two failed attempts
 setup slips and new user requirements do not count. Each use starts a fresh
 session that never reuses an adviser or candidate context. Escalation never
 resets existing holds or attempt budgets.
+At an advised hold or step-back that is not high-stakes, an adviser split goes
+to the user with no reconciliation and no Fable.
+
+## Advised holds
+
+Advise when a hold reaches the user and the reply picks between two or more
+paths an agent can then carry out.
+The criterion governs and the examples are illustrative.
+The never-advised list is exhaustive and judged by the cause, rather than reply
+option wording.
+Examples include `verification not proven`, provenance or unclosable-verification
+merge cards, a blocked operation after bounded recovery, a scoped no-test-first
+decision, the round-4 step-back hold, major-design urgent escalation in authored
+or codebase review, and authored `Escalate to user` concerns about security,
+permanent on-chain state changes or an architectural change in approach.
+Diligence `UNKNOWN` and a `Learning` contradiction remain driver dispositions,
+advised only if raised to the user as a hold.
+
+Never advise spec approval, npm stage approval or collaborator approval.
+Never advise access or credentials.
+Never advise forge merges by the user.
+Never advise `Auto-merge: off`.
+Never advise work-promotion, deploying-base or unknown-base report cards.
+Never advise the report-only comment-rating card.
+Never advise model unavailability or substitution.
+Never advise denied actions or explicit user stops.
+Never advise peer-review holds; peer mode keeps its cap panel and sends no other human ping.
+Never advise review-manager pass holds; the manager keeps its flagged-thread path.
+
+Before advice the driver closes the gap where possible under existing rules,
+then forms its own assessment.
+This pre-advice gap-closing never spends the one advice-driven action.
+In `mixed`, consult `axstack-advisor-astra` and `axstack-advisor-opus`
+independently with the same bounded evidence packet and question.
+The evidence packet and question omit the driver's own pick.
+Advisers never cross-read one another.
+Single-provider presets use the one configured adviser and record the other
+as an intentional absence.
+
+For high-stakes holds, use `axstack-advisor-astra` and `axstack-escalation-fable`
+plain AGREE after bounded checks under the existing high-stakes contract
+instead of the ordinary seats.
+For a single-provider high-stakes hold, pause for an explicit user decision
+under the existing contract.
+In a single-provider preset, consult the configured one of those two seats once.
+Show `advice unavailable: <seat>` for the absent high-stakes seat.
+In a single-provider preset, no AGREE can form.
+Mark the single-provider high-stakes card `high-stakes: no AGREE`
+in the parenthetical `Recommended` status.
+Only seats and disagreement handling follow that contract.
+For high-stakes holds the card, wait and authority rules here still apply.
+If Astra and Fable still disagree, show both options with the driver's pick
+first and `high-stakes: no AGREE` in the parenthetical `Recommended` status.
+The user's pick is the explicit user decision.
+The driver's pick never counts as AGREE.
+
+Add `Recommended`, `Trade-off`, `Checks would miss` and numbered `Reply` lines
+to the existing card:
+
+```text
+Recommended: <option n> (<advisers agree | advisers split | one adviser | advice pending: <seat> | advice unavailable: <seat>>)
+Trade-off: <one line>
+Checks would miss: <what tests and review would miss on this path | n/a for a non-code hold>
+Reply: 1. <option> 2. <option> ...
+```
+
+On a non-high-stakes split show both options with one-line reasons and the
+driver's pick first; apply the Fable carve-out above.
+On a single-provider adviser disagreement with the driver, show both options
+with one-line reasons and the driver's pick first, as on a split.
+With multiple open cards each reply names its PR, or the hold key for a hold
+without a PR.
+An ambiguous reply clears nothing and the driver asks once.
+Advice never clears a hold or grants approval, merge or `user-accepted unproven`.
+Silence never applies the recommendation.
+A user reply clears only its bound cause.
+
+Make one attempt per seat with no automatic retry or substitution.
+With a run watch armed wait at most until the next bound watch wake, then
+post the card.
+With no watch armed post the card at once.
+A running seat shows `advice pending: <seat>` on the card.
+A failed or unavailable seat shows `advice unavailable: <seat>` on the card.
+Late advice is an addendum in the driver thread, never a new hold or second alert.
+Keep pending dispatches in the run record and settle them when they terminate.
+Record an unavailable seat as a model gap for later work needing that seat.
+An advice gap never blocks the card or the user's reply.
+
+Reuse an advice receipt while its cause and evidence packet, including patch-id,
+are unchanged.
+Changed evidence, authority or question requires fresh advice.
+The round-4 card reuses the step-back advisers with a delta-only brief.
+On a head or base change, supersede the card under the existing supersede rules.
+Reissue the card only if the decision is still needed, bound to the current head and base.
+Reuse unchanged advice when reissuing the card.
+A reissued card for the same cause is the same hold and sends no new alert.
+A reply bound to a superseded head or base clears nothing at the new head or base.
+
+After advice, per PR and cause kind the driver can act once on advice to close the cause
+within existing authority only when advisers agree.
+In single-provider presets, for self-close the adviser must agree with the driver.
+Post the card on a split or a single-adviser disagreement with the driver.
+Post the card when the cause recurs after that one action, or when the action raises a new hold.
+
+Outside peer mode raise every serious-risk hold immediately in watch, implement,
+review, autopilot or debug before dispatching advisers.
+Serious-risk holds include security, downtime, data loss and major design.
+Serious-risk advice follows as an addendum with no second alert.
+Peer serious-risk holds stay never advised under the peer-review exclusion above.
 
 ## Serious risk
 

package/skills/axstack/references/diligence.md

@@ -15,8 +15,10 @@ The recorded owning watch thread merges under the
 Diligence never merges.
 
 Load [Finding severity](../../axstack-review/SKILL.md#finding-severity) for the shared rubric.
-Diligence returns `FINDINGS` for any `medium` or `high` mismatch.
-Diligence returns `PASS` with the low items listed when only low mismatches remain.
+Diligence returns `FINDINGS` for any `medium` or `high` mismatch except validated `Pre-existing` items.
+Diligence returns `PASS` with the low and validated `Pre-existing` items listed
+when only low mismatches or validated `Pre-existing` items remain.
+Diligence returns `FINDINGS` to contest a `Pre-existing` tag that lacks evidence or hits an exclusion.
 Keep diligence `UNKNOWN` unchanged.
 
 For a PR, compare every changed line with the accepted intent and exclusions:

package/skills/axstack/references/run-record.md

@@ -81,6 +81,29 @@ owner stops.
 deleted.
 The driver records `paused` on a user request or a hold; idle alone is neither.
 
+## Review-round budgets
+
+Each PR membership entry carries `rounds: <n>` and `step-back: unused | used r<n>`.
+The field `rounds` counts failing review rounds, not `repairs`.
+Ticketless PRs (small-change intents) and adopted PRs have entries too.
+A new planned PR, small-change PR or adopted PR starts at `rounds: 0` and `step-back: unused`
+when it enters the run, unless a prior run entry exists.
+When a prior run entry exists for the PR, copy that entry, including adopted PRs.
+A prior record predates the field only when its `Runtime` line names an Axstack version below 0.48.0.
+Such a pre-field entry starts with `rounds: 0` and `step-back: unused` only if the field is absent.
+Except for that absent-field initialization, an inherited entry with missing or unclear `rounds` or `step-back` values
+counts as `step-back: used`, including a newer record missing the field or an unknown `Runtime` version.
+Distinct PRs that share one ticket or issue keep separate budgets.
+Write `step-back: used r<n>` before dispatching any repair from the step-back,
+including a user-picked path from the advised step-back card.
+A replacement or split PR copies its predecessor's entry.
+The entry persists across rebases, resumes and owner transfer.
+A `step-back: used` entry permits no further extension.
+Any counted failing review round after the extension records `held` with an advised card,
+including a re-review after a base update and a round after a passing round 4.
+Follow [Advised holds](contracts.md#advised-holds) for that card.
+An interrupted or failed extra-round attempt never earns a second extension and follows the existing failure rules.
+
 ## Handoff and resumption
 
 Keep handoff state in this same record, never a second wrapper record. Before an
@@ -190,7 +213,7 @@ Deploying bases: <base -> integration | deploying; docs/workflow evidence>
 PR digest watermarks: <repo -> absolute path of its per-repository JSON file inside the private run directory> | none
 Release: <AGENTS.md file:line + tag-triggered workflow path + named install hosts> | not applicable (<reason>)
 Source base: <exact revision or source identity>
-PR membership: <PR -> ordinary-chain | legacy-native-stack; direct dependencies incl unpublished; active authors; head/base branch/base SHA>
+PR membership: <PR -> ordinary-chain | legacy-native-stack; direct dependencies incl unpublished; active authors; head/base branch/base SHA; rounds: <n>; step-back: unused | used r<n>>
 IDs: <projectId + driver threadId/runId + dispatch identity receipt pointers>
 Runtime: <host + T3 version + installed Axstack SHA + installed Axstack version/check time + last reference read time + capabilities JSON path>
 Schedules: <scheduledTaskIds of every watch and manager schedule>

package/skills/axstack-implement/SKILL.md

@@ -250,10 +250,10 @@ For each PR:
    polish.
    `REQUEST_CHANGES`, a failed required check, or post-readiness feedback returns
    findings to the same author for a new revision, increments `repairs`, and
-   returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model, serious
-   risk, or the third review round with `REQUEST_CHANGES` and/or diligence
-   `FINDINGS` on one PR records `held`. A changed parent immediately invalidates affected child readiness; refresh
+   returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model or serious
+   risk records `held`. A changed parent immediately invalidates affected child readiness; refresh
    the next ready children as needed under PR chains before step 1.
+   Follow [Advised holds](../axstack/references/contracts.md#advised-holds) for eligible `held` causes.
    Merge-ready also requires a current diligence `PASS` at that head; diligence
    `FINDINGS` return to the same author within the review round.
    Diligence `UNKNOWN` records the PR as `held` with the reason in the run record
@@ -262,7 +262,15 @@ For each PR:
    rule as a finding on the owning PR and hold merge-ready until the contradiction is resolved.
    An unrelated run-record `Learning` leaves merge-ready eligibility unchanged.
    A round with reviewer `REQUEST_CHANGES` and/or diligence `FINDINGS` increments
-   `repairs` once and counts once toward the third-round hold.
+   `repairs` once and counts once toward the round-3 step-back.
+   Failed checks and post-readiness feedback increment `repairs` but never count
+   as failing review rounds.
+   On any counted failing review round that leaves `rounds` at 3 or more while
+   `step-back: unused`, the driver steps back with both `axstack-advisor-astra`
+   and `axstack-advisor-opus` to assess exactly one extra repair round (round 4
+   in the normal case).
+   Load and follow [Round-3 step-back](references/step-back.md).
+   Load and follow [Review-round budgets](../axstack/references/run-record.md#review-round-budgets) before dispatching any repair from the step-back.
 
 The T3 run watch reconciles every unsettled dispatch attempt; the bounded
 forge check wait is the only other implementation wait.
@@ -272,6 +280,7 @@ That watch owns the bound T3 schedule wake; its runtime sets the cadence.
 A turn with unsettled launched threads must end only under the bound-watch rule in the T3 runtime contract.
 With settled threads, end a turn only when every required PR is `merge-ready` or `held`.
 Follow [Route each wake](../axstack-watch/SKILL.md#4-route-each-wake).
+Follow [Advised holds](../axstack/references/contracts.md#advised-holds) when raising eligible holds.
 Raise user-decision and serious-risk holds in the T3 driver thread and end the
 turn parked on the decision. Serious risks are raised immediately.
 After bounded safe recovery, raise a genuine blocked operation that still needs

package/skills/axstack-implement/references/step-back.md

@@ -0,0 +1,31 @@
+# Round-3 step-back
+
+An unavailable step-back seat counts as no agreement and falls to the user with the advised step-back card.
+Follow [Advised holds](../../axstack/references/contracts.md#advised-holds) for
+seat attempts, waits, gaps and cards, including the round-4 card's delta-only adviser reuse.
+
+Each adviser independently gets the open findings and the author's replies.
+Each adviser independently gets the per-round deltas.
+Each adviser independently gets blame showing the round in which each flagged line first appeared.
+Each adviser independently gets the approved scope, sketch and approach.
+
+Send one advised repair brief to the same author for the extra round only when all conditions below hold:
+
+- The driver accepts the path.
+- Both advisers agree on the path.
+- The path stays inside the approved scope.
+  The path must not break a sketch `Binding` line.
+- No independent hold applies.
+
+The extra round requires fresh independent reviewer and diligence receipts, with a fresh session of the same mapped reviewer role.
+Do not add an extra reviewer.
+Advisers must never lower a rating or clear a finding.
+Advisers can propose `Pre-existing` with evidence, which the extra-round reviewer validates under
+[review's Pre-existing rules](../../axstack-review/SKILL.md#finding-severity).
+
+When any condition fails, record `held` and fall to the user with the advised step-back card.
+Failed conditions include an adviser split, an unavailable seat, the driver rejecting the agreed path,
+or the only path leaving approved scope or breaking a `Binding` line.
+A scope change follows the existing material-revision route.
+An independent hold keeps its own card and rules, with received step-back advice attached as context.
+After an independent hold clears, recheck all extra-round conditions and reuse unchanged advice.