axstack 0.47.0 → 0.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -149,6 +149,14 @@ all scanned; those ten occupy zero slots.
 
 ## Admission and fairness
 
+Before admission, check sync eligibility against the user-recorded pair in the
+durable record under [PR shape](pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown follows ordinary review.
+Each bounded PR job follows [Peer mode](../../axstack-review/references/peer-mode.md#sync-admission-and-round-freshness)
+stale-round discard before each dispatch, before reconcile and before submission.
+
 The review manager admits all eligible actionable PR events
 that measured host capacity can support across ticks. Before each admission,
 inspect available memory, CPU load, and active worker trees across the host;
@@ -289,8 +297,9 @@ existing bot `verdict head=` marker, five-request cap and independent adviser
 panel, and compact output limits. Complete review may publish the
 ordinary binding `APPROVE` or `REQUEST_CHANGES` verdict after a final head,
 base, request, open-state, and existing-review readback. Incomplete review,
-unknown GitHub state, unavailable required models, or unresolved disagreement
+unknown GitHub state or unavailable required models
 publishes nothing.
+Resolve peer unresolved disagreement through the verifier route under corroboration.
 
 A new event that changes the disposition can change a peer verdict at an
 unchanged head under `axstack-review`'s Automation exception; its identical

package/skills/axstack/references/pr-shape.md

@@ -18,6 +18,23 @@ Never automatically subtract bulk from the full total; silent exclusion is forbi
 Disclose each bulk bucket with a reproducible recorded command.
 There is no universal safe LOC limit or fixed token percentage.
 
+## Peer sync proof
+
+Run `pr-shape.js --base <base> --head <head> --source <source>`.
+The sync term grants no authority.
+Sync is eligible only for a user-recorded pair `<repo>: <source> -> <base>`
+in the manager durable record, or user-named for manual review.
+The head repo must equal the base repo.
+Source S is a fetched base-repo ref with its SHA recorded.
+Resolve B/H/S to base/head/source commit SHAs.
+Pass requires B <= H and either H <= S or both B <= S and equal H/S trees.
+Use `git merge-base --is-ancestor` for <= and `git rev-parse <sha>^{tree}` for trees.
+Ancestor exit 1 means fail, other Git errors or missing objects mean unknown,
+and absent `--source` means n/a. Preserve the helper's commands and SHAs.
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown takes ordinary review.
+
 ## Theme
 One behavior or component may include the callers, tests, types, docs, and
 migrations that must change together to stay green and reviewable.

package/skills/axstack/references/run-record.md

@@ -81,6 +81,29 @@ owner stops.
 deleted.
 The driver records `paused` on a user request or a hold; idle alone is neither.
 
+## Review-round budgets
+
+Each PR membership entry carries `rounds: <n>` and `step-back: unused | used r<n>`.
+The field `rounds` counts failing review rounds, not `repairs`.
+Ticketless PRs (small-change intents) and adopted PRs have entries too.
+A new planned PR, small-change PR or adopted PR starts at `rounds: 0` and `step-back: unused`
+when it enters the run, unless a prior run entry exists.
+When a prior run entry exists for the PR, copy that entry, including adopted PRs.
+A prior record predates the field only when its `Runtime` line names an Axstack version below 0.48.0.
+Such a pre-field entry starts with `rounds: 0` and `step-back: unused` only if the field is absent.
+Except for that absent-field initialization, an inherited entry with missing or unclear `rounds` or `step-back` values
+counts as `step-back: used`, including a newer record missing the field or an unknown `Runtime` version.
+Distinct PRs that share one ticket or issue keep separate budgets.
+Write `step-back: used r<n>` before dispatching any repair from the step-back,
+including a user-picked path from the advised step-back card.
+A replacement or split PR copies its predecessor's entry.
+The entry persists across rebases, resumes and owner transfer.
+A `step-back: used` entry permits no further extension.
+Any counted failing review round after the extension records `held` with an advised card,
+including a re-review after a base update and a round after a passing round 4.
+Follow [Advised holds](contracts.md#advised-holds) for that card.
+An interrupted or failed extra-round attempt never earns a second extension and follows the existing failure rules.
+
 ## Handoff and resumption
 
 Keep handoff state in this same record, never a second wrapper record. Before an
@@ -190,7 +213,7 @@ Deploying bases: <base -> integration | deploying; docs/workflow evidence>
 PR digest watermarks: <repo -> absolute path of its per-repository JSON file inside the private run directory> | none
 Release: <AGENTS.md file:line + tag-triggered workflow path + named install hosts> | not applicable (<reason>)
 Source base: <exact revision or source identity>
-PR membership: <PR -> ordinary-chain | legacy-native-stack; direct dependencies incl unpublished; active authors; head/base branch/base SHA>
+PR membership: <PR -> ordinary-chain | legacy-native-stack; direct dependencies incl unpublished; active authors; head/base branch/base SHA; rounds: <n>; step-back: unused | used r<n>>
 IDs: <projectId + driver threadId/runId + dispatch identity receipt pointers>
 Runtime: <host + T3 version + installed Axstack SHA + installed Axstack version/check time + last reference read time + capabilities JSON path>
 Schedules: <scheduledTaskIds of every watch and manager schedule>

package/skills/axstack/scripts/pr-shape.js

@@ -6,6 +6,7 @@ Example: bun scripts/pr-shape.js --base main --head HEAD
 
 --base  Required actual PR base (parent branch for a stacked child)
 --head  Required candidate commit or branch
+--source Optional source ref for the read-only sync term; no source means n/a
 --help  Show flags, example, bucket definitions and exit codes
 
 Read-only Git; writes nothing, retains no state. Prints a bounded JSON summary:
@@ -17,15 +18,18 @@ Generated means linguist-generated set or true in .gitattributes at the head;
 uses the destination path for renames. Unset, false and unspecified are excluded.
 Ignores system/global attributes; local info/attributes causes an unknown bucket.
 Never subtract buckets; formatter-only changes require manual disclosure.
-No cohesion or approval verdict. Exit codes: 0 measured, 1 input/Git error,
-2 incomplete (no merge-base or unavailable committed-attribute evidence).
+Sync reports B <= H AND (H <= S OR (B <= S AND H tree == S tree)).
+Ancestor exit 1 means fail; other Git errors or missing source objects mean unknown.
+No term grants authority. No cohesion or approval verdict.
+Exit codes: 0 measured (including failed terms), 1 input/Git error,
+2 incomplete (unknown sync, no merge-base or unavailable committed-attribute evidence).
 `;
 
 function optionsFrom(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 2) {
     const flag = argv[i];
-    if (!['--base', '--head'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
+    if (!['--base', '--head', '--source'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
     const value = argv[i + 1];
     if (!value || value.startsWith('-')) throw new Error(`missing ref; pass ${flag} <commit-or-branch>`);
     if (flag in options) throw new Error(`duplicate ${flag}; pass it once`);
@@ -44,6 +48,34 @@ function run(argv, input) {
   return { code: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
 }
 
+function syncTerm(inputs, gitCommand) {
+  const evidence = { base: inputs.base, head: inputs.head, source: null, commands: [] };
+  if (!inputs.sourceRef) return { status: 'n/a', evidence: { ...evidence, reason: 'no --source supplied' } };
+  const query = (...args) => {
+    const argv = gitCommand(...args);
+    evidence.commands.push(argv);
+    return run(argv);
+  };
+  const result = (status, reason) => ({ status, evidence: { ...evidence, reason } });
+  const source = query('rev-parse', '--verify', '--end-of-options', `${inputs.sourceRef}^{commit}`);
+  if (source.code) return result('unknown', source.stderr.trim());
+  inputs.source = evidence.source = source.stdout.trim();
+  const ancestor = (a, b) => query('merge-base', '--is-ancestor', a, b).code;
+  const baseHead = ancestor(inputs.base, inputs.head);
+  if (baseHead !== 0) return result(baseHead === 1 ? 'fail' : 'unknown', 'base ancestor of head');
+  const headSource = ancestor(inputs.head, inputs.source);
+  if (headSource === 0) return result('pass', 'base <= head <= source');
+  if (headSource !== 1) return result('unknown', 'head/source ancestry unavailable');
+  const baseSource = ancestor(inputs.base, inputs.source);
+  if (baseSource !== 0) return result(baseSource === 1 ? 'fail' : 'unknown', 'base ancestor of source');
+  const headTree = query('rev-parse', '--verify', `${inputs.head}^{tree}`);
+  const sourceTree = query('rev-parse', '--verify', `${inputs.source}^{tree}`);
+  if (headTree.code || sourceTree.code) return result('unknown', 'tree objects unavailable');
+  evidence.headTree = headTree.stdout.trim();
+  evidence.sourceTree = sourceTree.stdout.trim();
+  return result(evidence.headTree === evidence.sourceTree ? 'pass' : 'fail', 'base <= source and equal head/source trees');
+}
+
 function numstat(text) {
   const tokens = text.split('\0');
   const rows = [];
@@ -87,11 +119,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       return result.stdout.trim();
     };
     const inputs = { repo, baseRef: options['--base'], headRef: options['--head'], base: resolve('--base'), head: resolve('--head') };
+    if (options['--source']) inputs.sourceRef = options['--source'];
+    const sync = syncTerm(inputs, gitCommand);
     const mergeCommand = gitCommand('merge-base', inputs.base, inputs.head);
     const merge = run(mergeCommand);
     if (merge.code) {
       const unknown = { status: 'unknown', evidence: { commands: [mergeCommand], reason: merge.stderr.trim() || 'no common ancestor' } };
-      io.stdout(`${JSON.stringify({ inputs, mergeBase: { ...unknown, value: null }, totals: unknown,
+      io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { ...unknown, value: null }, totals: unknown,
         buckets: { lockfiles: unknown, generated: unknown } })}\n`);
       return 2;
     }
@@ -118,13 +152,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       }
       generated = summarize(rows.filter((row) => paths.has(row.path)), attrEvidence);
     }
-    io.stdout(`${JSON.stringify({ inputs, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
+    io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
       totals: summarize(rows, { commands: [diffCommand], select: 'all records; no exclusions' }),
       buckets: { lockfiles: summarize(rows.filter((row) => lockfiles.includes(row.path.split('/').at(-1))),
         { commands: [diffCommand], select: 'destination basename is exactly one of lockfileNames', lockfileNames: lockfiles }), generated },
       disclosures: 'Buckets may overlap. Never subtract them from totals. Formatter-only changes require manual disclosure; cohesion is a manual judgment.',
     })}\n`);
-    return generated.status === 'unknown' ? 2 : 0;
+    return generated.status === 'unknown' || sync.status === 'unknown' ? 2 : 0;
   } catch (error) {
     io.stderr(`pr-shape error: ${error.message}\n`);
     return 1;

package/skills/axstack-implement/SKILL.md

@@ -250,9 +250,8 @@ For each PR:
    polish.
    `REQUEST_CHANGES`, a failed required check, or post-readiness feedback returns
    findings to the same author for a new revision, increments `repairs`, and
-   returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model, serious
-   risk, or the third review round with `REQUEST_CHANGES` and/or diligence
-   `FINDINGS` on one PR records `held`. A changed parent immediately invalidates affected child readiness; refresh
+   returns to step 1. `INCOMPLETE`, a provenance gap, unavailable model or serious
+   risk records `held`. A changed parent immediately invalidates affected child readiness; refresh
    the next ready children as needed under PR chains before step 1.
    Follow [Advised holds](../axstack/references/contracts.md#advised-holds) for eligible `held` causes.
    Merge-ready also requires a current diligence `PASS` at that head; diligence
@@ -263,7 +262,15 @@ For each PR:
    rule as a finding on the owning PR and hold merge-ready until the contradiction is resolved.
    An unrelated run-record `Learning` leaves merge-ready eligibility unchanged.
    A round with reviewer `REQUEST_CHANGES` and/or diligence `FINDINGS` increments
-   `repairs` once and counts once toward the third-round hold.
+   `repairs` once and counts once toward the round-3 step-back.
+   Failed checks and post-readiness feedback increment `repairs` but never count
+   as failing review rounds.
+   On any counted failing review round that leaves `rounds` at 3 or more while
+   `step-back: unused`, the driver steps back with both `axstack-advisor-astra`
+   and `axstack-advisor-opus` to assess exactly one extra repair round (round 4
+   in the normal case).
+   Load and follow [Round-3 step-back](references/step-back.md).
+   Load and follow [Review-round budgets](../axstack/references/run-record.md#review-round-budgets) before dispatching any repair from the step-back.
 
 The T3 run watch reconciles every unsettled dispatch attempt; the bounded
 forge check wait is the only other implementation wait.

package/skills/axstack-implement/references/step-back.md

@@ -0,0 +1,31 @@
+# Round-3 step-back
+
+An unavailable step-back seat counts as no agreement and falls to the user with the advised step-back card.
+Follow [Advised holds](../../axstack/references/contracts.md#advised-holds) for
+seat attempts, waits, gaps and cards, including the round-4 card's delta-only adviser reuse.
+
+Each adviser independently gets the open findings and the author's replies.
+Each adviser independently gets the per-round deltas.
+Each adviser independently gets blame showing the round in which each flagged line first appeared.
+Each adviser independently gets the approved scope, sketch and approach.
+
+Send one advised repair brief to the same author for the extra round only when all conditions below hold:
+
+- The driver accepts the path.
+- Both advisers agree on the path.
+- The path stays inside the approved scope.
+  The path must not break a sketch `Binding` line.
+- No independent hold applies.
+
+The extra round requires fresh independent reviewer and diligence receipts, with a fresh session of the same mapped reviewer role.
+Do not add an extra reviewer.
+Advisers must never lower a rating or clear a finding.
+Advisers can propose `Pre-existing` with evidence, which the extra-round reviewer validates under
+[review's Pre-existing rules](../../axstack-review/SKILL.md#finding-severity).
+
+When any condition fails, record `held` and fall to the user with the advised step-back card.
+Failed conditions include an adviser split, an unavailable seat, the driver rejecting the agreed path,
+or the only path leaving approved scope or breaking a `Binding` line.
+A scope change follows the existing material-revision route.
+An independent hold keeps its own card and rules, with received step-back advice attached as context.
+After an independent hold clears, recheck all extra-round conditions and reuse unchanged advice.

package/skills/axstack-review/SKILL.md

@@ -37,6 +37,8 @@ When the caller is a bounded review-manager PR job, load
 [Native PR managers](../axstack/references/automations.md): its reviewer briefs
 carry the required escalation field and every eligible peer PR takes a binding
 `APPROVE` or `REQUEST_CHANGES` verdict under the automation exception below.
+Sync skips are exempt from binding-verdict requirements under Peer mode.
+For a sync skip, never fabricate an internal verdict.
 
 For performance claims only, load [Performance checklist](../axstack/references/performance-checklist.md).
 
@@ -161,6 +163,7 @@ These verdicts apply only to PR modes. Codebase findings use coverage status.
   exact candidate SHA and current base, covering the identical full brief;
   follow-up has one current receipt covering the bounded Peer mode brief.
   Peer review requires no diligence receipt.
+  Peer complete also requires verifier receipts when dispatched.
 - **Authored complete:** the one required eligible non-author/non-owner reviewer has
   a current verified receipt for the exact candidate SHA and current base,
   covering the whole brief, all six angles, and applicable acceptance.
@@ -271,7 +274,9 @@ existing bot verdict markers across heads before publishing `REQUEST_CHANGES`;
 a would-be sixth takes the panel path before submission. A serious-risk escalation holds
 submission at its durable decision location. Otherwise `APPROVE` requires
 no validated blocker and `REQUEST_CHANGES` requires at least one evidenced
-validated blocker. `INCOMPLETE`, unavailable inputs, unresolved disagreement,
+validated blocker under Peer mode's corroboration bar.
+Under the Automation exception, route unresolved disagreement through the peer verifier route.
+`INCOMPLETE`, unavailable inputs,
 or unknown GitHub state submits nothing.
 
 Immediately before `gh pr review`, re-read self's reviews at the head.

package/skills/axstack-review/references/peer-mode.md

@@ -11,6 +11,26 @@ That decision is not a finding. Peer review needs no Axstack-created approved
 spec. Peer code stays readonly; the reviewer never edits it. Record exact head,
 current base, context and authority before dispatch.
 
+### Sync admission and round freshness
+
+Sync admission requires the user-recorded pair, matching head repo and base repo,
+and fetched source SHA under [PR shape](../../axstack/references/pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity, and leave the PR for the user.
+Sync fail or unknown enters ordinary review.
+
+Before each dispatch, before reconcile and before submission, re-read PR state,
+head, base branch, base SHA and draft against the pinned event.
+Discard if merged or closed, head or base SHA moved, base retargeted, or draft.
+On discard, cancel owned tasks, verify settlement under
+[Held job settlement](../../axstack/references/automations.md#held-job-settlement),
+preserve evidence and record `discarded: <reason>`.
+On discard, submit nothing.
+For merged or closed PRs, run existing cleanup.
+A new head is a new event, never a restart inside the job.
+Unknown GitHub state holds, never discards.
+Add no polling loop or watcher.
+
 A missing bot verdict marker selects the first review. An existing bot verdict
 marker selects follow-up from its `verdict head=` to the current head.
 
@@ -29,6 +49,34 @@ Every published peer verdict is binding `APPROVE` or `REQUEST_CHANGES`.
 Never publish a COMMENT review. APPROVE when no blocker remains open, with
 notes in the body. The bot never merges peer PRs.
 
+### Corroboration
+
+The owner can refute an allegation first with evidence.
+Send surviving single-source blockers to a fresh session of the other peer-pair
+role, batched per direction (primary's allegations to peer and peer's to primary).
+Use at most two verifiers per first review and one per follow-up.
+The verifier brief contains the allegation, relevant author replies and context,
+pinned head and base, and code. Never include reviewer verdicts in the verifier brief.
+For each blocker return CONFIRMED, REFUTED or UNSETTLED with the verifier's own evidence.
+Single-provider presets use the other model of the pair and disclose session/model
+independence instead of cross-family independence.
+A verifier receipt never replaces a reviewer receipt or counts toward the five-request cap.
+
+A blocker stands only when both first-pass reviewers raised the same concrete
+defect with behavioural evidence, or a verifier CONFIRMED it.
+Match the defect at any rating, treating an ambiguous match as single-source.
+REFUTED allegations are dropped and recorded privately as rejected with evidence.
+REFUTED allegations are never posted.
+UNSETTLED becomes a non-blocking note plus `Not verified:` within the five-note limit.
+Verifier unavailable or failed means INCOMPLETE.
+When the verifier unavailable or failed outcome holds, submit nothing.
+Pre-existing disputes settle before corroboration.
+This bar preserves the serious-risk hold path and the adviser panel below.
+
+On follow-up, prior open blockers and rejected rebuttals skip the verifier.
+New or reopened blockers, including the full-diff fallback, require verification.
+Downgraded notes never re-block unless the delta changes them or there is serious risk.
+
 First review dispatches `axstack-reviewer-primary` and `axstack-reviewer-peer`
 on the full diff and all six angles, independently with the identical brief
 and an isolated first pass. Never dispatch diligence in peer mode.

package/skills/axstack-review/references/review-candidate.md

@@ -27,6 +27,8 @@ This section applies to peer and authored PR modes.
      The mixed peer pair is cross-provider (Sol high + Opus medium), with independence
      still from separate sessions, the identical brief and an isolated first pass.
      Follow-up instead uses the one reviewer and bounded brief in [Peer mode](../SKILL.md#peer-mode-colleague-pr).
+     Peer verifiers use fresh other-role sessions with the same checkout isolation.
+     Apply Peer mode's corroboration brief and per-direction batching after first-pass receipts.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
@@ -156,8 +158,9 @@ This section applies to peer and authored PR modes.
    handler returns 200 and creates a session. Consequence: expired links remain
    usable.`
 4. **Reconcile findings without voting.** The owner verifies findings and uses
-   focused checks to resolve contradictions. Unresolved material disagreement
-   leaves peer review incomplete; reviewer votes never settle correctness.
+   focused checks to resolve contradictions. For peer unresolved disagreement,
+   use the verifier route under [corroboration](peer-mode.md#corroboration).
+   Reviewer votes never settle correctness.
    Accepted fixes return to the actual author. Account for each finding as
    validated, rejected with evidence, fixed, or explicitly unresolved.
 5. **Bind the current revision and base.** Peer follow-ups apply Peer mode,