axstack 0.48.0 → 0.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -149,6 +149,14 @@ all scanned; those ten occupy zero slots.
 
 ## Admission and fairness
 
+Before admission, check sync eligibility against the user-recorded pair in the
+durable record under [PR shape](pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown follows ordinary review.
+Each bounded PR job follows [Peer mode](../../axstack-review/references/peer-mode.md#sync-admission-and-round-freshness)
+stale-round discard before each dispatch, before reconcile and before submission.
+
 The review manager admits all eligible actionable PR events
 that measured host capacity can support across ticks. Before each admission,
 inspect available memory, CPU load, and active worker trees across the host;
@@ -289,8 +297,9 @@ existing bot `verdict head=` marker, five-request cap and independent adviser
 panel, and compact output limits. Complete review may publish the
 ordinary binding `APPROVE` or `REQUEST_CHANGES` verdict after a final head,
 base, request, open-state, and existing-review readback. Incomplete review,
-unknown GitHub state, unavailable required models, or unresolved disagreement
+unknown GitHub state or unavailable required models
 publishes nothing.
+Resolve peer unresolved disagreement through the verifier route under corroboration.
 
 A new event that changes the disposition can change a peer verdict at an
 unchanged head under `axstack-review`'s Automation exception; its identical

package/skills/axstack/references/pr-shape.md

@@ -18,6 +18,23 @@ Never automatically subtract bulk from the full total; silent exclusion is forbi
 Disclose each bulk bucket with a reproducible recorded command.
 There is no universal safe LOC limit or fixed token percentage.
 
+## Peer sync proof
+
+Run `pr-shape.js --base <base> --head <head> --source <source>`.
+The sync term grants no authority.
+Sync is eligible only for a user-recorded pair `<repo>: <source> -> <base>`
+in the manager durable record, or user-named for manual review.
+The head repo must equal the base repo.
+Source S is a fetched base-repo ref with its SHA recorded.
+Resolve B/H/S to base/head/source commit SHAs.
+Pass requires B <= H and either H <= S or both B <= S and equal H/S trees.
+Use `git merge-base --is-ancestor` for <= and `git rev-parse <sha>^{tree}` for trees.
+Ancestor exit 1 means fail, other Git errors or missing objects mean unknown,
+and absent `--source` means n/a. Preserve the helper's commands and SHAs.
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown takes ordinary review.
+
 ## Theme
 One behavior or component may include the callers, tests, types, docs, and
 migrations that must change together to stay green and reviewable.

package/skills/axstack/scripts/pr-shape.js

@@ -6,6 +6,7 @@ Example: bun scripts/pr-shape.js --base main --head HEAD
 
 --base  Required actual PR base (parent branch for a stacked child)
 --head  Required candidate commit or branch
+--source Optional source ref for the read-only sync term; no source means n/a
 --help  Show flags, example, bucket definitions and exit codes
 
 Read-only Git; writes nothing, retains no state. Prints a bounded JSON summary:
@@ -17,15 +18,18 @@ Generated means linguist-generated set or true in .gitattributes at the head;
 uses the destination path for renames. Unset, false and unspecified are excluded.
 Ignores system/global attributes; local info/attributes causes an unknown bucket.
 Never subtract buckets; formatter-only changes require manual disclosure.
-No cohesion or approval verdict. Exit codes: 0 measured, 1 input/Git error,
-2 incomplete (no merge-base or unavailable committed-attribute evidence).
+Sync reports B <= H AND (H <= S OR (B <= S AND H tree == S tree)).
+Ancestor exit 1 means fail; other Git errors or missing source objects mean unknown.
+No term grants authority. No cohesion or approval verdict.
+Exit codes: 0 measured (including failed terms), 1 input/Git error,
+2 incomplete (unknown sync, no merge-base or unavailable committed-attribute evidence).
 `;
 
 function optionsFrom(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 2) {
     const flag = argv[i];
-    if (!['--base', '--head'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
+    if (!['--base', '--head', '--source'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
     const value = argv[i + 1];
     if (!value || value.startsWith('-')) throw new Error(`missing ref; pass ${flag} <commit-or-branch>`);
     if (flag in options) throw new Error(`duplicate ${flag}; pass it once`);
@@ -44,6 +48,34 @@ function run(argv, input) {
   return { code: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
 }
 
+function syncTerm(inputs, gitCommand) {
+  const evidence = { base: inputs.base, head: inputs.head, source: null, commands: [] };
+  if (!inputs.sourceRef) return { status: 'n/a', evidence: { ...evidence, reason: 'no --source supplied' } };
+  const query = (...args) => {
+    const argv = gitCommand(...args);
+    evidence.commands.push(argv);
+    return run(argv);
+  };
+  const result = (status, reason) => ({ status, evidence: { ...evidence, reason } });
+  const source = query('rev-parse', '--verify', '--end-of-options', `${inputs.sourceRef}^{commit}`);
+  if (source.code) return result('unknown', source.stderr.trim());
+  inputs.source = evidence.source = source.stdout.trim();
+  const ancestor = (a, b) => query('merge-base', '--is-ancestor', a, b).code;
+  const baseHead = ancestor(inputs.base, inputs.head);
+  if (baseHead !== 0) return result(baseHead === 1 ? 'fail' : 'unknown', 'base ancestor of head');
+  const headSource = ancestor(inputs.head, inputs.source);
+  if (headSource === 0) return result('pass', 'base <= head <= source');
+  if (headSource !== 1) return result('unknown', 'head/source ancestry unavailable');
+  const baseSource = ancestor(inputs.base, inputs.source);
+  if (baseSource !== 0) return result(baseSource === 1 ? 'fail' : 'unknown', 'base ancestor of source');
+  const headTree = query('rev-parse', '--verify', `${inputs.head}^{tree}`);
+  const sourceTree = query('rev-parse', '--verify', `${inputs.source}^{tree}`);
+  if (headTree.code || sourceTree.code) return result('unknown', 'tree objects unavailable');
+  evidence.headTree = headTree.stdout.trim();
+  evidence.sourceTree = sourceTree.stdout.trim();
+  return result(evidence.headTree === evidence.sourceTree ? 'pass' : 'fail', 'base <= source and equal head/source trees');
+}
+
 function numstat(text) {
   const tokens = text.split('\0');
   const rows = [];
@@ -87,11 +119,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       return result.stdout.trim();
     };
     const inputs = { repo, baseRef: options['--base'], headRef: options['--head'], base: resolve('--base'), head: resolve('--head') };
+    if (options['--source']) inputs.sourceRef = options['--source'];
+    const sync = syncTerm(inputs, gitCommand);
     const mergeCommand = gitCommand('merge-base', inputs.base, inputs.head);
     const merge = run(mergeCommand);
     if (merge.code) {
       const unknown = { status: 'unknown', evidence: { commands: [mergeCommand], reason: merge.stderr.trim() || 'no common ancestor' } };
-      io.stdout(`${JSON.stringify({ inputs, mergeBase: { ...unknown, value: null }, totals: unknown,
+      io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { ...unknown, value: null }, totals: unknown,
         buckets: { lockfiles: unknown, generated: unknown } })}\n`);
       return 2;
     }
@@ -118,13 +152,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       }
       generated = summarize(rows.filter((row) => paths.has(row.path)), attrEvidence);
     }
-    io.stdout(`${JSON.stringify({ inputs, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
+    io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
       totals: summarize(rows, { commands: [diffCommand], select: 'all records; no exclusions' }),
       buckets: { lockfiles: summarize(rows.filter((row) => lockfiles.includes(row.path.split('/').at(-1))),
         { commands: [diffCommand], select: 'destination basename is exactly one of lockfileNames', lockfileNames: lockfiles }), generated },
       disclosures: 'Buckets may overlap. Never subtract them from totals. Formatter-only changes require manual disclosure; cohesion is a manual judgment.',
     })}\n`);
-    return generated.status === 'unknown' ? 2 : 0;
+    return generated.status === 'unknown' || sync.status === 'unknown' ? 2 : 0;
   } catch (error) {
     io.stderr(`pr-shape error: ${error.message}\n`);
     return 1;

package/skills/axstack-review/SKILL.md

@@ -37,6 +37,8 @@ When the caller is a bounded review-manager PR job, load
 [Native PR managers](../axstack/references/automations.md): its reviewer briefs
 carry the required escalation field and every eligible peer PR takes a binding
 `APPROVE` or `REQUEST_CHANGES` verdict under the automation exception below.
+Sync skips are exempt from binding-verdict requirements under Peer mode.
+For a sync skip, never fabricate an internal verdict.
 
 For performance claims only, load [Performance checklist](../axstack/references/performance-checklist.md).
 
@@ -161,6 +163,7 @@ These verdicts apply only to PR modes. Codebase findings use coverage status.
   exact candidate SHA and current base, covering the identical full brief;
   follow-up has one current receipt covering the bounded Peer mode brief.
   Peer review requires no diligence receipt.
+  Peer complete also requires verifier receipts when dispatched.
 - **Authored complete:** the one required eligible non-author/non-owner reviewer has
   a current verified receipt for the exact candidate SHA and current base,
   covering the whole brief, all six angles, and applicable acceptance.
@@ -271,7 +274,9 @@ existing bot verdict markers across heads before publishing `REQUEST_CHANGES`;
 a would-be sixth takes the panel path before submission. A serious-risk escalation holds
 submission at its durable decision location. Otherwise `APPROVE` requires
 no validated blocker and `REQUEST_CHANGES` requires at least one evidenced
-validated blocker. `INCOMPLETE`, unavailable inputs, unresolved disagreement,
+validated blocker under Peer mode's corroboration bar.
+Under the Automation exception, route unresolved disagreement through the peer verifier route.
+`INCOMPLETE`, unavailable inputs,
 or unknown GitHub state submits nothing.
 
 Immediately before `gh pr review`, re-read self's reviews at the head.

package/skills/axstack-review/references/peer-mode.md

@@ -11,6 +11,26 @@ That decision is not a finding. Peer review needs no Axstack-created approved
 spec. Peer code stays readonly; the reviewer never edits it. Record exact head,
 current base, context and authority before dispatch.
 
+### Sync admission and round freshness
+
+Sync admission requires the user-recorded pair, matching head repo and base repo,
+and fetched source SHA under [PR shape](../../axstack/references/pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity, and leave the PR for the user.
+Sync fail or unknown enters ordinary review.
+
+Before each dispatch, before reconcile and before submission, re-read PR state,
+head, base branch, base SHA and draft against the pinned event.
+Discard if merged or closed, head or base SHA moved, base retargeted, or draft.
+On discard, cancel owned tasks, verify settlement under
+[Held job settlement](../../axstack/references/automations.md#held-job-settlement),
+preserve evidence and record `discarded: <reason>`.
+On discard, submit nothing.
+For merged or closed PRs, run existing cleanup.
+A new head is a new event, never a restart inside the job.
+Unknown GitHub state holds, never discards.
+Add no polling loop or watcher.
+
 A missing bot verdict marker selects the first review. An existing bot verdict
 marker selects follow-up from its `verdict head=` to the current head.
 
@@ -29,6 +49,34 @@ Every published peer verdict is binding `APPROVE` or `REQUEST_CHANGES`.
 Never publish a COMMENT review. APPROVE when no blocker remains open, with
 notes in the body. The bot never merges peer PRs.
 
+### Corroboration
+
+The owner can refute an allegation first with evidence.
+Send surviving single-source blockers to a fresh session of the other peer-pair
+role, batched per direction (primary's allegations to peer and peer's to primary).
+Use at most two verifiers per first review and one per follow-up.
+The verifier brief contains the allegation, relevant author replies and context,
+pinned head and base, and code. Never include reviewer verdicts in the verifier brief.
+For each blocker return CONFIRMED, REFUTED or UNSETTLED with the verifier's own evidence.
+Single-provider presets use the other model of the pair and disclose session/model
+independence instead of cross-family independence.
+A verifier receipt never replaces a reviewer receipt or counts toward the five-request cap.
+
+A blocker stands only when both first-pass reviewers raised the same concrete
+defect with behavioural evidence, or a verifier CONFIRMED it.
+Match the defect at any rating, treating an ambiguous match as single-source.
+REFUTED allegations are dropped and recorded privately as rejected with evidence.
+REFUTED allegations are never posted.
+UNSETTLED becomes a non-blocking note plus `Not verified:` within the five-note limit.
+Verifier unavailable or failed means INCOMPLETE.
+When the verifier unavailable or failed outcome holds, submit nothing.
+Pre-existing disputes settle before corroboration.
+This bar preserves the serious-risk hold path and the adviser panel below.
+
+On follow-up, prior open blockers and rejected rebuttals skip the verifier.
+New or reopened blockers, including the full-diff fallback, require verification.
+Downgraded notes never re-block unless the delta changes them or there is serious risk.
+
 First review dispatches `axstack-reviewer-primary` and `axstack-reviewer-peer`
 on the full diff and all six angles, independently with the identical brief
 and an isolated first pass. Never dispatch diligence in peer mode.

package/skills/axstack-review/references/review-candidate.md

@@ -27,6 +27,8 @@ This section applies to peer and authored PR modes.
      The mixed peer pair is cross-provider (Sol high + Opus medium), with independence
      still from separate sessions, the identical brief and an isolated first pass.
      Follow-up instead uses the one reviewer and bounded brief in [Peer mode](../SKILL.md#peer-mode-colleague-pr).
+     Peer verifiers use fresh other-role sessions with the same checkout isolation.
+     Apply Peer mode's corroboration brief and per-direction batching after first-pass receipts.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
@@ -156,8 +158,9 @@ This section applies to peer and authored PR modes.
    handler returns 200 and creates a session. Consequence: expired links remain
    usable.`
 4. **Reconcile findings without voting.** The owner verifies findings and uses
-   focused checks to resolve contradictions. Unresolved material disagreement
-   leaves peer review incomplete; reviewer votes never settle correctness.
+   focused checks to resolve contradictions. For peer unresolved disagreement,
+   use the verifier route under [corroboration](peer-mode.md#corroboration).
+   Reviewer votes never settle correctness.
    Accepted fixes return to the actual author. Account for each finding as
    validated, rejected with evidence, fixed, or explicitly unresolved.
 5. **Bind the current revision and base.** Peer follow-ups apply Peer mode,