axstack 0.48.0 → 0.49.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.48.0",
+  "version": "0.49.1",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/skills/axstack/references/automations.md

@@ -149,6 +149,14 @@ all scanned; those ten occupy zero slots.
 
 ## Admission and fairness
 
+Before admission, check sync eligibility against the user-recorded pair in the
+durable record under [PR shape](pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown follows ordinary review.
+Each bounded PR job follows [Peer mode](../../axstack-review/references/peer-mode.md#sync-admission-and-round-freshness)
+stale-round discard before each dispatch, before reconcile and before submission.
+
 The review manager admits all eligible actionable PR events
 that measured host capacity can support across ticks. Before each admission,
 inspect available memory, CPU load, and active worker trees across the host;
@@ -289,8 +297,9 @@ existing bot `verdict head=` marker, five-request cap and independent adviser
 panel, and compact output limits. Complete review may publish the
 ordinary binding `APPROVE` or `REQUEST_CHANGES` verdict after a final head,
 base, request, open-state, and existing-review readback. Incomplete review,
-unknown GitHub state, unavailable required models, or unresolved disagreement
+unknown GitHub state or unavailable required models
 publishes nothing.
+Resolve peer unresolved disagreement through the verifier route under corroboration.
 
 A new event that changes the disposition can change a peer verdict at an
 unchanged head under `axstack-review`'s Automation exception; its identical

package/skills/axstack/references/contracts.md

@@ -121,6 +121,7 @@ Never advise spec approval, npm stage approval or collaborator approval.
 Never advise access or credentials.
 Never advise forge merges by the user.
 Never advise `Auto-merge: off`.
+Never advise risky-path holds.
 Never advise work-promotion, deploying-base or unknown-base report cards.
 Never advise the report-only comment-rating card.
 Never advise model unavailability or substitution.

package/skills/axstack/references/pr-shape.md

@@ -18,6 +18,23 @@ Never automatically subtract bulk from the full total; silent exclusion is forbi
 Disclose each bulk bucket with a reproducible recorded command.
 There is no universal safe LOC limit or fixed token percentage.
 
+## Peer sync proof
+
+Run `pr-shape.js --base <base> --head <head> --source <source>`.
+The sync term grants no authority.
+Sync is eligible only for a user-recorded pair `<repo>: <source> -> <base>`
+in the manager durable record, or user-named for manual review.
+The head repo must equal the base repo.
+Source S is a fetched base-repo ref with its SHA recorded.
+Resolve B/H/S to base/head/source commit SHAs.
+Pass requires B <= H and either H <= S or both B <= S and equal H/S trees.
+Use `git merge-base --is-ancestor` for <= and `git rev-parse <sha>^{tree}` for trees.
+Ancestor exit 1 means fail, other Git errors or missing objects mean unknown,
+and absent `--source` means n/a. Preserve the helper's commands and SHAs.
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity for dedupe, and leave the PR for the user.
+Sync fail or unknown takes ordinary review.
+
 ## Theme
 One behavior or component may include the callers, tests, types, docs, and
 migrations that must change together to stay green and reviewable.

package/skills/axstack/scripts/pr-shape.js

@@ -6,6 +6,7 @@ Example: bun scripts/pr-shape.js --base main --head HEAD
 
 --base  Required actual PR base (parent branch for a stacked child)
 --head  Required candidate commit or branch
+--source Optional source ref for the read-only sync term; no source means n/a
 --help  Show flags, example, bucket definitions and exit codes
 
 Read-only Git; writes nothing, retains no state. Prints a bounded JSON summary:
@@ -17,15 +18,18 @@ Generated means linguist-generated set or true in .gitattributes at the head;
 uses the destination path for renames. Unset, false and unspecified are excluded.
 Ignores system/global attributes; local info/attributes causes an unknown bucket.
 Never subtract buckets; formatter-only changes require manual disclosure.
-No cohesion or approval verdict. Exit codes: 0 measured, 1 input/Git error,
-2 incomplete (no merge-base or unavailable committed-attribute evidence).
+Sync reports B <= H AND (H <= S OR (B <= S AND H tree == S tree)).
+Ancestor exit 1 means fail; other Git errors or missing source objects mean unknown.
+No term grants authority. No cohesion or approval verdict.
+Exit codes: 0 measured (including failed terms), 1 input/Git error,
+2 incomplete (unknown sync, no merge-base or unavailable committed-attribute evidence).
 `;
 
 function optionsFrom(argv) {
   const options = {};
   for (let i = 0; i < argv.length; i += 2) {
     const flag = argv[i];
-    if (!['--base', '--head'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
+    if (!['--base', '--head', '--source'].includes(flag)) throw new Error(`unexpected argument ${flag}; use --help`);
     const value = argv[i + 1];
     if (!value || value.startsWith('-')) throw new Error(`missing ref; pass ${flag} <commit-or-branch>`);
     if (flag in options) throw new Error(`duplicate ${flag}; pass it once`);
@@ -44,6 +48,34 @@ function run(argv, input) {
   return { code: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
 }
 
+function syncTerm(inputs, gitCommand) {
+  const evidence = { base: inputs.base, head: inputs.head, source: null, commands: [] };
+  if (!inputs.sourceRef) return { status: 'n/a', evidence: { ...evidence, reason: 'no --source supplied' } };
+  const query = (...args) => {
+    const argv = gitCommand(...args);
+    evidence.commands.push(argv);
+    return run(argv);
+  };
+  const result = (status, reason) => ({ status, evidence: { ...evidence, reason } });
+  const source = query('rev-parse', '--verify', '--end-of-options', `${inputs.sourceRef}^{commit}`);
+  if (source.code) return result('unknown', source.stderr.trim());
+  inputs.source = evidence.source = source.stdout.trim();
+  const ancestor = (a, b) => query('merge-base', '--is-ancestor', a, b).code;
+  const baseHead = ancestor(inputs.base, inputs.head);
+  if (baseHead !== 0) return result(baseHead === 1 ? 'fail' : 'unknown', 'base ancestor of head');
+  const headSource = ancestor(inputs.head, inputs.source);
+  if (headSource === 0) return result('pass', 'base <= head <= source');
+  if (headSource !== 1) return result('unknown', 'head/source ancestry unavailable');
+  const baseSource = ancestor(inputs.base, inputs.source);
+  if (baseSource !== 0) return result(baseSource === 1 ? 'fail' : 'unknown', 'base ancestor of source');
+  const headTree = query('rev-parse', '--verify', `${inputs.head}^{tree}`);
+  const sourceTree = query('rev-parse', '--verify', `${inputs.source}^{tree}`);
+  if (headTree.code || sourceTree.code) return result('unknown', 'tree objects unavailable');
+  evidence.headTree = headTree.stdout.trim();
+  evidence.sourceTree = sourceTree.stdout.trim();
+  return result(evidence.headTree === evidence.sourceTree ? 'pass' : 'fail', 'base <= source and equal head/source trees');
+}
+
 function numstat(text) {
   const tokens = text.split('\0');
   const rows = [];
@@ -87,11 +119,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       return result.stdout.trim();
     };
     const inputs = { repo, baseRef: options['--base'], headRef: options['--head'], base: resolve('--base'), head: resolve('--head') };
+    if (options['--source']) inputs.sourceRef = options['--source'];
+    const sync = syncTerm(inputs, gitCommand);
     const mergeCommand = gitCommand('merge-base', inputs.base, inputs.head);
     const merge = run(mergeCommand);
     if (merge.code) {
       const unknown = { status: 'unknown', evidence: { commands: [mergeCommand], reason: merge.stderr.trim() || 'no common ancestor' } };
-      io.stdout(`${JSON.stringify({ inputs, mergeBase: { ...unknown, value: null }, totals: unknown,
+      io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { ...unknown, value: null }, totals: unknown,
         buckets: { lockfiles: unknown, generated: unknown } })}\n`);
       return 2;
     }
@@ -118,13 +152,13 @@ export function main(argv, io = { stdout: (text) => process.stdout.write(text),
       }
       generated = summarize(rows.filter((row) => paths.has(row.path)), attrEvidence);
     }
-    io.stdout(`${JSON.stringify({ inputs, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
+    io.stdout(`${JSON.stringify({ inputs, sync, mergeBase: { status: 'pass', value: mergeBase, evidence: { commands: [mergeCommand] } },
       totals: summarize(rows, { commands: [diffCommand], select: 'all records; no exclusions' }),
       buckets: { lockfiles: summarize(rows.filter((row) => lockfiles.includes(row.path.split('/').at(-1))),
         { commands: [diffCommand], select: 'destination basename is exactly one of lockfileNames', lockfileNames: lockfiles }), generated },
       disclosures: 'Buckets may overlap. Never subtract them from totals. Formatter-only changes require manual disclosure; cohesion is a manual judgment.',
     })}\n`);
-    return generated.status === 'unknown' ? 2 : 0;
+    return generated.status === 'unknown' || sync.status === 'unknown' ? 2 : 0;
   } catch (error) {
     io.stderr(`pr-shape error: ${error.message}\n`);
     return 1;

package/skills/axstack-review/SKILL.md

@@ -37,6 +37,8 @@ When the caller is a bounded review-manager PR job, load
 [Native PR managers](../axstack/references/automations.md): its reviewer briefs
 carry the required escalation field and every eligible peer PR takes a binding
 `APPROVE` or `REQUEST_CHANGES` verdict under the automation exception below.
+Sync skips are exempt from binding-verdict requirements under Peer mode.
+For a sync skip, never fabricate an internal verdict.
 
 For performance claims only, load [Performance checklist](../axstack/references/performance-checklist.md).
 
@@ -161,6 +163,7 @@ These verdicts apply only to PR modes. Codebase findings use coverage status.
   exact candidate SHA and current base, covering the identical full brief;
   follow-up has one current receipt covering the bounded Peer mode brief.
   Peer review requires no diligence receipt.
+  Peer complete also requires verifier receipts when dispatched.
 - **Authored complete:** the one required eligible non-author/non-owner reviewer has
   a current verified receipt for the exact candidate SHA and current base,
   covering the whole brief, all six angles, and applicable acceptance.
@@ -271,7 +274,9 @@ existing bot verdict markers across heads before publishing `REQUEST_CHANGES`;
 a would-be sixth takes the panel path before submission. A serious-risk escalation holds
 submission at its durable decision location. Otherwise `APPROVE` requires
 no validated blocker and `REQUEST_CHANGES` requires at least one evidenced
-validated blocker. `INCOMPLETE`, unavailable inputs, unresolved disagreement,
+validated blocker under Peer mode's corroboration bar.
+Under the Automation exception, route unresolved disagreement through the peer verifier route.
+`INCOMPLETE`, unavailable inputs,
 or unknown GitHub state submits nothing.
 
 Immediately before `gh pr review`, re-read self's reviews at the head.

package/skills/axstack-review/references/peer-mode.md

@@ -11,6 +11,26 @@ That decision is not a finding. Peer review needs no Axstack-created approved
 spec. Peer code stays readonly; the reviewer never edits it. Record exact head,
 current base, context and authority before dispatch.
 
+### Sync admission and round freshness
+
+Sync admission requires the user-recorded pair, matching head repo and base repo,
+and fetched source SHA under [PR shape](../../axstack/references/pr-shape.md#peer-sync-proof).
+On sync pass, use no reviewer dispatch and submit nothing, record `sync skip`
+with event identity, and leave the PR for the user.
+Sync fail or unknown enters ordinary review.
+
+Before each dispatch, before reconcile and before submission, re-read PR state,
+head, base branch, base SHA and draft against the pinned event.
+Discard if merged or closed, head or base SHA moved, base retargeted, or draft.
+On discard, cancel owned tasks, verify settlement under
+[Held job settlement](../../axstack/references/automations.md#held-job-settlement),
+preserve evidence and record `discarded: <reason>`.
+On discard, submit nothing.
+For merged or closed PRs, run existing cleanup.
+A new head is a new event, never a restart inside the job.
+Unknown GitHub state holds, never discards.
+Add no polling loop or watcher.
+
 A missing bot verdict marker selects the first review. An existing bot verdict
 marker selects follow-up from its `verdict head=` to the current head.
 
@@ -29,6 +49,34 @@ Every published peer verdict is binding `APPROVE` or `REQUEST_CHANGES`.
 Never publish a COMMENT review. APPROVE when no blocker remains open, with
 notes in the body. The bot never merges peer PRs.
 
+### Corroboration
+
+The owner can refute an allegation first with evidence.
+Send surviving single-source blockers to a fresh session of the other peer-pair
+role, batched per direction (primary's allegations to peer and peer's to primary).
+Use at most two verifiers per first review and one per follow-up.
+The verifier brief contains the allegation, relevant author replies and context,
+pinned head and base, and code. Never include reviewer verdicts in the verifier brief.
+For each blocker return CONFIRMED, REFUTED or UNSETTLED with the verifier's own evidence.
+Single-provider presets use the other model of the pair and disclose session/model
+independence instead of cross-family independence.
+A verifier receipt never replaces a reviewer receipt or counts toward the five-request cap.
+
+A blocker stands only when both first-pass reviewers raised the same concrete
+defect with behavioural evidence, or a verifier CONFIRMED it.
+Match the defect at any rating, treating an ambiguous match as single-source.
+REFUTED allegations are dropped and recorded privately as rejected with evidence.
+REFUTED allegations are never posted.
+UNSETTLED becomes a non-blocking note plus `Not verified:` within the five-note limit.
+Verifier unavailable or failed means INCOMPLETE.
+When the verifier unavailable or failed outcome holds, submit nothing.
+Pre-existing disputes settle before corroboration.
+This bar preserves the serious-risk hold path and the adviser panel below.
+
+On follow-up, prior open blockers and rejected rebuttals skip the verifier.
+New or reopened blockers, including the full-diff fallback, require verification.
+Downgraded notes never re-block unless the delta changes them or there is serious risk.
+
 First review dispatches `axstack-reviewer-primary` and `axstack-reviewer-peer`
 on the full diff and all six angles, independently with the identical brief
 and an isolated first pass. Never dispatch diligence in peer mode.

package/skills/axstack-review/references/review-candidate.md

@@ -27,6 +27,8 @@ This section applies to peer and authored PR modes.
      The mixed peer pair is cross-provider (Sol high + Opus medium), with independence
      still from separate sessions, the identical brief and an isolated first pass.
      Follow-up instead uses the one reviewer and bounded brief in [Peer mode](../SKILL.md#peer-mode-colleague-pr).
+     Peer verifiers use fresh other-role sessions with the same checkout isolation.
+     Apply Peer mode's corroboration brief and per-direction batching after first-pass receipts.
    - **Authored:** exactly one eligible independent reviewer from this complete
      mapping:
 
@@ -156,8 +158,9 @@ This section applies to peer and authored PR modes.
    handler returns 200 and creates a session. Consequence: expired links remain
    usable.`
 4. **Reconcile findings without voting.** The owner verifies findings and uses
-   focused checks to resolve contradictions. Unresolved material disagreement
-   leaves peer review incomplete; reviewer votes never settle correctness.
+   focused checks to resolve contradictions. For peer unresolved disagreement,
+   use the verifier route under [corroboration](peer-mode.md#corroboration).
+   Reviewer votes never settle correctness.
    Accepted fixes return to the actual author. Account for each finding as
    validated, rejected with evidence, fixed, or explicitly unresolved.
 5. **Bind the current revision and base.** Peer follow-ups apply Peer mode,

package/skills/axstack-watch/references/escalation.md

@@ -8,7 +8,8 @@ and a counted collaborator approval exists, on an `integration` base.
 Work promotion PRs and `deploying` or unknown bases are merged by the user on
 the forge. The existing serious-risk hold applies at once to both personal and
 work PRs.
-Personal and work PRs remain eligible whatever files they change, including
+Personal and work PRs remain eligible whatever files they change, subject to the
+[risky-path hold](readiness.md#5-state-readiness-precisely), including
 `.github/`, workflow-invoked files, package.json, lockfiles, test-runner config,
 branch-protection or ruleset config, `CODEOWNERS`, `AGENTS.md`, and non-clean
 revert lines such as `Revert: steps`.
@@ -30,15 +31,18 @@ at line start in the PR description.
 A quoted format inside a bullet never counts as the declaration.
 `--admin` and rule bypass are never used.
 `Auto-merge: off` for a run or PR makes the merge card wait, and it waits for the user.
+A risky-path hold blocks automatic merge.
 
-Post a merge card for every nonqualifying approval, base, verification, or off case.
+Post a merge card for every nonqualifying approval, base, verification, off,
+or risky-path case.
 Follow [Advised holds](../../axstack/references/contracts.md#advised-holds) for eligible merge-card causes.
 Bind it to the PR head and base SHA; list CI, authored review and diligence at
 those SHAs, counted collaborator approvals and bot votes with each vote's SHA
 and stale flag, and the causes holding this merge.
-A card that needs the user's decision (work promotion or work deploying/unknown base,
-`Auto-merge: off`, provenance, or an unclosable verification gap) is a decision
-hold raised in the T3 driver thread; the driver ends its turn parked on the decision.
+A card that needs the user's decision (work promotion or work deploying/unknown
+base, `Auto-merge: off`, risky-path, provenance, or an unclosable verification gap)
+is a decision hold raised in the T3 driver thread, and the driver ends its turn
+parked on the decision.
 Revalidate the current head and base; the reply clears only its bound cause.
 Person-wait cards follow the clock below.
 A changed head or base requires a refreshed card.
@@ -46,6 +50,9 @@ For an own PR on an `integration` base, the user's reply to the card authorizes
 the merge actor to merge under the guarded path, subject to the exceptions below.
 In `solo` mode the user's merge-card reply authorizes the guarded merge of
 user-written PRs or PRs with unknown or mixed provenance.
+Only an explicit user "merge this" for this PR at the exact head and base SHA
+clears the risky-path hold and authorizes the merge actor under the guarded path.
+A new head or base re-applies the hold.
 In `team` mode a reply never replaces counted collaborator approval.
 A reply can clear auto-merge turned off; verification acceptance follows the
 head-and-base-bound rule above. It never clears an ineligible work base or a

package/skills/axstack-watch/references/readiness.md

@@ -47,8 +47,14 @@ For each current head and base SHA, every merge-ready term must hold:
   Reviews carrying an Axstack automation marker never count.
   A later `CHANGES_REQUESTED` blocks until resolved; a stale or dismissed
   approval does not count.
-  A collaborator approval carries over only across a rebase, base-update merge or base-only retarget with unchanged
-  patch-id recorded for both heads while the forge still counts it.
+  A collaborator approval carries over only across a rebase, base-update merge or
+  base-only retarget with unchanged patch-id recorded for both heads, or to a new
+  head made by repairs addressing review feedback (that reviewer's comments,
+  other review threads, authored-review or diligence findings, or CI fixes),
+  while the forge still counts it.
+  Carryover requires an undismissed approval, no later `CHANGES_REQUESTED` from
+  that reviewer, and repository rules that require neither last-push approval
+  nor stale-review dismissal.
   Require fresh authored review, diligence, and CI on every new head.
   Refresh authored review, diligence and CI evidence at the current head and base after every head or base change; base updates return to the same author under the existing repair route.
   Text carrying a visible machine marker never counts as a user reply:
@@ -77,6 +83,11 @@ For each current head and base SHA, every merge-ready term must hold:
   evidence instead.
 - Proven verification: apply every receipt and acceptance term below, or its
   head-and-base-bound user acceptance, while every other gate still holds.
+- Risky paths: `merge-base..head` touches none of database migrations,
+  auth/authentication code, secrets or credential config, money/funds-moving
+  paths, or production deploy config, or a head-and-base-bound user clearance
+  under [Escalation](escalation.md) applies.
+  An uncertain risky-path classification holds automatic merge.
 - Veto: no `do-not-merge` label and no chat `hold` applies.
 
 Only comments and threads whose IDs are recorded in an agent receipt count as agent-authored.