axstack 0.54.0 → 0.55.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/claude-only.json

@@ -163,6 +163,15 @@
       "notes": "Read-only UI verifier: uses the configured verifier browser tools against the given build, URL, or artifact; captures screenshots, interactions, accessibility, desktop/mobile, and reduced-motion evidence in the dispatch evidence folder; returns a verdict with evidence paths. Performs the inline page interaction pass for every interactive page, bound to the exact bytes and SHA-256. Never edits source. T3 resolves Claude classes from saved capabilities; a Claude rejection holds.",
       "modelClass": "sonnet"
     },
+    {
+      "id": "axstack-ui-verifier-sonnet",
+      "name": "Axstack UI verifier Sonnet",
+      "provider": "claude",
+      "model": null,
+      "modeId": "bypassPermissions",
+      "thinkingOptionId": "high",
+      "notes": "Intentional single-provider absence: the mixed Sonnet UI pair is unavailable in this preset. Record dual-run verification as unverified without substitution."
+    },
     {
       "id": "axstack-explore-codebase",
       "name": "Axstack codebase explorer",

package/profiles/presets/codex-only.json

@@ -163,6 +163,15 @@
       "notes": "Read-only UI verifier: uses the configured verifier browser tools against the given build, URL, or artifact; captures screenshots, interactions, accessibility, desktop/mobile, and reduced-motion evidence in the dispatch evidence folder; returns a verdict with evidence paths. Performs the inline page interaction pass for every interactive page, bound to the exact bytes and SHA-256. Never edits source. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
       "modelClass": "sol"
     },
+    {
+      "id": "axstack-ui-verifier-sonnet",
+      "name": "Axstack UI verifier Sonnet",
+      "provider": "codex",
+      "model": null,
+      "modeId": "full-access",
+      "thinkingOptionId": "high",
+      "notes": "Intentional single-provider absence: the mixed Sonnet UI pair is unavailable in this preset. Record dual-run verification as unverified without substitution."
+    },
     {
       "id": "axstack-explore-codebase",
       "name": "Axstack codebase explorer",

package/profiles/presets/mixed.json

@@ -164,6 +164,15 @@
       "notes": "Read-only UI verifier: uses the configured verifier browser tools against the given build, URL, or artifact; captures screenshots, interactions, accessibility, desktop/mobile, and reduced-motion evidence in the dispatch evidence folder; returns a verdict with evidence paths. Performs the inline page interaction pass for every interactive page, bound to the exact bytes and SHA-256. Never edits source. Resolve the Terra class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution.",
       "modelClass": "terra"
     },
+    {
+      "id": "axstack-ui-verifier-sonnet",
+      "name": "Axstack UI verifier Sonnet",
+      "provider": "claude",
+      "modeId": "bypassPermissions",
+      "thinkingOptionId": "high",
+      "notes": "Read-only independent run 2 verifier for Android and web/PWA: same brief and pinned build, never sees run 1 results. Uses T3 device tools and Playwright MCP under ui-verification.md; returns per-feature evidence in its private folder. Never edits source. T3 resolves Claude classes from saved capabilities; a Claude rejection holds. Missing Sonnet high holds without substitution.",
+      "modelClass": "sonnet"
+    },
     {
       "id": "axstack-explore-codebase",
       "name": "Axstack codebase explorer",

package/skills/axstack/references/fleet-route-schema.md

@@ -0,0 +1,314 @@
+# Pure fleet recommendation API (schema 1)
+
+C1a exports `recommend(input, now)` and `parseFleetConfig(configText, configDigest)`
+from `../scripts/fleet-route.js`. Both are synchronous Bun APIs. They perform no
+I/O, use no ambient clock and keep no state. Importing the module launches nothing.
+The CLI wraps this API; bounded collection is separate from pure recommendation.
+
+```js
+import { recommend } from '../scripts/fleet-route.js';
+const recommendation = recommend(snapshot, evaluationEpochMs);
+// The driver preserves this JSON, then independently verifies execution authority.
+```
+
+Inputs are JSON values. The same canonical input and integer `now` produce
+byte-identical `JSON.stringify` output. Neither the input nor nested facts are
+mutated or shared with the output. Times are nonnegative epoch milliseconds.
+Errors throw `Error` with a stable leading code, e.g. `config-digest-mismatch`,
+`schema-version`, `assignment-conflict` or `evaluation-time`. CLI mapping of
+these errors belongs to the adapter; exceptions never authorize fallback routes.
+
+## Configuration bytes and policy
+
+`configText` contains the exact reviewed UTF-8 JSON bytes, including whitespace.
+`configDigest` is the run-pinned lowercase SHA-256 hex digest of those bytes.
+`parseFleetConfig` verifies the digest before parsing and returns the validated
+object. Missing/invalid configuration and digest mismatches fail explicitly.
+No account path or fleet identity is built into this API.
+
+### Offline command
+
+`bun fleet-route.js recommend --input snapshot.json --now 100000 --json`
+reads saved facts plus `--config <path>` (default:
+`~/.config/haoshoku/fleet-routing.json`). It never samples or dispatches.
+`--config-digest <sha256>` pins reviewed config bytes; otherwise the saved
+input must carry `configDigest`. Any saved `configText`/`configDigest` must
+agree with the file and explicit pin. Saved input may omit `configText`.
+`--task <name>` overrides only the request task preference. Evaluation time
+is required and explicit. `--help` lists flags and side effects.
+
+With `--json`, stdout is the complete schema-1 result; errors are always
+`{"error":{"code":"stable-code","message":"detail"}}` on stderr with
+empty stdout. Exit 0 means a recommendation/help, 1 means an input/config
+error, and 2 means explicit no-route JSON (when `--json` is used). Without
+`--json`, stdout is a one-line stage/host/reason summary. Authentication stays
+on the actual destination session: required session capabilities are supplied
+evidence, never inferred from the origin catalog or copied credentials.
+
+| Config field | Contract |
+| --- | --- |
+| `schemaVersion` | Exactly `1` |
+| `hosts` | Nonempty array of `{id, environmentId, fallbackLimitBp, capabilities}`; both identities unique |
+| `pool` | Unique subset of host IDs; may be empty |
+| `defaultOrder` | Every host ID exactly once |
+| `taskOrders` | Task-name map of complete preference orders, e.g. `playwright`; unknown tasks use default order |
+| `balanceLimitBp` | Integer 0..10000 |
+| `routes` | Ordered array of unique `{id, originEnvironmentId, environmentId, kind, enabled, evidence, authorProof?}` |
+
+Each host's `fallbackLimitBp` is an integer 0..10000. Routes target configured
+host environment IDs. `kind` is `local`, `remote` or `remote-author-coordinator`;
+only `local` has equal origin/destination IDs. Multiple routes to one host are
+allowed; the first proven route in configuration order represents that host.
+Only routes whose origin matches the input origin are considered.
+
+An `evidence` value is `{environmentId, pointer, observedAt}`. The environment
+must match the fact's destination host; the pointer is an opaque nonempty
+host-qualified reference and observation cannot be in the future. Evidence is
+supplied provenance, never a permission grant. A capabilities map has arbitrary
+names such as `browser:headed`, `worktree-isolation`, `session:sign-in`; each value
+is `{value: true|false|null, evidence}`. Required capabilities must be true and
+proven in both configuration and the destination snapshot.
+
+Coordinator routes are exclusively for `author` requests; readers use local/remote
+routes. Remote authors cannot use `remote` routes. A coordinator route is disabled
+unless explicitly enabled with `authorProof`:
+`{originEnvironmentId, environmentId, originVersions, destinationVersions,
+evidence, gatesPassed: true}`. Both version objects contain exact nonempty
+`{t3, axstack}` strings matching current origin/destination snapshots. This
+records the driver's completed pilot gates; the selector cannot prove them.
+Changed versions invalidate the route. Direct remote worktree delegation is
+unsupported; a local author requires `worktree-isolation` automatically.
+
+## Device and browser examples
+
+In account-local `taskOrders`, `device` and `playwright` are examples only;
+the user supplies complete host orders in their reviewed configuration.
+Capability names `device:android-emulator`, `browser:headless` and `desktop:user`
+are examples only, using the existing arbitrary-name capability map.
+A device request can require `device:android-emulator`; a headless web request
+can require `browser:headless`, proven at the destination like any capability.
+`desktop:user` describes desktop safety constraints, rather than a requirement
+that would exclude workers; the driver checks it before executing UI work.
+Host identities, preference orders, thermal thresholds and emulator availability
+remain account-local facts, with current evidence collected before execution.
+These examples add no runtime state, built-in task policy or capability inference.
+Follow [UI verification](ui-verification.md#android-device-and-webpwa-dual-run)
+for serial emulator use, desktop safety and declared thermal prechecks.
+
+## Recommendation snapshot
+
+| Input field | Contract |
+| --- | --- |
+| `schemaVersion` | Exactly `1` |
+| `configText`, `configDigest` | Exact bytes and run-pinned digest above |
+| `origin` | `{environmentId, versions: {t3, axstack}}` |
+| `request` | `{task, role, requiredCapabilities, repositoryId, providerInstanceId, model, options, runtimeMode}` |
+| `destinations` | One destination snapshot per environment, described below |
+| `routeFacts` | One current observation per route, described below |
+| `telemetry` | At most one sample per environment; absent samples are unknown |
+| `inventoryStatus` | `known` or `unknown` |
+| `inventoryObservedAt` | Required nonfuture timestamp when known; null/absent allowed when unknown |
+| `assignments` | Array of normalized `{assignmentId, environmentId, state}` |
+| `pendingAssignments` | Array of `{clientRequestId, environmentId, taskId?}` |
+| `exclusions` | `{hosts: {hostId: reason}, routes: {routeId: reason}}`; nonempty reason strings |
+
+`role` is `reader` (all nonwriter roles) or `author`. `requiredCapabilities`
+is an array of strings. An authentication requirement names the actual session
+capability; only the host proving that session is eligible. No credential
+transfer occurs. `options` is an object keyed by option ID. The adapter must
+normalize T3 option arrays to this map without dropping requested settings.
+
+A destination is `{snapshotId, environmentId, status, observedAt, evidence,
+versions, project, execution, capabilities}`. Status must be `known` to be
+eligible; unreadable/unknown facts exclude it. `project` is `{id, repositoryId}`.
+`execution` is `{available: true, providerInstanceId, model, options, runtimeMode}`:
+these are destination-verified facts, never the origin's model catalog. They
+must match the request exactly (option object key order is immaterial).
+Missing projects and mismatched repository/target settings have distinct reasons.
+For dispatch-plan binding, also supply `capabilitiesDigest`: the lowercase
+SHA-256 of the exact raw saved destination `orchestrator_capabilities` JSON
+bytes. The selector carries this optional fact as `destinationCapabilitiesDigest`;
+the adapter requires it. Collect the catalog on that destination/session, not
+from the origin's catalog. Both current `options.values[]` (strings/booleans)
+and legacy `options.options[].id` advertisements are supported.
+
+A route observation is `{routeId, reachable, authorized, expiresAt,
+destinationSnapshotId, evidence}`. Reachability and authorization must be true.
+Remote link expiry must be a future epoch timestamp. The destination snapshot ID
+must match the corresponding destination; mismatches exclude the route.
+The driver refreshes access, project and capability observations before dispatch;
+the selector imposes no invented lifetime on those facts. Load alone has the
+15-second freshness rule. Duplicate snapshot join keys fail schema validation.
+
+## Assignment normalization
+
+The driver queries T3 and supplies origin-qualified IDs (e.g. `origin:task-id`)
+and the environment actually doing the work. Remote receipts may have null
+`childThreadId`; use `remoteChild.environmentId`, not the origin, to normalize
+that assignment. The selector does not parse raw T3 receipts or query inventory.
+A coordinator and its nested author must share one normalized assignment ID.
+
+States accepted: `pending`, `queued`, `running`, `waiting`, `blocked`,
+`completed`, `failed`, `cancelled`, `canceled`, `rejected`. The last five are
+terminal and do not count. The adapter normalizes T3-native states to these.
+Duplicate identical inventory IDs count once; conflicting identities/states
+throw. Pending records deduplicate by client request ID and by returned
+origin-qualified `taskId` matching `assignmentId`. Even terminal inventory
+records suppress their reflected pending records. Pending IDs on different
+hosts conflict. Update the existing pending record when T3 returns a task ID;
+remove failed/not-submitted selections, retain ambiguous submissions until
+reconciled. An unknown inventory contributes no stale counts; known pending
+records still count. Counts report inventory status/time and pending provenance.
+These are observations, never reservations or predicted resource costs.
+
+## Bounded collection (C2)
+
+Collect with the installed helper (no bin/axstack.js subcommand):
+
+```bash
+bun fleet-route.js sample --fleet manifest.json --config reviewed.json --config-digest <sha256> --json
+bun fleet-route.js sample-recommend --fleet manifest.json --config reviewed.json \
+  --config-digest <sha256> --input facts.json --json
+```
+
+`sample` emits `{schemaVersion:1,configDigest,collectedAt,telemetry}`; each sample
+includes its ageMs at collectedAt.
+`sample-recommend` emits `{schemaVersion:1,input,evaluatedAt,recommendation}`;
+its complete `input` and explicit `evaluatedAt` replay through pure `recommend`.
+It replaces saved telemetry, validates all supplied C1 facts before networking,
+and uses the collector clock after collection. It neither refreshes route/project
+facts nor enables a route. Both commands require a run-pinned digest; config
+path defaults as above. They write stdout/stderr only. Sample reports are JSON
+with or without `--json`; this flag is accepted for interface consistency.
+
+The caller supplies a separate manifest, never private fleet defaults:
+
+```json
+{"schemaVersion":1,"hosts":[
+  {"hostId":"worker-a","environmentId":"env-worker-a","transport":"local"},
+  {"hostId":"worker-b","environmentId":"env-worker-b","transport":"ssh","destination":"sample-worker","user":"fixture_user"}
+]}
+```
+
+Only these keys are accepted. `hosts` has 1..64 entries, unique host IDs and
+SSH destinations; each host/environment pair must match reviewed config.
+At most one entry is local. Unlisted hosts have unknown telemetry. The caller
+must bind the local identity to its collecting host; a manifest grants no T3
+identity or execution authority. Local entries cannot carry SSH fields.
+SSH destinations are lowercase MagicDNS short names (1..63 ASCII letters,
+digits or interior hyphens, starting/ending alphanumeric, not all digits).
+No aliases with punctuation, addresses, FQDNs, user@host, ports, options or
+commands are accepted. Optional users match `[a-z_][a-z0-9_-]{0,31}`.
+Existing SSH configuration/identities and known-host records must already exist;
+no key paths, credentials, enrollment or interactive prompts are accepted.
+
+`--interval-ms` defaults to 5000, integer range 5000..60000. All manifest hosts
+start concurrently in one batch; each waits the interval after its first read
+returns, then reads again. `--timeout-ms` defaults to 10000, integer range
+interval+1000..120000, covering both reads, transport and waiting per host.
+Long intervals require an explicit larger timeout. Timed-out/cancelled SSH
+processes are killed and reaped, waits cancelled and listeners/timers removed.
+SIGINT/SIGTERM cancel the owned collection and produce unknown telemetry.
+SSH uses argv, noninteractive strict host-key checks and existing identities;
+the only remote command is a constant read of /proc/stat and /proc/meminfo.
+Output is capped at 64KiB per read; stderr details and credentials are not emitted.
+No agent, daemon, schedule, dispatch or persistent collection state is created.
+
+Linux CPU uses the delta of the first eight aggregate /proc/stat counters.
+Busy includes steal and excludes idle/iowait; guest/guest_nice are already in
+user/nice and are not added again. RAM uses MemTotal minus MemAvailable:
+`ramBp` is the upward-rounded mean of the first and latest endpoint pressure,
+`ramLatestBp` is latest pressure. This is an endpoint mean, not continuous RAM
+history. Missing/duplicate/malformed fields, counter regression, zero elapsed
+CPU ticks or changed MemTotal produce unknown, without partial pressure values.
+
+Each collected sample contains host/environment IDs, status, source
+`linux-proc-local` or `linux-proc-ssh`, `scope:whole-host`, intervalMs, timeoutMs,
+durationMs, windowStartedAt and receivedAt. Success additionally contains
+windowEndedAt, cpuBp, ramBp and ramLatestBp. `windowKind:collector-bracket`
+means the collector-clock window brackets both reads, transport and the wait;
+remote counter read times cannot be located more precisely within that bracket.
+`durationMs` uses monotonic elapsed time (integer milliseconds), not a claimed
+native history length. Both sources read whole-host Linux counters, never T3
+process metrics or the cached 200ms delta. No fresh 30-second history is claimed.
+Long windows retain their actual duration. All wall timestamps come from the
+collecting host; remote clocks are neither read nor used for age.
+
+A backwards collector clock, shortened window or forward jump over one second
+relative to monotonic elapsed time produces collector-clock unknown. Per-host
+statuses timeout, cancelled, malformed, inconsistent-counters, collector-clock
+and failed become C1 unknown reasons. Collection failure does not fabricate an
+access failure or load-based hold. C1 preserves source/window/duration and age
+for unknown telemetry where supplied. Offline historical C1 inputs may omit
+window timestamps and interval; when present, start/end must enclose duration,
+end cannot follow receipt, and interval must be 5000..60000 and <=duration.
+Age is solely evaluation time minus collector receipt, including stale/future
+unknown results. Re-run before dispatch; snapshots reserve no capacity.
+
+CPU/RAM basis points must be integers 0..10000. Instead of either `cpuBp` or
+`ramBp`, supply `cpuFraction` or `ramFraction` (finite 0..1). Exactly one
+representation per metric is allowed. Fractions round upward using their
+shortest decimal representation, avoiding binary multiplication overshoot.
+`ramLatestBp`, when supplied, also participates in the maximum pressure so an
+average cannot hide recent RAM pressure. Load is the max of the supplied CPU
+and RAM pressure; no role costs, GPU or personal-use gates exist.
+
+Missing, malformed, short-window, non-whole-host, failed and timed-out samples
+become unknown, as do ages >15000ms or <0. Age 15000ms remains measured. Unknown
+load does not exclude an otherwise eligible route. Additional collector fields
+(e.g. remote wall clock or detailed counter provenance) do not override the
+collector receipt timestamp or validated pressure fields.
+
+## Result and downstream binding
+
+The result has `schemaVersion`, `configDigest`, `evaluatedAt`,
+`originEnvironmentId`, `request`, `stage`, `reason`, `decisionReason`, `selected`,
+`flags`, `counts`, `eligible`, `excluded`. Stage is exactly `balance`,
+`pool-unknown`, `fallback` or `no-route`. No-route has `selected: null`.
+`reason: author-local-only` explicitly exposes a local-author limitation;
+`decisionReason` retains the underlying load choice.
+
+`selected` and each eligible host contain `hostId`, `environmentId`, `projectId`,
+`repositoryId`, `routeId`, `routeKind`, `destinationSnapshotId`,
+`destinationObservedAt`, `destinationEvidence`, `routeEvidence`, `versions`,
+`execution`, `capabilities`, `fallbackLimitBp`, `assignmentCount`, `telemetry`.
+Measured telemetry includes age, CPU/RAM, maximum pressure, source and window;
+unknown telemetry carries its reason and age when available.
+
+`counts.byEnvironment` maps configured environments to observed distinct active
+assignment counts. Flags expose `countsUnknown`, `poolEmpty`,
+`poolPartlyUnknown`, `telemetryUnknown`, `overloaded`, `localAuthorOnly`.
+Excluded entries include host/route identity, reason codes, explicit exclusion
+text and available configured/observed evidence. Failed alternative routes may
+appear even when another route on that host is eligible.
+
+### Dispatch-plan adapter
+
+Add `--recommendation recommendation.json --fleet-input snapshot.json
+--now 100000 --config-digest <run-pin>` to the existing dispatch-plan flags.
+All four are required together. `--capabilities` names the raw destination
+catalog. The complete selector input includes config bytes; retain the CLI's
+saved input plus the reviewed `configText` if the CLI supplied it from a file.
+Recompute using the same explicit time and task before binding. The adapter
+rejects any recommendation disagreement, missing/mismatched catalog digest,
+unavailable destination model/options, or role/settings/config disagreement.
+It never reinterprets a requested model pin as a different available model.
+
+Task plans add `environmentId`/`projectId` to `target`; launch plans add them
+beside `modelSelection`. All requested options survive as T3 option entries.
+Both include `fleetBinding: {configDigest, destinationSnapshotId,
+destinationCapabilitiesDigest}`. This is preserved evidence, not a T3 launch
+parameter. Copy only tool-supported launch fields. Coordinator author routes
+remain explicitly unsupported pending C3 lifecycle enablement.
+
+For `--verify`, supply the effective configuration plus independently observed
+`environmentId`, `projectId` and the preserved `fleetBinding` in one JSON
+envelope. All are compared; missing values hold. Do not synthesize observed
+fields from the plan. C3 owns live evidence collection and remote receipts;
+C1b verifies supplied evidence only and cannot authenticate its origin.
+Fleet binding mismatches exit 2; malformed CLI/files exit 1. Existing local
+planning without these flags retains its interface.
+
+A recommendation never launches,
+provisions, mutates links, retries submission or grants authority. Call afresh
+before each dispatch; assignment/load snapshots remain subject to races.

package/skills/axstack/references/role-roster.md

@@ -31,6 +31,11 @@
   review round and bounded research, spec, ticket, receipt, and release claims.
 - `axstack-ui-verifier`: owns the inline page interaction pass under [UI checks](ui-verification.md)
   for every interactive page, bound to the exact bytes and SHA-256.
+- `axstack-ui-verifier-sonnet`: `claude/sonnet` high in mixed, read-only;
+  independently drives Android and web/PWA run 2 under [UI checks](ui-verification.md#android-device-and-webpwa-dual-run).
+  `axstack-ui-verifier` (Terra high in mixed) drives run 1; the driver reconciles.
+  `axstack-ui-verifier-sonnet` is intentionally absent in both single-provider presets,
+  leaving dual-run verification unverified; record the absence without substitution.
 - `axstack-research-requirements`/
   `axstack-research-code`/`axstack-research-web`/
   `axstack-explore-execution`:

package/skills/axstack/references/routing.md

@@ -29,6 +29,8 @@ using saved T3 capabilities JSON; missing or malformed capabilities holds.
 Claude exact IDs come from capabilities, replacing transcript read-back.
 Use an explicit model as given; for `model:null` without a class, grok uses the
 provider's first listed model from saved capabilities and records its exact ID.
+A first listed ID without the `grok-` prefix holds that role with no substitution;
+the prefix checks family, not X access or other live capability.
 A Codex or Claude role with neither model nor class is an intentional absence
 and holds.
 Resume must reuse the saved capabilities and role snapshot with no re-resolution; changes require the user’s explicit decision.

package/skills/axstack/references/t3-runtime.md

@@ -76,7 +76,7 @@ configuration; unrelated configurations remain eligible.
 | Roles | Mechanism and permitted workspace | Completion |
 |---|---|---|
 | Advisers, research, read-only explorers, explainers, diligence, checker, auditor, arena prose candidates and judges, escalation | Must use async `delegate_task` in the driver worktree, title = role-labelled dispatch key; tracked and untracked files stay untouched; writes only `<run>/evidence/<key>/` | Native notification followed by persisted `task_status` |
-| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`) | Must use async `delegate_task`, title = role-labelled dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
+| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`, `axstack-ui-verifier-sonnet`) | Must use async `delegate_task`, title = role-labelled dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
 | Author and repairs | Fresh authors must use async `delegate_task` with `isolation:"worktree"`, title = role-labelled dispatch key, stable `clientRequestId` in their own worktree, kept until PR merges or closes; repairs use `t3_thread_send` to the same child | Delegated terminal checks plus verified candidate |
 | Owner | Driver thread in Driver worktree; never writes tracked candidate source or tests; planning artifacts allowed only for repository Markdown; scope, integration, forge mutations and record | No worker launch |
 

package/skills/axstack/references/ui-verification.md

@@ -2,8 +2,11 @@
 
 Every Playwright, browser, or rendered-UI check outside the two named browser
 exceptions, including a "confirm it in the browser" step, goes through async
-`delegate_task` to `axstack-ui-verifier` from the run's role snapshot. Give it the exact build, URL, or artifact and the private
-dispatch's evidence folder. The verifier is read-only: it never edits source.
+`delegate_task` to a configured UI verifier role.
+The configured UI verifier roles are `axstack-ui-verifier` and
+`axstack-ui-verifier-sonnet` from the role snapshot; select them under the
+[dual-run trigger](#android-device-and-webpwa-dual-run) below.
+Give each verifier the exact build, URL, or artifact and the private dispatch's evidence folder. The verifier is read-only: it never edits source.
 The PR writer remains the sole writer.
 
 Before using a PR preview URL, the UI verifier must read [PR previews](preview.md).
@@ -17,12 +20,12 @@ The second named browser exception permits dispatched roles to use
 `html_preview` as a non-publishing self-check.
 Dispatched-role self-checks never replace the driver's two previews or the `axstack-ui-verifier` pass.
 Dispatched roles never call `html_render`.
-All other browser checks outside the two named exceptions remain delegated to `axstack-ui-verifier`.
+All other browser checks outside the two named exceptions remain delegated to configured UI verifier roles under the dual-run trigger below.
 
 Read the [T3 runtime boundary](t3-runtime.md) before dispatch; for candidate
 checks use its driver-made disposable detached checkout at the pinned candidate SHA.
 Use the configured verifier browser and honor the user browser-tool policy.
-Candidate browser and visual checks must run in the delegated `axstack-ui-verifier` in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
+Candidate browser and visual checks must run in a delegated UI verifier role in its own detached checkout; outputs go to its private evidence folder, never the driver worktree.
 
 For every interactive page, require a real-browser `axstack-ui-verifier` interaction pass.
 Give the evidence path and SHA-256 of the exact bytes in the verifier brief.
@@ -47,6 +50,66 @@ Report a broken or stale recipe as a `low` finding naming `axstack-verify mainta
 Never let a broken or stale recipe waive existing acceptance obligations.
 Keep browser recipes tool-neutral for the verifier.
 
+## Android device and web/PWA dual run
+
+Apply the dual run to Android device verification or explicitly requested
+PWA/app feature verification, such as a `verify-<app>` device recipe or a user request.
+Ordinary review and watch browser checks use one `axstack-ui-verifier` pass by default.
+For these Android and web/PWA runs, assign run 1 to
+`axstack-ui-verifier` (Terra high).
+Dispatch independent run 2 to `axstack-ui-verifier-sonnet` with the same brief
+and the same pinned build.
+Never show run 2 the run 1 results.
+Start run 2 only after run 1 completes shutdown; use a fresh delegated session
+and a separate private evidence folder.
+The two-provider check requires the mixed preset; an intentional single-provider
+absence leaves dual-run verification unverified, without substitution.
+This dual run does not add a second pass to the inline-page exception above.
+
+Before run 1, record APK SHA-256 (or build SHA) and PWA deploy SHA in the brief.
+Include feature files, prerequisites, target URL and per-feature acceptance checks.
+Select the host through fleet routing using account-local configuration and
+[capability examples](fleet-route-schema.md#device-and-browser-examples).
+When `desktop:user` status is missing or unknown, treat the host as a user desktop.
+On a `desktop:user` host, including that safe default, use only a headless browser and a windowless emulator.
+Never focus windows or switch workspaces on a user desktop.
+Allow only one emulator per host at a time.
+Run a thermal precheck before starting on hosts that declare one; honor their
+account-local start/stop thresholds and hold or route elsewhere if unsafe.
+For iOS without a capable host, report unverified.
+
+Each run follows the same lifecycle:
+
+1. Call `device_list` and confirm `agentDeviceInstalled: true` before `device_open`.
+   Pass the selected device's `hostId` and `id` to `device_open`.
+2. Use `device_open` and its returned `agent-device` command to install, launch
+   and drive the pinned APK; open the app before snapshots or input.
+   Use the returned command's help for supported operations; report unavailable
+   install/build capabilities as unverified rather than inventing commands.
+3. Save a snapshot and `device_screenshot` for each feature end state in private
+   evidence; capture actions, resulting states and side effects.
+4. For web/PWA, use Playwright MCP at 390×844 and 1440×900, driving the same features.
+   Capture console errors as route template and code only.
+5. Return pass, fail or blocked per feature, pinned build identities and evidence
+   paths; keep secrets, recovery phrases, tokens and addresses out of reports.
+   Follow the app's production-testing policy; unattended production money paths
+   stop at read-only actions.
+6. After each run, including failed attempts, use `device_close` with
+   `shutdown: true` and `browser_close` for owned sessions; preserve evidence.
+
+The driver reconciles each feature:
+
+- When both runs pass, the driver records pass.
+- When both runs fail a feature, the driver records fail and routes it to `axstack-debug`.
+- If runs disagree, the driver holds and requests one Sonnet rerun of that feature.
+  Use a fresh delegated session and a separate private evidence folder for the
+  Sonnet rerun, with the same brief and same pinned build.
+  Never show the Sonnet rerun run 1 or run 2 results.
+  If the rerun still disagrees with run 1, report flaky/unverified with all observations.
+  If the rerun agrees with run 1, the agreed result stands while the driver records
+  the initial disagreement in evidence; an agreed failure routes to `axstack-debug`.
+- Blocked or missing coverage remains unverified, never a pass.
+
 ## Proof standards
 
 Apply these standards wherever referenced, including the verifier's candidate checks

package/skills/axstack/scripts/dispatch-plan.js

@@ -1,6 +1,8 @@
 import { readFileSync, writeFileSync } from 'node:fs';
+import { bindFleet } from './fleet-dispatch.js';
 
-const flags = ['--role', '--roles', '--capabilities', '--kind', '--verify', '--out'];
+const fleetFlags = ['--recommendation', '--fleet-input', '--now', '--config-digest'];
+const flags = ['--role', '--roles', '--capabilities', '--kind', '--verify', '--out', ...fleetFlags];
 const nonempty = (value) => typeof value === 'string' && value.trim().length > 0;
 const help = `Usage: bun dispatch-plan.js --role <id> --roles <roles.json>
   --capabilities <saved.json> --kind task|launch
@@ -13,6 +15,10 @@ Example: bun dispatch-plan.js --role axstack-author --roles roles.json --capabil
 --kind          task emits target and, for axstack-author, isolation:"worktree"; launch emits modelSelection
 --verify        Compare t3_thread_configuration JSON; print evidence then MATCH or each mismatch
 --out           Save the payload as full JSON here; stdout is an input/path/omitted-count summary
+--recommendation Saved fleet-route recommendation; requires all following fleet flags
+--fleet-input   Saved complete selector input, including exact reviewed config bytes
+--now           Injected nonnegative epoch-ms evaluation time matching the recommendation
+--config-digest Run-pinned config SHA-256; must match facts and recommendation
 --help          Show all flags and exit codes
 
 Read-only inputs: reads supplied JSON, spawns adjacent resolve-models.js, writes stdout/stderr.
@@ -22,6 +28,11 @@ Large verification retains its exit code, prints mismatches and advises --out on
 An unwritable --out still prints verification mismatches and retains exit 2.
 An omitted provider label is unknown; exact instance/model/options/mode checks still apply.
 Never dispatches or changes snapshots. Reuse recorded exact model pins as given.
+Fleet --capabilities is the selected destination's raw saved catalog, digest-bound
+by its destination facts. It is never the origin catalog by default.
+Fleet verification requires environmentId/projectId and fleetBinding alongside
+the effective T3 configuration. C3 collects that host-qualified evidence envelope.
+Coordinator routes remain unsupported here. A plan grants no launch authority.
 Exit codes: 0 ok, 1 error, 2 hold (including incomplete read-back).
 `;
 
@@ -39,9 +50,12 @@ function argumentsFrom(args) {
     if (flag in options) throw new Error(`duplicate argument ${flag}; pass it once`);
     options[flag] = value;
   }
-  for (const flag of flags.filter((flag) => !['--verify', '--out'].includes(flag))) {
+  for (const flag of ['--role', '--roles', '--capabilities', '--kind']) {
     if (!options[flag]) throw new Error(`expected ${flag}; pass ${flag} <value>`);
   }
+  if (fleetFlags.some((flag) => options[flag])) {
+    for (const flag of fleetFlags) if (!options[flag]) throw new Error(`expected ${flag} for fleet binding`);
+  }
   if (!['task', 'launch'].includes(options['--kind'])) throw new Error('expected --kind task|launch; pass --kind task or --kind launch');
   return options;
 }
@@ -60,7 +74,7 @@ function normalizedOptions(options) {
   return JSON.stringify(entries.sort(([left], [right]) => left.localeCompare(right)));
 }
 
-function verify(configuration, provider, model, options) {
+function verify(configuration, provider, model, options, fleet) {
   const mismatches = [];
   const selection = configuration?.modelSelection;
   const compare = (field, expected, observed, equal = expected === observed) => {
@@ -77,6 +91,10 @@ function verify(configuration, provider, model, options) {
   compare('options', options, selection?.options,
     normalizedOptions(options) === normalizedOptions(selection?.options));
   compare('runtimeMode', 'full-access', configuration?.runtimeMode);
+  if (fleet) {
+    for (const [field, expected] of Object.entries(fleet.destination)) compare(field, expected, configuration?.[field]);
+    for (const [field, expected] of Object.entries(fleet.fleetBinding)) compare(field, expected, configuration?.fleetBinding?.[field]);
+  }
   return { mismatches, ...(selection?.provider == null ? {
     providerEvidence: `provider: unknown; expected ${JSON.stringify(provider)}; observed missing; `
       + 'provider binding checked via instanceId and saved capabilities',
@@ -136,16 +154,25 @@ function plan(argv, io) {
     '--effort', role.thinkingOptionId, ...modelArgs], { stdout: 'pipe', stderr: 'pipe' });
   if (resolved.stderr.length) io.stderr(resolved.stderr.toString());
   if (resolved.exitCode !== 0) return resolved.exitCode === 1 ? 2 : 1;
-  const { model, effortOption, providerInstanceId } = JSON.parse(resolved.stdout.toString());
-  const options = effortOption ? [effortOption] : [];
+  const resolution = JSON.parse(resolved.stdout.toString());
+  const { model, effortOption, providerInstanceId } = resolution;
+  let fleet;
+  if (args['--recommendation']) {
+    if (!/^\d+$/.test(args['--now'])) throw new Error('evaluation-time');
+    fleet = bindFleet(readJSON(args['--fleet-input']), readJSON(args['--recommendation']),
+      args['--config-digest'], Number(args['--now']), readFileSync(args['--capabilities'], 'utf8'),
+      resolution, role.id === 'axstack-author');
+  }
+  const options = fleet?.options ?? (effortOption ? [effortOption] : []);
   if (args['--verify']) {
-    const verification = verify(readJSON(args['--verify']), providerInstanceId, model, options);
+    const verification = verify(readJSON(args['--verify']), providerInstanceId, model, options, fleet);
     emit(verification);
     return verification.mismatches.length ? 2 : 0;
   }
   const selection = { [args['--kind'] === 'launch' ? 'instanceId' : 'providerInstanceId']: providerInstanceId,
-    model, options };
+    model, options, ...(args['--kind'] === 'task' ? fleet?.destination : {}) };
   emit({ [args['--kind'] === 'launch' ? 'modelSelection' : 'target']: selection, runtimeMode: 'full-access',
+    ...(fleet ? { fleetBinding: fleet.fleetBinding, ...(args['--kind'] === 'launch' ? fleet.destination : {}) } : {}),
     ...(args['--kind'] === 'task' && role.id === 'axstack-author' ? { isolation: 'worktree' } : {}) });
   return 0;
 }