axstack 0.9.0

package/skills/axstack/references/lifecycle.md

@@ -0,0 +1,137 @@
+# Shared lifecycle and receipts
+
+Phases load through [Standing contracts](contracts.md)' mandatory edge.
+Substantive delegated or resumable work uses a driver-owned [Run record](run-record.md)
+binding state and receipts to exact revisions.
+
+## Roster (compact)
+
+- Driver: current chat; owns scope, decisions, cross-PR dependencies, Linear
+  mutations, and integration.
+- Owner (`axstack-owner`): one persistent owner per PR; launches its author,
+  reviewers and watches; may perform authorized PR-scoped publication within user authority.
+  Human merge is default.
+- Author: exactly one writer per candidate; accepted fixes return there.
+  Workers launch no recursive teams.
+- Reviewers: peer = two independent `axstack-reviewer-primary` and
+  `axstack-reviewer-secondary` sessions with identical brief and isolated first
+  pass; authored = one eligible configured reviewer from actual author
+  provenance. Owner and author never review.
+- Driver/monitor/watchdog: the five-minute driver is the automation session
+  itself, a mutating owner for the PRs it handles with no `axstack-monitor` or
+  `axstack-owner` role row. `axstack-monitor` is an optional read-only observer
+  that never sends. `axstack-watchdog` is the hourly health checker that never
+  mutates GitHub and performs exactly one kind of send, a gate-authorized
+  automation-health escalation recorded in `watchdog.json`.
+- Auditor (`axstack-auditor`): report-only; never edits, merges, activates, or
+  audits itself.
+
+Prefer parallel independent bounded work; no redundant workers.
+Per [standing contracts](contracts.md), fanout is dependency/capacity-driven
+with no fixed count, within host and spending limits. [PR shape](pr-shape.md)
+covers theme/size; queue via `gh stack`.
+
+## Ownership
+
+The PR owner remains accountable for candidate, fixes, evidence, and monitoring;
+peer code stays read-only. Missing or idle sessions never transfer ownership.
+Owned implementation enters review through the revision-bound
+[candidate-publication boundary](candidate-publication.md).
+
+## Native handoff and resume
+
+Preparation completion/watch expiry writes a resumable record. Ordinary resume
+reconciles it, keeps the current owner, and launches no native handoff.
+Only an explicit user request to transfer ownership enters this branch.
+
+1. Reconcile the [Run record](run-record.md) with Orca Tasks, Dispatches,
+   sessions, Git revisions, forge, pending receipts, and timer expiries; live
+   owners and authoritative Dispatches beat stale state.
+2. Load the [Orca runtime boundary](orca-runtime.md), then follow its
+   version-matched runtime-owned handoff guidance. Never guess calls, paths,
+   roles, or fallback models. Guide discovery does not prove capability.
+3. If the required native capability is missing, report the exact setup gap and
+   keep the current owner; no replacement or ownership transfer launches.
+   Read-only reconciliation may continue.
+4. Record recipient/pending receipt before launch. If uncertain, reconcile the
+   actual workspace/session before retry and block duplicates.
+5. Launch is not ownership. Record the recipient's explicit acceptance receipt
+   before changing ownership; current owner remains accountable until then. A
+   prior owner seeing a different valid accepted owner stops.
+
+Complete record: goal, authority, intent, IDs, revisions, evidence, pending
+receipts/timers, unresolved decisions, next action, and transfer ownership/gap.
+
+## Receipts (bind each decision to evidence)
+
+Store concise receipt references, not raw worker output, in the [Run record](run-record.md).
+
+- Session receipt: actual agent/workspace IDs, requested provider/model and
+  role; reuse on resume rather than spawn a replacement.
+- Acceptance receipt: sender/recipient, accepted scope/authority, timestamp,
+  and ownership session receipt.
+- Review receipt: mode, applicable provenance, reviewer, SHA/base,
+  verdict (`APPROVE | REQUEST_CHANGES | INCOMPLETE`), coverage, limitations and
+  findings. Changed code needs a receipt for its new revision.
+- Submission receipt: actual commit, review, remote confirmation; ambiguity
+  requires external lookup before retry.
+- Audit receipt: scope, evidenced PASS/FAIL/UNKNOWN counts/denominators and
+  proposals. Only an authorized sanitized summary publishes.
+
+## Execution tracking
+
+The driver consumes native Orca completion and escalation deliveries for the
+active Run. Process each whole delivery before acknowledgment and validate its
+Task, Dispatch, sender, authority, revisions, and receipts before advancing the
+run record. Duplicate deliveries are deduplicated by runtime identity. Healthy
+unchanged observations produce no user-facing update.
+
+Detect completed-but-unadvanced work, failed sessions, unresolved launch
+receipts, and stalls through the version-matched orchestration guide. Never
+duplicate a writer; idle is not complete. `input_accepted`, `turn_started`,
+session liveness, delivery, and verified advancement are distinct evidence.
+On `consumer_fenced`, reconcile the active coordinator rather than borrowing an
+identity. Respect settlement protection including `user_takeover`.
+
+No execution heartbeat or substitute scheduler is created by Axstack. Native
+watch automation follows [Watch health](#watch-health).
+Tracking grants no merge, release, model-substitution, or scope authority.
+
+## Deadline (one rule for every owned timer)
+
+The default 24-hour deadline covers every task-owned timer, including open-PR
+monitors and watchdogs. Stop at deadline; remaining work gets a resumable
+handoff, never silent renewal. Merge-ready differs from merged; human merges.
+
+## Watch health
+
+The user lifted the native-watch hold by user decision on 2026-09-16. The driver
+automation is a mutating owner for its PRs; `axstack-watchdog` stays
+independent and read-only, with quiet healthy snapshots, deduplicated events,
+restart reconciliation, and one shared deadline. Native Orca automations expose
+a provider but cannot pin model, effort, or permission, so the driver records
+its model identity every tick and the watchdog treats a mismatch as a safety
+hold. Build no custom scheduler and use no legacy fallback. Details live in
+[Watch runtime](../../axstack-watch/references/watch-runtime.md).
+
+## Audit hook (end of run and meaningful checkpoints)
+
+Auditing defaults on for every substantive run at its end and meaningful
+checkpoints such as material deviation or repeated repair. Load the bundled [audit skill](../../axstack-audit/SKILL.md)
+and dispatch its auditor. An `axstack-audit` run is excluded: it writes its
+record and launches no children.
+
+The auditor reads the [Run record](run-record.md) for scope, outcomes, and
+metric counts/denominators; reports evidenced PASS/FAIL/UNKNOWN; and invents no
+numbers or cost. Proposals change nothing. Accepted proposals return as
+tested, independently reviewed work with a regression scenario and unchanged
+holdout checks. No automatic self-edit, merge, or activation. Records stay
+private; publication needs separate authority.
+
+## Idle-complete archive and retain
+
+After required PRs merge or hand off, timers stop, and receipts verify, mark
+the same [Run record](run-record.md) `Archived` in place. Preserve
+scope, revisions, evidence, receipts, and expiries. Archive only idle-complete
+records: never active/waiting workers, unrelated host state, or ownership merely
+because it is idle.

package/skills/axstack/references/orca-runtime.md

@@ -0,0 +1,109 @@
+# Orca runtime boundary
+
+Read this immediately before using Orca for a role dispatch, handoff, delivery,
+settlement, or recovery. Ordinary local reading and writing do not load it.
+Axstack owns policy, role selection, and evidence; Orca owns Run, Task,
+Dispatch, session, worktree, messaging, settlement, and scheduling state.
+
+## Discover the runtime-owned guides
+
+Resolve one Orca executable for the session and reuse it. Prefer
+`ORCA_CLI_COMMAND` when set, then the checkout's `orca-dev` when
+`ORCA_DEV_REPO_ROOT` is set, the Linux-safe `orca-ide` outside managed
+terminals, and otherwise `orca`. If the selected executable fails, report that
+exact gap; never switch binaries silently.
+
+Before supervised work, load the selected executable's version-matched
+`skills get orchestration --json` and `skills get orca-cli --json` guides.
+Follow returned schemas and their named conditional references rather than
+copying their command procedures into Axstack. Missing guide discovery is a
+setup gap. It does not authorize legacy runtime use or an Axstack dispatcher,
+daemon, scheduler, database, or escalation engine.
+
+## Bind the configured role
+
+Read `roles.json` relative to the actually loaded `axstack` skill. The installed
+shape is `{ "version": 1, "preset": "<name>", "roles": [...] }`. Bundled
+profiles are setup inputs shaped as
+`{ "version": 1, "roles": [...] }`. A new run records the selected preset and
+all 21 role rows once. An active run keeps the exact snapshot until the user
+explicitly changes it.
+
+Select the requested role by stable ID. A missing or null model holds only that role;
+never launch a provider default. Validate provider, model, and effort
+against the guide and actual launch capability. Stored `modeId` and other
+permission fields are conservative intent, not proof of effective permission
+parity or a security boundary. Requested settings, input acceptance, effective
+settings, and completed work are separate evidence. An unsupported or
+unavailable value holds affected work for the user's decision without fallback.
+The single-provider preset's null adviser is intentional installation data, not
+readiness failure; because Align and Spec require both adviser receipts, either
+null adviser still holds those phases. The current chat is the driver and has
+no role row in any preset.
+
+## Supervise one authoritative attempt
+
+For supervised work, use the orchestration guide's native Run, Task, and
+Dispatch flow. Reconcile existing attempts first. Bind the approved spec or
+small-change intent, brief, authority, role snapshot, worktree, base, and
+candidate to the Task; preserve the returned
+Task, Dispatch, terminal, agent, and worktree identities. Exactly one Dispatch
+may write a candidate at a time.
+
+A worker worktree carries the lineage of the work it serves. Create it with
+`--parent-worktree` naming the candidate's worktree, so a reviewer, repair, or
+child-task checkout appears under the candidate it belongs to instead of as an
+unrelated top-level row. `--no-parent` is only for unrelated, independent work
+with no parent context, never a review or repair of an existing candidate. When
+a worktree was created with the wrong lineage, correct it in place with
+`worktree set --parent-worktree`; that is metadata and does not disturb a
+running worker. Lineage is presentation and reconciliation state, never
+authority: it grants nothing, and a correct parent never substitutes for the
+Task, Dispatch, and receipt evidence above.
+
+An `input_accepted` stage proves only that input reached the terminal. Require
+`turn_started` plus runtime/session inspection before treating the agent as
+started, and verify the requested role independently before trusting its work.
+A workspace trust, hook review, permission, authentication, or model prompt is
+a visible hold. Never answer a trust or permission prompt on the worker's
+behalf. Preserve the attempt and use only the runtime guide's inspection and
+recovery procedure; reconcile before retry so no duplicate writer starts.
+
+## Consume, settle, and recover
+
+Process a whole delivery before acknowledgment. Accept `worker_done` only when
+its sender, Task, and Dispatch match the expected active attempt; then verify
+the candidate revision and evidence before advancing Axstack's derived record.
+A valid completion for an older Dispatch never completes a newer Dispatch.
+Duplicate messages are deduplicated by their runtime identity.
+
+On `consumer_fenced`, stop consuming under that identity. Reconcile the active
+coordinator and delivery through the runtime guide; never bypass the fence,
+forge a sender, borrow a terminal identity, or partially acknowledge the
+delivery. Settlement is also runtime-owned: reuse, retain, or release a settled
+terminal only through the guide. A `user_takeover` result requires retention;
+do not close, release, reuse, or send commands to that terminal as cleanup.
+
+Contact loss, silence, idle state, or an absent status never proves exit or
+transfers authority. Ordinary restart and resume reconcile the same owner,
+author, Task, Dispatch, worktree, revisions, and pending receipts. Authorized
+repairs return to the same author when its session and evidence remain usable;
+uncertainty holds replacement rather than creating a second writer.
+
+## Transfer ownership explicitly
+
+Distinguish supervised workers from a full ownership handoff. Only the user's
+explicit transfer request enters this branch. Record the intended recipient,
+exact scope, revisions, authority, and pending request before following the
+runtime-owned `orca-cli` handoff procedure.
+
+Input acceptance or turn start is launch evidence, not ownership. Validate an
+explicit recipient acceptance against the intended request, session, scope,
+candidate/base, and authority before changing ownership. Until then the current
+owner remains accountable. After a valid acceptance, record it, transfer only
+the accepted authority, and have the prior owner stop. Ordinary resume keeps
+the current owner and never launches a handoff.
+
+The runtime step is complete only when its real receipts are recorded with
+their limitations. Those receipts grant no merge, release, publication, model
+substitution, host-configuration, or scope authority.

package/skills/axstack/references/pr-shape.md

@@ -0,0 +1,39 @@
+# PR shape
+
+## Measure
+Measure the full PR from its actual PR base with:
+```sh
+git diff -M --numstat $(git merge-base <base> <head>)..<head>
+```
+
+A stacked child uses its parent branch; a root PR uses its actual target branch.
+`main` is only an example; repositories may target `develop` or a release branch.
+Total additions + deletions over all files. Disclose moves detected by `-M`;
+report binaries by count and purpose, never estimated lines. Disclose generated,
+lockfile, and formatter-only bulk buckets alongside the total.
+
+The full total controls the level: ≤2000 is the target. The 2001–2500 rationale
+band requires only a recorded cohesion rationale, with no split-attempt record.
+The >2500 exception band requires the full exception record below. Bulk may
+support either rationale only with a reproducible recorded command. Never
+automatically subtract bulk or shift bands; silent exclusion is forbidden; no file-count hard metric.
+
+## Theme
+One behavior or component may include the callers, tests, types, docs, and
+migrations that must change together to stay green and reviewable.
+This is not a folder restriction. Unrelated themes split even under the target.
+Smaller cohesive PRs are encouraged; no padding.
+
+## Exception band
+The driver attempts a reasonable split first. If each tried split materially
+compromises atomicity, green state, or independent reviewability, or inseparable
+reproducible bulk dominates, record and proceed autonomously within the approved
+spec. The mandatory record includes the full total, bulk buckets with their
+reproducible command, measured head and base, split attempts tried, and why each
+fails on atomicity, green state, or reviewability. “Already written,” deadlines,
+and rebase pain are not reasons.
+Size alone never requires user approval. Review verifies the measurement and
+whether the stated split failure is real under angle 6, not the number itself.
+Missing rationale blocks approval; weak rationale returns to the author through
+the normal split/rework loop, never to the user. Escalate only for an existing
+material-scope, security, downtime, data-loss, major-design-risk, or unavailable-model hold.

package/skills/axstack/references/routing.md

@@ -0,0 +1,129 @@
+# Shared routing (every owned phase loads this)
+
+Choose one route; load only the phase and references needed next.
+
+## Role routing
+
+Presets: `mixed`, `codex-only`, `claude-only`. For a new run, read
+`profiles.preset` from `.axstack-manifest.json` at the actually loaded
+skills root, or an explicit user selection recorded in the run record. Proceed
+only with exactly one unambiguous preset; missing or contradictory sources are
+a setup gap: hold. Never infer from live profiles or `list_profiles`, harness,
+tools, credentials, quota, subscription, or default to `mixed`.
+
+At run start, capture one **routing snapshot**: the complete map of all 21 role
+IDs with provider/model/mode/effort, absent or unconfigured roles recorded
+explicitly, and no invented provider default. An absent or unconfigured role
+holds only that role's work, not the run. A role installed or changed later
+must not silently enter the snapshot; adding it needs an explicit user
+decision. Live profiles are authoritative at snapshot time and for availability;
+bundled presets are setup inputs, not runtime proof.
+
+Preset changes apply to new runs only; an active run keeps its snapshot.
+Changing it or replacing a session needs an explicit user decision and
+revalidation. Unavailable models, unsupported efforts, missing roles, and
+incompatible overrides hold only affected work; no automatic fallback, quota
+routing, subscription inference, or silent provider/model/effort substitution.
+
+Role IDs:
+
+- The current chat drives (no role ID); `axstack-owner` owns one PR and
+  `axstack-author` its sole writer.
+- `axstack-reviewer-primary` and `axstack-reviewer-secondary` are the ordered
+  peer pair. Peer review uses both; authored review uses this table:
+
+  | Preset | Author | Reviewer (model/effort) |
+  | --- | --- | --- |
+  | `mixed` | Codex / Sol (`codex/gpt-5.6-sol`) | `axstack-reviewer-secondary` (`claude/claude-opus-5` medium) |
+  | `mixed` | Claude / Opus (`claude/claude-opus-5`) | `axstack-reviewer-primary` (`codex/gpt-5.6-sol` medium) |
+  | `codex-only` | Codex / Sol (`codex/gpt-5.6-sol`) | `axstack-reviewer-secondary` (`codex/gpt-5.6-terra` xhigh) |
+  | `claude-only` | Claude / Opus (`claude/claude-opus-5`) | `axstack-reviewer-secondary` (`claude/claude-sonnet-5` xhigh) |
+- `axstack-advisor-astra` and `axstack-advisor-fable` advise independently;
+  `axstack-auditor` audits; `axstack-checker` reports discrepancies.
+- `axstack-explainer` authors explanations; `axstack-explainer-review`
+  reviews them. `axstack-monitor` observes only; `axstack-watchdog` sends
+  only gate-authorized health escalations.
+- `axstack-debug-investigator-1..4` each probe one L1 brief.
+
+Provenance is matched on provider/model ID; record effort but never use it to
+create a mapping. Provenance absent from the preset's table row is
+unsupported and `INCOMPLETE` (including its secondary reviewer model, Astra,
+Luna, or Fable); report the exact gap and ask the user. Never derive a reverse
+pairing from slot position, driver, owner, or provider. Author and owner never
+review their own work.
+
+## Direct routes (no spec ceremony)
+
+- One bounded research question -> `axstack-research`: verify primary sources
+  and code, return a cited note with limitations. Fan out only distinct
+  questions.
+- Understanding a system, change, or implementation gap -> `axstack-explain`:
+  show current/intended behavior, evidence dimensions, and bounded gaps; use
+  project docs and verify rendered behavior when applicable. Stale axstack-docs
+  is superseded. Publication needs separate authority.
+- A bug, failing test, regression, or wrong behavior, red loop wanted ->
+  `axstack-debug`: diagnose, escalate via adviser-directed investigators, hand
+  off a classified repair (explain: how; debug: what's wrong).
+- Codebase-quality or refactor discovery -> `axstack-improve`: inspect bounded
+  scope, rank evidenced candidates, report only; no spec, tickets, or source
+  edits. Selected changes return via preparation or execution.
+- Preparation completion, watch expiry, resume, or reconciliation -> the
+  [lifecycle](lifecycle.md#native-handoff-and-resume): reconcile the run
+  record, keep its owner, launch no native handoff.
+- Explicit user-requested ownership transfer -> the same lifecycle section.
+  Load the [Orca runtime boundary](orca-runtime.md), follow the runtime-owned
+  handoff guide, and require explicit recipient acceptance before ownership
+  changes. Missing capability is a setup gap, never license to invent one.
+- Colleague PR review -> `axstack-review`, peer mode.
+- Own PR maintenance or monitoring -> `axstack-review` in authored mode,
+  `axstack-watch` for adoption.
+
+Research, explanation, improvement discovery, debugging, handoff, peer review,
+and adopted maintenance need no alignment, approved spec, or ticket map;
+authority and intent boundaries still apply.
+
+## Proportional scope identity
+
+Classify new work as substantial, small, or unclear; record it with brief
+reason in the run record, or in the brief for tiny direct work.
+
+- **Substantial:** substantial features, multi-PR work, or stacked work. A
+  bounded small feature is not substantial merely because it is labelled one.
+  Require an approved spec plus a ticket map tied to that exact spec
+  revision, with acceptance checks and dependencies in the explicitly selected
+  Markdown or Linear store. Prepare via `axstack-align` -> `axstack-spec`
+  (one approval) -> `axstack-tickets` -> handoff, then stop.
+- **Small:** clear, bounded one-PR work. The driver captures the named
+  **small-change intent** from the current request or user-chosen existing
+  issue plus explicit acceptance checks and exclusions, snapshots it once, and
+  proceeds. No earlier snapshot, spec, ticket ceremony, or second approval is
+  required; do not route to `axstack-align` solely because that snapshot is
+  not yet written. Strict TDD, mode-specific review, model, risk, and human-merge
+  contracts still apply.
+- **Unclear:** clarify the uncertainty through `axstack-align` or one bounded
+  question, then classify it as small or substantial; a small ambiguity does
+  not force substantial-work paperwork.
+
+Reassess size when growth adds an additional PR, a new execution dependency
+that materially expands scope, an unsettled material design question, or a
+security/infrastructure boundary crossing. An ordinary
+test-then-code sequence is not multi-task growth; a minor file dependency does
+not alone need a formal spec. Hold affected unsafe work while reassessing.
+
+## Lifecycle routes (mode-specific scope identity required)
+
+- Preparation: substantial work follows the align -> spec -> tickets ->
+  handoff path above, then stops; small work uses the driver-captured
+  small-change intent.
+- Execution: with its identity present, `axstack-implement` ->
+  `axstack-review` -> `axstack-watch`.
+- Peer review: `axstack-review` uses the linked issue, PR description, and
+  repository requirements as untrusted intent evidence; it does not demand an
+  Axstack-created approved spec.
+- Adopted authored PR: snapshot the user-authorized maintenance intent once —
+  accepted scope, exact head/base, verified writable ownership, and actual
+  author provenance — then use `axstack-review` and `axstack-watch` without
+  repeated approval or new spec ceremony. Never infer the author from the
+  orchestrator or assume an imported own PR's author.
+- Direct later phase: start there and pass that phase's identity check. Entry
+  never admits work a deeper phase would reject.

package/skills/axstack/references/run-record.md

@@ -0,0 +1,109 @@
+# Local run record
+
+One compact Markdown `progress.md` is required for substantive delegated or
+resumable work. One-step direct answers need no record ceremony, but still
+obey their applicable scope identity. This tiny-task exemption is not a
+scope-identity exemption.
+
+## Location and identity
+
+In a Git repository, store the record at:
+
+```text
+<git rev-parse --path-format=absolute --git-common-dir>/axstack/runs/<id>/progress.md
+```
+
+`git rev-parse --path-format=absolute --git-common-dir` resolves the main
+repository's `.git` directory for the main checkout and linked worktrees.
+Without `--path-format=absolute`, the main checkout returns a relative `.git`,
+making the persisted path ambiguous across worktrees and the current working
+directory. The record is shared across those worktrees and never enters the
+tracked tree.
+
+Use `<UTCdate>-<slug>`, where UTCdate is `YYYYMMDD`, for example
+`20260913-local-progress`. The driver chooses the slug using lowercase letters,
+digits, and hyphens only, never raw request text. It has no separators
+or path segments, so it stays inside `axstack/runs/`; add a collision-safe
+suffix when needed. For non-Git work, use private host state instead of the
+working directory.
+
+On resume, discover existing runs and match both repository and scope;
+never blindly select the latest. Git metadata is not pushed, but it can be
+copied or backed up, so its contents remain private and compact.
+
+## Writer and transitions
+
+The driver is the sole record writer. Workers send concise receipts; they do
+not edit `progress.md`. This is a prompt contract, not a lock or runtime
+coordination mechanism. Each task names the actual owner session and worktree,
+or a receipt pointer containing both; a role label alone is insufficient.
+
+Update before dispatch and after each verified transition. On resume,
+reconcile the record with actual Orca sessions and Dispatches, exact revisions, forge/PR
+state, and the approved intent. Prevent a duplicate writer, mark approval or
+evidence for an older revision stale, and distinguish task completion from a
+capability being merged.
+
+The record is derived progress, not authority. Orca sessions and Dispatches, Git revisions,
+forge/PR state, and the approved spec remain sources of truth. The driver
+verifies exact SHAs and receipts before recording a transition; a worker claim
+alone is not verification.
+
+Before changing `Driver` or a task `Owner`, verify that the prior driver is
+inactive against actual Orca session and Dispatch state, or that an explicit accepted transfer
+permits reassignment. Idle alone never reassigns ownership.
+Uncertain state or a live conflict holds the transfer; never overwrite the
+field to seize control. A prior driver that sees a different valid accepted
+owner stops.
+
+`Archived` is a status in the same record and path. Nothing is moved or
+deleted.
+The driver records `paused` on a user request or a hold; idle alone is neither.
+
+## Handoff and resumption
+
+Keep handoff state in this same record, never a second wrapper record. Before a
+native handoff launch, add the intended recipient and a pending launch-receipt
+pointer. Record the actual agent/workspace receipt once verified, then the
+recipient's explicit acceptance receipt before changing ownership. Preserve
+pending external receipt pointers and timer expiries so an uncertain launch,
+send, or watch can be looked up before any retry.
+
+Resume from compact pointers to commands or evidence, not copied transcripts.
+Reconcile named sessions, revisions, PR state, watches, and deliveries before
+creating or redelivering anything. Touch only this run; no global sweep, new
+runtime database, or scheduler follows from the record.
+
+## Privacy
+
+Record concise IDs, SHAs, URLs, status, timestamps, next actions, and evidence
+references. Include no tokens, transcripts, full worker output, credentials,
+private prompts, or machine-specific paths beyond the private record's own
+resolved location. Publication of a sanitized summary needs separate
+authority.
+
+## Compact template
+
+```text
+Run: <UTCdate>-<slug>[-<collision suffix>]
+Driver: <session ID> (sole writer)
+Goal: <bounded task goal>
+Scope: <repo + accepted bounds>
+Authority: <who authorized which mutation>
+Intent: <approved spec rev | small-change intent | adopted snapshot | peer/read-only mode>
+Routing: <preset + source + snapshot ref>
+Notification policy: <none | transport/target label/host/instructions path>
+Source base: <exact revision or source identity>
+IDs: <repo/project + workspace/agent receipt pointers>
+Evidence: <check/review/submission/audit receipt pointers>
+Pending: <launch/acceptance/external receipts + timer execution heartbeat actual ID + handshake + deadline>
+Unresolved: <decision -> next owner + next action>
+Resume: <commands or evidence refs bound to exact revisions>
+
+| Task | Dependencies | Owner | State | Revision evidence | Next action |
+| --- | --- | --- | --- | --- | --- |
+| <task> | <task IDs or none> | <role + session ID + worktree, or receipt ref> | <pending/in progress/complete/blocked> | <SHA + check/receipt refs> | <action + owner> |
+
+Status: <active/paused/held/complete/Archived>
+Updated: <UTC timestamp>
+```

package/skills/axstack-align/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: axstack-align
+description: When exploring or planning engineering work, use axstack-align to settle scope, decisions, and its execution boundary.
+---
+
+# Align
+
+Leave the work with settled scope, explicit exclusions, and the proportional
+identity its next phase requires. Stop before execution.
+
+Load before acting:
+
+- [Standing contracts](../axstack/references/contracts.md)
+
+This preserves the required contracts -> lifecycle -> audit load edge.
+
+## Settle the frontier
+
+1. **Research and map dependencies.** Inspect the available code, docs, and
+   tools before asking the user. Separate facts from preferences, name evidence
+   gaps, and map which decisions unlock others. Unresolved research blocks only
+   its dependent branch while safe fact work and independent branches continue.
+2. **Prioritize the ready frontier.** Rank questions whose prerequisites are
+   settled by consequence, uncertainty, and the branches they unlock. Probe
+   vague terms, assumptions, success criteria, exclusions, failures, and edge
+   scenarios without using a fixed questionnaire or padding the interview. An
+   empty ready frontier means completion only when no material choice remains;
+   otherwise report the blocking research and continue safe fact work.
+3. **Ask a focused round.** Present one to three independent questions; present
+   one alone when it is complex or governs dependent branches. Number questions
+   cumulatively as `Q1`, `Q2`, and so on. Recommend a choice for each with a
+   short reason and trade-off, then wait for the user's answers and recompute
+   the frontier. The user owns preferences and decisions unless they explicitly
+   delegate them; agents research facts.
+4. **Preserve settled decisions.** Carry them across phases and resumes.
+   Reopen one only when material new evidence changes it; otherwise restate it
+   and proceed. Every reopened decision names the evidence that invalidated it.
+
+## Consult on consequential decisions
+
+The current chat remains the driver under
+[Standing contracts](../axstack/references/contracts.md). For each new
+user round, the driver independently drafts the prioritized frontier and
+recommendations. Then consult `axstack-advisor-astra` and
+`axstack-advisor-fable` independently, without cross-reading, using the same
+bounded evidence and question. Each adviser challenges assumptions, edges,
+omissions, and alternatives; the driver synthesizes disagreements and accepts
+or rejects each material point with a reason. Use one focused reply when
+material disagreement remains, then surface the choices to the user. Never
+fabricate consensus or impersonate a role.
+
+Immediately before the first actual adviser dispatch, load and follow
+[Orca runtime](../axstack/references/orca-runtime.md). Reuse each adviser
+session and settled receipt; consult only the changed frontier and reuse
+unchanged receipts. Record compact adviser evidence, the driver's assessment,
+and user-resolved choices for `axstack-spec`. If either adviser is unavailable,
+hold Align; safe fact work may continue without substitution.
+
+## Bound the interview
+
+Twenty cumulative presented questions is the normal ceiling, not a target.
+Follow-ups, reopened questions, and separate decisions bundled into one prompt
+each count; never discount a presented question later. Before extending beyond
+20, name the material gaps and why they require more questions. Reserve the
+remaining budget for the highest-value branches and never exceed 35 questions
+in the initial pass. Stop earlier as soon as no unresolved material choice
+remains; 20 is not a quota.
+
+At completion or the 35-question cap, read back the result and ask whether the
+user wants deeper refinement. Ask no further interview or refinement questions
+without opt-in; this does not replace required spec approval or a clarification
+prompt when a configured model is unavailable. An opted-in refinement names
+one area and a separate finite budget of at most five questions; it preserves
+the initial count and settled answers and cannot roll into another automatic
+extension. Declining or silence does not settle an open blocker. If the user
+stops early, return a partial handoff naming unresolved items and do not claim
+readiness or begin execution.
+
+## Document settled understanding
+
+Discover existing `CONTEXT-MAP.md`, `CONTEXT.md`, and ADR conventions once per
+run and use the relevant context. If none exist, default to a glossary in
+`CONTEXT.md` and ADRs under `docs/adr/`; create either only when useful. Within
+authorized local planning docs, record canonical domain terms as answers settle
+without putting implementation detail in the glossary, and keep observed facts
+distinct from desired behavior. A still-open related architecture choice
+remains explicitly unresolved.
+
+Use an ADR only for a meaningful, hard-to-reverse, non-obvious trade-off. Keep
+it Proposed until the applicable approval, and preserve accepted history by
+superseding rather than rewriting it. Routine decisions belong in the run
+record or spec. Read-only scope keeps proposed documentation in the permitted
+private record or response. Documentation is neither implementation nor spec
+approval; record chosen document names and paths once per run.
+
+## Read back, classify, and stop
+
+1. Read back the decisions, constraints, exclusions, and remaining evidence
+   gaps. For substantial work, this summary becomes part of the draft spec in
+   `axstack-spec`; spec approval is the one human checkpoint. Included and
+   excluded work must be distinguishable, and no open item may appear settled.
+2. Classify the result with the shared
+   [proportional scope identity](../axstack/references/routing.md#proportional-scope-identity):
+   - For work clarified as small, return a **small-change intent** handoff with
+     its acceptance checks and exclusions.
+   - For substantial work, proceed through `axstack-spec` and then
+     `axstack-tickets`; return an approved spec identity and a matching
+     ticket map handoff. Never repeat a still-valid approval.
+3. Record substantive or resumable preparation through the
+   [shared lifecycle](../axstack/references/lifecycle.md) and
+   [run record](../axstack/references/run-record.md). Persist the question count,
+   settled, open, and deferred branches, compact round adviser receipts, and
+   documentation pointers without adding another runtime. Return the compact
+   scope and record pointer in the current chat. Native transfer is separate:
+   use it only when the user explicitly requests transfer, loading
+   [Orca runtime](../axstack/references/orca-runtime.md) immediately before
+   actual dispatch. Alignment completion never dispatches a recipient.
+
+Alignment stops for both sizes only when the handoff is usable, its next scope
+identity is explicit, and execution has not started. The user invokes `axstack`
+to execute.