clinkx 0.3.0 → 1.1.0

package/clinkx-workflows/workflows/council-discover.yaml

@@ -22,6 +22,87 @@ variables:
     required: false
     default: []
     description: Optional file paths (absolute, or relative to workspace root) shared with the council
+  context_bundle_files:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder bundle files copied into the workflow run
+  cb_task:
+    type: string
+    required: false
+    default: ""
+    description: Optional context_builder task override
+  cb_roots:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder source roots
+  cb_focus_paths:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder focus path refinement. Context preflight runs by default; these paths narrow selection when supplied.
+  cb_include_globs:
+    type: string[]
+    required: false
+    default: []
+    description: Context-builder include glob refinements
+  cb_exclude_globs:
+    type: string[]
+    required: false
+    default: ["**/*.po", "**/*.pot", "**/*.mo", "**/locales/**/*.json", "**/i18n/**/*.json"]
+    description: Context-builder exclude glob refinements
+  cb_search_terms:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder search term refinement. Context preflight runs by default; these terms narrow selection when supplied.
+  cb_profile:
+    type: string
+    required: false
+    default: implementation_medium
+    description: Context-builder budget profile
+  cb_budget_adapter:
+    type: string
+    required: false
+    description: Adapter whose context_builder budget defaults apply when context preflight runs (preflight runs by default unless cb_context_mode is off).
+  cb_allow_secrets:
+    type: boolean
+    required: false
+    description: When false, restores fail-closed context_builder source secret omission/redaction AND rejects high-confidence secrets in persisted task text (cb_task/user_request) before the run starts; default true includes secrets.
+  cb_budget_max_estimated_tokens:
+    type: number
+    required: false
+    description: Context-builder budget override — max estimated tokens
+  cb_budget_max_files:
+    type: number
+    required: false
+    description: Context-builder budget override — max files selected
+  cb_budget_max_scan_files:
+    type: number
+    required: false
+    description: Context-builder budget override — max files scanned
+  cb_budget_max_bytes_per_file:
+    type: number
+    required: false
+    description: Context-builder budget override — max bytes per file
+  cb_budget_max_total_bytes:
+    type: number
+    required: false
+    description: Context-builder budget override — max total bytes
+  cb_budget_max_search_results:
+    type: number
+    required: false
+    description: Context-builder budget override — max search results
+  cb_delegate:
+    type: string
+    required: false
+    default: ""
+    description: Optional context_builder delegate config as a JSON string (enabled/curator/finalizer)
+  cb_context_mode:
+    type: string
+    required: false
+    description: "Context preflight mode selector. Allowed values: full | deterministic | off | inherit. Omitted or inherit follows the server default (CLINKX_WORKFLOWS_CONTEXT_DEFAULT); full runs curator+finalizer delegate, deterministic seeds discovery with no delegate, off skips preflight. Allowed-value validation is owned by the resolver; no concrete mode default is materialized in YAML."
   context_images:
     type: string[]
     required: false
@@ -29,7 +110,10 @@ variables:
     description: Optional image paths (absolute, or relative to workspace root) shared with the council
 
 settings:
-  timeout_seconds: 1800
+  timeout_seconds: 10800
+  # Vendor/generated evidence the finalizer cannot see degrades the run
+  # (marked conditional) instead of failing it.
+  context_external_gap_policy: degrade
 
 stages:
   - id: analysts
@@ -44,23 +128,26 @@ stages:
     calls:
       - id: analyst_a
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
         prompt_template: council/discover-analyst.txt
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         validator_schema_id: council_discover_analyst_v2
       - id: analyst_b
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
         prompt_template: council/discover-analyst.txt
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         validator_schema_id: council_discover_analyst_v2
       - id: analyst_c
         cli_name: claude
+        timeout_seconds: 1200
         role: json-default
         prompt_template: council/discover-analyst.txt
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         validator_schema_id: council_discover_analyst_v2
 
@@ -76,8 +163,9 @@ stages:
     calls:
       - id: cross_reviewer_a
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         prompt_template: council/discover-cross-reviewer.txt
         anonymize_context: true
@@ -86,8 +174,9 @@ stages:
         validator_schema_id: council_discover_cross_reviewer_v4
       - id: cross_reviewer_b
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         prompt_template: council/discover-cross-reviewer.txt
         anonymize_context: true
@@ -96,8 +185,9 @@ stages:
         validator_schema_id: council_discover_cross_reviewer_v4
       - id: cross_reviewer_c
         cli_name: claude
+        timeout_seconds: 1200
         role: json-default
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         prompt_template: council/discover-cross-reviewer.txt
         anonymize_context: true
@@ -117,6 +207,7 @@ stages:
     calls:
       - id: ranking
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
         reducer: council_ranking_v1
         prompt: "Deterministic ranking reducer"
@@ -136,9 +227,10 @@ stages:
     calls:
       - id: chairman
         cli_name: codex
+        timeout_seconds: 1200
         role: json-default
         prompt_template: council/discover-chairman.txt
-        absolute_file_paths_from: context_files
+        absolute_file_paths_from: [context_files, context_bundle_files]
         images_from: context_images
         context_from:
           - analysts

package/clinkx-workflows/workflows/council-plan-review.yaml

@@ -0,0 +1,253 @@
+# GENERIC plan review council — the sixth generic council (members/chairman/user_request).
+# The typed approval transport is the separate plan-review-receipts workflow. Guarantee
+# delta versus plan-review-receipts: NO immutable-revision binding, NO execution-contract
+# digest, NO immutable snapshot, and NO receipt candidates — the plan travels as a mutable
+# file path via context_files, reviewer non-mutation is a prompt instruction only (not an
+# enforced boundary), and the result is a generic council verdict that CANNOT feed an
+# approval gate.
+# Use plan-review-receipts (typed plan_review contract) when those guarantees matter.
+name: council-plan-review
+description: "Plan review council: reviewers critique a plan file, cross-reviewers evaluate, chairman synthesizes (1-10 members). No typed contract, digest binding, or receipts — the typed transport is plan-review-receipts."
+version: 1.0.0
+
+variables:
+  user_request:
+    type: string
+    required: true
+    description: The plan review request including context (what the plan is for, what to scrutinize)
+  mode:
+    type: string
+    required: false
+    default: plan_review
+    description: Review mode
+  rubric:
+    type: string
+    required: false
+    default: '[{"name":"scope_and_non_goals","description":"Explicit scope and stated non-goals","weight":15},{"name":"evidence_anchors","description":"Load-bearing claims cite checkable files, symbols, or commands","weight":15},{"name":"dependency_graph","description":"Explicit, acyclic, executable task ordering","weight":10},{"name":"runnable_verification","description":"Each substantive change has a verification a person or CI can actually run","weight":15},{"name":"rollback","description":"A stated way back for hard-to-reverse work only","weight":10},{"name":"risks","description":"Real risks named with blast radius","weight":15},{"name":"undisguised_blockers","description":"Genuine blockers stated as blockers, preferences not inflated","weight":10},{"name":"cross_boundary_ownership","description":"Owners and pinned contracts for work crossing repo, package, or service boundaries","weight":10}]'
+    description: Evaluation rubric for plan reviewers
+  context_files:
+    type: string[]
+    required: false
+    default: []
+    description: Optional file paths (absolute, or relative to workspace root) shared with the council; include the plan file here
+  context_bundle_files:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder bundle files copied into the workflow run
+  cb_task:
+    type: string
+    required: false
+    default: ""
+    description: Optional context_builder task override
+  cb_roots:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder source roots
+  cb_focus_paths:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder focus path refinement. Context preflight runs by default; these paths narrow selection when supplied.
+  cb_include_globs:
+    type: string[]
+    required: false
+    default: []
+    description: Context-builder include glob refinements
+  cb_exclude_globs:
+    type: string[]
+    required: false
+    default: ["**/*.po", "**/*.pot", "**/*.mo", "**/locales/**/*.json", "**/i18n/**/*.json"]
+    description: Context-builder exclude glob refinements
+  cb_search_terms:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder search term refinement. Context preflight runs by default; these terms narrow selection when supplied.
+  cb_profile:
+    type: string
+    required: false
+    default: review_deep
+    description: Context-builder budget profile
+  cb_budget_adapter:
+    type: string
+    required: false
+    description: Adapter whose context_builder budget defaults apply when context preflight runs (preflight runs by default unless cb_context_mode is off).
+  cb_allow_secrets:
+    type: boolean
+    required: false
+    description: When false, restores fail-closed context_builder source secret omission/redaction AND rejects high-confidence secrets in persisted task text (cb_task/user_request) before the run starts; default true includes secrets.
+  cb_budget_max_estimated_tokens:
+    type: number
+    required: false
+    description: Context-builder budget override — max estimated tokens
+  cb_budget_max_files:
+    type: number
+    required: false
+    description: Context-builder budget override — max files selected
+  cb_budget_max_scan_files:
+    type: number
+    required: false
+    description: Context-builder budget override — max files scanned
+  cb_budget_max_bytes_per_file:
+    type: number
+    required: false
+    description: Context-builder budget override — max bytes per file
+  cb_budget_max_total_bytes:
+    type: number
+    required: false
+    description: Context-builder budget override — max total bytes
+  cb_budget_max_search_results:
+    type: number
+    required: false
+    description: Context-builder budget override — max search results
+  cb_delegate:
+    type: string
+    required: false
+    default: ""
+    description: Optional context_builder delegate config as a JSON string (enabled/curator/finalizer)
+  cb_context_mode:
+    type: string
+    required: false
+    description: "Context preflight mode selector. Allowed values: full | deterministic | off | inherit. Omitted or inherit follows the server default (CLINKX_WORKFLOWS_CONTEXT_DEFAULT); full runs curator+finalizer delegate, deterministic seeds discovery with no delegate, off skips preflight. Allowed-value validation is owned by the resolver; no concrete mode default is materialized in YAML."
+  context_images:
+    type: string[]
+    required: false
+    default: []
+    description: Optional image paths (absolute, or relative to workspace root) shared with the council
+
+settings:
+  timeout_seconds: 10800
+  # Vendor/generated evidence the finalizer cannot see degrades the run
+  # (marked conditional) instead of failing it.
+  context_external_gap_policy: degrade
+
+stages:
+  - id: reviewers
+    description: "Council members review the plan independently"
+    parallel: true
+    retry:
+      mode: all
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: continue
+    calls:
+      - id: reviewer_a
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        validator_schema_id: council_code_review_reviewer_v1
+        post_processor: citation_check
+      - id: reviewer_b
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        validator_schema_id: council_code_review_reviewer_v1
+        post_processor: citation_check
+      - id: reviewer_c
+        cli_name: claude
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        validator_schema_id: council_code_review_reviewer_v1
+        post_processor: citation_check
+
+  - id: cross_review
+    description: "Cross-reviewers evaluate plan reviews anonymously"
+    parallel: true
+    retry:
+      mode: all
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: continue
+    calls:
+      - id: cross_reviewer_a
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-cross-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        anonymize_context: true
+        context_from:
+          - reviewers
+        validator_schema_id: council_code_review_cross_reviewer_v4
+        post_processor: citation_check
+      - id: cross_reviewer_b
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-cross-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        anonymize_context: true
+        context_from:
+          - reviewers
+        validator_schema_id: council_code_review_cross_reviewer_v4
+        post_processor: citation_check
+      - id: cross_reviewer_c
+        cli_name: claude
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-cross-reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        anonymize_context: true
+        context_from:
+          - reviewers
+        validator_schema_id: council_code_review_cross_reviewer_v4
+        post_processor: citation_check
+
+  - id: ranking_analysis
+    description: "Deterministic ranking of plan reviews"
+    parallel: false
+    retry:
+      mode: transport_only
+      max_retries: 0
+      backoff_seconds: 0
+      max_backoff_seconds: 0
+    on_failure: continue
+    calls:
+      - id: ranking
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        reducer: council_ranking_v1
+        prompt: "Deterministic ranking reducer"
+        context_from:
+          - cross_review
+        validator_schema_id: council_ranking_reducer_v1
+
+  - id: chairman
+    description: "Chairman synthesizes plan review verdict"
+    parallel: false
+    retry:
+      mode: transport_only
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: abort
+    calls:
+      - id: chairman
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json-codereviewer
+        prompt_template: council/plan-review-chairman.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        images_from: context_images
+        context_from:
+          - reviewers
+          - cross_review
+          - ranking_analysis
+        validator_schema_id: council_code_review_chairman_v1

package/clinkx-workflows/workflows/plan-review-receipts.yaml

@@ -0,0 +1,230 @@
+name: plan-review-receipts
+description: "Plan review council: one immutable plan revision, one ordered roster, one advisory synthesis. Returns receipt candidates, never approval (B-1)"
+version: 1.0.0
+
+# Exact seat composition is NOT expressed here. This file is the four-stage SEED
+# the isolated plan-review expander (A-3, src/plan-review/expander.ts) fans out:
+# it requires these exact stage IDs in this exact order, each holding exactly one
+# seed call, and clones the reviewer/cross_review blueprints once per admitted
+# roster seat. The workflow grammar (src/schema.ts) has no `foreach` and no
+# object variables, and the roster deliberately never travels as a generic
+# variable — it rides the typed `plan_review` input (A-1/A-2).
+#
+# This seed must NOT declare static `absolute_file_paths`: the expander INLINES
+# the verified canonical plan snapshot into each actor's prompt and EMPTIES the
+# file list (A-6/D9), so a path named here would be dropped — naming one would
+# only mislead.
+#
+# Actors run under their adapter's default permissions. Non-mutation is a PROMPT
+# INSTRUCTION carried by the packaged templates, not an enforced boundary; the
+# runtime makes no containment claim and this file must not imply one.
+
+variables:
+  # ---------------------------------------------------------------------------
+  # Rubric binding (server-packaged v1; caller may only echo its exact digest)
+  # ---------------------------------------------------------------------------
+  # The runtime computes and binds this digest; the default merely advertises
+  # the value clients need when precomputing expected_execution_contract_digest.
+  rubric_digest:
+    type: string
+    required: false
+    default: 92625957e2afd55f4c55943a74d8d059a10df4fe3d3febda6a1bce80f6df6681
+    description: Server-packaged plan-review rubric digest. If supplied, it must exactly match this value.
+
+  # ---------------------------------------------------------------------------
+  # Context anchors / overrides (repo evidence only — never the plan)
+  # ---------------------------------------------------------------------------
+  # The plan itself is force-excluded from selection by the non-overridable
+  # plan-review context policy (A-7), in both the pre-dispatch exclusion fold and
+  # the post-finalization filter. These anchors select REPO EVIDENCE that sits
+  # alongside the immutable snapshot; they cannot re-admit the plan.
+  # Deliberately DEFAULTLESS: a `default: ""` would fabricate a blank task that is
+  # indistinguishable from genuine omission, and would publish that invented blank
+  # into the advertised public variable schema and the generated discovery fixture.
+  # Defaultless keeps omission observable as omission.
+  #
+  # `required: false` is deliberate, NOT an oversight. `required` gates on a STATIC
+  # proxy, but the real precondition is dynamic: "a contextBuilderRunner is present".
+  # A runner-absent server (CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED=false) runs no
+  # preflight and needs no seed, so a static `required: true` would reject a request
+  # that is perfectly valid there. The actual enforcement is
+  # validateContextSeedSourceAtAdmission, which fires pre-mutex only when a runner
+  # made the context policy non-null.
+  cb_task:
+    type: string
+    required: false
+    description: "Context_builder seed describing what repo evidence the review needs. CONDITIONALLY REQUIRED: whenever context preflight is available — the default deployment — this must be supplied and trimmed-nonblank, and admission rejects a blank or omitted value with -32602 before any run state is created. It is genuinely optional only on servers where preflight is unavailable (no context-builder runner, e.g. the hard bypass CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED=false), where no seed is consumed. Optionally narrow selection with cb_focus_paths or cb_search_terms."
+  cb_roots:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder source roots
+  cb_focus_paths:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder focus path refinement. Context preflight runs by default; these paths narrow selection when supplied. Paths resolving to the bound plan or any plan-workspace PLAN.md are rejected at admission.
+  cb_include_globs:
+    type: string[]
+    required: false
+    default: []
+    description: Context-builder include glob refinements
+  cb_exclude_globs:
+    type: string[]
+    required: false
+    default: ["**/*.po", "**/*.pot", "**/*.mo", "**/locales/**/*.json", "**/i18n/**/*.json"]
+    description: Context-builder exclude glob refinements. The plan-review plan exclusions are folded in on top of these and cannot be dropped.
+  cb_search_terms:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder search term refinement. Context preflight runs by default; these terms narrow selection when supplied.
+  # `review_deep` is chosen for its BUDGET (~96k est. tokens / 300 files): plan review needs broad
+  # repo evidence. It also couples in the code-review-shaped `review_deep_v1` coverage policy, which
+  # can report `degraded` here — an "unclassifiable" target (tests exist but no confident link) can
+  # never be satisfied yet still folds into missing_required:["regression_test"]. That is WARN-ONLY
+  # with no dispatch effect: fail_on_degraded_context_coverage defaults false and no workflow sets
+  # it, and `context_quality` is read by no template — so the budget is worth the noisy warning.
+  # Coverage policy lives in the ROOT package: src/context-builder/review-coverage.ts
+  # (evaluateContextCoverage, buildContextReviewObligations, resolveContextCoveragePolicy).
+  # council-code-review and council-debug share the same policy.
+  cb_profile:
+    type: string
+    required: false
+    default: review_deep
+    description: Context-builder budget profile
+  cb_budget_adapter:
+    type: string
+    required: false
+    description: Adapter whose context_builder budget defaults apply when context preflight runs (preflight runs by default unless cb_context_mode is off).
+  cb_allow_secrets:
+    type: boolean
+    required: false
+    description: When false, restores fail-closed context_builder source secret omission/redaction AND rejects high-confidence secrets in persisted task text (cb_task) before the run starts; default true includes secrets.
+  # Declared so callers can actually pass the mode the descriptions above reference; the resolver
+  # owns allowed values and the default, so no concrete mode is materialized here.
+  # NOTE: soft `off` still resolves a NON-NULL policy (resolveWorkflowContextMode), so the
+  # admission seed check STILL fires. Declaring this does NOT waive the nonblank cb_task
+  # requirement for soft-off callers — a deliberate owner decision, not an oversight.
+  cb_context_mode:
+    type: string
+    required: false
+    description: "Context preflight mode selector. Allowed values: full | deterministic | off | inherit. Omitted or inherit follows the server default (CLINKX_WORKFLOWS_CONTEXT_DEFAULT); full runs curator+finalizer delegate, deterministic seeds discovery with no delegate, off skips preflight. Allowed-value validation is owned by the resolver; no concrete mode default is materialized in YAML."
+
+  # ---------------------------------------------------------------------------
+  # Evidence file channels
+  # ---------------------------------------------------------------------------
+  # Entries resolving to the bound plan or any plan-workspace PLAN.md are
+  # rejected pre-mutex (A-7): a caller must not be able to hand actors a MUTABLE
+  # plan alongside the immutable snapshot.
+  context_files:
+    type: string[]
+    required: false
+    default: []
+    description: Optional repo evidence file paths (absolute, or relative to workspace root) shared with the roster. The bound plan and plan-workspace PLAN.md files are rejected.
+  context_bundle_files:
+    type: string[]
+    required: false
+    default: []
+    description: Optional context_builder bundle files copied into the workflow run. Preflight appends the curated bundle here; the bound plan and plan-workspace PLAN.md files are rejected.
+
+settings:
+  timeout_seconds: 10800
+
+stages:
+  # Every roster seat votes (D2). One call per seat, cloned from this blueprint.
+  # `parallel`/`on_failure` are re-asserted by the expander: a failed seat stays
+  # that exact failed seat (D3, no substitution) and must not abort its peers.
+  - id: reviewers
+    description: "Each roster seat reviews the immutable plan snapshot independently"
+    parallel: true
+    retry:
+      mode: all
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: continue
+    calls:
+      - id: reviewer_seed
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json
+        prompt_template: plan-review/reviewer.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        validator_schema_id: plan_review_reviewer_v1
+
+  # Advisory (D2). FIXED cardinality: one call per roster seat, unconditionally —
+  # a seat with no valid peer artifacts still runs and persists a degenerate
+  # no-op. The expander rewrites `context_from` to this seat's PEERS only and
+  # projects each peer to its semantic body, so the anonymized set never carries
+  # a seat_id, provider, or plan binding.
+  - id: cross_review
+    description: "Each seat cross-reviews its peers' anonymized reviews (advisory)"
+    parallel: true
+    retry:
+      mode: all
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: continue
+    calls:
+      - id: cross_seed
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json
+        prompt_template: plan-review/cross-review.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        anonymize_context: true
+        context_from:
+          - reviewers
+        validator_schema_id: plan_review_cross_review_v1
+
+  # Deterministic reducer (B-5) — no LLM, no provider, nothing spawned. The
+  # packaged ranking template documents the reducer contract but is never sent
+  # anywhere; the engine runs the reducer in place of the call.
+  - id: ranking_analysis
+    description: "Deterministic advisory ranking over cross-review artifacts"
+    parallel: false
+    retry:
+      mode: transport_only
+      max_retries: 0
+      backoff_seconds: 0
+      max_backoff_seconds: 0
+    on_failure: continue
+    calls:
+      - id: ranking
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json
+        reducer: plan_review_ranking_v1
+        prompt_template: plan-review/ranking.txt
+        context_from:
+          - cross_review
+        validator_schema_id: plan_review_ranking_reducer_v1
+
+  # Advisory (D2). The chairman occupies a roster seat and votes like any other
+  # seat in `reviewers`; this stage is its SEPARATE synthesis call, which can
+  # never create, repair, or replace a receipt. `on_failure: continue` states the
+  # intent that a chairman failure is advisory metadata, not a run failure — the
+  # engine's terminal decision is Track C's (C-4) to change.
+  - id: chairman
+    description: "Chairman synthesizes an advisory view — never an approval or final gate"
+    parallel: false
+    retry:
+      mode: transport_only
+      max_retries: 1
+      backoff_seconds: 10
+      max_backoff_seconds: 60
+    on_failure: continue
+    calls:
+      - id: chairman
+        cli_name: codex
+        timeout_seconds: 1200
+        role: json
+        prompt_template: plan-review/chairman.txt
+        absolute_file_paths_from: [context_files, context_bundle_files]
+        context_from:
+          - reviewers
+          - cross_review
+          - ranking_analysis
+        validator_schema_id: plan_review_chairman_v1