codex-orchestrator 2.0.11 → 2.0.13

package/internal-workflow/skills/tickets-orchestrator/SKILL.md

@@ -0,0 +1,199 @@
+---
+name: tickets-orchestrator
+description: Coordinate an approved multi-ticket dependency graph through unique fresh workers, strict dependency-safe integration, root-owned Git checkpoints, direct Parent proof, and cumulative Spec and Standards review. Route a single ticket to Implement.
+---
+
+# Tickets Orchestrator
+
+Coordinate the complete approved graph. This skill owns graph scheduling,
+integration, local checkpoints, and the cumulative Parent outcome. It does not
+replace Implement for one ticket or create another planning layer.
+
+## Graph-only boundary
+
+Activate only for an approved graph with multiple executable child tickets,
+multiple ready disjoint children, dependency-frontier coordination, or an
+explicit request to execute the complete graph. A single deterministic ticket
+routes to `$implement`, which supplies its one fresh worker and owns its normal
+proof and review path.
+
+Do not implement a planning-context Parent when executable children exist.
+Root must not implement a full child or merge ticket boundaries. A ticket that
+cannot execute from its body plus the Parent PRD is a ticket-packet defect and
+fails closed.
+
+## Authority and ownership
+
+Before work, require:
+
+- one clean isolated integration worktree and pinned baseline for every
+  repository in the graph;
+- the complete Parent PRD, complete tickets, and authoritative tracker state,
+  including native Parent, sub-issue, and blocker links;
+- repository policy, bounded child write scopes and exclusions; and
+- deterministic proof obligations that exercise the target coordinator state.
+
+Every child receives a unique fresh `implementer`. Begin every assignment with
+`Assigned role: implementer` and include the complete ticket, complete Parent
+PRD, repository policy, bounded write scope, exclusions, required proof, stop
+conditions, and explicit no-Git boundary. Capture a non-empty worker identity
+and wait for that same worker to complete. Workers perform no Git action and
+return changed files, local proof, skipped checks, risks, Decision Deltas,
+overlap, and blockers. Any worker Git event fails the child.
+
+Root is the only integrator and Git writer. After the required gates pass, root
+automatically creates a scoped child or wave checkpoint. Push and PR always
+require separate authority. Tracker writes also require explicit authority.
+
+## Ephemeral integration ledger
+
+Keep one in-memory integration ledger keyed by stable authoritative repository
+identity, never by a worker or worktree path. For each repository record its
+integration worktree, pinned baseline SHA, ordered confirmed checkpoint SHAs,
+any checkpoint SHAs rediscovered during recovery as `recovery_commits`, and,
+once settled, its final checkpoint and exact `baseline..final` range. Fail
+closed when repository identity or membership is ambiguous.
+
+This ledger coordinates only the current run. Never serialize it to a file,
+database, branch, commit, tracker field, comment, tag, or other durable state.
+Git checkpoints remain product integration commits, not workflow-state
+records. Rebuild a lost ledger from authoritative sources and confirmed Git.
+
+## Coordinator contract
+
+1. Populate the repository-keyed in-memory ledger, pin every baseline, inspect
+   each integration worktree's clean status, reread Parent, tickets, tracker
+   links, blockers, and labels, then build the ready frontier.
+2. Do not start a blocked child. Sequence any dependency or overlap. Use one
+   parallel wave only when owners, write scopes, public seams, proof resources,
+   migrations, generated artifacts, and source-of-truth contracts are all
+   genuinely disjoint.
+3. Launch one unique fresh worker per ready child. Never reuse a worker context
+   or treat narration as completion.
+4. Wait for every worker in the wave. A failure, timeout, missing identity,
+   incomplete wait, scope drift, dirty overlap, or stale or missing proof fails
+   the affected wave.
+5. Root inspects each worker report and the complete integrated diff, confirms
+   ownership and scope, and leaves unrelated or ambiguous state untouched.
+6. Run only rewritten target-state checks plus the smallest affected combined
+   deterministic proof on the settled bytes. Do not use inherited coordinator
+   tests, live agents, or Codex execution as acceptance evidence, and do not
+   create a replacement runner.
+7. Only after worker proof, root inspection, target-state checks, and combined
+   proof are current may root create the scoped checkpoint in the affected
+   repository. Its message names the Parent and exact child or wave issues.
+8. Reread Git to confirm the checkpoint and clean integration boundary, then
+   append its SHA to that repository's in-memory checkpoint sequence before
+   releasing successors. A proven checkpoint is an integration boundary, not
+   a Parent completion claim.
+
+A multi-repository wave settles checkpoints per repository but releases as one
+unit. If settlement stops after one or more repository checkpoints are
+confirmed, retain those earlier commits; do not roll them back, rewrite them,
+or duplicate them to simulate an atomic wave. Reconstruct every affected
+repository from Git. For a repository with no confirmed checkpoint, classify
+the checkpoint as not yet created, not as a failed checkpoint commit. In that
+repository's isolated integration worktree, revalidate intact authorized work
+or assign a unique fresh implementer to recreate missing work under the
+original ticket boundary. Root then reruns affected target-state checks and the
+combined deterministic proof across every repository range and creates only
+the missing scoped checkpoint. Release no successor until every repository
+checkpoint in the wave is confirmed and that combined proof is current. Keep
+all settlement state only in the ephemeral repository-keyed ledger.
+
+Any authorized in-scope repair returns to a unique fresh implementer for the
+affected existing ticket under that ticket's original bounded assignment and
+no-Git boundary. Root never edits the repair itself. Root integrates the worker
+result, reruns the affected proof, and creates a new scoped checkpoint before
+final review resumes. New
+behavior, ownership, scope, or ticket boundaries are a Decision Delta and stop
+the graph.
+
+No per-ticket delivery Review runs for graph children. Their worker proof and
+root checkpoint gates accumulate into the one final Parent Review below.
+
+## Recovery
+
+After interruption, reconstruct each repository entry only from its integration
+worktree, pinned baseline, Parent PRD, tracker, tickets, Git, and unique root
+checkpoints. Do not trust worker narration or create duplicate durable run
+state. Put a uniquely rediscovered checkpoint SHA in both its ordered checkpoint
+sequence and `recovery_commits`; do not create a recovery-only commit.
+
+If a checkpoint command result is lost, reread Git in the affected repository
+before any retry. Accept recovery when exactly one reachable scoped commit
+after that repository's baseline has the expected Parent-and-ticket message and
+matching diff. Multiple matches, unexpected commits, uncertain ownership, or
+ambiguous uncommitted or staged state fail closed. When no matching commit
+exists and Git confirms that no checkpoint was created, mark that repository
+checkpoint not yet created and resume the per-repository settlement path; do
+not describe it as a failed checkpoint commit. Leave uncertain bytes untouched
+and release no successor until the whole wave settles.
+
+## Final Parent acceptance
+
+After every child checkpoint and final deterministic proof are settled, pin the
+final checkpoint and exact `baseline..final` range in every repository entry.
+Compare the complete Parent PRD directly against all full cumulative repository
+ranges. Do not substitute child reports, local tests, tracker state, or the
+last child diff.
+
+The reusable final-review mechanism launches one fresh `spec_reviewer` and one
+fresh `standards_reviewer` in parallel on the repository-keyed set of final
+checkpoints and ranges. Spec checks every Parent obligation against the full
+diff and proof. Standards checks correctness, repository policy, failure paths,
+cleanup, duplicate ownership, compatibility residue, and unnecessary machinery.
+
+Capture both non-empty identities and complete both waits. Reviewer verdicts
+are evidence, not authority: root verifies each finding against the Parent and
+cumulative diff, and Parent approval exists when both independent reviews have
+no verified blocker or required-proof gap. Generic `PASS` without direct Parent
+coverage, failed review, and timeout remain blocking. A blocker
+requires a concrete defect or proof gap causally linked to a Parent obligation,
+existing invariant, or mandatory repository rule. Other findings are
+non-blocking observations.
+
+Before repair dispatch, root independently establishes **Authority** (the
+Parent obligation, invariant, or rule), **Trigger**, **Impact**, and **Minimal
+repair**. Only a finding with all four facts is a verified blocker eligible for
+repair. When root verifies such a blocker, assign the
+affected existing ticket to a unique fresh implementer with no Git authority.
+Root integrates the returned repair, reruns affected target-state and combined
+deterministic proof, creates the scoped checkpoint, pins the new revision, and
+launches only the affected targeted lens: Spec for Parent behavior, Standards
+for correctness or mandatory rules, and both lenses for mixed or unisolatable
+repairs. Before relaunch, update the affected
+repository's final checkpoint and range. Give the reviewer the previous
+reviewed checkpoint as baseline, the repair delta, repaired blockers, directly
+affected Parent obligations and cross-ticket seams, and current affected proof.
+Review only the repair delta and directly affected Parent obligations.
+Untouched parts of the cumulative result retain their approval.
+
+Before each repair dispatch, consolidate every verified blocker from the current review
+into one graph-final repair batch. Dispatch each affected existing ticket once
+under its original boundary, then settle all returned checkpoints and proof
+before targeted Review. The original Parent and ticket authority covers these
+in-scope repairs without another user confirmation. Repeat the graph-final
+repair and targeted Review loop until approval; reviewer count is never a stop
+condition. Use a complete cumulative two-lens Review again only when the repair
+cannot be isolated from previously approved scope.
+
+Deterministic checks may prove this mechanism's contract without counting as a
+real final-review activation. The real activation occurs only for the settled
+final graph revision owned by the graph's final acceptance step.
+
+Read [delegate-integrate.md](references/delegate-integrate.md) for workers,
+waves, integration, and checkpoints; [finish-delivery.md](references/finish-delivery.md)
+for cumulative review and authorized delivery; and
+[stop-completion.md](references/stop-completion.md) for fail-closed recovery.
+
+## Handoff
+
+Report, per repository key, the integration worktree, baseline SHA, ordered
+checkpoint and recovery-commit SHAs, final checkpoint SHA, and exact final
+range. Also report frontier state, worker identities and write scopes,
+dependency and overlap decisions, checkpoint messages, combined deterministic
+results tied to repository ranges, both final review questions and the ranges
+in the reviewer brief when activated, tracker actions, skipped checks, risks,
+Decision Deltas, blockers, and exact Git actions. Never claim Parent completion
+from a child checkpoint or persist the in-memory ledger as handoff state.

package/internal-workflow/skills/tickets-orchestrator/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Tickets Orchestrator"
+  short_description: "Coordinate approved multi-ticket graphs"
+  default_prompt: "Use $tickets-orchestrator for this approved multi-ticket graph: unique fresh child implementers, strict dependency-safe root integration, root-owned checkpoints, direct cumulative Parent proof, and independent Spec and Standards review."
+policy:
+  allow_implicit_invocation: true

package/internal-workflow/skills/tickets-orchestrator/evals/evals.json

@@ -0,0 +1,126 @@
+{
+  "schema_version": 1,
+  "skill": "tickets-orchestrator",
+  "cases": [
+    {
+      "id": "deterministic-ticket-direct",
+      "prompt": "Deliver one authorized issue whose execution targets and proof are already deterministic.",
+      "expected": ["route the ticket to Implement", "launch exactly one fresh implementer through the single-ticket route"],
+      "forbidden": ["activate tickets-orchestrator", "manufacture a replacement planning layer"]
+    },
+    {
+      "id": "fresh-worker-assignment-and-git-owner",
+      "prompt": "Start two children in an approved graph from a clean isolated integration worktree.",
+      "expected": ["use a unique fresh implementer for every ticket", "include the complete ticket, Parent PRD, repository policy, and bounded write scope", "reserve all Git actions to root"],
+      "forbidden": ["reuse a worker context", "let a worker stage or commit", "implement a full child on root"]
+    },
+    {
+      "id": "dependency-and-overlap-sequencing",
+      "prompt": "Tickets A and B touch the same owner and proof resource; ticket C is natively blocked by B.",
+      "expected": ["sequence A and B", "release C only after B and combined deterministic proof succeed"],
+      "forbidden": ["launch A and B in one wave", "release C from worker narration"]
+    },
+    {
+      "id": "safe-disjoint-wave",
+      "prompt": "Two ready tickets have disjoint owners, write scopes, migrations, generated artifacts, and exclusive proof resources.",
+      "expected": ["launch both fresh workers in one parallel wave", "wait for both workers before root integration"],
+      "forbidden": ["merge ticket boundaries", "let either worker commit"]
+    },
+    {
+      "id": "repository-keyed-in-memory-scheduling",
+      "prompt": "An approved graph spans two repositories with separate integration worktrees and baselines.",
+      "expected": ["keep an in-memory ledger keyed by stable repository identity", "schedule each ticket only against its repository integration worktree, baseline, and checkpoints", "keep proof ranges separate per repository"],
+      "forbidden": ["key state by worker identity", "imply one Git range across repositories", "persist workflow state"]
+    },
+    {
+      "id": "worker-or-proof-failure-fails-closed",
+      "prompt": "A worker times out or fails and another worker returns stale target-state validation.",
+      "expected": ["create no affected checkpoint commit", "release no successor", "report both blockers"],
+      "forbidden": ["substitute root implementation", "accept inherited legacy tests", "continue from a partial wave"]
+    },
+    {
+      "id": "root-checkpoint-order",
+      "prompt": "A wave completes successfully and its successor is ready.",
+      "expected": ["wait for worker proof", "inspect the integrated diff on root", "run rewritten target-state checks and combined deterministic proof", "commit a scoped root checkpoint naming the Parent and exact ticket issues before releasing the successor"],
+      "forbidden": ["commit from a worker", "release the successor before the checkpoint"]
+    },
+    {
+      "id": "crash-before-checkpoint",
+      "prompt": "Root crashes after combined proof but before the checkpoint commit begins.",
+      "expected": ["reread the worktree and Git", "treat the ticket as uncommitted", "release no successor until the full root gate is repeated"],
+      "forbidden": ["infer a checkpoint from completed proof", "trust worker narration", "skip root diff inspection"]
+    },
+    {
+      "id": "lost-checkpoint-response",
+      "prompt": "The root commit command may have succeeded, but its response was lost.",
+      "expected": ["reread Git before retrying", "accept exactly one scoped checkpoint reachable from the pinned baseline whose message names the Parent and exact tickets"],
+      "forbidden": ["blindly retry the commit", "trust worker narration", "write duplicate durable run state"]
+    },
+    {
+      "id": "repository-keyed-recovery-commit",
+      "prompt": "The in-memory ledger is lost after a checkpoint response disappears in one repository of a two-repository graph.",
+      "expected": ["rebuild repository entries from authoritative sources and Git", "record the uniquely rediscovered SHA in that repository checkpoint sequence and recovery_commits", "release successors only from the reconstructed repository-scoped checkpoint"],
+      "forbidden": ["create a recovery-only commit", "recover from worker narration", "write a ledger file"]
+    },
+    {
+      "id": "multi-repository-wave-partial-checkpoint-settlement",
+      "prompt": "A two-repository wave passes proof. Root confirms the checkpoint in repository A, but settlement is interrupted before repository B has a checkpoint; Git later confirms that B has no matching commit and its work may be missing.",
+      "expected": ["retain repository A's confirmed earlier checkpoint", "reconstruct both repository entries from Git and classify repository B's checkpoint as not yet created rather than a failed checkpoint commit", "revalidate intact repository B work or recreate missing work through a unique fresh implementer in B's isolated integration worktree", "rerun combined deterministic proof across every repository range and create only B's missing scoped checkpoint", "release no successor until every repository checkpoint and combined proof settle"],
+      "forbidden": ["roll back or rewrite repository A's confirmed commit", "duplicate repository A's checkpoint", "release a successor from repository A alone", "persist settlement state"]
+    },
+    {
+      "id": "interrupted-or-dirty-integration",
+      "prompt": "Root is interrupted during staging and later finds ambiguous uncommitted state overlapping the ticket scope.",
+      "expected": ["leave ambiguous state untouched", "block the affected ticket", "reconstruct only from baseline, tracker, Parent, tickets, Git, and unique root checkpoints"],
+      "forbidden": ["guess ownership", "discard the state", "commit ambiguous bytes", "create duplicate workflow bookkeeping"]
+    },
+    {
+      "id": "cumulative-parent-review-mechanism",
+      "prompt": "All graph checkpoints and deterministic proof are settled at one final revision.",
+      "expected": ["compare the complete Parent PRD directly to the full cumulative diff", "launch fresh Spec and Standards reviewers in parallel", "complete both independent waits and grant coordinator approval only when no verified blocker or required-proof gap remains"],
+      "forbidden": ["gate acceptance on the raw reviewer verdict", "review only the last child", "accept a generic PASS", "reuse a reviewer context", "create durable review lifecycle state"]
+    },
+    {
+      "id": "repository-ranges-in-proof-review-and-handoff",
+      "prompt": "A two-repository graph is ready for final proof, reviewer briefs, and handoff.",
+      "expected": ["pin an exact baseline..final range for each repository", "give the reviewer the repository-keyed baselines, final checkpoints, ranges, and proof", "report each integration worktree, checkpoint and recovery commit, and final range in handoff"],
+      "forbidden": ["review only one repository", "omit a repository range from the reviewer brief", "persist the in-memory ledger as handoff state"]
+    },
+    {
+      "id": "failed-final-review",
+      "prompt": "The Standards reviewer fails or times out.",
+      "expected": ["block Parent completion", "report the failed Standards review"],
+      "forbidden": ["replace the reviewer with root self-review", "mark the Parent complete"]
+    },
+    {
+      "id": "material-repair-reviews-new-revision",
+      "prompt": "A final reviewer reports a material finding in affected existing ticket #33; root independently establishes its Authority, Trigger, Impact, and Minimal repair without widening the Parent outcome.",
+      "expected": ["classify the finding as a verified blocker only after all four facts are established", "assign ticket #33 to a unique fresh implementer with no Git authority", "have root integrate the worker repair, rerun affected target-state and combined deterministic proof, and create a new scoped checkpoint", "launch only the affected fresh targeted lens on the new revision"],
+      "forbidden": ["dispatch repair from the reviewer label alone", "have root implement the material defect", "reuse either old approval", "record a review lifecycle", "create a durable completion artifact"]
+    },
+    {
+      "id": "graph-delivery-stops-before-remote-git",
+      "prompt": "All local graph checkpoints and cumulative acceptance approve, but push and PR were not separately authorized.",
+      "expected": ["report local checkpoint state", "perform no push or PR"],
+      "forbidden": ["infer push authority", "open a PR", "mutate the tracker without authority"]
+    },
+    {
+      "id": "cumulative-final-review-repair-loop",
+      "prompt": "The cumulative graph-final Standards reviewer reports two findings with established Authority, Trigger, Impact, and Minimal repair plus one unsupported preference labeled BLOCK; the targeted reviewer later reports another finding for which root independently establishes the same four facts.",
+      "expected": [
+        "consolidate all verified current-review blockers into one graph-final repair batch",
+        "treat the unsupported preference as an observation and perform no repair for it",
+        "dispatch each affected existing ticket once through a unique fresh Gitless implementer",
+        "settle updated checkpoints and cumulative proof before only the affected fresh targeted lens",
+        "continue the repair and targeted Review loop until approval"
+      ],
+      "forbidden": [
+        "run per-ticket delivery Review",
+        "treat the reviewer label as repair authority",
+        "stop because of reviewer count alone",
+        "carry approval for the changed impact cone",
+        "persist review bookkeeping"
+      ]
+    }
+  ]
+}

package/internal-workflow/skills/tickets-orchestrator/references/delegate-integrate.md

@@ -0,0 +1,83 @@
+# Delegate And Integrate
+
+## Fresh child ownership
+
+Launch one unique fresh `implementer` per child. Root never keeps a ticket for
+itself, splits one child among workers, or reuses a prior worker context. Begin
+the assignment with `Assigned role: implementer` and provide the complete
+ticket, complete Parent PRD, repository policy, bounded write scope and
+exclusions, blocker state, proof, stop conditions, concurrent-work warning,
+and no-Git boundary.
+
+Record a non-empty identity and complete the wait for that same worker. Require
+changed files, local proof, skipped checks, risks, Decision Deltas, overlap, and
+blockers. Worker timeout, failure, missing identity, incomplete wait, scope
+drift, or any staging or commit attempt blocks its ticket. Root must not finish
+the child on the worker's behalf.
+
+## Frontier and waves
+
+Build readiness from authoritative native blockers and the current root
+checkpoints. Before scheduling, resolve every ticket to one stable repository
+key and use only that repository's in-memory integration-worktree, baseline,
+and checkpoint entry. A successor stays blocked until its prerequisites have a
+confirmed checkpoint in the correct repository entries and current combined
+proof across every affected repository range.
+
+Tickets may share one wave only when their owners, write scopes, public seams,
+proof resources, migrations, generated artifacts, and source-of-truth
+contracts are all disjoint. Any uncertainty or overlap forces strict
+sequencing. Wait for the whole disjoint wave before integration.
+
+## Root integration gate
+
+The mandatory order is: worker completion, root diff inspection, rewritten
+target-state checks, combined deterministic proof, root checkpoint commit,
+then successor release.
+
+After every wave, root:
+
+1. verifies each worker identity, completed wait, report, and local proof;
+2. inspects the complete integrated diff and status in every affected
+   repository-keyed integration worktree without discarding unrelated or
+   ambiguous work;
+3. confirms every changed file belongs to exactly one authorized child scope;
+4. runs only the rewritten targeted coordinator checks and the smallest
+   affected combined deterministic check on settled bytes;
+5. creates no new checkpoint in an unsettled repository and releases no
+   successor on any failure or stale result, while retaining any earlier
+   repository checkpoint already confirmed for the wave; and
+6. after all gates pass, creates one scoped root checkpoint in each affected
+   repository whose message names the Parent and exact child or wave issues,
+   confirms each from Git, appends each SHA to the matching in-memory checkpoint
+   sequence, and only then recalculates the frontier.
+
+Proof briefs must name the repository key, integration worktree, baseline,
+current checkpoint, and exact range being exercised. Never combine bytes from
+different repositories into an implied single Git range. The coordinator may
+aggregate proof outcomes in memory, but must not persist the integration ledger
+or create bookkeeping commits.
+
+## Multi-repository wave settlement
+
+Checkpoint settlement is per repository even though successor release is per
+wave. If settlement is interrupted after some repositories commit, keep every
+confirmed earlier checkpoint and reconstruct all affected repository entries
+from Git. Never roll back, rewrite, or duplicate a confirmed commit to make the
+wave appear atomic.
+
+For each repository without a confirmed checkpoint, first use Git to determine
+whether its authorized work is intact. No matching commit means its checkpoint
+is not yet created; it is not by itself a failed checkpoint commit. Revalidate
+intact work in that repository's isolated integration worktree. If work is
+missing, assign a unique fresh implementer to recreate it under the original
+ticket scope and no-Git boundary, then integrate it there. Rerun affected
+target-state checks and the combined deterministic proof over every repository
+range before root creates only the missing scoped checkpoints. Release no
+successor until every repository checkpoint for the wave is confirmed and the
+combined proof is current. Record no settlement state outside the ephemeral
+repository-keyed ledger.
+
+Root never edits a repair. Every authorized in-scope defect returns to a unique
+fresh implementer, then root reruns affected proof. A change to product behavior, ownership, scope, or ticket
+boundaries is a Decision Delta and stops integration.

package/internal-workflow/skills/tickets-orchestrator/references/finish-delivery.md

@@ -0,0 +1,69 @@
+# Finish And Deliver
+
+## Cumulative Parent acceptance
+
+Start only after every child has a confirmed root checkpoint, every blocker is
+settled, every repository-keyed integration worktree is clean, and required
+deterministic proof is current on every final checkpoint.
+
+1. In the in-memory ledger, pin each repository's final checkpoint and exact
+   `baseline..final` range. Compare the complete Parent PRD directly against the
+   full cumulative diff for every range. Cover every Parent obligation,
+   exclusion, child interaction, and failure path.
+2. Launch one fresh `spec_reviewer` and one fresh `standards_reviewer` in
+   parallel. Give both briefs the
+   repository-keyed map of integration worktrees, baselines, final checkpoints,
+   exact final ranges, and proof plus the Parent PRD, child graph, and repository
+   policy. Require Spec to check Parent-obligation fidelity and Standards to
+   check correctness and cleanup, each returning `APPROVE` or `BLOCK`.
+3. Capture both non-empty identities and require both completed waits. Their
+   outputs must tie findings to every pinned final range.
+   Generic `PASS`, a partial wait, missing Parent coverage, or a failed or
+   timed-out reviewer blocks Parent completion. The reviewer verdict is
+   evidence, not authority: approval exists when the completed independent
+   review has no verified blocker or required-proof gap. A blocker requires a
+   concrete defect or proof gap causally linked to a Parent obligation,
+   existing invariant, or mandatory repository rule; other findings are
+   non-blocking observations.
+4. Verify findings against the cumulative diff. Before repair dispatch,
+   independently establish **Authority**, **Trigger**, **Impact**, and
+   **Minimal repair**. Only a finding with all four facts is a verified blocker
+   eligible for repair. For every authorized in-scope defect,
+   assign a unique fresh implementer to the affected existing ticket under its
+   original bounded assignment and explicit no-Git boundary. Root integrates
+   the worker result, reruns affected target-state checks and combined
+   deterministic proof, creates a new scoped checkpoint, pins that revision,
+   and launches only the affected fresh targeted lens: Spec for Parent behavior,
+   Standards for correctness or mandatory rules, and both for mixed or
+   unisolatable repairs. Root never
+   edits the repair. Before relaunch, update the affected in-memory final
+   checkpoint and range. Give the reviewer the previous reviewed checkpoint
+   as baseline, the repair delta, repaired blockers, directly affected Parent
+   obligations and cross-ticket seams, and current affected proof. Review only
+   the repair delta and directly affected Parent obligations. Untouched parts of
+   the cumulative result retain their approval. Before dispatch, consolidate
+   every verified blocker from the current review into one graph-final repair batch and
+   dispatch each affected ticket once for that revision. Repeat the graph-final repair and targeted
+   Review loop until approval; reviewer count is never a stop condition, and
+   in-scope repair requires no new user confirmation. Use a complete cumulative
+   Review again only when the repair cannot be isolated from previously approved
+   scope.
+5. No per-ticket delivery Review runs for graph children. Never substitute the
+   last child diff, checkpoint messages, child reports,
+   tracker state, or root self-review for the completed approval.
+
+Checking the reusable launch contract with deterministic tests is not the real
+final activation. Activate reviewers only for the graph's settled final
+revision after all source and consumer synchronization owned by that graph is
+complete.
+
+## Delivery boundaries
+
+After coordinator approval from the completed independent evidence, report
+every repository key, integration worktree,
+baseline, checkpoint and recovery-commit SHA, final checkpoint, exact final
+range, direct Parent coverage, deterministic proof, reviewer identities and
+verdicts, skipped checks, and residual risk. This is a report, not durable
+workflow state. Reconcile tracker state only when explicitly authorized. Push,
+PR, merge, and release each require separate authority; local graph acceptance
+grants none of them.

package/internal-workflow/skills/tickets-orchestrator/references/stop-completion.md

@@ -0,0 +1,63 @@
+# Stop And Completion
+
+## Fail-closed conditions
+
+Create no new checkpoint in an unsettled repository and release no successor
+when any of these is true. Retain any earlier repository checkpoint already
+confirmed for a partially settled multi-repository wave:
+
+- Parent authority, a ticket body, native blocker state, repository policy,
+  owner, write scope, exclusion, or deterministic proof is missing or
+  contradictory;
+- a child needs a new product decision, changed ownership, changed scope, or a
+  changed ticket boundary;
+- worker identity is missing or reused, its wait is incomplete, it times out or
+  fails, its output overlaps another owner, or it attempts a Git action;
+- supposedly parallel children share an owner, write scope, public seam, proof
+  resource, migration, generated artifact, or source-of-truth contract;
+- the root diff contains unexplained or dirty overlapping bytes;
+- target-state or combined deterministic proof is missing, failed, or stale;
+- a ticket, checkpoint, proof result, or final range cannot be assigned to
+  exactly one repository-keyed in-memory integration entry;
+- checkpoint ownership, message, scope, or commit result is ambiguous;
+- the final reviewer is missing, incomplete, failed, timed out, tied to another
+  revision, or does not approve; or
+- work is interrupted while index or worktree ownership is uncertain.
+
+## Recovery
+
+Rebuild the lost in-memory repository ledger only from authoritative repository
+identity, each integration worktree and pinned baseline, Parent PRD, tracker,
+tickets, Git, and unique root checkpoints. Worker narration and uncommitted
+state are not completion evidence. Recovery creates no additional durable
+workflow record.
+
+After a lost checkpoint response, reread Git in the affected repository before
+any retry. Recover only one commit reachable from that repository's pinned
+baseline with the expected Parent-and-ticket message and exact authorized
+scope. Append that SHA to the matching in-memory checkpoint sequence and
+`recovery_commits`; never create a recovery-only commit. More than one match
+blocks the ticket. If no match exists and Git confirms no checkpoint was
+created, classify that repository checkpoint as not yet created, not as a
+failed checkpoint commit. Preserve confirmed checkpoints in the other
+repositories, then revalidate intact authorized work or recreate missing work
+through a unique fresh implementer in the affected isolated integration
+worktree. Root reruns affected checks and combined proof and creates only the
+missing checkpoint. Leave ambiguous staged or unstaged bytes untouched; do not
+guess, discard, stage, commit, or release a successor. No successor is released
+until every repository checkpoint and the combined deterministic proof settle.
+
+## Completion standard
+
+The graph is complete only when every child has one confirmed root checkpoint,
+all blockers are settled, every final repository worktree boundary is clean,
+deterministic proof is current for every exact `baseline..final` range, the
+complete Parent PRD is proved directly against those full cumulative diffs, and
+one fresh Spec reviewer plus one fresh Standards reviewer completed on the
+repository-keyed range map with approval for both lenses. A child
+checkpoint, local test result, tracker status, worker report, generic verdict,
+or review of only the final child cannot establish Parent completion.
+
+Report any skipped check, Decision Delta, unresolved overlap, remote Git action,
+or tracker action honestly. Never infer push or PR authority from local graph
+completion.