devlyn-cli 2.10.1 → 3.0.1

package/AGENTS.md

@@ -4,7 +4,7 @@ devlyn-cli installs `/devlyn:ideate` (optional) and `/devlyn:resolve` (required)
 
 ## North Star
 
-This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. The harness must measurably out-earn bare prompting, and every added layer (pair mode, probes, gates) must out-earn the layer below it. When rules below conflict or feel ambiguous in context, resolve toward this goal.
+This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. When rules below conflict or feel ambiguous in context, resolve toward this goal.
 
 ## Core principles
 
@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
-6. **Optimized** — efficient on the resource that matters (wall-time, tokens, attention, cognitive load on the next reader). "Slower but more thoughtful" is not free.
+6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
 
 Three discipline rules govern HOW the principles are applied:
@@ -36,9 +36,13 @@ ideate (optional)  ->  resolve  ->  ship
 
 Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not duplicate.
 
-Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (IMPLEMENT/CLEANUP + primary VERIFY judge) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md. If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); legacy executor (with optional separate worker/primary/pair profiles) uses the canonical skill's orchestrator-supported default, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine; no pin / no file → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
-Conversational handoff + loop engineering (default entry): the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get spec amendment + re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review` and the drain continues.
+Conversational entry: Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval.
+
+Use full `/devlyn:resolve` for material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes, or inconclusive inspection/checks. Counts of lines, files or words alone do not establish low risk. Explicit resolve (even small), formal spec workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If new risk appears mid-edit, preserve the delta in the full run's scope/evidence; do not hide it in a new baseline or reconfirm existing authorization.
+
+Full-route handoff + loop engineering: the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: before the first full run, commit the scoped queue-item delta (when applicable) and linked spec bundle; findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get a committed spec amendment before re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review`; commit every terminal `[x]` / `[F]` transition before advancing. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
 
 ## Subtractive-First Editing
 
@@ -103,13 +107,8 @@ Exclude vague claims. They produce vague fixes.
 - Never revert user changes unless explicitly asked.
 - Use `rg` / `rg --files` for search.
 - Keep changes scoped to the task; stop when the core request is answered or the change is verified.
-- For installer or skill edits inside the devlyn-cli source repo, run `bash scripts/lint-skills.sh`.
 - Treat the project's own `docs/VISION.md`, `docs/ROADMAP.md`, `docs/roadmap/**`, and any local `AGENTS.md` / `CLAUDE.md` overrides as authoritative when present.
 
-### Evolution loop — orchestrator-neutral continuation
-
-Any orchestrating engine (Claude, Codex, or future) continuing harness / loop-engineering work cold-starts from `autoresearch/HANDOFF.md` (read order inside), then `autoresearch/NORTH-STAR.md` (goal + floor/ceiling contracts + ops-test gates) and `autoresearch/PRINCIPLES.md`. Instruments and gates are scripts + files, never model memory. The pair partner is the strongest available OTHER engine — the protocol is direction-symmetric (iter-0060). On any model/version change, re-certify engine seats with the seat-fitness instrument before re-pinning `.devlyn/engines.json` (NORTH-STAR ceiling contract; iter-0064).
-
 ## Communication
 
 - Lead with objective evidence before opinion.

package/CLAUDE.md

@@ -4,7 +4,7 @@ devlyn-cli installs `/devlyn:ideate` (optional) and `/devlyn:resolve` (required)
 
 ## North Star
 
-This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. The harness must measurably out-earn bare prompting, and every added layer (pair mode, probes, gates) must out-earn the layer below it. When rules below conflict or feel ambiguous in context, resolve toward this goal.
+This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. When rules below conflict or feel ambiguous in context, resolve toward this goal.
 
 ## Core principles
 
@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
-6. **Optimized** — efficient on the resource that matters (wall-time, tokens, attention, cognitive load on the next reader). "Slower but more thoughtful" is not free. Each layer of composition or process must beat the simpler baseline.
+6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
 
 Three discipline rules govern HOW the principles are applied:
@@ -39,26 +39,30 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 
 | Role | Default | Manual override |
 |---|---|---|
-| Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md). Measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when the project carried the devlyn AGENTS.md (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4) | switch CLIs; the file artifacts (spec/queue/state) carry over |
-| Executor — IMPLEMENT/CLEANUP + primary VERIFY judge; PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
+| Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md) | switch CLIs; the file artifacts (spec/queue/state) carry over |
+| Legacy executor — worker/primary unless separately profiled; PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin | canonical skill's orchestrator-supported default | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
 | Pair judge — default for VERIFY; conditional for risk probes | first available OTHER engine (claude↔codex) | `/devlyn:engines pair <name>,...`; `--no-pair` opts out |
 
 `/devlyn:engines` with no args shows the current role table, detected engines, and how to pin or clear — the pins live in `.devlyn/engines.json`.
 
-`.devlyn/engines.json` is machine-local — not committed, not archived. Pins are promises: a pinned unavailable engine stops with `BLOCKED:<engine>-unavailable`; a name without a `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines (GLM, pi-agent backends) plug in by shipping an adapter file — no skill changes. Codex BUILD/IMPLEMENT and PLAN-pair remain research-only paths behind explicit `--engine codex`.
+`.devlyn/engines.json` is machine-local — not committed, not archived. Pins are promises: a pinned unavailable engine stops with `BLOCKED:<engine>-unavailable`; a name without a `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines (GLM, pi-agent backends) plug in by shipping an adapter file — no skill changes.
 
-**The executor pin binds the orchestrator in plain conversation too, not only inside a skill run.** When you would do implementation work directly and executor is pinned to a non-default engine, route that work through the pin — run it via `/devlyn:resolve` (which reads the pin at PHASE 0), or delegate to that engine — instead of editing as `claude`. No pin / no `.devlyn/engines.json` → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+**The executor pin binds the orchestrator in plain conversation too, not only inside a skill run.** When you would do implementation work directly and executor is pinned to a non-default engine, route that work through the pin — run it via `/devlyn:resolve` (which reads the pin at PHASE 0), or delegate to that engine. No pin / no `.devlyn/engines.json` → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
-### Conversational handoff + loop engineering — the default entry for all work
+### Conversational entry + full-route handoff
 
-The user does not invoke skills manually; the orchestrating model does. Small tasks: invoke `/devlyn:resolve "<goal>"` directly. Large tasks agreed in conversation:
+Before writes, inspect requested files and relevant callers/tests. Default to direct execution only for clear, local, reversible, low-risk work with a decisive existing or small task-specific acceptance check. Preserve requested behavior, scope, explicit constraints and the executor pin; make scoped edits, run required checks, review the final diff, and report changes with evidence. One concise route/check explanation suffices; ordinary direct work needs no spec, pipeline state, phase workers or extra approval.
+
+Use full `/devlyn:resolve` for material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes, or inconclusive inspection/checks. Counts of lines, files or words alone do not establish low risk. Explicit resolve (even small), formal spec workflows and queue drains retain all canonical phases, independent verification, pins and failure handling. If new risk appears mid-edit, preserve the delta in the full run's scope/evidence; do not hide it in a new baseline or reconfirm existing authorization.
+
+The user does not invoke skills manually; the orchestrating model does. Large tasks agreed in conversation:
 
 1. Write the agreed contract to `docs/specs/<id>/spec.md` (+ `spec.expected.json` when mechanical verifications exist). Always a spec file for large work — a written spec is the user's reviewed contract; free-form large now assumes-and-logs instead of halting (zero-scope-signal goals still halt to ideate).
 2. Present a one-screen plan-contract summary — the user's single review checkpoint, BEFORE the pipeline starts.
-3. On go-ahead, invoke `/devlyn:resolve --spec <path>` hands-free to completion.
-4. **Per-task outer loop**: read the terminal verdict. PASS → done. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through durable artifacts (spec, findings, run archive), never conversation memory.
+3. On go-ahead, commit the scoped queue-item delta (when applicable) and linked spec bundle, then invoke `/devlyn:resolve --spec <path>` hands-free to completion.
+4. **Per-task outer loop**: read the terminal verdict. PASS → done. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), commit that scoped amendment, then re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through committed durable artifacts (spec, findings, run archive), never conversation memory.
 
-**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, run the outer loop, mark `[x]` done or `[F]` blocked with reason, continue; a blocked item never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review` and move on. End the drain with a per-item verdict + assumptions report.
+**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, commit the scoped owner baseline, run the outer loop, mark `[x]` done or `[F]` blocked with reason, commit that terminal transition, then continue; a blocked item never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review`, commit it, and move on. End the drain with a per-item verdict + assumptions report. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
 
 ## Subtractive-first editing — perfection = nothing left to remove
 <!-- runtime-principles:section=subtractive-first:begin -->
@@ -127,10 +131,6 @@ This rule exists because LLMs (including you) are trained to be helpful, compreh
 **Stopping rule.** A task is done when the user's stated goal is closed AND no off-path work was added. If you find yourself hesitating because "I should also do Z" — Z is drift. Note it for follow-up, do not execute.
 <!-- runtime-principles:section=goal-locked:end -->
 
-## Evolution loop — orchestrator-neutral continuation
-
-Any orchestrating engine (Claude, Codex, or future) continuing harness / loop-engineering work cold-starts from `autoresearch/HANDOFF.md` (read order inside), then `autoresearch/NORTH-STAR.md` (goal + floor/ceiling contracts + ops-test gates) and `autoresearch/PRINCIPLES.md`. Instruments and gates are scripts + files, never model memory. The pair partner is the strongest available OTHER engine — the protocol is direction-symmetric (iter-0060). On any model/version change, re-certify engine seats with the seat-fitness instrument before re-pinning `.devlyn/engines.json` (NORTH-STAR ceiling contract; iter-0064).
-
 ## Error Handling Philosophy
 
 **No silent fallbacks.** Handle errors explicitly and show the user what happened.
@@ -158,7 +158,7 @@ A finding without one of these forms is excluded. Vague findings produce vague f
 
 ## Codex invocation
 
-When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex`, default VERIFY pair, or conditional risk-probe routing), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If Codex is required and unavailable, stop with `BLOCKED:codex-unavailable` and setup guidance.
+For Codex model selection, receipts, isolation and availability, follow the invoked skill's sibling `_shared/codex-config.md` and `_shared/engine-preflight.md` (`config/skills/_shared/` in this repository).
 
 ## Working Mode
 
@@ -169,7 +169,7 @@ When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine cod
 
 ## Skill Boundary Policy
 
-The runtime pipeline surface is two skills — `/devlyn:resolve` and `/devlyn:ideate` — plus `/devlyn:design-ui` for creative UI exploration and two utilities added on explicit user direction: `/devlyn:engines` (engine-role config, iter-0038) and `/devlyn:queue` (intent-queue status/add/drain, iter-0039). `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, or `/devlyn:team-resolve` surfaces. `/devlyn:design-ui` spawns a 5-specialist design team (Creative Director, Product Designer, Visual Designer, Interaction Designer, Accessibility Designer). `/devlyn:reap` is an optional user-invoked skill in `optional-skills/`; resolve never delegates to it.
+The runtime pipeline surface is two skills — `/devlyn:resolve` and `/devlyn:ideate` — plus `/devlyn:design-ui` for creative UI exploration and two utilities: `/devlyn:engines` (engine-role config) and `/devlyn:queue` (intent-queue status/add/drain). `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, or `/devlyn:team-resolve` surfaces. `/devlyn:design-ui` spawns a 5-specialist design team (Creative Director, Product Designer, Visual Designer, Interaction Designer, Accessibility Designer). `/devlyn:reap` is an optional user-invoked skill in `optional-skills/`; resolve never delegates to it.
 
 Browser validation runs directly from BUILD_GATE using whichever toolchain is available (Chrome MCP, Playwright, or curl-tier fallback) — there is no separate `/devlyn:browser-validate` skill.
 

package/README.md

@@ -27,7 +27,7 @@ If devlyn-cli saved you time, [give it a star](https://github.com/fysoul17/devly
 npx devlyn-cli
 ```
 
-That's it. The installer opens with a single **agent selector** — pick any combination of **Claude Code**, **Codex CLI**, **oh-my-pi (omp)**, **Pi**, or **Grok Build CLI**, and devlyn installs into every one you choose in a single pass. Claude Code and any agent already present on your machine are pre-checked, so the common case is just Enter. Skill-capable agents receive the `devlyn:resolve`, `devlyn:ideate`, and `devlyn:design-ui` skills — plus the `devlyn:engines` and `devlyn:queue` utilities — in the directory each one loads from: Codex → `~/.codex/skills/`, Grok → `~/.grok/skills/`, while **omp and Pi share `~/.agents/skills/`** — the cross-agent standard both read — so the bundle is written there once, not duplicated per agent. In Codex / omp / Pi, invoke them as skills (`$devlyn:resolve`, `$devlyn:ideate`, `$devlyn:design-ui`); in Claude Code and Grok Build CLI they're slash commands (`/devlyn:resolve`). Run it again anytime to update. (`npx devlyn-cli -y` installs the Claude core non-interactively; `npx devlyn-cli agents <cli>` adds one agent later.)
+That's it. The installer opens with a single **agent selector** — pick any combination of **Claude Code**, **Codex CLI**, **oh-my-pi (omp)**, **Pi**, or **Grok Build CLI**, and devlyn installs into every one you choose in a single pass. Claude Code and any agent already present on your machine are pre-checked, so the common case is just Enter. Skill-capable agents receive the `devlyn:resolve`, `devlyn:ideate`, and `devlyn:design-ui` skills — plus the `devlyn:engines` and `devlyn:queue` utilities — in the directory each one loads from: Codex → `~/.codex/skills/`, Grok → `~/.grok/skills/`, while **omp and Pi share `~/.agents/skills/`** — the cross-agent standard both read — so the bundle is written there once, not duplicated per agent. In Codex / omp / Pi, invoke them as skills (`$devlyn:resolve`, `$devlyn:ideate`, `$devlyn:design-ui`); in Claude Code and Grok Build CLI they're slash commands (`/devlyn:resolve`). Rerunning refreshes skills for selected agents, preserves existing AGENTS.md without legacy managed markers (legacy appended blocks are still cleaned up), and replaces CLAUDE.md when Claude Code is selected. Use the bundled AGENTS.md template path printed by the installer to compare and merge relevant shared runtime instructions into your preserved AGENTS.md, retaining your content and keeping engine-specific instructions distinct. (`npx devlyn-cli -y` installs the Claude core non-interactively; `npx devlyn-cli agents <cli>` adds one agent later.)
 
 ---
 
@@ -62,7 +62,7 @@ Skip ideate entirely if you have a spec or just want to describe the work — `/
 
 ### Step 2 — Resolve with `/devlyn:resolve`
 
-Hands-free pipeline for any coding task — bug fix, feature, refactor, debug, modify, PR review. Pass a spec, a free-form goal, or a diff to verify.
+Before writes, inspect requested files and relevant callers/tests. Clear, local, reversible, low-risk conversational edits with a decisive acceptance check run directly, honoring scope, constraints and executor pins; finish required checks and diff review, then report evidence. Material ambiguity, subsystem/design work, security/auth/payment/persistence/concurrency/public-API-contract changes or no decisive check use full `/devlyn:resolve`. Explicit resolve (including small tasks), formal specs and queue drains keep the full workflow below. Pass a spec, a free-form goal, or a diff to verify.
 
 ```
 /devlyn:resolve "fix the login bug"                                # free-form
@@ -81,7 +81,7 @@ PLAN  →  IMPLEMENT  →  BUILD_GATE  →  CLEANUP  →  VERIFY (fresh subagent
 - **VERIFY** runs in a fresh subagent context with no code-mutation tools — findings only, structurally independent.
 - Git checkpoints at every phase for safe rollback. Fix-loop budget shared across BUILD_GATE and VERIFY (`--max-rounds N`, default 4).
 
-Common flags: `--engine claude|codex|auto` (default `claude`), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
+Common flags: `--engine claude|codex|omp` (default: the orchestrator-supported default), `--role-config <path>` (one-run worker/judge profiles, see below), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
 `--pair-verify` and `--no-pair` are mutually exclusive; using both stops with `BLOCKED:invalid-flags`.
 
 Free-form goals that ask for benchmark evidence, pair-evidence, risk-probe
@@ -106,20 +106,44 @@ Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent
 devlyn separates three engine roles:
 
 - **Orchestrator** — the CLI you opened (Claude Code, Codex, or omp) that drives the conversation and loop. The contract is symmetric (`CLAUDE.md` ↔ `AGENTS.md`), so the same phase-gated pipeline runs whichever you launch; the file artifacts (spec, queue, state) carry over if you switch.
-- **Executor** — IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`. PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin.
+- **Executor** (legacy) — the worker for IMPLEMENT / CLEANUP and their repair rounds, and the primary VERIFY judge, unless either is separately profiled (below). Defaults to the orchestrator-supported default. PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin. An absent primary profile follows the legacy executor, not an opt-in worker profile.
 - **Pair judge** — the first available *other* engine, default for VERIFY and conditional for risk probes.
 
-`--engine claude` (default) is the canonical implementation surface for IMPLEMENT, BUILD_GATE, and CLEANUP; PLAN always runs on the orchestrator's native worker. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
+`--engine <name>` sets the legacy executor for one run as an engine-only entry (it clears any lower-precedence profile's model/effort). BUILD_GATE and risk-probe derivation keep their existing routes; PLAN always runs on the orchestrator's native worker. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
 
-Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins, stored machine-local in `.devlyn/engines.json`). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
+Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `role <worker|primary_judge|pair_judge> <JSON object>` / `role <name> clear` manage the pins, stored machine-local in `.devlyn/engines.json`; `clear` removes all legacy and role pins, preserves unrelated keys, and deletes an empty file). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
 
-`--engine codex` routes IMPLEMENT to Codex — research-only at HEAD: iter-0020 closed Codex BUILD/IMPLEMENT below the quality floor on the 9-fixture suite (L2 vs L1 = −3.6, 3/8 gated fixtures cleared the +5 margin floor — release-readiness FAIL); iter-0033g + iter-0034 closed PLAN-pair as research-only with explicit unblock conditions (container/sandbox infra OR production telemetry capturing positive evidence of subagent introspection). Install the Codex CLI (https://platform.openai.com/docs/codex) and pass the flag explicitly to opt in:
+#### Explicit worker and judge profiles
+
+`.devlyn/engines.json` may add a `roles` object with `worker`, `primary_judge`, and `pair_judge` entries. Each entry requires `engine` and accepts an optional exact `model` ID and `effort`; unknown fields, aliases (`default`, `auto`, `opus`, `sonnet`, `fable`, `codex` as a model), null/empty values, and duplicate keys stop with `BLOCKED:invalid-engine-config`. Only the project's own `.devlyn/engines.json` is read — no parent or global lookup. Example (an example, not a default or ranking):
+
+```json
+{
+  "executor": "codex",
+  "pair_judge_priority": ["claude"],
+  "roles": {
+    "worker": {"engine": "codex", "model": "gpt-6-astra", "effort": "xhigh"},
+    "primary_judge": {"engine": "codex", "model": "gpt-6-astra", "effort": "high"},
+    "pair_judge": {"engine": "claude", "model": "claude-fable-5-1", "effort": "medium"}
+  }
+}
+```
+
+`--role-config <path>` supplies the same `{"roles": {...}}` object for one run only, with no other top-level keys; the flag may appear once.
+
+- **Precedence** — an entry replaces the lower one as a whole; model/effort never merge across engines. Worker and primary judge: run `--role-config` entry > `--engine` (engine-only) > project role entry > legacy executor/default. Pair judge: run entry > project entry > `pair_judge_priority` / the OTHER-engine complement. A missing `model`/`effort` keeps that route's current default and is shown as inherited/unresolved.
+- **Boundaries** — `worker` covers IMPLEMENT / CLEANUP and their repair rounds; `primary_judge` and `pair_judge` cover VERIFY only. PLAN stays orchestrator-fixed, BUILD_GATE keeps its existing route, and risk-probe derivation stays outside these controls. OTHER must differ from the primary by engine: an explicit same-engine pair is `BLOCKED:invalid-engine-config`. `--no-pair` is unchanged — explicit solo VERIFY; an unused pair entry is neither dispatched nor availability-checked.
+- **Initial explicit routes** — Codex worker/primary/pair accept exact `model` + `effort` (dispatched as `-m` / `-c model_reasoning_effort=`, validated against the installed Codex CLI's native model metadata for its version). Claude primary/pair judges pass an exact `model` as `--model` and validate native result identity; model-only selection needs no source update for a new ID. Explicit `effort` separately requires the adapter's version/model support declaration. The Claude worker stays the native `Agent` route and is engine-only: explicit `model`/`effort` on a Claude worker is `BLOCKED:unsupported-role-option` — a supported-route boundary, not a claim that Claude cannot implement. Other adapters (omp, grok) are engine-only for their eligible roles.
+- **Errors** — `BLOCKED:unsupported-role-option` names the role, engine and field with guidance; there is no clamp, fallback, substituted model, or weaker retry. An explicitly selected engine (flag, pin, or profile) that is unavailable stops with `BLOCKED:<engine>-unavailable`. A native warning that a requested option was ignored is a failed promise even at exit 0.
+- **Requested vs observed** — `/devlyn:engines` status prints each role's requested engine/model/effort, source and dispatch channel before dispatch; it describes a request and does not prove a native invocation happened. Effective model is reported only with native evidence; a Codex worker receipt binds requested dispatch and leaves effective model unknown. A reported worker model reroute blocks completion even at exit 0. SURFACE_CLOSE inherits native Claude model settings and records the model from its required JSON result. Effective effort stays unknown unless native evidence establishes it — invocation arguments prove dispatch, not provider-internal reasoning.
+
+`--engine codex` routes IMPLEMENT / CLEANUP to Codex as a supported engine-only route (exact model/effort via the profiles above). Historical record: iter-0020 closed Codex BUILD/IMPLEMENT below the quality floor on the 9-fixture suite (L2 vs L1 = −3.6, 3/8 gated fixtures cleared the +5 margin floor — release-readiness FAIL). Separately, PLAN-pair remains research-only: iter-0033g + iter-0034 closed it with explicit unblock conditions (container/sandbox infra OR production telemetry capturing positive evidence of subagent introspection). Install the Codex CLI (https://platform.openai.com/docs/codex) and pass the flag explicitly to opt in:
 
 ```
-/devlyn:resolve "fix the auth bug" --engine codex   # research-only
+/devlyn:resolve "fix the auth bug" --engine codex
 ```
 
-If Codex or Claude is absent when explicitly selected, or OTHER engine is absent under `--pair-verify`, the harness stops with `BLOCKED:<engine>-unavailable` and prints setup guidance. Automatic VERIFY absence is a reported solo route. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
+If an engine is absent when explicitly selected by flag, pin, or role profile, or OTHER engine is absent under `--pair-verify`, the harness stops with `BLOCKED:<engine>-unavailable` and prints setup guidance. Automatic VERIFY absence is a reported solo route. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
 
 ### Benchmark score runs
 

package/benchmark/auto-resolve/results/20260507-f10-f11-tier1-full-pipeline/headroom-gate.json

@@ -0,0 +1,25 @@
+{
+  "run_id": "20260507-f10-f11-tier1-full-pipeline",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 2,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": true,
+  "rows": [
+    {
+      "fixture": "F10-persist-write-collision",
+      "status": "FAIL",
+      "bare_score": 75,
+      "solo_score": 94,
+      "reason": "bare score 75 > 60; solo_claude score 94 > 80"
+    },
+    {
+      "fixture": "F11-batch-import-all-or-nothing",
+      "status": "FAIL",
+      "bare_score": 98,
+      "solo_score": 97,
+      "reason": "bare score 98 > 60; solo_claude score 97 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260507-f10-f11-tier1-full-pipeline/headroom-gate.md

@@ -0,0 +1,10 @@
+# Headroom Gate — 20260507-f10-f11-tier1-full-pipeline
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F10-persist-write-collision | 75 | 94 | FAIL | bare score 75 > 60; solo_claude score 94 > 80 |
+| F11-batch-import-all-or-nothing | 98 | 97 | FAIL | bare score 98 > 60; solo_claude score 97 > 80 |

package/benchmark/auto-resolve/results/20260508-f22-exact-error-headroom/headroom-gate.json

@@ -0,0 +1,18 @@
+{
+  "run_id": "20260508-f22-exact-error-headroom",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": false,
+  "rows": [
+    {
+      "fixture": "F22-cli-ledger-close",
+      "status": "FAIL",
+      "bare_score": 94,
+      "solo_score": 98,
+      "reason": "bare score 94 > 60; solo_claude score 98 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260508-f22-exact-error-headroom/headroom-gate.md

@@ -0,0 +1,9 @@
+# Headroom Gate — 20260508-f22-exact-error-headroom
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F22-cli-ledger-close | 94 | 98 | FAIL | bare score 94 > 60; solo_claude score 98 > 80 |

package/benchmark/auto-resolve/results/20260508-f26-headroom/headroom-gate.json

@@ -0,0 +1,18 @@
+{
+  "run_id": "20260508-f26-headroom",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": false,
+  "rows": [
+    {
+      "fixture": "F26-cli-payout-ledger-rules",
+      "status": "FAIL",
+      "bare_score": 25,
+      "solo_score": 98,
+      "reason": "solo_claude score 98 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260508-f26-headroom/headroom-gate.md

@@ -0,0 +1,9 @@
+# Headroom Gate — 20260508-f26-headroom
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F26-cli-payout-ledger-rules | 25 | 98 | FAIL | solo_claude score 98 > 80 |

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-cli-quote-tax-rules/l2_risk_probes/result.json

@@ -0,0 +1,28 @@
+{
+  "fixture": "F16-cli-quote-tax-rules",
+  "arm": "l2_risk_probes",
+  "run_id": "20260507-f16-riskprobes-v15-pricing-diagnostic",
+  "disqualifier": false,
+  "verify_score": 1.0,
+  "commands_passed": 4,
+  "commands_total": 4,
+  "diff_bytes": 8961,
+  "files_changed": 2,
+  "elapsed_seconds": 1164,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F23-cli-fulfillment-wave/l2_risk_probes/result.json

@@ -0,0 +1,28 @@
+{
+  "fixture": "F23-cli-fulfillment-wave",
+  "arm": "l2_risk_probes",
+  "run_id": "20260508-f23-riskprobes-v17-rollback-probe",
+  "disqualifier": false,
+  "verify_score": 1.0,
+  "commands_passed": 3,
+  "commands_total": 3,
+  "diff_bytes": 13562,
+  "files_changed": 2,
+  "elapsed_seconds": 1805,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS_WITH_ISSUES",
+  "verify_verdict": "PASS_WITH_ISSUES",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F25-cli-cart-promotion-rules/l2_risk_probes/result.json

@@ -0,0 +1,30 @@
+{
+  "fixture": "F25-cli-cart-promotion-rules",
+  "arm": "l2_risk_probes",
+  "run_id": "20260509-f25-cartprobe-v2",
+  "disqualifier": false,
+  "oracle_disqualifier": false,
+  "oracle_findings_count": 0,
+  "verify_score": 1.0,
+  "commands_passed": 4,
+  "commands_total": 4,
+  "diff_bytes": 12108,
+  "files_changed": 2,
+  "elapsed_seconds": 1177,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260511-f12-webhook-headroom/headroom-gate.json

@@ -0,0 +1,28 @@
+{
+  "run_id": "20260511-f12-webhook-headroom",
+  "rule": "at least 1 candidate fixtures; each must satisfy bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, with both baseline arms evidence-complete",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 1,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "fixture_count_ok": true,
+  "avg_bare_headroom": -25.0,
+  "min_bare_headroom": -25,
+  "avg_solo_headroom": -19.0,
+  "min_solo_headroom": -19,
+  "rows": [
+    {
+      "fixture": "F12-webhook-raw-body-signature",
+      "status": "FAIL",
+      "bare_score": 85,
+      "solo_score": 99,
+      "bare_headroom": -25,
+      "solo_headroom": -19,
+      "reason": "bare score 85 > 60; solo_claude score 99 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f12-webhook-headroom/headroom-gate.md

@@ -0,0 +1,15 @@
+# Headroom Gate — 20260511-f12-webhook-headroom
+
+Verdict: **FAIL**
+
+Fixtures passed: 0/1 (minimum required: 1)
+
+Rule: at least 1 fixtures; bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, both baseline arms evidence-complete.
+Average bare headroom: -25.0
+Minimum bare headroom: -25
+Average solo headroom: -19.0
+Minimum solo headroom: -19
+
+| Fixture | Bare | Bare headroom | Solo | Solo headroom | Status | Reason |
+|---|---:|---:|---:|---:|---|---|
+| F12-webhook-raw-body-signature | 85 | -25 | 99 | -19 | FAIL | bare score 85 > 60; solo_claude score 99 > 80 |

package/benchmark/auto-resolve/results/20260511-f15-concurrency-headroom/headroom-gate.json

@@ -0,0 +1,28 @@
+{
+  "run_id": "20260511-f15-concurrency-headroom",
+  "rule": "at least 1 candidate fixtures; each must satisfy bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, with both baseline arms evidence-complete",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 1,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "fixture_count_ok": true,
+  "avg_bare_headroom": -39.0,
+  "min_bare_headroom": -39,
+  "avg_solo_headroom": -14.0,
+  "min_solo_headroom": -14,
+  "rows": [
+    {
+      "fixture": "F15-frozen-diff-race-review",
+      "status": "FAIL",
+      "bare_score": 99,
+      "solo_score": 94,
+      "bare_headroom": -39,
+      "solo_headroom": -14,
+      "reason": "bare score 99 > 60; solo_claude score 94 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f15-concurrency-headroom/headroom-gate.md

@@ -0,0 +1,15 @@
+# Headroom Gate — 20260511-f15-concurrency-headroom
+
+Verdict: **FAIL**
+
+Fixtures passed: 0/1 (minimum required: 1)
+
+Rule: at least 1 fixtures; bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, both baseline arms evidence-complete.
+Average bare headroom: -39.0
+Minimum bare headroom: -39
+Average solo headroom: -14.0
+Minimum solo headroom: -14
+
+| Fixture | Bare | Bare headroom | Solo | Solo headroom | Status | Reason |
+|---|---:|---:|---:|---:|---|---|
+| F15-frozen-diff-race-review | 99 | -39 | 94 | -14 | FAIL | bare score 99 > 60; solo_claude score 94 > 80 |

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/F21-cli-scheduler-priority/l2_risk_probes/result.json

@@ -0,0 +1,32 @@
+{
+  "fixture": "F21-cli-scheduler-priority",
+  "arm": "l2_risk_probes",
+  "run_id": "20260511-f21-current-riskprobes-v1",
+  "disqualifier": false,
+  "oracle_disqualifier": false,
+  "oracle_findings_count": 0,
+  "verify_score": 1.0,
+  "commands_passed": 3,
+  "commands_total": 3,
+  "diff_bytes": 14846,
+  "files_changed": 2,
+  "elapsed_seconds": 1112,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high",
+      "risk_profile.high_risk",
+      "risk_probes_enabled"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/full-pipeline-pair-gate.json

@@ -0,0 +1,44 @@
+{
+  "run_id": "20260511-f21-current-riskprobes-v1",
+  "rule": "headroom candidates only; bare headroom >= 5; solo_claude headroom >= 5; l2_risk_probes must be evidence-clean, pair_mode true, pair_trigger eligible with a canonical reason, and beat solo_claude by the configured margin",
+  "verdict": "PASS",
+  "fixtures_total": 1,
+  "fixtures_passed": 1,
+  "min_fixtures": 1,
+  "fixture_count_ok": true,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "min_pair_margin": 5,
+  "pair_arm": "l2_risk_probes",
+  "max_pair_solo_wall_ratio": 3.0,
+  "require_hypothesis_trigger": false,
+  "max_observed_pair_solo_wall_ratio": 1.4728476821192054,
+  "avg_pair_margin": 33.0,
+  "avg_pair_solo_wall_ratio": 1.4728476821192054,
+  "rows": [
+    {
+      "fixture": "F21-cli-scheduler-priority",
+      "status": "PASS",
+      "bare_score": 33,
+      "bare_headroom": 27,
+      "solo_score": 66,
+      "solo_headroom": 14,
+      "pair_score": 99,
+      "pair_margin": 33,
+      "pair_mode": true,
+      "pair_trigger_eligible": true,
+      "pair_trigger_reasons": [
+        "complexity.high",
+        "risk.high",
+        "risk_probes.enabled",
+        "spec.solo_headroom_hypothesis"
+      ],
+      "pair_trigger_has_canonical_reason": true,
+      "pair_trigger_has_hypothesis_reason": true,
+      "pair_solo_wall_ratio": 1.4728476821192054,
+      "reason": ""
+    }
+  ]
+}