devlyn-cli 4.3.29 → 4.3.31

package/AGENTS.md

@@ -13,7 +13,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
@@ -27,7 +27,7 @@ Three discipline rules govern HOW the principles are applied:
 ## Quick Start
 
 - `devlyn-ideate` — loop designer and intent queue: `plan <intent or document>` writes a validated loop package, `add` queues its tasks, `status` (or no arguments) reports the queue, `drain` executes it serially.
-- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md` in `.claude/skills/` or `.agents/skills/` (project, else `~`). With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
+- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md`. With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
 - Executor — `devlyn-engines` shows it and pins it in `.devlyn/engines.json`. A pinned executor does the implementation work, direct or drained: when it is not you, delegate to it, and when it is unavailable stop with `BLOCKED:<engine>-unavailable`. Without a pin, you are the executor.
 
 Each skill's `SKILL.md` is the source of truth for its flags and workflow.

package/CLAUDE.md

@@ -13,7 +13,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
@@ -27,7 +27,7 @@ Three discipline rules govern HOW the principles are applied:
 ## Quick Start
 
 - `devlyn-ideate` — loop designer and intent queue: `plan <intent or document>` writes a validated loop package, `add` queues its tasks, `status` (or no arguments) reports the queue, `drain` executes it serially.
-- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md` in `.claude/skills/` or `.agents/skills/` (project, else `~`). With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
+- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md`. With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
 - Executor — `devlyn-engines` shows it and pins it in `.devlyn/engines.json`. A pinned executor does the implementation work, direct or drained: when it is not you, delegate to it, and when it is unavailable stop with `BLOCKED:<engine>-unavailable`. Without a pin, you are the executor.
 
 Each skill's `SKILL.md` is the source of truth for its flags and workflow.

package/bin/engines.js

@@ -1,10 +1,7 @@
 // Engine IDs in the order of devlyn-os-v1/packages/contracts/src/engines.ts. An ID joins only once its
-// channels are confirmed on the real CLI, with that examined version as its floor below; the planner
+// channels are confirmed on the real CLI, with that examined version as its floor; the planner
 // refuses every other ID. CLI binary names (for example agy) are not engine IDs.
-const ENGINE_IDS = Object.freeze([
-  'claude', 'codex', 'grok', 'omp', 'antigravity', 'cursor', 'opencode', 'kimi', 'copilot', 'qwen', 'pi',
-]);
-
+//
 // The versions each channel was examined on. Any newer release, a new major included, is taken as
 // compatible: a version number is not evidence that a channel broke (omp 18 kept both flags devlyn
 // uses), and refusing unexamined majors turned working engines off. Only a version below the examined
@@ -23,18 +20,19 @@ const ENGINE_CAPABILITIES = Object.freeze({
   qwen: { minimum: '0.26.0', executor: false },
   pi: { minimum: '1.4.0', executor: false },
 });
+const ENGINE_IDS = Object.freeze(Object.keys(ENGINE_CAPABILITIES));
 
 function readableVersion(engine, version) {
   return typeof version === 'string'
     && (engine === 'cursor' ? /^\d{4}\.\d{2}\.\d{2}-[0-9a-f]+$/ : /^\d+\.\d+\.\d+$/).test(version);
 }
 
-function supportedVersion(engine, version) {
+// Whether `version` is at least `minimum`, the engine's floor unless a channel names a later examined one.
+function supportedVersion(engine, version, minimum = ENGINE_CAPABILITIES[engine].minimum) {
   if (!readableVersion(engine, version)) return false;
-  const capability = ENGINE_CAPABILITIES[engine];
-  if (engine === 'cursor') return version.slice(0, 10).replace(/\./g, '') >= capability.minimum.slice(0, 10).replace(/\./g, '');
+  if (engine === 'cursor') return version.slice(0, 10).replace(/\./g, '') >= minimum.slice(0, 10).replace(/\./g, '');
   const actual = version.split('.').map(Number);
-  const floor = capability.minimum.split('.').map(Number);
+  const floor = minimum.split('.').map(Number);
   for (let i = 0; i < 3; i++) {
     if (actual[i] !== floor[i]) return actual[i] > floor[i];
   }

package/bin/harness-activation.js

@@ -8,6 +8,10 @@ const history = require('./skill-history.json');
 const { MARKER, marketplaceName, projectionPath, inspectProjection } = require('./codex-projection');
 
 const SKILLS = ['devlyn-ideate', 'devlyn-engines'];
+// The version an engine's run-folder channel was examined on; bin/engines.js keeps the engine's floor. An
+// older version, and Windows (channelGate), keep the plan they had before the channel: only a first task
+// carries the principles.
+const CHANNEL_MINIMUM = { antigravity: '1.5.4', cursor: '2026.11.05-86047df' };
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
 const textValue = (value) => typeof value === 'string' && !value.includes('\0');
 const strings = (value) => Array.isArray(value) && value.every(textValue);
@@ -139,6 +143,10 @@ function discoveryRoots(context, env, config) {
   const roots = [...(context.skillRoots || [])];
   const add = (base, ...parts) => { if (base) roots.push(path.resolve(base, ...parts)); };
   const engine = context.engine;
+  // Antigravity and Cursor search the folders their examined version reads only where they get their run-folder
+  // channel; elsewhere they keep the folders searched before it.
+  const channelled = ['antigravity', 'cursor'].includes(engine) && !channelGate(context);
+  const antigravity = channelled && engine === 'antigravity';
   const native = {
     claude: [env.CLAUDE_CONFIG_DIR || path.join(home, '.claude'), '.claude'],
     codex: [context.accountHome || env.CODEX_HOME || path.join(home, '.codex'), '.agents'],
@@ -153,7 +161,9 @@ function discoveryRoots(context, env, config) {
   }[engine];
   if (engine !== 'codex') add(native[0], 'skills');
   const copilotDefaultHome = !env.COPILOT_HOME || path.resolve(env.COPILOT_HOME) === path.join(home, '.copilot');
-  if (!['claude', 'cursor'].includes(engine) && (engine !== 'copilot' || copilotDefaultHome)) add(engine === 'pi' ? pi.agentsHome : home, '.agents/skills');
+  if (!['claude', 'cursor'].includes(engine) && !antigravity && (engine !== 'copilot' || copilotDefaultHome)) add(engine === 'pi' ? pi.agentsHome : home, '.agents/skills');
+  // The examined Antigravity reads ~/.gemini/skills and its personal folder ~/.gemini/config instead.
+  if (antigravity) { add(home, '.gemini/skills'); add(home, '.gemini/config/skills'); }
   if (['omp', 'opencode', 'grok'].includes(engine)) add(home, '.claude/skills');
   if (engine === 'omp') {
     add(home, '.codex/skills'); add(home, '.agent/skills');
@@ -166,12 +176,24 @@ function discoveryRoots(context, env, config) {
   }
   if (engine === 'copilot') for (const dir of (config?.skillsDirs ?? env.COPILOT_SKILLS_DIRS ?? '').split(',').filter(Boolean)) add(context.cwd, dir);
   if (engine === 'pi') add(context.cwd, '.pi/skills');
+  const walk = [];
   for (let dir = path.resolve(context.cwd); ; dir = path.dirname(dir)) {
+    walk.push(dir);
+    if (fs.existsSync(path.join(dir, '.git'))) break;
+    // Outside any repository the examined Antigravity reads the working directory alone.
+    if (dir === path.dirname(dir)) { if (antigravity) walk.splice(1); break; }
+  }
+  // The examined Cursor also searches nested folders below the working directory, which the planner does not.
+  const cursorFolders = channelled && engine === 'cursor' ? ['.cursor', '.agents', '.claude', '.codex', '.grok'] : [];
+  for (const folder of cursorFolders) add(home, folder, 'skills');
+  if (cursorFolders.length) add(home, '.cursor/skills-cursor');
+  for (const dir of walk) {
+    for (const folder of cursorFolders) add(dir, folder, 'skills');
     if (native[1]) add(dir, native[1], 'skills');
     if (!['claude', 'cursor'].includes(engine)) add(dir, '.agents/skills');
     if (['grok', 'omp', 'opencode', 'copilot'].includes(engine)) add(dir, '.claude/skills');
     if (['omp', 'antigravity'].includes(engine)) add(dir, '.agent/skills');
-    if (fs.existsSync(path.join(dir, '.git')) || dir === path.dirname(dir)) break;
+    if (antigravity) { add(dir, '_agents/skills'); add(dir, '_agent/skills'); }
   }
   return [...new Set(roots)];
 }
@@ -377,10 +399,73 @@ function skillCatalog(release, paths = path) {
   return ['Devlyn session skill catalog (read the absolute file to invoke):',
     ...SKILLS.map((name) => `${name}: ${paths.join(root, name, 'SKILL.md')}`),
     `This session's _shared folder is ${paths.join(root, '_shared')}.`,
-    'Use that absolute folder wherever the Devlyn defaults name _shared/, including the Quick Start references to .claude/skills/ or .agents/skills/.',
+    'Use that absolute folder wherever the Devlyn defaults name _shared/.',
   ].join('\n');
 }
 
+// A skill entry of Antigravity's run folder: the release skill's own name and description lines as
+// written, then the release SKILL.md to follow. A copy cannot be planned (plan files are text and the
+// skills carry scripts), and since 1.5.2 Antigravity skips a link or a manifest entry that leads outside
+// the added folder. Each line must be one complete top-level entry, or the plan fails.
+function antigravitySkill(release, name) {
+  const dir = path.join(release.root, 'config/skills', name);
+  const file = path.join(dir, 'SKILL.md');
+  const text = fs.readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
+  const end = text.startsWith('---\n') ? text.indexOf('\n---\n', 3) : -1;
+  const lines = end < 0 ? [] : text.slice(4, end).split('\n');
+  const header = ['name', 'description'].map((field) => {
+    const at = lines.flatMap((line, index) => (line.startsWith(`${field}:`) ? [index] : []));
+    if (at.length !== 1 || !lines[at[0]].slice(field.length + 1).trim() || /^\s/.test(lines[at[0] + 1] ?? '')) {
+      fail('config-unreadable', { path: file, field }, 1);
+    }
+    return lines[at[0]];
+  });
+  return `---\n${header.join('\n')}\n---\nRead ${file} and follow it as this skill. `
+    + `Its folder, ${dir}, is the skill's folder (DEVLYN_SKILL_DIR), not the folder of this file.\n`;
+}
+
+// The path with the links of its existing part resolved; parts that do not exist yet are kept as given.
+function physicalPath(target) {
+  let parent = path.resolve(target);
+  const missing = [];
+  while (!fs.existsSync(parent)) { missing.unshift(path.basename(parent)); parent = path.dirname(parent); }
+  return path.join(fs.realpathSync(parent), ...missing);
+}
+
+// The reasons for the principles and the skills when neither reaches the session.
+const withheld = (params) => [reason('principles-unavailable', params), reason('skills-unavailable', params)];
+
+// Why an engine keeps the plan it had before its run-folder channel, as the reasons for the principles and the
+// skills when no first task carries them, or null when it gets the channel. The channels were examined on macOS
+// and are not planned on Windows, whatever the version: it cannot show who owns a folder, and an argument that
+// misbehaves there would break a pane. Below the version a channel was examined on, updating the engine gets it.
+function channelGate(context) {
+  if (process.platform === 'win32') return withheld({ detail: 'platform-unexamined' });
+  const minimum = CHANNEL_MINIMUM[context.engine];
+  if (supportedVersion(context.engine, context.version, minimum)) return null;
+  const outdated = reason('engine-version-unsupported', { minimum });
+  return [outdated, outdated];
+}
+
+// The first directory that makes a run-folder channel's `folder`, inside a resolved run directory (physicalPath),
+// unsafe to hand an engine that loads what it finds there, or null. Every existing level from the folder up, the
+// folder included, must be a real directory (a link is not one) of this user or root that no one else can write:
+// another user could put a .git or a folder of their own there later. With `git`, no directory from the folder up
+// may hold a .git entry of any kind: Antigravity 1.5.4 loads the agents and hooks of a Git root above an added
+// folder with no trust check. A level that does not exist yet is skipped; a level lstat cannot read cannot be
+// shown safe. Access-control lists are not read.
+function unsafeRunDir(folder, git) {
+  const entry = (file) => {
+    try { return fs.lstatSync(file, { throwIfNoEntry: false }) ?? null; } catch { return false; }
+  };
+  for (let dir = folder; ; dir = path.dirname(dir)) {
+    const stats = entry(dir);
+    if (stats === false || (stats && (!stats.isDirectory() || ![process.getuid(), 0].includes(stats.uid) || stats.mode & 0o022))) return dir;
+    if (git && entry(path.join(dir, '.git')) !== null) return dir;
+    if (dir === path.dirname(dir)) return null;
+  }
+}
+
 function codexRegistrations(config, accountHome) {
   const owned = [], errors = [];
   for (const [key, plugin] of Object.entries(config.plugins || {})) {
@@ -478,11 +563,7 @@ function planActivation(releaseRoot, input, env = process.env) {
   const catalog = skillCatalog(release);
   const instructions = joinText(defaults, catalog);
   const file = (relativePath, utf8) => {
-    let parent = path.resolve(context.runDir);
-    const missing = [];
-    while (!fs.existsSync(parent)) { missing.unshift(path.basename(parent)); parent = path.dirname(parent); }
-    const physical = path.join(fs.realpathSync(parent), ...missing);
-    const relative = path.relative(release.root, physical);
+    const relative = path.relative(release.root, physicalPath(context.runDir));
     if (!relative || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))) {
       fail('invalid-arguments', { argument: 'runDir must be outside the release' }, 2);
     }
@@ -497,6 +578,19 @@ function planActivation(releaseRoot, input, env = process.env) {
     status.invocation = { kind: 'read-file', text: `Read ${path.join(release.root, 'config/skills/devlyn-ideate/SKILL.md')}` };
   };
   const native = (mechanism, kind, text) => { status.skills = channel('configured', mechanism); status.invocation = { kind, text }; };
+  // Where no run-folder channel is planned, only a first task carries the principles and the catalog, ahead
+  // of its text; without one nothing reaches the session and each channel gives its reason.
+  const firstTask = ([principlesReason, skillsReason]) => {
+    if (context.initialPrompt) {
+      status.principles = channel('partial', 'initial-task', [reason('principles-task-only')]);
+      plan.prompt = { ...context.initialPrompt, text: joinText(instructions, context.initialPrompt.text) };
+      fallback();
+    } else {
+      status.principles = channel('unavailable', null, [principlesReason]);
+      status.skills = channel('unavailable', null, [skillsReason]);
+    }
+  };
+  // A skill folder that cannot be inspected is also found, so every inspection error comes with a collision.
   const collisions = found.map((entry) => reason('name-collision', { name: entry.name, path: entry.path }));
   switch (context.engine) {
     case 'claude': {
@@ -645,18 +739,73 @@ function planActivation(releaseRoot, input, env = process.env) {
         } else fallback([...collisions, ...errors, ...kimi.errors]);
       }
       break;
-    case 'antigravity':
-    case 'cursor':
-      // Only a first task carries the principles and the catalog: without one nothing reaches the session.
-      if (context.initialPrompt) {
-        status.principles = channel('partial', 'initial-task', [reason('principles-task-only')]);
-        plan.prompt = { ...context.initialPrompt, text: joinText(instructions, context.initialPrompt.text) };
-        fallback();
+    case 'antigravity': {
+      // Antigravity reads AGENTS.md (always on) and .agents/skills in every workspace folder, and a folder given
+      // by --add-dir is one. A conversation keeps its added folders and reads them from disk again on every
+      // launch, so the plan is the same in every launch mode and a caller hands a resumed conversation the same
+      // runDir: with another, both folders apply while the old one exists. A folder removed later only stops
+      // applying. It truncates a rule file over 24,000 bytes.
+      const gate = channelGate(context);
+      if (gate) {
+        firstTask(gate);
+        break;
+      }
+      // The engine is given the resolved folder, the one the checks ran on.
+      const folder = path.join(physicalPath(context.runDir), 'antigravity');
+      const unsafe = unsafeRunDir(folder, true);
+      if (unsafe) {
+        firstTask(withheld({ detail: 'run-dir-unsafe', path: unsafe }));
+        break;
+      }
+      const bytes = Buffer.byteLength(instructions), maximum = 24000;
+      if (bytes > maximum) {
+        status.principles = channel('unavailable', null, [reason('principles-unavailable', { detail: 'too-large', bytes, maximum })]);
       } else {
-        status.principles = channel('unavailable', null, [reason('principles-unavailable', { detail: 'no-initial-task' })]);
-        status.skills = channel('unavailable', null, [reason('skills-unavailable', { detail: 'no-initial-task' })]);
+        file('antigravity/AGENTS.md', instructions);
+        principles('add-dir');
       }
+      if (collisions.length) fallback([...collisions, ...errors], bytes <= maximum);
+      else {
+        for (const name of SKILLS) file(`antigravity/.agents/skills/${name}/SKILL.md`, antigravitySkill(release, name));
+        native('add-dir', 'slash', '/devlyn-ideate');
+      }
+      if (plan.files.length) plan.engineArgs.push('--add-dir', folder);
       break;
+    }
+    case 'cursor': {
+      const gate = channelGate(context);
+      if (gate) {
+        firstTask(gate);
+        break;
+      }
+      // A --plugin-dir folder's sessionStart command hook runs when a session is created, and Cursor puts the
+      // additional_context it prints before the model as instructions, kept with the conversation (10,200
+      // characters were delivered whole). A resumed chat runs no hook and keeps what its first launch had
+      // (measured); a fork is treated the same way, because what it gets is not established. The hook is a
+      // command Cursor runs, so it is planned only in a safe run directory, by its resolved absolute path, quoted
+      // for the shell: no lookup through PATH or the working folder. The skills come from the release, whatever
+      // the run directory.
+      const hook = path.join(physicalPath(context.runDir), 'cursor');
+      const unsafe = unsafeRunDir(hook);
+      if (unsafe || !isFile('/bin/cat')) {
+        firstTask(withheld(unsafe ? { detail: 'run-dir-unsafe', path: unsafe } : { detail: 'platform-unexamined' }));
+      } else {
+        const command = `/bin/cat '${path.join(hook, 'context.json').replace(/'/g, "'\\''")}'`;
+        file('cursor/hooks/hooks.json', JSON.stringify({ version: 1, hooks: { sessionStart: [{ command }] } }) + '\n');
+        // Every non-ASCII character escaped, so no shell or code page can change the text.
+        file('cursor/context.json', JSON.stringify({ additional_context: instructions })
+          .replace(/[\u0080-\uffff]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`) + '\n');
+        plan.engineArgs.push('--plugin-dir', hook);
+        status.principles = continuation ? channel('partial', 'session-start-hook', [reason('principles-session-start-only')])
+          : channel('configured', 'session-start-hook');
+      }
+      if (collisions.length) fallback([...collisions, ...errors], plan.files.length > 0 || plan.prompt !== null);
+      else {
+        plan.engineArgs.push('--plugin-dir', path.join(release.root, 'config'));
+        native('plugin-dir', 'slash', '/devlyn-ideate');
+      }
+      break;
+    }
   }
   if (plan.engineArgs.length || Object.keys(plan.envPatch).length || plan.prompt) plan.envPatch.DEVLYN_HARNESS_ROOT = release.root;
   return finish(plan);

package/bin/harness-context.js

@@ -8,7 +8,7 @@ const path = require('path');
 const crypto = require('crypto');
 const readline = require('readline');
 const { spawn, spawnSync } = require('child_process');
-const { verifyRelease, materializeRelease, fail } = require('./release');
+const { physicalRoot, materializeRelease, fail } = require('./release');
 
 const ENGINES = Object.freeze(['claude', 'codex', 'omp']);
 const READ_MS = 6000;
@@ -209,13 +209,13 @@ function appState(home, common) {
   return { defaultRelease: state.defaultRelease || null, choice };
 }
 
-// A release chosen by a record must verify as recorded; it never yields to another release.
+// A release chosen by a record must be the one recorded; its own planner verifies its files.
 function recorded(root, version, digest, source) {
-  let release;
-  try { release = verifyRelease(root).release; }
-  catch (error) { fail('release-unavailable', { source, version, detail: error.reason?.code || error.message }, 3); }
-  if (release.version !== version || release.digest !== digest) fail('release-version-conflict', { source, version }, 3);
-  return { release, source };
+  let manifest;
+  try { root = physicalRoot(root); manifest = JSON.parse(fs.readFileSync(path.join(root, 'release.json'), 'utf8')); }
+  catch (error) { fail('release-unavailable', { source, version, detail: error.reason?.code || error.code || 'unreadable' }, 3); }
+  if (manifest?.version !== version || manifest?.digest?.value !== digest) fail('release-version-conflict', { source, version }, 3);
+  return { release: { package: 'devlyn-cli', version, digest, root }, source };
 }
 
 // The release a terminal launch plans with: an unfinished queue's bound release in this repository,

package/bin/instruction-templates.json

@@ -469,6 +469,7 @@
       "bddb4f88a0c11165b9cafe7a31027e9769313e1aee7c0a9ed9dad490e4fe1bcc",
       "be11c198a50be2884c4c1efec52bbddff55c7547a5daf0ec2ef046279c95dc45",
       "bfdb7c7e4db21e1c452e730cecadc8e97abd317c6e54ae58c298f4288b1f1354",
+      "c1970e6a96f0c4241907d29fb4cdf831ad255b2bbfdb5270fe0aefc32cb91f0d",
       "c1a1e9722a0f3c13c693eeaacdac8cc3d13d36d242f2bab58311170496ea4e2e",
       "c236da36a45d4013ffb7e131575229b605f662a30b5174f14754f519acc24252",
       "c276962617888c5ac2d352c5e2ed018c5ce9d00f199c73e1dd61438ec4a914fb",
@@ -494,6 +495,7 @@
       "cc8bf51efb9ef8e5fa4134743f2d25434f4fd51595128edcfd2331dbf29d7dd5",
       "ccacf091bab4102d7156631c6227120a661bb4ec0df514e14a59db44b7bd5dfd",
       "ce1b0d9d0621fd057e684dc18b43156d30f589c72ed20189ea1232ea4f7ce6c6",
+      "ce8c1ea5c851fed75b898759fcf8359bd95ec04b30e547ed06bdf4101a2dddd8",
       "cebacda3b11db7aa161d96b12edd6f3f790ee2850404cd42ecdf2912ed53de08",
       "cefad7acb7dcd92777f888081aa6585b1418aa581366736fd44db68b1bd66dd0",
       "cf43eb0460beebdfe1efbfb1a35a39e5fe450137252ea2c83e51d978faa1f17e",
@@ -996,6 +998,7 @@
       "c115b2ba9ec7abe2fa5261a5894e3c4899794b527f01ec682ae7fd2479199c08",
       "c150c40a04099d7b726eb8aecc8eec8e92f9f9248a6a5c15556c08000c4bd231",
       "c16ff4fe013ee2cef905d767a09305d9c1b2f778a06b439f0bc4645ac05bc82b",
+      "c1970e6a96f0c4241907d29fb4cdf831ad255b2bbfdb5270fe0aefc32cb91f0d",
       "c1c7e45fedafb97770b6726539694eb0668c70677c2031fe2db2bc8b5339423a",
       "c227759474dc46ec6df00fe7baf8ba4b6b0adc71f5068ef522ff46526c861a48",
       "c27b13c3ae4e6fb34d9b28b8f4e899e29bfbf606a69207b9532d0e44e6078a2e",
@@ -1024,6 +1027,7 @@
       "ce351bfa301b000f0786cac24959108a3db6cdf1cad3733cb07b394c62d35227",
       "ce3cceeb74119953afde95da84dbe1bd6e3da3dbde5f85dd123a0fe8afec5d36",
       "ce4b307083addc337a833547cb6998cb34a38d82e572587e9a57dc2cf46d275a",
+      "ce8c1ea5c851fed75b898759fcf8359bd95ec04b30e547ed06bdf4101a2dddd8",
       "ce9c73a3305e4ec9cd559cec6fdd10b8f4a9f3124b42ea4598340dc16a575505",
       "ceddbf09792093c7417e72c7e2cf08e4780e9798dcd107292cdd095b023c2a8c",
       "cf04e7c73e16d8e0e561e89d4a6519a1c47b9ffa08f88d1e5bda75ad2983f4df",

package/bin/skill-history.json

@@ -12,6 +12,7 @@
       "08c91060cfec04518de582599d1892ad50f6e6cec69aecd8678760c3e0039fa0",
       "0a60dd9b96442be24a571dd5fe6cac426bba7dd7a06ad17f3211f4f9fd9b1741",
       "0b5c3f72d18f8eea538bfef7192b207ff5cbac25c7e0d2ce080cc725bfdaa2e2",
+      "0d7e8097f36623f68b7cdc26e9c2eb80d9792b3776edf308d306febdfd9f26ae",
       "0f397a4edd6b1b3063d27f6205dc6b3d069fa616624bccf661539b174535fc7e",
       "110005e3c7052d35502186d907b169c9fc7c85d558ab7c7ad0ba2f0308aa7a5d",
       "11ac38b21ecc139211af1b335bb3acc4f0f1bc4b5c133e81a80cafebcaaca298",
@@ -124,6 +125,7 @@
       "97e7ad89c74c609b15dfbf6f9f7ac61df8b50e97e4bc318f72922e058ecffba4",
       "9815b6e6963e068872a6dbeae24068143bf92042bb035f67bafd1a224d65bcb0",
       "998343c148618b937556b58b83749c05d5aa3283280d751c118da6a542fb87f2",
+      "9ca5956a73070555a93f19ecb1f92a8f57cec6fd1170a2809eeacc49cc0841be",
       "9dd3ec225818efe0ad3726192db94ff129154e995617a9d3c150fc58ad0f9f2c",
       "9e4d06fd466fa896040109bac0018fcfb2f1604d55abb4180ff1f1a0b665bbc8",
       "9f14ca629e41730b1a9fb5d0ad1a39cff558fe34758d6ceccbb9de498f9f384e",
@@ -223,7 +225,8 @@
       "3fe0742825aff05fa6fda49d3e3e0fbf5457307af944eb90f2771cbf611edd69",
       "4a8bed603191eeb6834a5008691bb3942e77462abd2818340b808a752ee5a224",
       "57c2481f9ae36623f59b365eae82f22d54253f8ba0fd690949a12858b5f6e308",
-      "b352d21d2a86def2997d89ae1ffa35b0fe428781f75cfa9e1b69a3384416ec31"
+      "b352d21d2a86def2997d89ae1ffa35b0fe428781f75cfa9e1b69a3384416ec31",
+      "be2562b5541d754c34e42b4242751bbaf3b3b2780f4314552ebb63a350e23170"
     ],
     "devlyn-auto-resolve": [
       "0740bb91fb99953631b0c2c273f00210544576f9497af5eecfdd5fe1e58349e2",
@@ -362,6 +365,7 @@
       "36b58dbdc26e51abc05a60872c4582faeebd67e9fe5626a3933467ba07c68dc4",
       "40237cd5259dbcf7c490f130e844a9e32eea48a8edabd50800edee5029bf95a4",
       "4213143689f7e7fe62ab8743c256a45492fafffc1757d64901b7b02725aee5c3",
+      "472d2ad853c96651324aa9a3de00cb61c0cecacb389e850ab1b380d535d22922",
       "49d6e024b343dd77e4c0cea0e513e40fe679a7a8192953190d042b3a21bbf69c",
       "5536f8391ec4442f1b793dba8dd5d7820d45f4b6dadf1111cbac9d54469a01ca",
       "573a6059a7383b37affd9c2e8bc6c88a4fb54117628a5a0746406cc32111e9aa",
@@ -398,6 +402,7 @@
       "c8e375aab574148542f392b093cbbf3f2e8dc623826b45e35df0a1a2c3862226",
       "ce282a55328c2d071cacc377670fbebea4da4b9a7fee81b25293fb26763f17c9",
       "cf61a917a804503ef1e26fbb1cf498181e843a0758ec001f84edb7bcac837448",
+      "d622e92c7bf32d315a5aabe2554efbc9f62790ace19a088ead9a7cef195fc715",
       "d6433bf0f96dd9dd485c3623885255738654674b3e23cfcc1a2cfd24f3cda96e",
       "db8d921aabf0d04811b55465a3757c62c4b39631aebaf6eecc994ca241cfbe56",
       "e25da746dc37b2e82c658a28d9481fd69741151045683eee2119582ddaf731cd",
@@ -822,6 +827,8 @@
     "4.3.28",
     "4.3.29",
     "4.3.3",
+    "4.3.30",
+    "4.3.31",
     "4.3.4",
     "4.3.5",
     "4.3.6",

package/config/skills/_shared/engine-preflight.md

@@ -1,7 +1,5 @@
 # Shared — Executor Pre-flight
 
-Used by `/devlyn-ideate` and `/devlyn-engines`: one rule for which engine executes implementation work and what happens when it is missing.
-
 ## Selection
 
 The executor is the `executor` pin in `.devlyn/engines.json` at the checkout root (set with `/devlyn-engines executor <name>`), else the CLI the user opened. A linked worktree or subdirectory has no pin unless one is set there. Only Claude and Codex can execute, so a drain from any other CLI needs a claude or codex pin. Keys earlier releases wrote for retired pipeline roles (`pair_judge_priority`, `roles`) stay as written and select nothing: a worker profile never becomes the executor.

package/config/skills/_shared/runtime-principles.md

@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
@@ -29,7 +29,7 @@ Three discipline rules govern HOW the principles are applied:
 ## Quick Start
 
 - `devlyn-ideate` — loop designer and intent queue: `plan <intent or document>` writes a validated loop package, `add` queues its tasks, `status` (or no arguments) reports the queue, `drain` executes it serially.
-- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md` in `.claude/skills/` or `.agents/skills/` (project, else `~`). With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
+- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md`. With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
 - Executor — `devlyn-engines` shows it and pins it in `.devlyn/engines.json`. A pinned executor does the implementation work, direct or drained: when it is not you, delegate to it, and when it is unavailable stop with `BLOCKED:<engine>-unavailable`. Without a pin, you are the executor.
 
 Each skill's `SKILL.md` is the source of truth for its flags and workflow.

package/config/skills/_shared/task-completion.md

@@ -62,9 +62,6 @@ The repository comes from the remote's GitHub URL and the base from the reposito
 A non-default base is refused at allocation.
 Every delivery allocation owns a linked worktree; `--worktree` is required and
 must name an absent path.
-Cleanup removes empty parents through the exact per-repo root shown above or its legacy `.devlyn.noindex`/`.devlyn` root, keeping the shared `.devlyn-worktrees` container. Allocation also sweeps empty legacy roots for this repo.
-On Windows, allocation marks only a newly created shared container hidden and creates the worktree not content-indexed (content only; names stay indexed); files copied in keep their own attributes.
-A marking failure continues allocation and is reported in `warnings`.
 Remote allocation first cleans earlier merged deliveries, then allocation refuses with `BLOCKED:disk`
 without creating a receipt, branch or worktree when that filesystem has less than max(10 GiB, 2%) free; free space and allocate again.
 A publication allocation normally starts at the exact fetched remote base,
@@ -122,9 +119,7 @@ Git config `devlyn.warmBuildDirs` is true, or it is unset and the Cargo workspac
 Cargo.toml sets `[workspace.metadata.devlyn] warm-build-dirs = true`,
 allocation seeds that directory from a built checkout of the repository, so
 the first build does not rebuild every dependency; `build_dirs` in its result
-and receipt says what it did, and a skip means an ordinary cold build. The
-Git setting takes precedence on this machine: false disables and invalid values
-skip; global, system, include and per-worktree values are not consulted. Seeding
+and receipt says what it did, and a skip means an ordinary cold build. Seeding
 keeps dependency outputs that may hold the other checkout's paths, and those
 follow that checkout's later rebuilds. `warm-build-dirs.py <worktree>` does the same for a
 worktree made without allocation. A warmed directory leaves with the worktree
@@ -146,11 +141,7 @@ python3 "$DEVLYN_SHARED_DIR/task-complete.py" clean-scratch \
   --receipt '<returned receipt.json>' --writers-stopped
 ```
 
-This empties only the prospectively owned scratch, preserves its directory
-identity for interrupted cleanup and later builds, checks live users and reports
-the logical byte count separately from actual free disk space.
-Unknown historical roots, source/recovery data, shared caches and terminal
-history are never adopted or swept. A refused cleanup does not block source
+A refused cleanup does not block source
 delivery; it stays visible in the handoff with its receipt and retry command
 (`CLEANUP_PENDING` after delivered source). No task is described as cleaned
 while owned disposable files remain. On resumption, finish any pending scratch
@@ -257,9 +248,6 @@ are preserved beside it as `records.<digest>/.devlyn`, never rewriting earlier c
 Non-regular files or symlinks there, partial/corrupt custody, an unreadable
 earlier copy or a mismatched `records.<digest>` copy retain the tree for repair.
 
-Legacy in-place receipts retire refs only once their task branch is no longer
-checked out; their checkout is never modified. Local ref deletion is guarded by
-the expected SHA; remote deletion uses an exact force-with-lease solely as
-compare-and-delete, never for product publication. A changed remote branch is
+A changed remote branch is
 retained. Retry uses the external receipt/evidence after removal. Recovery
 refs/evidence have no automatic expiry.

package/config/skills/devlyn-ideate/references/executor.md

@@ -59,4 +59,4 @@ Each `review_requirements` ID needs review evidence: a JSON record under `<workt
 }
 ```
 
-A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.
+A record counts only when it binds this task, the candidate source and both contract digests; any other well-formed record is reported under `ignored_reviews` (a source change invalidates earlier reviews; the record for the changed source may come from a pass that reads only the change and the invariants it touches). A listed review or runner record that is unreadable or not this shape fails acceptance with its path named; keys a review record or finding adds beyond this shape are ignored. The counted records' `requirements` must cover `review_requirements`. Each finding's `disposition` is `open`, `resolved` or `rejected` (`rejected` needs a `reason`); an open binding finding blocks acceptance. The loop requires no particular engine or number of reviewers.

package/config/skills/devlyn-ideate/references/loop.md

@@ -55,11 +55,9 @@ Package cleanup, parent pruning and report failures appear as diagnostics under
 
 ## Release binding and read-only consumers
 
-`<git-common-dir>/devlyn-loops/harness.json` is authoritative across linked worktrees: `{schemaVersion: 1, release: {package, version, digest, root}, defaults: {path, sha256}}`. Paths are absolute and hashes cover exact bytes. The queue lock covers binding before the first capture. An interrupted first add, unfinished tasks, recovery conflicts and pending delivery retain it; settlement removes it. A different release refuses: use the exact recovery argv when it gives one (a JSON argv array preserving the caller’s arguments); otherwise do what it says (Drain in Devlyn, the tasks to finish first, or a repair). Never build the bound queue’s path yourself. No caller substitutes another implementation.
+`<git-common-dir>/devlyn-loops/harness.json` is authoritative across linked worktrees: `{schemaVersion: 1, release: {package, version, digest, root}, defaults: {path, sha256}}`. Paths are absolute and hashes cover exact bytes. The queue lock covers binding before the first capture. An interrupted first add, unfinished tasks, recovery conflicts and pending delivery retain it; settlement removes it. No caller substitutes another implementation.
 
-`queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. Apps should use this reader instead of `status`, which still reconciles cleanup. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation when handoff is allowed, and is null when the refusal names Drain in Devlyn, tasks to finish first, or a repair. Use an exact recovery argv when provided; otherwise follow the refusal.
-
-Codex projection writers place `.devlyn-harness-projection.json` at the copied plugin root, beside `skills` and `.codex-plugin`: `{schemaVersion: 1, release: <ReleaseRef>, source: "native/codex/plugins/devlyn"}`. The reader verifies the named release and every projected file’s bytes/mode against that subtree (excluding only the marker). Symlinked skill invocations resolve through their real path. Standalone installs and existing unfinished unbound queues retain legacy behavior; new legacy packets use v2 with a null release, and their `defaults` name the invoking installation's own `_shared/runtime-principles.md` (`source: "skill"`). No engine applicability is inferred from instruction filenames: bound queues use verified release defaults with native instructions taking precedence, except a Devlyn managed block, which the defaults replace. Worker and runner paths point to the bound release, independent of a projection cache’s lifetime.
+`queue.py inspect --repo <dir> --json` reads without cleanup, locks or writes. It returns the status summary plus `binding` (null for legacy) and `compatibility`: `compatible`, `legacy`, `reasons`, `recoveryArgv`, `taskPacket` ranges and `queueBinding` ranges. Incompatible or unreadable state is reported, never migrated. For a mismatch, `recoveryArgv` names the bound queue’s inspect invocation when handoff is allowed, and is null when the refusal names Drain in Devlyn, tasks to finish first, or a repair. Use an exact recovery argv when provided; otherwise follow the refusal.
 
 ## Executor exchange
 

package/config/skills/devlyn-ideate/references/package-format.md

@@ -107,7 +107,6 @@ Coverage proves that every obligation has evidence. Whether the checks express t
 - The only legal transition turns one pending row into `[x]` or `[F]` with every other byte unchanged, so a terminal commit changes one line of its loop's file. Terminal rows are never reinterpreted or rerun. The blank lines let transitions of adjacent rows merge, and loops never share a file.
 - Identities are unique; equal titles are fine.
 - `docs/specs/queue.md` is the legacy queue. Its raw rows are intents: readable, never executed, never written (a row there that fully matches this grammar is ignored). `add --materialize <line>` plans one pending legacy row as a loop whose `## Intent` reproduces it verbatim (whitespace may reflow); that loop's queue file starts with `<!-- replaces docs/specs/queue.md row (occurrence <n>): <row> -->`, the row's exact text and its occurrence among equal rows, line endings aside. Every checkout, a fresh clone included, then shows the loop's rows in that row's place. A claim matching no row replaces nothing; a row two loops claim (two clones each materializing it) is hidden, neither loop taking its place, so it is never planned again.
-- Status and drain read the legacy rows in file order, each replaced row as its loop's rows; then the other recorded loops in add order, from their captures; then loops without a record here, as in a fresh clone, from the checkout's tracked queue files in loop-id order.
 
 ## Commands
 

package/harness/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- devlyn:instructions:begin sha256=f2206e5ed1c96a6c5fc368836bb041e8e77328048ca617f902ed6fb72dcb742d -->
+<!-- devlyn:instructions:begin sha256=7a484752888c37d7e91a9edfaa17d36b34ada221fc1d533ab9d73bc08c56ae7e -->
 Project-specific instructions outside this managed block take precedence over these defaults.
 
 # Project Instructions
@@ -16,7 +16,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 1. **No workaround** — fix the root cause, never the symptom. No `any`, no `@ts-ignore`, no silent `catch`, no hardcoded fallback that hides a broken contract. No config bypasses.
 2. **No overengineering** — smallest sufficient change, one responsibility per module. New abstractions need an observed failure. Subtractive-first: ask "what can I delete instead?" before writing anything new. Remove code your change makes unused; only report unrelated pre-existing dead code.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
-4. **Worldclass** — zero CRITICAL, zero HIGH security/design findings on the shippable path. Any review is one pass in which every reviewer, including each one the user requires, reads the source the checks ran on; fix each finding or reject it with a reason, re-check the fixes and the invariants they touch, and repeat the full review only while a CRITICAL or HIGH finding remains.
+4. **Worldclass** — zero CRITICAL, zero HIGH findings on the shippable path; each must name a concrete case of wrong behavior or results, a security hole, or lost or corrupted data. A review is one pass on the source the checks ran on, by the reviewers the user requires, else by one reviewer who has not seen the author's reasoning. Fix each finding or reject it with a reason, and verify every edit and the invariants it touches. Only a CRITICAL or HIGH calls for another reviewer pass, which reads the fixes, the rejections and the invariants they touch. If one survives that pass, or its fix caused a new one, repair once more; if the next pass finds either again, stop: the work does not ship and is reported blocked.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
 6. **Optimized** — efficient on the resource that matters (the user's time, tokens, attention, runtime) without weakening correctness or requirements. An extra check or process step must beat the simpler path.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
@@ -30,7 +30,7 @@ Three discipline rules govern HOW the principles are applied:
 ## Quick Start
 
 - `devlyn-ideate` — loop designer and intent queue: `plan <intent or document>` writes a validated loop package, `add` queues its tasks, `status` (or no arguments) reports the queue, `drain` executes it serially.
-- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md` in `.claude/skills/` or `.agents/skills/` (project, else `~`). With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
+- Delivery — direct work edits the current checkout; deliver completed, verified requests with changes by project policy (default PR and merge), following `_shared/task-completion.md`. With known concurrent writers, isolate before editing; on unexplained changes, pause writes until safe or isolated. An ideate drain delivers every task. Explicit limits win; commit alone stays local.
 - Executor — `devlyn-engines` shows it and pins it in `.devlyn/engines.json`. A pinned executor does the implementation work, direct or drained: when it is not you, delegate to it, and when it is unavailable stop with `BLOCKED:<engine>-unavailable`. Without a pin, you are the executor.
 
 Each skill's `SKILL.md` is the source of truth for its flags and workflow.