greprag 5.59.3 → 5.60.1

package/skill/templates/codex-chip-spawn.md

@@ -3,6 +3,12 @@
 This is the Codex Desktop chip method. It is separate from Claude Code
 `spawn_task`: never use or copy the Claude Block 1/Block 2 prompt here.
 
+Exact visible titles are role contracts: `PLANNER: <Mission>` owns intent and
+acceptance, `LEAD: <Mission>` is always Luna/xhigh and owns orchestration,
+`Chip A/B/C: <Specific Purview>` are Luna/xhigh workers, and
+`ADVISOR: <Purview>` is read-only Sol/high advice for a documented fundamental
+blocker.
+
 ## Gate: one chip or a mission?
 
 A single independent task proceeds directly. If two or more chips target one
@@ -18,6 +24,10 @@ uniquely named `Chip A: <Specific Purview>`, `Chip B: ...`; a single worker is
 Every mission starts with a durable parent-owned goal. Give it a concrete
 objective, final state, and stable acceptance criterion IDs. Every write chip
 declares non-overlapping ownership leases; research uses `--read-only`.
+After the planner attaches the Luna LEAD, the LEAD creates one nested goal and
+runs `greprag codex chip goal bind-lead <lead-id> --goal-id <nested-goal-id>`.
+That emits `GOAL_READY:<goalId>`; no LEAD execution or child dispatch is valid
+before it. All later Chips, ADVISOR, and MECHANIC tasks use that exact goal.
 
 ```bash
 greprag codex chip goal create \
@@ -36,30 +46,18 @@ greprag codex chip spawn "<independent task>" \
 ```
 
 The parent/`LEAD:` selects each worker model before dispatch; the child never
-self-selects or changes it. Defaults are exact:
-
-- **Standard — `gpt-5.6-luna` / `xhigh`:** bounded single-owner execution with
-  clear acceptance criteria: scoped implementation, tests, docs, or focused
-  research/review.
-- **Complex — `gpt-5.6-sol` / `high`:** use when *any* hard signal applies:
-  orchestration/decomposition; multi-chip integration or merge arbitration;
-  architecture/API/schema decisions; cross-cutting ownership; ambiguous
-  requirements needing synthesis; high-risk migration/security/accounting
-  correctness; or novel diagnosis with multiple interacting hypotheses.
-
-In multi-chip missions the `LEAD:` itself is Sol/high, but it classifies every
-worker independently—workers do not inherit Sol. Complex selection requires a
-concise `--model-reason` plus one or more `--complexity-signal` values:
-`orchestration`, `multi-chip-integration`, `architecture-api-schema`,
-`cross-cutting-ownership`, `ambiguous-synthesis`, `high-risk-correctness`, or
-`novel-multi-hypothesis-diagnosis`. Explicit `--model`/`--effort` overrides are
-supported and require `--model-reason`; standard records its rubric reason by
-default. Native Desktop `thinking` uses the callable enum and is checked against
-the selected model's advertised effort matrix.
-An arbitrary custom native model also requires `--native-model-verified`, which
-means the parent verified it on the Desktop surface before dispatch. The
-manifest persists profile/model/effort, parent session in
-`selectedBy`, reason, and matched signals.
+self-selects or changes it. `LEAD` and ordinary Chips are fixed to
+`gpt-5.6-luna/xhigh`.
+`PLANNER` may use Luna/xhigh or explicitly Sol/high. `ADVISOR` must be
+`--read-only`, Sol/high, and carry `--model-reason "Fundamental blocker: ..."`.
+The old `--complex`, `--profile complex`, and `--complexity-signal` routing is
+rejected for new spawns. Native Desktop `thinking` uses the callable enum and
+is checked against the selected model's advertised effort matrix. The manifest
+persists role, model, effort, parent session, reason, and criterion evidence.
+The auditable selection fields are `selectedBy`, `reason`, and `matched signals`.
+The hard-signal rubric covers `architecture/API/schema` and
+`high-risk migration/security/accounting`; a scope boundary sends a
+`breakthrough message` and the child `never swaps models autonomously`.
 
 Native Desktop is the default runtime.
 `--runtime cli` is opt-in and only valid when PATH Codex `model/list` actually
@@ -73,6 +71,9 @@ The spawn command creates a unique starting branch, records the manifest and
 lease, and returns a `greprag-codex-native-v4` handoff. Pass `createRequest`
 exactly to native `create_thread`: it already contains the full real mission,
 selected `model`, `thinking`, project target, and worktree starting branch.
+The native target schema is `target.type=project` with
+`startingState={type:"branch", branchName}` inside the worktree environment;
+do not invent a checkout path or second bootstrap turn. Do not add `cwd`, `title`, `model`, or `effort` to the native create request; those values belong to the handoff and post-create verification contract.
 `expectedBaseSha` is the attach-time commit invariant behind that reserved branch.
 This is the only assignment turn. Never create a bootstrap task and never send
 the mission again after attach.
@@ -91,6 +92,8 @@ and starts the monitor. The enforced order is create-real-mission → provisiona
 bind → resolve → rename/verify → attach → IN-FLIGHT → monitor. A standalone CLI cannot
 invoke the Desktop-owned surface, so it prepares rather than pretending an old
 PATH app-server successfully ran a 5.6 turn.
+The title race contract is `set_thread_title` → read it back twice →
+`IN-FLIGHT → mission` monitor only after the exact title remains stable.
 
 ## Mandatory parent inbox lifecycle
 
@@ -101,9 +104,9 @@ The child must address the recorded parent session, not a bare mailbox:
   report` command in its opening prompt.
 - `BLOCKED` before ending when it cannot finish, by running the exact `codex
   chip block` command.
-- If the work crosses the selected model boundary, send a breakthrough message
-  explaining the new signal. The parent decides whether to steer or relaunch;
-  the child never swaps models autonomously.
+- If the work crosses the selected model boundary, run
+  `codex chip breakthrough <id> --reason "..."`. This emits a typed
+  `BREAKTHROUGH` event to the recorded parent; the child never swaps models.
 
 The attached host monitor validates receipts from the recorded native cwd,
 exact base ancestry, clean state, and every changed path against the lease. A
@@ -112,13 +115,17 @@ reserved chip ref, then sends the terminal inbox event. The
 child never merges, pushes, cleans up, or edits the parent checkout. Reports map
 concrete evidence to every covered goal criterion. The parent reviews the diff,
 integrates it, and runs `greprag codex chip goal accept <goal-id> --summary
-"<review judgment>"` only when all criteria and chips are satisfied. For a
-verified squash/cherry-pick add `--integrated <chip-id>` to acceptance. Acceptance
+"<review judgment>"` only when all criteria and chips are satisfied. A
+LEAD-owned goal with no additional child chip records final proofs with
+`goal attest --commit <release-commit>` plus repeated `--evidence` and `--check`
+before acceptance. For a verified squash/cherry-pick add `--integrated <chip-id>`
+to acceptance. Acceptance
 returns machine-readable closeout entries: apply each native `archiveRequest`
 first, then its exact `cleanupCommand`. Cleanup does not imply acceptance, is
 refused before it, and requires `--native-archived` for native tasks.
 
-Native chips have a receipt deadline (default 180 minutes; override with
+Native chips require parent-side `--native-model-verified` proof before monitor
+start and have a receipt deadline (default 180 minutes; override with
 `--native-timeout-minutes`). This standalone CLI cannot query Desktop-private
 turn status, so it never guesses that a settled task succeeded: write *and read*
 chips must submit `report`/`block`, and timeout fails loudly. One live monitor
@@ -145,12 +152,15 @@ Useful recovery commands:
 ```bash
 greprag codex chip handoff <id> --json
 greprag codex chip status <id>
-greprag codex chip steer <id> "<follow-up>"
+greprag codex chip breakthrough <id> --reason "<follow-up>"
 greprag codex chip resume <id>
 greprag codex chip stop <id>
 ```
 
-For a native chip, `steer` emits a `send_message_to_thread` handoff. Stop fails
+For a native chip, `BREAKTHROUGH` is the sole agent-visible control envelope;
+native turn transport remains private. Breakthrough delivery is
+durably queued → injected → acknowledged → acted; empty completed turns are
+not delivery, and natural-turn drain is degraded fallback only. Stop fails
 loud until the parent interrupts the Desktop task, then confirms that fact with
 `stop <id> --native-interrupted`; the CLI never records a false cancellation.
 After restart/usage interruption, use `resume`, deliver its handoff, and wait for
@@ -161,3 +171,7 @@ For an invalid terminal launch, preserve the mission and run `goal exclude
 replacement. Excluded evidence cannot satisfy acceptance. To abandon the whole
 mission, stop every chip first, then use `goal cancel <goal-id> --reason
 "<concrete reason>"`; cancelled closeout is not acceptance.
+
+Mechanic repair incidents are not Mechanic task termination: `REPAIR-READY/CLOSED`
+returns the same Luna/xhigh Mechanic to `OPEN+DORMANT` for later typed friction.
+Only final LEAD teardown may accept/clean it with `--mechanic-final`.