model-orchestrator 0.1.34 → 1.0.0

package/templates/agents/snippets/subagent-context.mjs

@@ -19,7 +19,7 @@ import { isAbsolute, join, basename } from 'node:path';
 const RULES_FILE_REL = {{RULES_DIR_OVERRIDE_JS}}
   ? {{RULES_CANDIDATES_JSON}}.map(rulesPath).join(' or ')
   : {{RULES_FILE_REL_JSON}};
-const TASK_BUNDLE_REL = rulesPath({{TASK_BUNDLE_REL_JSON}});
+const TASK_BRIEF_REL = rulesPath({{TASK_BRIEF_REL_JSON}});
 const STDIN_DRAIN_MS = 250; // hard cap: never let an open, never-closed stdin pipe hold this hook open
 
 function rulesPath(baked) {
@@ -30,9 +30,9 @@ function rulesPath(baked) {
 const additionalContext = [
   'SUBAGENT CONTEXT (model-orchestrator).',
   'Routing rules: ' + RULES_FILE_REL + (isAbsolute(RULES_FILE_REL) ? '.' : ' (relative to the project root).'),
-  'Task bundle format: ' + TASK_BUNDLE_REL + '.',
-  'Report contract: say what you did, what you did NOT do, and what you could not verify. "Unverified" is acceptable; a confident guess is not. Stop at the bound your brief set, and never claim work you cannot show.',
-  'You are a delegate: do not route further work to another subagent yourself, and do not mark your own output as the final verification of it.'
+  'Task brief format: ' + TASK_BRIEF_REL + '.',
+  'Report contract: return coverage and evidence, including partial work and unverified checks. Stop at the bound set by your brief.',
+  'When further delegation is authorized by your brief, keep the whole scope and section ownership in each handoff. Return your result to the assigning agent for independent verification.'
 ].join(' ');
 
 // Drain stdin without ever blocking on it. A bare `readFileSync(0)` waits

package/templates/beginner/ORCHESTRATOR.md

@@ -1,60 +1,55 @@
-# ORCHESTRATOR.md: routing rules for one agent
+# ORCHESTRATOR.md: model routing inside one agent
 
-Primary agent: **{{PRIMARY_NAME}}**. Everything below runs inside that one agent. You do not need a second vendor to orchestrate; you need tiers, task classes, and gates that can fail.
+{{STACK_SUMMARY}}
 
-## Tiers (capability, not model names)
+Main agent: **{{PRIMARY_NAME}}**. When work arrives, match it to a capability tier and the tools available in this session. A **tier** describes a model's capability and cost. A **lane** is an AI tool or model you can hand work to.
+
+## Choose the tier for the job
 
 | Tier | Use for | On {{PRIMARY_NAME}} |
 |---|---|---|
-| **deep** | ambiguous planning, architecture, strategy, root-cause debugging, anything expensive to get wrong | {{PRIMARY_DEEP}}, highest effort |
-| **standard** | code writing, code review, execution of a known plan, research synthesis | {{PRIMARY_STANDARD}}, high effort |
-| **fast** | classification, extraction, formatting, bulk summarization | {{PRIMARY_FAST}}, low effort |
-
-Three cost levers, always together: **tier** sets the price per token, **token discipline** sets how many tokens (read only what you will touch, never re-read, deliverables not narration), **effort** sets how hard each call thinks.
+| planning model | ambiguity, architecture, strategy and unknown causes | {{PRIMARY_DEEP}} |
+| working model | code writing, review, execution and research synthesis | {{PRIMARY_STANDARD}} |
+| cheap model | classification, extraction, formatting and bulk summaries | {{PRIMARY_FAST}} |
 
-Robustness first, cost second. Split tiers because the split produces better work, not because it is cheaper. Cost is a constraint to respect, never the reason for a routing choice.
+When routing, select capability, context size and effort together. Use a cheap model for bounded volume and a planning model when the decision requires it. For builds, check the live model roster and use high effort; raise to xhigh where supported for architecture, security or irreversible work.
 
 ## Decision tree (first match wins)
 
-1. **Bulk and mechanical?** classify, tag, extract, reformat, summarize many similar items → fast tier.
-2. **Needs live data?** trends, current docs, pricing, recent events → standard tier with tools; freshness comes from tools, not from a bigger model.
-3. **Reviewing without changing?** → standard tier, read-only, findings ranked by severity. Escalate to deep only for security-critical review.
-4. **Ambiguous, strategic, or expensive to get wrong?** "design my…", "figure out…", unknown cause → deep tier. Then hand the plan down.
+1. **Bulk or mechanical:** classify, tag, extract, rename or reformat -> cheap model tier.
+2. **Read many files:** use {{READER_ROLE}}; read the scoped sources and return the requested digest.
+3. **Current data:** use live tools with a working model.
+4. **Review code:** use {{REVIEW_ROLE}} in a fresh context, or an independent working model with read-only scope enforced by its prompt; Bash access remains a separate tool grant.
+5. **Verify findings:** reproduce each claim before a repair.
+6. **Check a definition of done:** probe its named artifact and report MET, NOT_MET or UNVERIFIABLE.
+7. **Ambiguity or architecture:** use a planning model and return an executable plan.
 {{DECISION_RULE5_L1}}
 
-Modifiers:
-- **Plan big, execute small.** The expensive tier steers, the cheaper tier does the volume. Never make the fast tier design anything; never make the deep tier grind out bulk output.{{INLINE_THRESHOLD_NOTE}}
-- **Never silently retry at the same tier after a failure.** Escalate one tier, or consult the deep tier once, and say which you did. If two consults do not unstick it, stop and tell the human.
-- **De-escalate.** If a request sounds deep but is a lookup or a small edit, route down. Default down, escalate on evidence.
-
-## The two checkpoints (every build)
-
-- **Checkpoint 1, before writing anything.** You map everything it touches yourself (files, systems, docs, tickets). Then ask the deep tier, on the finished map: *is this the simplest way, what is most likely to go wrong, what did the request miss?* It must return one named weak spot and one gap in the request. Approval alone is not an answer.
-- **Checkpoint 2, after the build is green.** Security-shaped diffs get a second-opinion read (in a fresh context, told to challenge, allowed to answer CLEAN). Architecture-shaped diffs get the deep tier reviewing build against plan. Never both on one diff. Every finding reproduced before it reaches a human.
-
-Cap: two deep-tier consults per build. The full procedure is `protocols/build-protocol.md`.
+When a route fails, diagnose the cause and state the next choice. When the task is a lookup, route down.{{INLINE_THRESHOLD_NOTE}}
 
-## Delegating inside one agent
+## Build from a shared context
 
-{{DELEGATE_RULES_NOTE}} Every hand-off carries a `TASK_BUNDLE.md` brief: purpose, task class, granted scope, capabilities, denied actions, conventions it does not have, report contract, exit parameters. Absence is denial.
+When building, follow `protocols/build-protocol.md`: freeze acceptance checks, probe availability, spike risky assumptions, order dependencies, research bounded questions, write one context file, and assign by live capability. Then build, merge split work, audit once with a companion consult asking a different question, and verify the authorized change in use.
 
-## Numbers and logic go through a tool, never your head
+When a background task runs, check liveness and output growth every five minutes. After two checks without growth, diagnose and report. When a boundary refuses a write, hand that patch to an authorized writer and continue independent work.
 
-Any figure someone will act on, any comparison you state, any complexity, equivalence or speedup claim: computed, not estimated. `protocols/numbers-and-logic.md` names when calling is mandatory. Companion tool: codecalc ({{CODECALC_STATUS}}).
+When the workflow needs an independent reviewer unavailable to this session, report the audit as pending and arrange a separate review before shipping.
 
-## Memory and record
+## Hand off a complete task brief
 
-Anything durable is searched for before it is written, its folder index is corrected in the same pass, and one writer records. `protocols/memory-and-record.md`. Companion tool (optional, needs an Obsidian vault): obsidian-tc, {{OBSIDIAN_TC_STATUS}}.
+{{DELEGATE_RULES_NOTE}} When handing off work, use `TASK_BRIEF.md` (`aunx brief`): include the user's ask, context file, exact scope, non-goals, interfaces, capabilities, denied actions, acceptance checks, inventory, measurements and coverage-table report contract. Actions outside the granted scope are denied.
 
-## Docs, then prove
+## Tools and fallbacks
 
-Before writing code against a library, SDK, API or CLI you have not confirmed the current shape of, pull current docs; then a run, not the doc, is what proves it behaves that way. `protocols/docs-then-prove.md`. Companion tool (optional, needs a network call): Context7, {{CONTEXT7_STATUS}}. Paired with codecalc, {{CODECALC_STATUS}}: docs say what it is supposed to do, codecalc's run says what it actually does.
+- When a number or logical claim affects a decision, compute it with a tool. codecalc: {{CODECALC_STATUS}}. When absent, use the local runtime, spreadsheet or tests. See `protocols/numbers-and-logic.md`.
+- When recording durable information, search first, update its index and keep one writer. obsidian-tc: {{OBSIDIAN_TC_STATUS}}. When absent, use project files and version control. See `protocols/memory-and-record.md`.
+- When writing against a changing interface, read current docs and run a check. Context7: {{CONTEXT7_STATUS}}. When absent, use official docs or installed source; when codecalc is absent, use the project's runtime. See `protocols/docs-then-prove.md`.
 
-## The seven protocols
+## Workflow files
 
-`protocols/build-protocol.md` · `protocols/propagate.md` · `protocols/gap-analysis.md` · `protocols/deep-research.md` · `protocols/numbers-and-logic.md` · `protocols/memory-and-record.md` · `protocols/docs-then-prove.md`. Each is a set of questions that can be answered wrong. That is the design, not a flaw.
+When beginning a build, scaffold the context file with `aunx context` and the acceptance checks with `aunx checks`. Record decisions in `DECISIONS.md`. Use `protocols/README.md` to find the procedure for a rename, research task, record update or coverage check.
 
-## When you outgrow this
+## Add another AI tool
 
-You will know: you keep wanting a second model family to read your diff, a $0 lane for bulk, or a live-data lane your primary does not have. That is level 2. Re-run the installer with `--level 2`.
+When a task needs another model family, tool reach or capacity, rerun the installer with `--level 2`. Verify that lane's access before assigning work.
 {{ROUTE_GATE_SECTION}}

package/templates/beginner/README.md

@@ -1,3 +1,3 @@
 # templates/beginner/
 
-Written at every level. `ORCHESTRATOR.md` is the single-agent routing document: tiers as effort levels inside one agent, the five-branch decision tree, the two checkpoints, and when you have outgrown level 1. At level 2+ `ROUTING.md` supersedes it and says so.
+Written at every level. `ORCHESTRATOR.md` is the single-agent routing document: planning, working and cheap model tiers; task classification; building from a shared context file and acceptance checks; handing off a task brief; tool fallbacks; and when to add another AI tool. At level 2 and up, `ROUTING.md` supersedes it.

package/templates/common/ACCEPTANCE_CHECKS.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "checks": [
+    {
+      "id": "replace-this-example",
+      "source": "Replace with the user's quoted requirement",
+      "description": "Replace with a property of the final artifact and a command that verifies it",
+      "command": ["node", "-e", "process.exit(1)"],
+      "cwd": "."
+    }
+  ]
+}

package/templates/common/CONTEXT.md

@@ -0,0 +1,37 @@
+# Context file
+
+## Request and approved scope
+
+<Quote the user's request. Name the final artifact, authorized surfaces and non-goals.>
+
+## Source of truth
+
+<List relevant rules, specifications and source paths with a short note on what each establishes.>
+
+## Current state
+
+<Record the branch or revision, existing changes, baseline checks and live availability probes. Include the probe date and surface inspected.>
+
+## Affected surfaces
+
+<Name the files, interfaces and consumers this change touches. Record bounded search evidence.>
+
+## Decisions and open questions
+
+<Link the decision log. List resolved choices and any question that blocks dependent work.>
+
+## Acceptance checks
+
+<Point to the checks file. Include baseline results, required runtime access and assumptions that still need a spike.>
+
+## Resources and order of work
+
+<List available lanes and their reach, each section's owner, dependencies and steps skipped with reasons.>
+
+## Measurements
+
+<Give each runtime spike's value, method, script, sample size and date.>
+
+## Verification and handoff
+
+<Record final evidence and anything still unverified. Every task brief for this run reads this file.>

package/templates/common/DECISIONS.md

@@ -0,0 +1,11 @@
+# Decision log
+
+When choosing an approach, append a concise decision record with evidence. Record the practical reason, not private chain-of-thought.
+
+## <Date: decision title>
+
+- **Did:** <the choice made>.
+- **Why:** <the evidence and tradeoff that support it>.
+- **Serves:** <the requirement or user outcome it serves>.
+- **Rejected:** <alternatives considered and the reason each was set aside>.
+- **Evidence:** <source path, command or measured result>.

package/templates/common/README.md

@@ -1,9 +1,15 @@
 # Your orchestrator (start here)
 
 Installed {{DATE}} · level {{LEVEL_ID}}: **{{LEVEL_NAME}}**, {{LEVEL_TAGLINE}}
-Primary agent: **{{PRIMARY_NAME}}**
+Main agent: **{{PRIMARY_NAME}}**
 
-You have access to:
+{{STACK_TABLE}}
+
+{{STACK_FALLBACK_NOTE}}
+
+{{STACK_GAPS}}
+
+What each AI is:
 {{AIS_LIST}}
 
 Companion tools:
@@ -11,14 +17,18 @@ Companion tools:
 
 ## The idea in one line
 
-This folder gives your agent routing instructions and, at level 2+, a runner for explicitly selected CLI lanes. The agent chooses the tier or lane; the runner does not automatically compare prices or choose a model.
+This folder gives your agent routing instructions and, at level 2+, a runner for explicitly selected CLI lanes. The agent reads the rules and chooses the tier or lane; `aunx route` supplies a keyword suggestion and `aunx cli-run` runs the lane the caller selects.
 
-## Activate it
+## What's left for you
 
 These are the same steps, in the same order, that the installer printed in your terminal.{{CHAT_UPLOAD_NOTE}}
 
 {{ACTIVATION_STEPS}}
 
+Interactive installs apply the main agent's rules and supported project settings after the single confirmation. Choose automatic activation in the edit screen or use `--no-apply` to leave activation for later. With `--yes`, add `--apply-snippets` to apply it. Selected companions are registered when the main agent has a cataloged project MCP config; other hosts keep a manual setup step.
+
+The installer runs the doctor presence check automatically. Live canaries remain opt-in through `--doctor --run` at level 2 or above.
+
 ## Then prove it took
 
 {{PROOF_STEPS}}
@@ -27,8 +37,11 @@ These are the same steps, in the same order, that the installer printed in your
 
 | File | Read it when |
 |---|---|
-| `ORCHESTRATOR.md` | First. The routing rules your primary agent follows: tiers, task classes, the two checkpoints. |
-| `TASK_BUNDLE.md` | Before you hand any work to a subagent, a second CLI, or a chat window. The brief template. |
+| `{{ROUTING_FILE}}` | First. The routing rules your main agent follows: tiers, task classes, acceptance checks and resource selection. |
+| `CONTEXT.md` | At the start of a run. Shared source facts, scope, decisions and measurements (`aunx context`). |
+| `ACCEPTANCE_CHECKS.json` | When verifying the final artifact (`aunx checks run`). Replace the failing example first. |
+| `DECISIONS.md` | When choosing an approach. Did / Why / Serves / Rejected with evidence. |
+| `TASK_BRIEF.md` | Before you hand any work to a subagent, a second CLI, or a chat window. The brief template. |
 | `protocols/build-protocol.md` | You are about to build, code, migrate or deploy something. |
 | `protocols/propagate.md` | You are renaming or changing a term, path, slug, schema field or routing rule. |
 | `protocols/gap-analysis.md` | You just finished something comprehensive and want the second pass that hunts for what is missing. |
@@ -46,11 +59,11 @@ Level 2 adds `ROUTING.md`, `TIERS.md`, `DELEGATION_MATRIX.md`, `RESEARCH_TRIAGE.
 
 {{LOAD_IT}}
 
-## The three rules that carry everything
+## Route, check and verify
 
-1. **Route by capability tier, not by model name.** deep = ambiguous or expensive to get wrong · standard = well-specified execution and review · fast = bulk and mechanical. Default down, escalate on evidence.
-2. **A gate you cannot fail is not a gate.** "Does it look good?" passes every time. "Name what is most likely to go wrong, and what the request missed" can come back empty, which is how you know it worked.
-3. **Exit 0 is not a deliverable.** Any tool, CLI or subagent can report success and hand back nothing. Check for the artifact, not the status line.
+1. When selecting a tier, use a planning model for ambiguity, a working model for execution and review, and a cheap model for mechanical work. Check current capabilities before dispatch.
+2. When introducing a gate, demonstrate its failing case before relying on a passing result.
+3. When a tool reports success, verify the requested artifact and acceptance checks.
 
 ## Where things went
 
@@ -58,4 +71,4 @@ Level 2 adds `ROUTING.md`, `TIERS.md`, `DELEGATION_MATRIX.md`, `RESEARCH_TRIAGE.
 
 ## Uninstall
 
-Before deleting anything, inspect `MANIFEST.json`: entries beginning with `[project] ` identify the subagent files managed by this installation. Review those individual files and remove only the ones you no longer want, preserving edited or pre-existing files. Never delete the shared `.claude/agents` or `.agents/agents` folder; it may contain unrelated agents. If the manifest is missing, inspect files individually rather than deleting a folder. Remove the orchestrator block you manually copied into your project rules file or chat instructions. Then delete this generated docs folder only after preserving any work you added to it. The optional log at `~/.ai-orchestrator/cli-run.log.jsonl` is shared across installations; remove it only if you no longer need that history.
+When removing this installation, run the installer with `--uninstall` and the same `--dir` and `--project` paths. Use `--dry` first to inspect what would be removed. The manifest identifies managed files, applied rules blocks and added hook or MCP entries; edited entries are preserved and named. Backups stay beside changed files. Never delete shared agent folders that may contain unrelated files. Review any rules or settings you merged by hand and remove only this installation's entries. The local log at `~/.ai-orchestrator/cli-run.log.jsonl` is shared across installations; preserve it while another installation uses it.

package/templates/common/TASK_BRIEF.md

@@ -0,0 +1,84 @@
+# Task brief (`aunx brief`)
+
+When handing work to an agent, CLI or fresh session, fill this brief and pass it with the relevant context. Keep every field; write `none` with a reason for an empty field. Treat capabilities as an explicit allow-list: absence is denial.
+
+## Context
+
+<Path to the run's context file, source files to read first, and facts that explain this task. Give a fresh session access to the actual contents.>
+
+## The user's ask
+
+> <Quote the user's acceptance-critical request. Distinguish a rule from a preference or an unresolved choice.>
+
+## Purpose
+
+<What this task is for and why.>
+
+## Scope of build
+
+- Finished artifact: <one line naming the final result>.
+- Files and changes: <each path, its owner and required behavior>.
+- Shared interfaces: <contracts every section depends on>.
+- Order of work: <dependencies and next steps>.
+- Non-goals: <work deliberately outside this task>.
+- Interfaces not to break: <existing commands, formats, APIs and behaviors>.
+
+For a non-build task, describe the bounded result here and mark build-only fields inapplicable with a reason.
+
+## Task class
+
+<read_only | draft_only | mutating>. For `draft_only`, write the proposed result to the named output and leave its destination unchanged.
+
+## Granted scope
+
+<Paths, topics, record sets, environments and write ownership. Everything outside this list is out of scope.>
+
+## Capabilities
+
+<Allowed actions and tools, including exact write destinations and permitted commands.>
+
+## Denied actions
+
+<Explicit prohibitions, such as publishing, sending, deleting, changing permissions or exposing secrets. Actions absent from Capabilities are denied.>
+
+## Conventions
+
+<Project rules the receiving session needs. Even a session that loads standing rules needs this task's scope and current decisions.>
+
+## Acceptance checks
+
+| Requirement quoted from the ask | Final property | Verifier command or manual procedure | Baseline result |
+|---|---|---|---|
+| <quote> | <observable property> | <command; exit 0 means satisfied> | <PASS / FAIL / UNVERIFIED> |
+
+Include availability checks for required tools and access. Name the checks file when using `aunx checks run`. Replay against the final merged artifact and any materialized output whose properties may change.
+
+## Resource inventory
+
+- The lane **holds**: <probed tools, models, context window, permissions and runtime access>.
+- The lane **lacks**: <needed capabilities absent here, and an authorized route to them if known>.
+- Probe evidence: <command, date, result and the surface it actually inspected>.
+
+## Measurements
+
+<Runtime spikes, baseline counts or performance figures with method, script, sample size and date. Mark an unmeasured assumption UNVERIFIED.>
+
+## Report contract
+
+Return a coverage table with one row per requirement:
+
+| Requirement | Status | Evidence |
+|---|---|---|
+| <requirement> | IMPLEMENTED / PARTIAL / MISSING / OUT-OF-SCOPE | <path, test or command output> |
+
+Name changed files, verification results, unresolved decisions and unverified behavior. State what you did and did not do. Keep evidence separate from inference.
+
+## Exit parameters
+
+<A wall-clock ceiling, work ceiling or stop condition. For background work, name the five-minute heartbeat and the response to two checks without progress.>
+
+When a bound is reached, stop and return the partial result with uncovered requirements named. When permission refuses a write, hand the patch to an authorized writer and continue independent work.
+
+## Small read-only lookups
+
+For a one-line lookup with no output artifact, state `Task brief: none (one-line lookup, read-only)` and its scope. For secrets, deletion, bulk mutation, deployment or someone else's data, use the full brief and the appropriate permission boundary.

package/templates/common/protocols/README.md

@@ -1,15 +1,18 @@
-# protocols/
+# Workflow playbooks
 
-Seven procedures. Each one is a list of questions whose answers can be wrong.
+When a task matches a row, use that procedure and keep its evidence with the result.
 
-| File | Fires when | The gate |
+| File | Use when | Result |
 |---|---|---|
-| `build-protocol.md` | You build, code, implement, migrate or deploy | 3 phases, 8 stages; the ship step is the only irreversible one |
-| `propagate.md` | You rename or change anything other files reference | Re-grep the OLD name everywhere and expect zero |
-| `gap-analysis.md` | You finished something comprehensive | A second pass that hunts for what is MISSING, ideally by a different model |
-| `deep-research.md` | The source set is unknown and the answer will be cited later | Parallel engines, then triage; disagreement is the signal |
-| `numbers-and-logic.md` | You are about to state a number, a comparison, a complexity, an equivalence | Computed by a tool (codecalc) or not stated |
-| `memory-and-record.md` | You are about to write anything durable | Searched first, indexed in the same pass, one writer (obsidian-tc when selected) |
-| `docs-then-prove.md` | You are about to write code against a library, SDK, API or CLI | Current docs first (Context7 when selected), then a run proves it; the run wins on disagreement |
+| `build-protocol.md` | Building, implementing, migrating or deploying | A scoped, checked change verified in use |
+| `context-file.md` | Sharing build context across agents | One source file every brief reads |
+| `acceptance-checks.md` | Turning requirements into final-artifact checks | Commands and explicit manual checks with PASS/FAIL evidence |
+| `decision-log.md` | Choosing an approach or skipping a step | Did / Why / Serves / Rejected with evidence |
+| `propagate.md` | Changing a shared name, path or convention | All affected surfaces updated and the old identifier checked |
+| `gap-analysis.md` | Checking coverage against a request | Missing scope and evidence gaps reported |
+| `deep-research.md` | Answering a question from an initially unknown source set | Bounded research with verified sources |
+| `numbers-and-logic.md` | Reporting consequential numbers or logical claims | Computed results and method |
+| `memory-and-record.md` | Writing durable information | A searchable, indexed record with one writer |
+| `docs-then-prove.md` | Coding against a changing interface | Current documentation and runtime verification |
 
-Not for lookups, prose edits, bulk classification or one-line config. Those get none of this.
+For lookups, prose edits, bulk classification and one-line configuration changes, use the relevant routing rule and direct verification. When an optional companion tool is absent, each affected procedure names an equivalent local workflow.

package/templates/common/protocols/acceptance-checks.md

@@ -0,0 +1,14 @@
+# Acceptance checks (`aunx checks`)
+
+- When a requirement determines acceptance, quote it and turn it into an observable property of the final artifact.
+- Scaffold a checks file with `aunx checks`. Replace the intentionally failing example with a real verifier before using the file.
+- Prefer an argv array for `command`, for example `["node", "--test", "test/example.test.js"]`. String commands run through the local shell, so review them as executable code before running a checks file.
+- Set `cwd` relative to the checks file. Keep checks inside the task's authorized scope.
+- Demonstrate a failing case for each new gate before trusting a passing result.
+- Include availability facts when later work depends on a tool, permission or service remaining accessible.
+- Run `aunx checks run ACCEPTANCE_CHECKS.json` against the final artifact. A failed command gives the gate exit code 1.
+- When a check needs human judgment, record `manual: true` and its procedure in `description`. A manual or unverified check blocks the automated gate until replaced by a verifiable result; it is never silently counted as PASS.
+- When packaging, rendering or deployment can change the property, replay the check against that materialized output too.
+- When scope changes, preserve the original check and the decision that replaces it in the decision log.
+
+When the command runner is unavailable, run each verifier with the project's local runtime and record its exit code. Optional companion tools can supply a verifier; their absence calls for an equivalent local check or an explicit UNVERIFIED result.