opencode-thrum-pro 0.1.0 → 0.1.2

package/assets/commands/thrum-_stamp-protocol.md

@@ -84,6 +84,71 @@ parseable with `grep -F` semantics without regex. The reader-side regex in
 `verify-against-plan` anchors on this fixed format; do not reorder or recase any
 field.
 
+## Review-object binding (THRUM-REVIEW stamp — plan/prompt binding)
+
+A review stamp's PRESENCE proves a review happened; it does not prove the
+stamp still binds the artifact that was reviewed. An edit made after a
+`Ready:Yes` verdict leaves a stamp that still reads `Ready:Yes` while
+describing a document that no longer exists — the same class of staleness the
+Authored-against stamp solves for the tree, applied here to the artifact
+itself.
+
+The `THRUM-REVIEW` stamp carries two extra keys per stage, binding it to the
+exact git blob it reviewed and the exact source it was reviewed against:
+
+| Stage | Self-binding key | Source-lock key |
+| --- | --- | --- |
+| `stage=plan` | `plan_obj` | `src_lock` |
+| `stage=prompt` | `prompt_obj` | `plan_lock` |
+
+### Derivation (strip-then-hash, run at stamping time)
+
+```sh
+# self-object blob: strip EVERY THRUM-REVIEW line, hash the remainder, filters OFF
+obj=$(grep -v '^<!-- THRUM-REVIEW:' "$FILE" | git hash-object --no-filters --stdin)
+# source-lock blob: the source file is not mutated by the stamp -> plain hash
+lock=$(git hash-object --no-filters "$SOURCE_FILE")
+```
+
+- Strip set = every line matching `^<!-- THRUM-REVIEW:` (all cycles) — NOT
+  `THRUM-GATE`/`THRUM-DEFER`. The stamp cannot bind a hash that includes
+  itself, so its own lines are removed before hashing (chicken-and-egg).
+- `--no-filters --stdin` bypasses gitattributes clean filters / autocrlf so
+  the value emitted here and the value re-derived at read time agree
+  byte-for-byte.
+- Hash the **working-tree** file, not a committed blob — an uncommitted
+  post-review edit must be caught before it is ever committed.
+- For `stage=plan`: `$SOURCE_FILE` is the LOCKED brainstorm (plus design spec,
+  if any); `src_lock` proves the plan was reviewed against the source that was
+  current at review time.
+- For `stage=prompt`: `$SOURCE_FILE` is the LOCKED plan; `plan_lock` proves the
+  prompt was reviewed against the plan that was current at review time.
+- When multiple cycles' `THRUM-REVIEW: stage=<S>` lines coexist, the
+  **highest-cycle (last-appended)** line is the binding verdict; earlier
+  lines are history, never re-checked. Stamps are only ever appended, never
+  reordered, so append-order == cycle-order — select with `tail -1`, never a
+  sort (`cycle=10` must beat `cycle=9`, which a lexical sort inverts).
+
+### Null/unresolvable guard
+
+Same failure class as the Authored-against stamp above: if either `obj` or
+`lock` comes back empty or `null`, STOP and report — do NOT emit a stamp with
+an empty/`null` binding key. A `THRUM-REVIEW` line with `plan_obj=` (or any of
+the four binding keys) empty or literal `null` still matches a reader's regex
+and reads as a valid binding — the value a reader would trust to prove binding
+is exactly the value that never resolved.
+
+### Extended stamp shape (fixed key order preserved)
+
+```text
+<!-- THRUM-REVIEW: stage=plan verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> verify=<...> plan_obj=<blob> src_lock=<blob> [rev=... notes="..."] -->
+<!-- THRUM-REVIEW: stage=prompt verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> prompt_obj=<blob> plan_lock=<blob> -->
+```
+
+`plan_obj`/`src_lock` and `prompt_obj`/`plan_lock` are appended after the
+stage's existing keys, in this order — keeping the fixed-key-order convention
+this file already establishes for the Authored-against stamp above.
+
 ## Read-time provenance re-derivation
 
 Both checks below are computable from the two fields the stamp already carries

package/assets/skills/brainstorm-steward/SKILL.md

@@ -26,6 +26,10 @@ tree rule (a roster member that is a coordinator escalates to the human, not
 to that coordinator). Everything below is additive — the brainstorm-specific
 duties layered on top of that base.
 
+Your roster is entirely remote (other boxes), so the base skill's remote
+modal-unblock note applies to every roster member by default — never reach
+for `thrum tmux key`, which is local-socket-only.
+
 ## Roster = brainstormers
 
 Your `watch_params.roster` is the list of brainstormer agent names you
@@ -63,6 +67,17 @@ thread:
   detection would miss it entirely if the send failed, was mis-addressed,
   or the brainstormer simply froze before sending.
 
+  This backstop's actual capture loop runs as the same `thrum monitor`-
+  scheduled script the base `persistent-watcher-archetype` skill ships —
+  `resources/thrum-watch-pane-capture.sh` — pointed at your own roster of
+  brainstormers via your own `watch_params.json`. One parameterized script
+  serves both archetypes; only the roster contents and cadence differ, and
+  those are already `watch_params.json` fields, not script forks. Follow
+  that skill's "Driving your cycle" section for the setup-copy step and the
+  exact `thrum monitor start` registration — **`--notify-on-success` is
+  mandatory there too**, for the identical reason: a `--schedule`d job
+  delivers nothing on `--match` alone (thrum-ruz1z §5c).
+
 ## The queue (your pane console)
 
 Render one unified list across every roster member, oldest-first:

package/assets/skills/choosing-subagent-models/SKILL.md

@@ -52,24 +52,30 @@ These are the tiers now:
 
 ## Worked examples — LITERAL ARGUMENTS, AND EFFORT IS TOOL-DEPENDENT
 
-**Pass `model` AND `effort` on every spawn, whichever mechanism you use.** Syntax
-per mechanism — re-check the schema in front of you rather than restating from
-memory, because it can change:
+**Pin `model` on every spawn. Pass `effort` wherever the mechanism exposes it.**
+Syntax per mechanism — re-check the schema in front of you rather than restating
+from memory, because it can change:
 
 | Mechanism | `model` | `effort` |
 |---|---|---|
-| **Agent tool** | ✅ settable | ✅ **settable — pass it** |
+| **Agent tool** | ✅ settable | ✖ **not exposed — do not pass it** |
 | **Workflow `agent()`** (opts: label, phase, schema, model, effort, isolation, agentType) | ✅ settable | ✅ settable |
 | **Agent DEFINITION** (`.claude/agents/*.md` / plugin `agents/*.md` frontmatter) | ✅ | ✅ — sets the default for that agent type |
+| **`thrum tmux create` / `launch`** | ✅ `--model` | ✅ `--effort` — pass on BOTH |
 
-**Agent tool — pass `effort` as a literal argument, alongside `model`.**
+**Agent tool — `model` only. It takes no `effort` argument.**
 
 ```python
-Agent(subagent_type="general-purpose", model="sonnet", effort="low",
+Agent(subagent_type="general-purpose", model="sonnet",
       description="Code-quality review of <branch>",
       prompt="...")
 ```
 
+**The tier philosophy still governs even where the Agent tool cannot express it:**
+sonnet-low for investigation and mechanical work, sonnet-medium for reviewers,
+verifiers and implementers. Where effort is not settable, carry the intent through
+the agent definition, the Workflow opts, or the tmux launch flags.
+
 An agent definition can also carry a default:
 
 ```yaml
@@ -87,8 +93,9 @@ agent(prompt, { model: "sonnet", effort: "low" })             // mechanical sub-
 ```
 
 **THE DIRECTIVE, imperative and not a comment: REVIEWERS RUN SONNET AT MEDIUM
-EFFORT.** Pass `effort: "medium"` literally — under Workflow AND under the Agent
-tool. Never dispatch a reviewer "from memory".
+EFFORT.** Pass `effort: "medium"` literally under Workflow, in the agent
+definition, or on `thrum tmux create`/`launch`. Never dispatch a reviewer "from
+memory".
 
 **AND VERIFY, DO NOT ASSERT:** any claim about what a tool does or does not expose
 must be checked against the schema in front of you.
@@ -112,9 +119,10 @@ plus brainstormer → opus-medium and brainstormer's own subagents → sonnet-lo
 
 ## Pin every spawn explicitly — the floor depends on the ROLE, not the depth
 
-Every orchestrator MUST pass an explicit `model:` and `effort:` on EVERY subagent
-it spawns. An unspecified subagent SILENTLY INHERITS THE PARENT'S MODEL — so an
-Opus orchestrator that forgets the pin just spent Opus tokens on a grep.
+Every orchestrator MUST pass an explicit `model:` on EVERY subagent it spawns, and
+`effort` wherever the mechanism exposes it. An unspecified subagent SILENTLY
+INHERITS THE PARENT'S MODEL — so an Opus orchestrator that forgets the pin just
+spent Opus tokens on a grep.
 
 **The floor is set by what the agent DOES, not by how deep it sits** — see the
 Agent tiers table above. This applies recursively: an implementer spawning its

package/assets/skills/conversation-only-context/SKILL.md

@@ -0,0 +1,186 @@
+---
+name: conversation-only-context
+description: "Use at the START of any long-lived agent session (researcher, coordinator, orchestrator, brainstormer), and whenever the operator says we are going to have a long conversation, get a lot done, or keep many threads open - also when context is climbing, when several investigations are in flight at once, when you are about to read code or a multi-file doc set to investigate, or when you catch yourself opening a log to just check quickly."
+---
+
+# Conversation-only context — spend your own context on the human, dispatch everything else
+
+Your context is the session's scarcest resource. It buys conversation with the
+operator, messaging, queue and state — nothing else. Every investigation,
+verification, root-cause, code read, doc summary and VM job goes to a named
+persistent subagent that writes its result to a file.
+
+`<scratch>` below means `/private/tmp` on macOS (where `/tmp` is a symlink) and
+`/tmp` on Linux. Check with `[ -L /tmp ]`; never assume from the platform name.
+
+## Wake procedure
+
+0. Caller binding decays to anonymous across a restart. Before the first mutating
+   thrum command, re-warm it: `thrum prime >/private/tmp/rw.txt 2>&1` — output to
+   a file, **not** back into context.
+1. Read the **full** prime briefing with the Read tool, every page, in order. Name
+   one load-bearing fact from the **middle** of it before taking any action.
+2. Execute the resume plan from the newest restart snapshot.
+3. Reconcile `thrum queue list` against `thrum state show personal_state:current`.
+4. Read `thrum inbox --unread` **and** run `thrum message search` — stale unread
+   sorts last and is missed by the inbox page. Mark each processed message read
+   (`thrum message read <id>`).
+5. Where the snapshot lists live subagents (§ restart handoff), respawn each one
+   with its result file as seed before doing its work yourself.
+
+## The dispatch rule
+
+**The parent never reads code, logs, or multi-file doc sets to investigate.**
+Ask a subagent a smaller question instead. "I will just check quickly" is the
+failure this skill exists to prevent.
+
+| Parent keeps inline | Parent dispatches |
+|---|---|
+| Reading and replying to messages (`thrum reply --stdin <<'EOF'`) | Any code read, grep sweep, or call-site audit |
+| Queue and state reconcile | Root-cause investigation |
+| Talking to the human at the pane | Verification of an implementer's work |
+| Owner-only decisions, surfaced with a recommendation | Summarizing a doc set |
+| Tiny mechanical git **in its own worktree** (commit/push docs) | Any VM job |
+| Reading a subagent's ≤20-line summary | Anything whose tool output runs to pages |
+| The ONE file a question names — a subagent's report, or a deliverable you were asked to review | Everything the named file cites |
+
+That row is purpose, not size: a file handed to you to act on is conversation,
+not investigation.
+
+Never spawn a subagent to operate inside another agent's worktree.
+
+## Dispatch shape
+
+Every dispatch carries: an explicit `name:`, an explicit `model:`, an output file
+path, a ≤15-20 line reply cap, and the pasted CONSTRAINTS block. Launch
+independent subagents **in one message** so they run in parallel.
+
+Pin `model:` on every spawn. Pass `effort` only where the mechanism exposes it —
+Workflow `agent()` opts, agent-definition frontmatter, `thrum tmux launch
+--effort`. **The Agent tool does not take `effort`.**
+
+```python
+Agent(subagent_type="general-purpose",
+      name="<prefix>_<slug>",
+      model="sonnet",
+      description="<3-5 words>",
+      prompt="""<task>
+
+WRITE your result to <scratch>/<prefix>-<slug>.md. Reply to me with a
+summary of at most 20 lines - no logs, no transcripts, no command dumps.
+
+=== CONSTRAINTS ... ===  # pasted verbatim, see below
+""")
+```
+
+Write is fine for a NEW result file; to update an existing one, Read it first or
+append with a heredoc (`cat >> <path> <<'EOF'`) — Write refuses to overwrite a
+file it has not read this session.
+
+Continue it — never respawn:
+
+```python
+SendMessage(to="<prefix>_<slug>",
+            message="Answer L3 and L5 first and report a partial now. Same file, append.")
+```
+
+A name keeps working after the subagent's turn ends; a send resumes it with its
+context intact. "A subagent whose turn ends is not waiting — it is gone" applies
+to fire-and-forget monitors, not to a named agent you re-message.
+
+### Naming and tiers
+
+| Subagent role | Name prefix | Model / effort (effort only where exposed) | Result file |
+|---|---|---|---|
+| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | `sonnet` / low | `<scratch>/<name>.md` |
+| Root-cause | `<bead>_rc` | `sonnet` / low | `<scratch>/<bead>-rc.md` |
+| Verifier, reviewer, design-verify | `<bead>_verify` | `sonnet` / medium | `<scratch>/<bead>-verify.md` |
+| Implementer | `impl_<slug>` | `sonnet` / medium | `<scratch>/<slug>-impl.md` |
+| VM driver | `vmdriver_<slug>` | `sonnet` / medium | `<scratch>/<slug>-vm.md` |
+| Prose or deep review | any | `opus` — **only when the operator asks** | as above |
+
+Haiku is banned. Opus is never yours to grant onward.
+
+### CONSTRAINTS block — paste verbatim into every dispatch
+
+```text
+=== CONSTRAINTS — apply to you and anything YOU dispatch (including this line) ===
+- Work SYNCHRONOUSLY. Tests in the FOREGROUND with a bounded `-timeout`.
+- NO POLL LOOPS. Never `until <check>; do sleep N; done`, never
+  `while kill -0 $(cat pid)`, never `$( )` in a loop condition — even when a
+  tool's own guidance suggests it. It trips a permission modal, and A FROZEN
+  PANE EMITS NOTHING, so nobody can tell you are blocked. If you must background
+  work, wait for the completion notification.
+- Every sub-agent YOU spawn gets an explicit `model:` — sonnet (low mechanical,
+  medium judgment). HAIKU IS BANNED. Opus is never yours.
+- READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
+  `stash`/`clean` in ANY directory — `stash` is one shared stack across all
+  worktrees and the shared tree holds live agents' uncommitted state.
+- Pair every zero/empty result with a control that MUST return non-zero.
+```
+
+## Relaying findings
+
+Consolidate one pass's findings into **one** numbered message, severity-tagged
+BLOCKING / IMPORTANT / MINOR — never partial batches, which get half-fixed. But a
+**design-gating** answer goes out the moment it lands, even while the rest of the
+pass is still running: when a downstream implementer is already building, send the
+cheapest zero-cost interim guidance immediately rather than waiting for the
+verifier to finish.
+
+A result file on this box is unreadable from a remote-box coordinator. **Put the
+substance in the message; never send only a path.**
+
+Attribute what you did not verify yourself: forwarding a subagent's finding as
+your own claim launders an unchecked assertion into your authority. Either read
+the cited line, or write "from my verifier, cites `file:line`".
+
+## Pane discipline
+
+Write to the pane only when the human asked, or when the decision is one only the
+human can make. Everything else goes through `thrum send` / `thrum reply`.
+Surface an owner-only decision crisply, with a recommendation attached.
+
+## VM work
+
+Use a named persistent driver (`vmdriver_<slug>`) per
+`dev-docs/daemon-wedge-sync-audit/execution-pattern-driver-subagents-in-vm.md`:
+reach the VM only through the repo's tmux-ssh script, state the three-clause GO
+(execute now · drive to completion yourself · then stop and report), require the
+isolation proof and the 3-section report. VM specifics — profiles, first-boot
+re-key, isolation legs — are in `dev-docs/vm-dev-patterns/`. Never do VM work
+yourself.
+
+## Restart handoff
+
+Subagents do not survive a restart. Before restarting:
+
+1. Tell every live subagent to finish and write its file.
+2. Record in the restart snapshot, per subagent: **name · what it owned · result
+   file path · model/effort**.
+3. State which subagents have already exited.
+
+The successor respawns each one with its result file as seed.
+
+Restart on a number read from the pane footer, never on a felt sense.
+
+## See Also
+
+- `efficient-multi-agent-research` — the fan-out sibling: partition, investigate to
+  disk, consolidate, for N>6 items. This skill sets the session's posture; that one
+  runs a single pass.
+- `choosing-subagent-models` — the tier policy and source of the CONSTRAINTS block.
+
+## Failure modes
+
+- Respawning a fresh single-shot subagent for a follow-up when a named one already holds the context — `SendMessage` it; a respawn loses the context and pays the re-read.
+- A fire-and-forget "monitor until done" agent that arms a monitor and ends its turn — measured at 70 min, 122k tokens, zero output. Put the drive-to-completion clause in every dispatch.
+- The parent reading code or docs "to just check quickly" — message the subagent that already read them and ask for the one field.
+- One subagent handed ten tasks — partition it and dispatch the parts in parallel.
+- A spawn with no `name:` — it cannot be re-messaged. Name every spawn.
+- A spawn with no `model:` — it silently inherits Opus. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
+- Holding a design-gating answer behind the rest of the pass while an implementer builds on the old premise — that one goes immediately; the rest ships as one consolidated message.
+- Acting on the resume plan alone and skipping the middle of the prime — the falsified premise sits in the part you skipped.
+- Trusting an older "not started" message over a newer "already running" one — verify, do not recall; that cuts both directions.
+- Restarting without listing every live subagent's name and result file in the snapshot — the successor cannot respawn what is not written down.
+- Forwarding a subagent's BLOCKING finding to a third party as your own claim — check the cited line, or attribute it; never state as yours what you did not verify.

package/assets/skills/coordinator-dispatching-work/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coordinator-dispatching-work
-description: "Use when starting an epic, dispatching to an implementer, creating a worktree for an agent, or spawning a sub-agent. Loads coordinator-specific discipline for kicking off implementation work."
+description: "Use when starting an epic, dispatching to an implementer or orchestrator, choosing or re-routing which orchestrator gets a task, creating a worktree for an agent, or spawning a sub-agent. Loads coordinator-specific discipline for kicking off implementation work - routing by requirement and checking the target's load first."
 ---
 
 # Coordinator: Dispatching Work
@@ -72,8 +72,10 @@ optimization.
 
 ## Check the target's queue before you dispatch (R3)
 
-Before dispatching, confirm the agent isn't already loaded: `thrum queue list --agent
-<target>` (message it to confirm if its state is unclear). An empty result does NOT
+Before dispatching, read the target's load two ways: its queue AND its pane. `thrum
+queue list --agent <target>` (a well-run orchestrator keeps its queue current) plus a
+quick `thrum tmux capture <target>` to see what it is mid-task on (message it to confirm
+if its state is unclear). An empty result does NOT
 mean free — it also shows for an agent that keeps no queue or that you mis-named;
 confirm by message before assigning. `assign` appends to `assigned_to` with no
 duplicate check, so this pre-dispatch read is the only guard against double-loading a
@@ -236,11 +238,21 @@ grep -E 'THRUM-REVIEW: stage=prompt verdict=Ready:Yes([[:space:]]|-->|$)' "$PROM
 ```
 
 - **Stamp present** → the pre-dispatch review is already satisfied; SKIP
-  re-running it and dispatch.
-- **Stamp absent** → fall through to the normal pre-dispatch dual review. Do NOT
-  block dispatch on the stamp — it is a shortcut that lets you skip a redundant
-  review, not a new hard requirement (pre-feature prompts and prompts from other
-  flows won't carry it).
+  re-running it and dispatch. (The binding check itself — does the stamp still
+  bind the exact prompt object and locked plan — is `project-setup`'s job, not
+  this gate's; see its canonical contract, `project-setup` SKILL.md § "Step 5:
+  Stamp the prompt for the review loop" + Phase 0. Do not restate that recipe
+  here.)
+- **Stamp absent on a project-setup-produced prompt is an ANOMALY, not a
+  sanctioned shortcut.** After the prompt-stamp fix (`project-setup` Step 5),
+  project-setup cannot report completion or dispatch-readiness without
+  appending this stamp — so a project-setup prompt reaching dispatch without
+  one means something skipped a step. Do not treat its absence as normal; run
+  the full pre-dispatch dual review AND surface the missing stamp as a finding.
+  The one legitimate, narrow carve-out: **pre-feature prompts and prompts from
+  non-project-setup flows** genuinely never carry this stamp — for those, fall
+  through to the normal pre-dispatch dual review same as before, with no
+  anomaly flag.
 
 This is the prose side of the boundary; the post-DONE dual-review (which reviews
 the implementer's CODE, a different artifact) always runs separately. The prompt
@@ -251,6 +263,14 @@ post-DONE side.)
 
 When the fleet has standing orchestrators and the work is a full plan execution:
 
+🔴 **Route by what the work REQUIRES, not by which orchestrator is easiest to reach.**
+An orchestrator co-located with special resources - a build/signing/release box, the
+shared data store, a particular OS - is RESERVED for work that needs those resources;
+all other work goes to a general-purpose orchestrator, addressed BY NAME. The
+locally-visible orchestrator is the one you reach for by reflex, and that reflex
+overloads it. Enumerate the FULL set first (local and remote alike), then pick by
+requirement and by load - never by visibility.
+
 ### Step 1: Select an orchestrator
 
 ```bash

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -420,6 +420,74 @@ circuit-breaker — **BLOCKING**. Peer call with timeout but no circuit-breaker
 **Triage:**
 `git diff main...HEAD --name-only | xargs grep -n '{peer_call_patterns}'`
 
+## Lens 11 — Census classification coverage (mandatory test, not a pattern check)
+
+**Why:** `go test ./...` never runs in Pass-3 — targeted-test selection is
+scoped to files the diff touches, and `internal/daemon/rpc/testcensus` is an ad
+hoc test target nothing routes to. A merge that adds a `state.NewState(...)`
+call site in an `internal/daemon/rpc/*_test.go` file (test-fixture setup, not a
+handler) can leave it unclassified and desync the frozen census snapshot with
+no gate catching it — trunk went RED post-merge on 573mo v87 for exactly this
+reason (thrum-ykmly).
+
+**Relationship to Lenses 1–10:** every other lens in this file is an
+LLM-judgment pattern check — grep a pattern, read the surrounding code, apply
+judgment. This lens is MECHANICAL: run the command, read PASS/FAIL. It shares
+its evidentiary discipline with the philosophy gate's coincidence-detector-tests
+lens and preamble rule 3 (RUN any test you make a claim about) rather than with
+Lenses 1–10's pattern-matching shape.
+
+**Own narrower trigger — this lens does NOT fire on every gate run.**
+`internal/daemon/` is already a gate-wide `trigger_directories` entry, so this
+gate already RUNS on any `internal/daemon/rpc/` diff. This lens carries its OWN
+trigger on top of that (see `config.lenses.census_classification_coverage` and
+`lens_scope_semantics`): it fires only when the diff (against merge-base,
+preamble rule 4) either (a) touches `internal/daemon/rpc/testcensus/**`
+directly, or (b) touches an `internal/daemon/rpc/*_test.go` file AND an
+added/changed line matches `trigger_content_pattern` (bare `NewState(`,
+alias-agnostic on purpose — a renamed import of the state package would defeat
+a `state.`-prefixed match, and over-firing here costs one fast test run while
+under-firing reproduces the exact hole this lens exists to close). A diff
+elsewhere under `internal/daemon/` (state/, safedb/, scheduler/, or an
+`rpc/*_test.go` edit that never touches a `NewState(` call) fires the GATE but
+not THIS lens — record it walked-and-N/A. A non-test `.go` change in
+`internal/daemon/rpc/` alone (e.g. a handler edit with no test change) does not
+fire this lens either: `census.go`'s `Run()` only scans `*_test.go` source
+non-recursively, so a handler-only edit cannot desync the census by
+construction.
+
+**How to apply:** Read `config.lenses.census_classification_coverage`. Check
+the trigger per the paragraph above. If it fires, run
+`config.lenses.census_classification_coverage.mandatory_test_command` in the
+gate's throwaway worktree (preamble rule 2) and record the literal output.
+
+**Gates `TestCensusClassificationCoverage` ONLY — deliberately NOT the whole
+package.** `mandatory_test_command` is `-run`-scoped to
+`^TestCensusClassificationCoverage$`. The sibling test in the same package,
+`TestCensusRegeneration`, is an orthogonal count-snapshot drift detector — it
+reds on ANY new top-level test function added anywhere in
+`internal/daemon/rpc`, unrelated to whether any `NewState` site is classified.
+Gating the whole package would false-block the next unrelated census-surface
+diff on `TestCensusRegeneration`'s brittleness with zero added
+defect-prevention (`ClassificationCoverage` alone already catches the defect
+this lens exists for). `TestCensusRegeneration`'s own staleness is tracked
+separately (nd2j1/P1 owns the classification data; the brittle count-snapshot
+assertion itself is tracked as **thrum-33zzh** — "make advisory or drop the
+raw-count assertion"), not by this lens.
+
+**Severity:** Trigger fires and `mandatory_test_command` was not run before
+merge, OR was run and is RED — **BLOCKING**. A RED result means an unclassified
+`NewState` site: confirm `testdata/classifications.json` was regenerated per
+`internal/daemon/rpc/testcensus/README.md` and re-committed on the same branch
+before merge.
+
+**Triage:**
+```bash
+git diff <merge-base>...<tip> --name-only | grep -E 'internal/daemon/rpc/testcensus/|internal/daemon/rpc/.*_test\.go$'
+# for any *_test.go hit outside testcensus/, confirm content match:
+git diff <merge-base>...<tip> -- <file> | grep -E '^\+.*NewState\('
+```
+
 ## Cross-gate consolidation with the philosophy gate
 
 This gate runs **in parallel** with `coordinator-philosophy-merge-gate` (both

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -176,6 +176,30 @@ executed half is **scoped to the change**:
 - Any `*_tripwire_test.go` the change touches must stay green or the diff must
   state why its premise changed; a tripwire edited to accommodate the change is a
   finding, not a fix.
+- 🔴 **The CLASS-firing governance gates, on the merged tree — they are BLIND to
+  changed-package scoping, exactly like the `//go:embed` asset in §5.**
+  `TestFixtureDriftGuard_NoUnlistedSchemaMirrors` (`internal/schema`) and
+  `TestEveryMirrorWriterIsSanctioned` (`tests/gate`) fire on a CLASS — a hand-rolled
+  `CREATE TABLE` for a real production table name, or a new durablelane / mirror
+  writer — so a diff adds the violation **without touching `internal/schema` or
+  `tests/gate`**, and the changed-package `-race` never runs them. Cheap trigger, run
+  it every merge: `git diff <base> <tip> | grep -iE 'CREATE TABLE|ALTER TABLE|durablelane|MirrorWriter|sanctionedMirrorWriters'`
+  — ANY hit ⇒ also run `go test ./internal/schema/ -run TestFixtureDriftGuard` and
+  `go test ./tests/gate/ -run TestEveryMirrorWriterIsSanctioned` on the MERGED tree.
+  Measured 2026-08-28: kgi7t (`TestEveryMirrorWriterIsSanctioned`) and xo58f
+  (`TestFixtureDriftGuard`) BOTH escaped per-merge Pass-3 this way and surfaced only
+  in the daily gate as trunk-reds. The changed-package rule below is necessary, not
+  sufficient — a class gate is a property of the TREE, not the neighbourhood.
+  🔴 **Also always-run, same class-gate reasoning:**
+  `TestNoMainStateDBWriteOwnerBypasses` (`internal/testgate`; corpus 5.1
+  owner-bypass-check) — a scanner ratchet over every raw main-State-DB write
+  site, blind to changed-package scoping the same way. Measured 2026-09-04:
+  thrum-mjmu3 Part a introduced a raw `r.db.ExecContext` outside
+  `safedb.WriteCoordinator` in a durable-lane cold-boot restore step; the
+  ratchet went 213→214 and gate_thrum's Pass-3 on that merge was CLEAN because
+  this test was not yet in the always-run set (thrum-wdt97). Run it on the
+  MERGED tree every merge: `go test ./internal/testgate/... -run
+  TestNoMainStateDBWriteOwnerBypasses`.
 
 **Establish branch-attributable vs pre-existing from the changed-package `-race`
 result** — a regression adds failures the same packages did not have before. Do

package/assets/skills/coordinator-running-brainstorm-cycles/SKILL.md

@@ -519,8 +519,11 @@ contract-drift and quality issues the internal reviewer misses.
    stamp. Any FEASIBILITY finding (see Loop semantics) routes to the
    coordinator instead of being folded inline.
 6. Researcher repeats only if cycle-1 introduces new design surface (rare for
-   bounded mechanical plans); otherwise v2 LOCKED, stamped
-   `<!-- THRUM-REVIEW: stage=plan verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> verify=Ready:Yes -->`.
+   bounded mechanical plans); otherwise v2 LOCKED. Before stamping, compute
+   `plan_obj`/`src_lock` per `_stamp-protocol.md` § "Review-object binding"
+   (strip-then-hash the plan against itself for `plan_obj`; plain-hash the
+   LOCKED source for `src_lock`), then stamp
+   `<!-- THRUM-REVIEW: stage=plan verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> verify=Ready:Yes plan_obj=<blob> src_lock=<blob> -->`.
 7. Researcher signals plan LOCKED back to coord, citing both review passes
    and the Deviations block.
 
@@ -561,11 +564,12 @@ review catches translation errors (plan → prompt) plus prompt-specific quality
      `requesting-code-review` SUPPLEMENTARY — clarity, scope language,
      dispatch-readiness, sub-agent model guidance, DONE-shape spec.
 3. Researcher consolidates → folds inline → re-issues prompt; `project-setup`
-   appends the prompt-stage stamps (it OWNS them — see that skill's Step 5):
-   first `<!-- THRUM-GATE: stage=prompt next=dispatch -->` immediately after the
-   prompt is generated, then
-   `<!-- THRUM-REVIEW: stage=prompt verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> -->`
-   after this review terminates.
+   OWNS and applies the prompt-stage stamps — the gate footer, the
+   binding-bound verdict stamp, and the hard completion requirement that it
+   not exist without one — per that skill's canonical contract (`project-setup`
+   SKILL.md § "Step 5: Stamp the prompt for the review loop" + Phase 0). This
+   step does not restate that mechanics; it exists only to confirm the stamp
+   is applied within the same project-setup session, before signaling back.
 4. Researcher signals "project-setup complete + post-setup dual-review applied"
    back to coord, citing both review passes + final artifact paths.
 

package/assets/skills/efficient-multi-agent-research/SKILL.md

@@ -125,10 +125,10 @@ hard to consolidate. Specify table columns in every prompt.
 **Not specifying output file paths** - Agents may write to the working directory
 or not at all. Always include the exact output path in every prompt.
 
-**Have sub-agents write their findings file with a Bash heredoc, not the Write
-tool.** The Write tool refuses subagent report files ("Subagents should return
-findings as text, not write report files") regardless of how the brief is worded.
-The filesystem is writable; the tool is what refuses.
+**Write is fine for a NEW findings file; a heredoc is the safe form for updating
+one.** Write refuses to overwrite a file it has not Read this session, so a
+round-2 agent updating an existing findings file fails unless it Reads it first.
+Prefer `cat >> <path> <<'EOF'` to append on later rounds.
 
 **Put this in every prompt:**
 
@@ -136,8 +136,9 @@ The filesystem is writable; the tool is what refuses.
 READ-ONLY EVERYWHERE EXCEPT YOUR OUTPUT FILE.
 Do not modify source, tests, config, git state, or the issue tracker.
 You MUST write your findings to exactly: dev-docs/<topic>/findings_N.md
-Write it with a Bash heredoc (cat > <path> <<'EOF' ... EOF), NOT the Write tool —
-Write refuses report files. That single write is expected and authorized.
+Write is fine for creating it. To UPDATE it on a later round, Read it first or
+append with a heredoc (cat >> <path> <<'EOF' ... EOF) — Write refuses to
+overwrite a file it has not Read. That single write is expected and authorized.
 ```
 
 If an agent still returns text instead of a file, persist it yourself verbatim