opencode-thrum-pro 0.1.4 → 0.1.6

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -117,23 +117,35 @@ rediscovering these the hard way:
    carrying dupes instead of the real content.
 6. Run full-package `-race`, not targeted `-run` — a targeted race run misses
    cross-test races.
-7. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
+7. **`internal/daemon/rpc` must NEVER be run monolithically at gate time, in
+   either lane** — a bare package-level `go test [-race] ./internal/daemon/rpc`
+   starves and hits the configured `-timeout` wall in both the race and
+   non-race lane. The gate's OUTPUT must show the sharded runner actually
+   executed for RPC (`race-shard` / `package-shard --mode norace`, or
+   `scripts/test-run.sh race|norace ./internal/daemon/rpc`, or `make gate`
+   which shards both lanes automatically) — not just that some RPC test ran.
+   A bound-timeout with ZERO test failures is a FALSE RED, not a finding:
+   distinguish it from a genuine hang/deadlock via
+   `go run ./cmd/testgate classify-timeout --log <file> --shard-config <file>
+   --shard <name>` (fails closed — only BOUND-TIMEOUT exits 0; HANG and
+   UNCLASSIFIED both exit nonzero) before reporting it as a regression.
+8. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
    currently runs a build of the actual post-merge tree; a clean pre-merge
    build/test does not prove the merged result compiles or passes.
-8. Use `rm -r`, NEVER `rm -rf`; use plain `git worktree remove` to drop a worktree, never
-   `--force` as the default (see item 12 below). A broad `ask` rule on `rm -rf *` outranks any narrow `/tmp` allow,
+9. Use `rm -r`, NEVER `rm -rf`; use plain `git worktree remove` to drop a worktree, never
+   `--force` as the default (see item 13 below). A broad `ask` rule on `rm -rf *` outranks any narrow `/tmp` allow,
    so `rm -rf` raises a human permission prompt EVERY time regardless of path —
    it stalls gate sub-agents mid-run waiting on a keystroke. `rm -r` runs free. Do NOT widen the ask rule
    to work around this; that entry is the only deletion protection on the box.
-9. Check the discriminator before picking a scratch path, don't assume from
-   the platform: `[ -L /tmp ]`. macOS (symlink) — create throwaway worktrees
-   under `/private/tmp`; a worktree under `/tmp` false-FAILs worktree-ancestor
-   tests via the symlink, producing a confident wrong gate result. Linux (real
-   dir) — `/tmp` is correct; `/private/tmp` may not exist there and must not
-   be created.
-10. Your report reaches the coordinator ONLY as your final returned text.
+10. Check the discriminator before picking a scratch path, don't assume from
+    the platform: `[ -L /tmp ]`. macOS (symlink) — create throwaway worktrees
+    under `/private/tmp`; a worktree under `/tmp` false-FAILs worktree-ancestor
+    tests via the symlink, producing a confident wrong gate result. Linux (real
+    dir) — `/tmp` is correct; `/private/tmp` may not exist there and must not
+    be created.
+11. Your report reaches the coordinator ONLY as your final returned text.
     Side-channel output is discarded. Put the whole verdict in the return value.
-11. **NEVER run `git stash`, `git checkout`, `git reset`, or any working-tree
+12. **NEVER run `git stash`, `git checkout`, `git reset`, or any working-tree
     mutation in the SHARED repo.** Do read-only inspection there (`git show
     <sha>:<path>`, `git log`, `git diff`) and do every build/test in a throwaway
     detached worktree. `git stash` is a SINGLE SHARED STACK across every
@@ -142,7 +154,7 @@ rediscovering these the hard way:
     hold uncommitted `State.md` they are actively re-authoring.
     If you believe you must mutate the shared tree, STOP and report instead —
     that is always a finding, never a step.
-12. **TEAR DOWN YOUR THROWAWAY WORKTREE WHEN THE GATE ENDS — after two checks,
+13. **TEAR DOWN YOUR THROWAWAY WORKTREE WHEN THE GATE ENDS — after two checks,
     in this order.** A required final step, not cleanup etiquette. Each
     abandoned worktree pins its HEAD commit against `gc` and adds a
     `.git/worktrees` admin entry, so the object store grows monotonically.
@@ -155,7 +167,7 @@ rediscovering these the hard way:
         it. Usually fine (a gate merge is reproducible by redoing it) but say so
         in your report rather than doing it silently.
     Then `git worktree remove <wt>` — **plain, no `--force`.** Its rc=128 refusal backstops
-    ONLY untracked/modified content (see rule 8 on `rm -r`) — it does NOT cover gitignored
+    ONLY untracked/modified content (see rule 9 on `rm -r`) — it does NOT cover gitignored
     content, which git removes silently with no refusal; a clean rc=0 is not proof nothing of
     value was in there (see coordinator-assessing-agent-completion's reap procedure). `--force`
     is a justified override only, never the default (see coordinator-merging-code §7a).
@@ -169,6 +181,21 @@ config entry (see `lens_scope_semantics` in the config), which still runs on
 every diff regardless of trigger directories. If the config has no
 `trigger_directories`, fail with guidance to run `project-hotpath-gate`.
 
+## Invariant-ratchet lenses
+
+A lens may declare `mandatory_test_command` (see `census_classification_coverage`
+and `write_owner_bypass_ratchet` in `.thrum/hotpath-gate.json`) instead of
+(or alongside) a pattern-match `question`/`required_evidence` pair. When
+present, PASS/FAIL is the command's own exit code — never a judgment call
+from reading the diff. This is the shape for any invariant that already has
+a mechanical detector: wire the detector as an `always_run` lens with a
+monotonic budget (a count that may only decrease, or an explicit
+waiver-tagged exception), so a diff cannot silently re-widen the invariant
+in the same change that appears to narrow it. `write_owner_bypass_ratchet`
+is the reference instance: it fails a merge that bumps a
+ceiling/aggregate in the ledger file without a `RATCHET-WAIVER:` tag, even
+when the ledger-equality test alone would pass.
+
 ## Delta re-gate continuity — walk the whole branch, read the whole function
 
 **Why:** A commit introducing a lock can be an ancestor of a delta-re-gate's
@@ -432,7 +459,7 @@ hoc test target nothing routes to. A merge that adds a `state.NewState(...)`
 call site in an `internal/daemon/rpc/*_test.go` file (test-fixture setup, not a
 handler) can leave it unclassified and desync the frozen census snapshot with
 no gate catching it — trunk went RED post-merge on 573mo v87 for exactly this
-reason (thrum-ykmly).
+reason.
 
 **Relationship to Lenses 1–10:** every other lens in this file is an
 LLM-judgment pattern check — grep a pattern, read the surrounding code, apply
@@ -476,7 +503,7 @@ diff on `TestCensusRegeneration`'s brittleness with zero added
 defect-prevention (`ClassificationCoverage` alone already catches the defect
 this lens exists for). `TestCensusRegeneration`'s own staleness is tracked
 separately (nd2j1/P1 owns the classification data; the brittle count-snapshot
-assertion itself is tracked as **thrum-33zzh** — "make advisory or drop the
+assertion itself is a distinct open question — "make advisory or drop the
 raw-count assertion"), not by this lens.
 
 **Severity:** Trigger fires and `mandatory_test_command` was not run before
@@ -520,10 +547,24 @@ otherwise leave them.
 
 ## If it fails
 
-Send it back as a normal review finding — same channel as dual-review output,
-folded into the same numbered list if dual review is still open, or as its own
-short reply if dual review already passed. Cite the offending function/file,
-which lens it failed, and the config value that triggered the finding.
+For a genuine hot-path/perf defect, a production-behaviour change, or a design
+judgment call: send it back as a normal review finding — same channel as
+dual-review output, folded into the same numbered list if dual review is still
+open, or as its own short reply if dual review already passed. Cite the
+offending function/file, which lens it failed, and the config value that
+triggered the finding.
+
+For mechanical bookkeeping only (census/shard regen via the tool, line-number
+or key refreshes, ledger totals/ceilings where the arithmetic is derivable, a
+per-entry waiver or citation comment recording a classification already
+established elsewhere (never a new safety judgment of your own), a nosec
+baseline hash for an already-reviewed pattern, comment wording, stale test
+expectations that merely follow a landed change): fix it yourself as a
+`GATE-AUTHORED` commit on your
+`gate/` branch, re-run ONLY the lens(es) the fix affects, and report
+`CLEAN-WITH-GATE-FIXES` listing each fix instead of bouncing it to the owner.
+When unsure which bucket a finding falls in, ask the coordinator with the exact
+diff — don't bounce reflexively.
 
 ## Efficacy tracking (v1 acceptance requirement)
 
@@ -563,6 +604,7 @@ rows.
 | `FALSE_POSITIVE`        | Gate flagged something correct — record which lens and why |
 | `SLIPPED`               | A wedge occurred AFTER merge that the gate did not catch   |
 | `SKIPPED_WITH_EVIDENCE` | Gate deliberately skipped (no trigger dirs), evidence cited |
+| `CLEAN-WITH-GATE-FIXES` | Gate found only mechanical bookkeeping gaps, fixed them itself as a GATE-AUTHORED commit, re-ran only the affected checks, merge proceeded |
 
 **Retrospective reclassification:** When triaging a new wedge or incident, grep
 `dev-docs/hotpath-gate-efficacy.md` for the merged branch/date. If the gate
@@ -591,4 +633,4 @@ gaps and lens improvements for the next version.
   first gate run, appended after each run)
 
 <!-- THRUM-GATE: stage=skill next=review -->
-<!-- THRUM-REVIEW: stage=skill verdict=Ready:Yes cycle=2 date=2026-07-10 -->
+<!-- THRUM-REVIEW: stage=skill verdict=Ready:Yes cycle=2 -->

package/assets/skills/coordinator-managing-state-and-lifecycle/SKILL.md

@@ -57,8 +57,11 @@ created from origin, unpushed commits can be lost or inaccessible.
 
 **How to apply:** Session close protocol — push the coordination branch every
 session end. **Read the branch name, never recall it:**
-`jq -r '.orchestration.merge_target' .thrum/config.json` (or your project's
-CLAUDE.md § Branching Strategy). Push every `feature/*` and `fix/*` branch too.
+`CONFIG=.thrum/config.json; [ -f .thrum/redirect ] && CONFIG="$(cat .thrum/redirect)/config.json"; jq -r '.orchestration.merge_target' "$CONFIG"`
+(a worktree's `.thrum/` holds only a `redirect` file pointing at the main
+repo's `.thrum` dir, so reading `.thrum/config.json` directly there returns
+empty) — or your project's CLAUDE.md § Branching Strategy. Push every
+`feature/*` and `fix/*` branch too.
 A docs/site branch pushes only when the site is ready to deploy; `main` and
 `release/*` go through the release flow.
 
@@ -77,10 +80,7 @@ batch — the visual tree exposes inversion immediately. For bulk epic creation
 (many tasks at once), spawn parallel sub-agents to issue the `bd create` calls;
 bd is fully concurrent-safe.
 
-> **Model tiers:** pass an explicit `model:` on every dispatch — `sonnet`
-> (low effort) mechanical, `sonnet` (medium effort) judgment, Opus only on
-> operator-ask or a skill step that names it. See the
-> `choosing-subagent-models` skill for the full policy.
+> **Model tiers:** pass an explicit `model:` on every dispatch; choose model and effort per the `choosing-subagent-models` skill (read `runtime.role_models` at the moment of use). Never let a sub-agent inherit your own model.
 
 ## Use `bd close --suggest-next` to surface unblocked work
 

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -90,9 +90,11 @@ merge target before merging.
 
 ## 3. PASS-3 GATES — DISPATCH BOTH TO THE GATE RUNNER
 
-**Resolve the Gate Runner from `thrum team` by its `gate` ROLE — never by a
-remembered agent name.** A name in a skill goes stale exactly like a copied model
-tier.
+1. Select from your team of established long-running gate agents.
+2. Choose an available pair for hot-path and philosophy.
+3. Tell those agents where sensitive tests must execute.
+4. Launch a new gate agent only if the persistent set is genuinely unavailable —
+   never merely because an old candidate-specific session is stale.
 
 Record the dispatch on your own queue (`thrum queue assign <bundle>
 <gate-runner>`) per `coordinator-dispatching-work`'s queue step before
@@ -157,7 +159,9 @@ worktree; its sub-agents get READ-ONLY git. `checkout`/`reset`/`restore`/`stash`
 `clean`/`rebase` forbidden in **every** directory for both. Give an escape hatch
 for instrument-and-undo (a `cp` copy, or edit-then-revert) or the careful agent
 breaches the fence doing good work. **Use `rm -r`, NEVER `rm -rf`.**
-**Pasting a fence is not enforcing it.**
+**Pasting a fence is not enforcing it.** This same fenced commit capability is
+what the sanctioned `GATE-AUTHORED` mechanical-bookkeeping-fix commit uses — it
+is not a new permission grant.
 
 ## 4. THE EXECUTED VERIFY — SCOPED TO THE CHANGE
 
@@ -175,7 +179,13 @@ executed half is **scoped to the change**:
 - The `merge-base --is-ancestor` fast-forward check (§6).
 - Any `*_tripwire_test.go` the change touches must stay green or the diff must
   state why its premise changed; a tripwire edited to accommodate the change is a
-  finding, not a fix.
+  finding, not a fix — **except** a mechanical follow-up (updating a stale
+  expectation to merely track an already-landed, already-reviewed change: a
+  renumbered line, a regenerated census key, and the like), which the gate may
+  fix itself as a `GATE-AUTHORED` commit and re-run. A tripwire edit that changes
+  what the tripwire actually *enforces* — any design or behavior judgment call —
+  stays a finding, never a self-administered fix. Keep this distinction sharp;
+  it is the highest-risk edit in this whole sequence.
 - 🔴 **The CLASS-firing governance gates, on the merged tree — they are BLIND to
   changed-package scoping, exactly like the `//go:embed` asset in §5.**
   `TestFixtureDriftGuard_NoUnlistedSchemaMirrors` (`internal/schema`) and
@@ -186,18 +196,18 @@ executed half is **scoped to the change**:
   it every merge: `git diff <base> <tip> | grep -iE 'CREATE TABLE|ALTER TABLE|durablelane|MirrorWriter|sanctionedMirrorWriters'`
   — ANY hit ⇒ also run `go test ./internal/schema/ -run TestFixtureDriftGuard` and
   `go test ./tests/gate/ -run TestEveryMirrorWriterIsSanctioned` on the MERGED tree.
-  Measured 2026-08-28: kgi7t (`TestEveryMirrorWriterIsSanctioned`) and xo58f
+  Measured previously: kgi7t (`TestEveryMirrorWriterIsSanctioned`) and xo58f
   (`TestFixtureDriftGuard`) BOTH escaped per-merge Pass-3 this way and surfaced only
   in the daily gate as trunk-reds. The changed-package rule below is necessary, not
   sufficient — a class gate is a property of the TREE, not the neighbourhood.
   🔴 **Also always-run, same class-gate reasoning:**
   `TestNoMainStateDBWriteOwnerBypasses` (`internal/testgate`; corpus 5.1
   owner-bypass-check) — a scanner ratchet over every raw main-State-DB write
-  site, blind to changed-package scoping the same way. Measured 2026-09-04:
-  thrum-mjmu3 Part a introduced a raw `r.db.ExecContext` outside
+  site, blind to changed-package scoping the same way. Measured previously:
+  a merged branch introduced a raw `r.db.ExecContext` outside
   `safedb.WriteCoordinator` in a durable-lane cold-boot restore step; the
   ratchet went 213→214 and gate_thrum's Pass-3 on that merge was CLEAN because
-  this test was not yet in the always-run set (thrum-wdt97). Run it on the
+  this test was not yet in the always-run set. Run it on the
   MERGED tree every merge: `go test ./internal/testgate/... -run
   TestNoMainStateDBWriteOwnerBypasses`.
 
@@ -272,12 +282,16 @@ agreeing (`rev-parse origin/<branch>` and `ls-remote`). **Assert the branch TIP*
 1. **The verdict artifact.** The runner saves verdicts to
    `dev-docs/gate-reports/<ISO-week>/<date>/<gate-slug>/` and **commits them
    BEFORE removing any worktree.** Save → commit → then destroy. A verdict that
-   exists only in a message cannot be audited later.
+   exists only in a message cannot be audited later. The artifact must be able to
+   carry a `CLEAN-WITH-GATE-FIXES` outcome, and when one applies it cites the
+   `GATE-AUTHORED` commit SHA.
 2. **The efficacy row**, in `dev-docs/hotpath-gate-efficacy.md` — required for
    **every** trigger-dir merge, including `SKIPPED_WITH_EVIDENCE` rows and
    orchestrator-run merges. The log measures gate **coverage**, not just outcomes.
    Record `FALSE_POSITIVE=0` explicitly on a clean run so the zero is a
-   measurement rather than an absence.
+   measurement rather than an absence. Same rule applies here: an
+   `outcome=CLEAN-WITH-GATE-FIXES` row cites the `GATE-AUTHORED` commit SHA when
+   one exists.
 3. **Commit accumulated agent state** under `.thrum/agents/` along with the merge.
    Uncommitted agent state exists in exactly one working tree, and it IS the
    agent's memory across restarts. **Never `git add -f`.**

package/assets/skills/coordinator-philosophy-merge-gate/SKILL.md

@@ -90,6 +90,14 @@ dispatch time — hand this list verbatim:
    carrying dupes instead of the real content.
 6. Run full-package `-race`, not targeted `-run` — a targeted race run
    misses cross-test races that only a full-package run surfaces.
+   **Exception: `internal/daemon/rpc` must NEVER be run monolithically** — a
+   bare `go test [-race] ./internal/daemon/rpc` cannot finish inside any
+   gate-length timeout. Run it through the sharded runner (`race-shard`,
+   `scripts/test-run.sh race ./internal/daemon/rpc`, or `make gate`) and confirm
+   the gate's output shows it executed. A bound-timeout with ZERO test failures
+   is a false red: classify it with `go run ./cmd/testgate classify-timeout
+   --log <file> --shard-config <file> --shard <name>` (only BOUND-TIMEOUT exits
+   0) before reporting a regression. See item 7 of `coordinator-hotpath-merge-gate`.
 7. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
    currently runs a build of the actual post-merge tree; a clean pre-merge
    build/test does not prove the merged result compiles or passes.
@@ -414,13 +422,26 @@ Two cautions, so this rule does not cause its own incident:
 
 ## If it fails
 
-Send it back as a normal review finding — same channel as dual-review output,
-folded into the same numbered list if dual review is still open, or as its own
-short reply if dual review already passed. Cite the offending function/file and
-which anti-pattern (`ph<N>`), meta-check, or Lens 10 sub-probe it failed. Do
-NOT block on Lens 10d findings that are
-genuinely disclaimed substrate issues (see Lens 10 scope discipline above); DO
-block on any Lens 10b or 10d finding on NEW work.
+For a genuine anti-pattern, Lens 10 finding, production-behaviour issue, or
+design judgment call: send it back as a normal review finding — same channel as
+dual-review output, folded into the same numbered list if dual review is still
+open, or as its own short reply if dual review already passed. Cite the
+offending function/file and which anti-pattern (`ph<N>`), meta-check, or Lens
+10 sub-probe it failed. Do NOT block on Lens 10d findings that are genuinely
+disclaimed substrate issues (see Lens 10 scope discipline above); DO block on
+any Lens 10b or 10d finding on NEW work.
+
+For mechanical bookkeeping only (census/shard regen via the tool, line-number
+or key refreshes, ledger totals/ceilings where the arithmetic is derivable, a
+per-entry waiver or citation comment recording a classification already
+established elsewhere (never a new safety judgment of your own), a nosec
+baseline hash for an already-reviewed pattern, comment wording, stale test
+expectations that merely follow a landed change): fix it yourself as a
+`GATE-AUTHORED` commit on your
+`gate/` branch, re-run ONLY the check(s) the fix affects, and report
+`CLEAN-WITH-GATE-FIXES` listing each fix instead of bouncing it to the owner.
+When unsure which bucket a finding falls in, ask the coordinator with the exact
+diff — don't bounce reflexively.
 
 ## See also
 

package/assets/skills/coordinator-plan-reconcile-gate/SKILL.md

@@ -67,11 +67,11 @@ Spawn **one** top-level agent, `model: "fable"`.
 
 This is not a self-granted exception; it is the single deliberate use of
 Fable anywhere in the system, kept as an independent check-and-balance
-against everything else, which runs on the sonnet ceiling.
+against everything else, which runs on the standard tier ceiling (see `choosing-subagent-models`).
 Fable — a distinct, more-capable model — is the right instrument specifically
 because a holistic cross-plan reconcile (does seam X mean the same thing in
-plan ① as in plan ②?) benefits from a different model than the sonnet-run
-per-plan reviews, a form of cross-document judgment a sonnet-tier pass has
+plan ① as in plan ②?) benefits from a different model than the standard-tier
+per-plan reviews, a form of cross-document judgment a standard-tier pass has
 been shown to miss.
 
 This is the **one named, cited exception** to the standing "never SELECT

package/assets/skills/coordinator-rolling-out-to-nodes/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: coordinator-rolling-out-to-nodes
+description: "Use when rolling a build across all nodes — fleet deploy, rolling the nodes, deploy everywhere, ship to every node, canary then the rest, promote the canary, staged rollout, deploying after a merge batch. Orchestrates the staged order and the promotion gate between stages, and delegates each node to the coordinator-deploying-a-node runbook. Load this BEFORE dispatching any node."
+---
+
+# Coordinator: Rolling Out a Build Across All Nodes — staged order, canary, promotion gate
+
+> This skill is the ORCHESTRATION layer. It does not replace
+> `coordinator-deploying-a-node` — it calls it, once per node.
+
+## 0. Universal invariants (read first — these outrank everything below)
+
+These hold for every deployment regardless of project or topology. The adapter supplies *how*, these define *what must be true*.
+
+1. **Build once; distribute identical bytes.** One pinned immutable artifact (SHA/version/checksum triple) is built once at one SHA on the build host; every node installs from that same artifact. No node re-derives it. Pin exact SHA, never tip. Adapter: `fleet.deployment.thrum.artifact` or `fleet.deployment.products.<id>.artifact`.
+2. **Target-local mutation.** The node-local coordinator performs the mutation (install/migrate/restart) locally on its own host. Never drive a node's build/install/restart from another host. The orchestrator dispatches and gates; the node executes.
+3. **Immutable identifier + checksum.** Artifact is identified by SHA + version + checksum; verify BEFORE install that the delivered bundle is the one the orchestrator built. Adapter: `artifact.checksum`, `artifact.version_file`, `artifact.commit_file`.
+4. **Canary evidence does not transfer.** A canary pass proves the *build* is sound; it does not prove any other node's *state* is sound. Every node takes its own BEFORE readings.
+5. **Verify by observed effect, never exit code.** Install/restart success is proven by post-mutation observation (version equals pin, NEW PID, service status reports pin, migration moved), not by installer exit 0. Adapter: `install.verify_by_effect`, `health.probes`.
+6. **Capture before/after.** For every node, capture BEFORE state (current version/state, health counters) before mutation and AFTER state after; compare.
+7. **Account for every target.** Roster completeness: enumerate topology from config, disposition each node (rolled on pin / deferred with owner sign-off + notify local coordinator), and never normalize unmeasured rows.
+
+Additional parameterized invariants (skill-owned, adapter-valued):
+
+- Pull-current first (ff-only) before reasoning about state. Adapter: `preflight.pull_command`.
+- Backup before touching anything; sizing via adapter formula. Adapter: `backup.command`, `backup.sizing_formula`.
+- Never bypass the storage engine's file ownership. Adapter: `storage_access.via`, `storage_access.forbidden`.
+- Install-before-restart ordering; re-render between install and restart. Adapter: `templates.order`.
+- Convergence wait from mechanism, not impatience. Adapter: `health.convergence_wait`.
+
+## 1. Enumerate topology (from adapter — never hard-code)
+
+Read the project's deployment adapter inside `.thrum/config.json` (`fleet.deployment`; human-readable reference at the deployment-adapter reference). Never hard-code topology or commands in the dispatch or in this skill — read them from that single source.
+
+- For Thrum fleet plus connected daemons: `fleet.deployment.thrum.topology` (`canary`, `waves`, `excluded`, `connected_daemons`, `identity_resolution`).
+- For a customer product `<id>`: `fleet.deployment.products.<id>.topology` (same shape, per-product `canary`/`nodes`/`waves`).
+
+Resolve each node's `daemon_id` / `ssh_alias` / `coordinator` via the adapter's `identity_resolution` method (daemon_id join, not name). If topology is empty, STOP — do not invent nodes.
+
+**Why every node carries an `ssh_alias`:** so the rolling coordinator can reach the node directly when the messaging or pane-mirror path fails. The main case is an agent stuck on a permission prompt or dialog. Read the pane with `ssh <alias> tmux capture-pane -p -t <session>`, then answer a prompt you recognise as safe with `tmux send-keys`. Never approve blindly, and never pick a "don't ask again" option. Re-capture afterwards to confirm the pane moved on. A node flagged `blocked-on-human` gets unblocked this way in the same turn; don't wait on it or reorder the roll around it. The alias is for pane interaction and artifact distribution only. The node still builds, installs and restarts itself, through its own coordinator.
+
+> Example — Thrum project: topology canary and waves are defined in `topology.canary` / `topology.waves` (seven boxes, one excluded), connected daemons per `topology.connected_daemons`. Build host and build command are adapter values, not skill literals.
+
+## 2. Pin the artifact (build once at SHA/version/checksum)
+
+Derive the immutable pin on the build host (adapter `artifact.build_host`): current `HEAD` SHA, version, and checksum. When multiple related artifacts (e.g., core plus connected-repo bundles) are involved, pin each immutably and distribute the same set to every relevant node. Announce the pin in the dispatch so every node can verify it.
+
+Artifact identity lives in `artifact.output`, `artifact.version_file`, `artifact.commit_file`, `artifact.checksum`. Never use a floating tag like tip; always the pinned SHA.
+
+## 3. Preflight (control-plane current, forward-only, backup sizing via adapter)
+
+- Verify control-plane checkout is current: `preflight.pull_command` (must be ff-only; if not fast-forwardable, STOP and surface).
+- Forward-only check per node: `preflight.forward_only_check` — prove the pin is an ancestor of the node's current SHA (plus a control that must FAIL, e.g., an invented SHA, to prove the check discriminates).
+- Backup sizing via adapter: `backup.sizing_formula` — compute `free_at_completion` per the formula before running `backup.command`; if the projected peak exceeds the safe threshold, STOP and escalate.
+
+## 4. Build once → distribute identical artifact (mechanism via adapter)
+
+Build once per artifact on its `artifact.build_host` via `artifact.build_command` → verify the produced bundle's version/checksum/commit sidecar → distribute the identical bytes to every node's inbound drop path (`artifact.distribution.drop_path`) via the adapter's `artifact.distribution.mechanisms` (e.g., drop-folder or copy). No node re-derives or rebuilds. Verify BEFORE unpack that the delivered bundle matches the pin.
+
+> Example — Thrum project: build once via the adapter's `artifact.build_command` on the adapter's `artifact.build_host`, distribute via the adapter's `artifact.distribution.mechanisms` to `artifact.distribution.drop_path`, bundle carries sidecars verified per adapter.
+
+## 5. The staged order — canary, waves, prepare-and-hold, promotion gate
+
+- **Canary first, alone.** One node (adapter `topology.canary`) rolls first. Its health must be observed green before any wave proceeds.
+- **Waves with coordinated dependency/order/rollback.** Subsequent waves follow `topology.waves`. When related daemons share ordering (e.g., connected-repo daemons that must restart together), respect the adapter-defined dependency and restart order; a failure in one dependent daemon triggers coordinated rollback per adapter `rollback` / `backup.restore_command`.
+- **Prepare-and-hold + release BY NAME.** If the mechanism supports it, prepare all nodes in a wave (acquire + verify artifact, take BEFORE snapshot, but do not restart) then release by explicit node name, not by broadcast.
+- **Promotion gate.** After each stage, verify by observed effect on that node (see node skill) before promoting. On no-go, halt the rollout and roll back the affected node(s) per adapter.
+
+## 6. Dispatching a node — what the message must carry
+
+Dispatch each node to its own local coordinator (resolved via `identity_resolution`), never via remote shell for the mutation itself. The dispatch message must carry:
+
+- Pinned artifact identifier (SHA/version/checksum) and drop-path location.
+- Which adapter section to use (`fleet.deployment.thrum` vs `fleet.deployment.products.<id>`).
+- Expected pin for verification and the BEFORE-snapshot request.
+- Hold/release semantics if using prepare-and-hold.
+
+The node's local runbook is `coordinator-deploying-a-node` — reference that skill by name in the dispatch.
+
+## 7. After the last node — roster completeness, phase reconciliation, test gate
+
+- Enumerate the topology again from the same adapter source and disposition every entry (rolled on pin / deferred with owner sign-off + notify local coordinator). Missing or unmeasured rows are not normalized.
+- Reconcile registry/phase: verify every daemon reports the pin (adapter `health.probes` + `install.verify_by_effect`), and that agent phases have converged.
+- Run the project's gate that is appropriate for the change (e.g., `make gate` or equivalent) before declaring success.
+
+## 8. Holds and red flags
+
+- If `fleet.deployment` is absent or `fleet.deployment.products` and `fleet.deployment.thrum` are both empty, STOP — no topology is defined.
+- If the control-plane pull is not fast-forwardable, STOP.
+- If `fleet.deployment.thrum.products` exists (vestigial), STOP — products live only at `fleet.deployment.products`.
+- If a node reports success by exit code alone without observed-effect verification, treat as not-verified.
+- Never wrap a service restart in a blind timeout on the node (see node skill `service.never_timeout` and `migration.signal_rules`).

package/assets/skills/coordinator-running-autonomous-feature-development/SKILL.md

@@ -106,8 +106,8 @@ outlive its author and later be enforced as if it were the human's mandate.
 through a standing orchestrator.**
 
 The reason, in one line: orchestrators own the implementer lifecycle and the
-`--model sonnet` pin; standing one up yourself risks the implementer inheriting
-opus. Your lane is dispatch-decision + gate + merge. Full dispatch mechanics
+`--model` pin (from `runtime.role_models`, per `choosing-subagent-models`); standing one up yourself risks the implementer inheriting
+your own model. Your lane is dispatch-decision + gate + merge. Full dispatch mechanics
 live in **`coordinator-dispatching-work`**.
 
 **Recovery:** if an implementer was ever stood up directly, **tear it down
@@ -117,7 +117,7 @@ coordinator-spawned implementer — it may carry the wrong model.
 | Rationalization                                                      | Reality                                                                                                                                                                                                                                                                                                   |
 | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | "I'll just stand up the implementer myself, it's faster."            | **WRONG** — route through a standing orchestrator. |
-| "The orchestrator can just adopt the implementer I already spawned." | **WRONG** — it may carry opus. Tear it down first; let the orchestrator spawn its own with the sonnet pin.                                                                                                                                                                                                |
+| "The orchestrator can just adopt the implementer I already spawned." | **WRONG** — it may carry a costly model. Tear it down first; let the orchestrator spawn its own with the pinned model.                                                                                                                                                                                                |
 
 ## Coordinator-run Q&A vs escalate