orchestrator-workflow 0.30.0 → 0.32.0

package/CHANGELOG.md

@@ -7,6 +7,432 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.32.0] - 2026-09-11
+
+### Added
+
+- A review-method axis, orthogonal to the effort tier: every reviewer
+  briefing now names `review_method: normal | rigorous | adversarial`
+  (`assets/agents/reviewer.md`, SKILL.md step 7, the kit-fence
+  Scaling-delegation text). The three methods are obligation sets, not
+  personas: `normal` reads the diff and spec and runs the declared tests
+  once, for docs/renames/batch cosmetics; `rigorous` (the default when a
+  briefing names none) adds an independent extract, a base-attribution
+  control, and mandatory reproduction of every empirical claim (the
+  pre-existing `reproduction`/`matches_implementer_claim` requirement);
+  `adversarial` adds one discriminating probe or negative control per
+  acceptance criterion, an active search of the neighbouring scenario
+  space, an attempt to break the claimed invariant, and a list of break
+  attempts that failed. `adversarial` and `rigorous` both carry a
+  withdrawal rule: a finding that does not reproduce on a second attempt
+  with a corrected harness is withdrawn in the same round and reported
+  under a `withdrawn` list with the reason, so the method cannot buy false
+  positives; emit `withdrawn: []` when nothing was withdrawn. The reviewer
+  output contract (both copies, `reviewer.md` and SKILL.md) gains
+  `method_applied` and `withdrawn`; until the grounding-mcp reader parses
+  the marker (agent-grounding follow-up 5df7b809), the orchestrator checks
+  by hand that the return's `method_applied` matches the briefing's
+  `review_method`, resupplying a mismatch or omission rather than
+  accepting it.
+  `assets/templates/05-review-findings.md` gains a `Method` line per review
+  round, outside the pinned Findings table
+  (`test/template-markers.test.ts` pins it); the grounding-mcp
+  completeness reader does not parse it yet, tracked as a follow-up in the
+  agent-grounding repo. SKILL.md's selection rule: `adversarial` at
+  minimum for security judgment, install/deploy scripts, hand-edited
+  lockfiles, cross-major overrides, or anything the operator flags
+  high-risk; `normal` only for docs, renames, or batch cosmetics;
+  `rigorous` otherwise; never `adversarial` on the `-medium` reviewer tier
+  (budget mismatch). Tiers themselves are unchanged. Anchored by the
+  pandora run `2026-09-11-cve-sweep`: reviews R1, R5, R11, R13 and R14
+  found the Critical and High findings by probing; R4, R6 and R9 on the
+  default method returned no findings and R8 only two informational lows;
+  R5 withdrew a harness artefact. The selection rule stays advisory, not
+  an AGENTS.md rule, until an A/B (same tasks, run once under `rigorous`
+  and once under `adversarial`, counting real Critical/High findings and
+  findings withdrawn) is recorded.
+
+- A citation-sibling-drift guard (`test/docs-consistency.test.ts`, next to
+  the existing anchor-load-bearing checks) catches a citation that resolves
+  and anchors correctly on its own but names the wrong sibling among a run
+  of near-identical citations, a class neither okf-kit's `citations-resolve`
+  rule nor the local anchor guards can see, because both check an anchor
+  only inside its own cited range. Two rules, applied per paragraph: (a) the
+  same `file:range#anchor` cited twice in one paragraph, unless allowlisted
+  with a reason; (b) a string anchor's text also occurring, uncited, at
+  another line of the same target within a 20-line window (widened from 10
+  in review round 2, see below) while the paragraph cites a sibling range
+  of that file, unless allowlisted. Fixtures
+  reproduce three review findings that shared this shape and were the
+  motivation for the guard: three sibling `it`-block citations collapsing
+  onto one range twice, the third never cited; three per-harness bullet
+  citations doing the same; two logically distinct assertions collapsing
+  onto one shared range and anchor text, the second's own line never cited.
+  Run over the current bundle, every hit either rule reports is read
+  against its own target file and the citing paragraph, then fixed or
+  allowlisted; the measured per-rule hit counts live in `docs/okf/log.md`
+  with the classification that produced them, not here, so the two sites
+  cannot drift apart. The recurring coincidence shapes are a doc-wide
+  "topic sentence, then repeat as the closing list item" convention for
+  rule (a), and a short or common token -- a keyword, a mirrored field on
+  twin interfaces, a comment restating a literal, a test-assertion idiom on
+  an adjacent line, a reused local variable name -- recurring near a real
+  citation for rule (b). Lives in this file rather than as an okf-kit rule
+  because this
+  suite already runs on every PR while an okf-kit rule needs a release and
+  a fleet pin bump first; an opt-in okf-kit rule for the same class is a
+  named follow-up candidate once this guard has proven itself.
+- Review round 2 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): the round-1 review found 7 of the round's 18 raw hits were not
+  coincidental at all -- real mis-pointed citations that got allowlisted
+  instead of fixed, because the round-1 pass classified every hit by range
+  and reason without re-deriving each cited claim's real evidence line by
+  line. All seven re-pointed to their real evidence, citation-only, no
+  content changes: a duplicate `docs-consistency.test.ts` self-citation
+  whose second claim's real test sat 26 lines below the first
+  (`subagent-contracts-superset.md`); an `init.test.ts` range that stopped
+  6 lines short of the `model: opus` assertion it named
+  (`model-preselection.md`); a `SKILL.md` duplicate whose first claim's
+  real text sat just above the cited line (`run-state-lifecycle-and-
+  markers.md`); an `init.ts` comment cited in place of the real
+  `installKitFile` call it restates (`install-fence-mechanics.md`); an
+  `init.ts` range crossing from one branch of `installKitFile` into
+  another branch's own record line (`install-fence-mechanics.md`); an
+  `init.ts` range naming the wrong call for an `opencodeEffortLine(...)`
+  claim (`model-preselection.md`, cited from two spellings of the same
+  path); and a milder range that stopped 1 line short of the parameter its
+  own sentence's second half named (`install-fence-mechanics.md`). Widened
+  `SIBLING_GUARD_WINDOW` from 10 to 20 once a real case fell just outside
+  it (two genuinely distinct `init.ts` notes sharing one message, 18 lines
+  apart, both legitimate and now allowlisted per doc); re-triaged every
+  additional hit the wider window surfaced against the bundle, fixing or
+  allowlisting each with a reason stating what the cited line actually
+  says (see `docs/okf/log.md` for the full re-triage and the re-measured
+  counts). Added `anchorKey` (first 8 hex chars of a sha256 over the
+  finding's own anchor text, computed at test time, never stored literally
+  in the array) to every allowlist entry and to the match, plus a test
+  asserting every entry matched at least one finding on the current
+  bundle, closing a gap where a range-only match would silently exempt any
+  future, differently-anchored finding on the same range. Added a fixture
+  at the real batch-39 S3 geometry (a literal duplicate citation, its real
+  sibling 15 lines away, not the original fixture's 10-line near-miss
+  range) asserting both rules' behaviour, and a negative fixture pinning
+  that the duplicate-citation rule fires regardless of window, since it is
+  a pairing comparison, not a windowed one. Two coverage gaps noted in the
+  guard's own comment and here rather than closed this round: a path-less
+  continuation citation (`:N-M#"..."`, whose path is implied by the
+  preceding citation) never matches the citation regex, so this guard
+  cannot see one -- extending the regex to resolve a continuation's
+  implied path is a named follow-up; and a citation-shaped string inside a
+  fenced ` ``` ` code block is now skipped rather than matched (closing the
+  reverse risk of misreading a code sample as a citation), a cheap
+  addition alongside the rest of this round's work.
+- Review round 3 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): a second consecutive review round found allowlist entries that
+  certified real wrong-sibling drift, so this round changes the mechanism
+  rather than only the entries. An allowlist entry now records the
+  GEOMETRY it was cleared against -- the target-file line(s) carrying the
+  uncited identical anchor text for a rule-(b) entry, the doc line the
+  repeat sits on for a rule-(a) one -- and that geometry is part of the
+  match, so an entry exempts only the hit it was actually reviewed for: a
+  new uncited occurrence next to an already-cleared one, or a repeat that
+  moved to another doc line, fails instead of inheriting the old verdict. A
+  test re-reads those recorded lines against the current files
+  independently of the guard's own output (the anchor text is re-derived
+  from the doc's own citation, since the array deliberately stores a hash
+  rather than the literal text), so an entry whose situation no longer
+  exists goes red instead of silently exempting a different one. The
+  free-form `reason` field is replaced by `claim`: one sentence naming what
+  the citing sentence describes and why the cited line, rather than the
+  uncited sibling, is its evidence, written so a reviewer can falsify it by
+  reading exactly the two lines the entry names. Process, recorded in
+  `docs/okf/log.md` with each round's classification: an allowlist entry is
+  accepted only on an INDEPENDENT review classification of the hit, never
+  on the reading of whoever implemented or re-pointed the citation, which
+  is how both earlier rounds' wrong verdicts reached a green suite.
+  Re-pointed the pair this round's review found (a sentence about the
+  dropped-role tier-variant SUB-loop citing the enclosing loop's own note
+  range, in two docs) to the sub-loop's own note, dropped their entries,
+  and re-triaged every remaining hit at the current window against its
+  target file. Also citation-only: a fence-contract citation that stopped
+  short of the assertion its sentence names, a run-state citation one line
+  short of the sentence it supports, and a slicer-superset citation whose
+  sentence's second half is now cited from the test that actually pins it.
+  Two more fixtures: rule (b) firing at the guard's window and staying
+  silent at the round-1 value of 10 for an uncited occurrence 15 lines
+  outside the cited range (the window was previously pinned only
+  indirectly, through the no-dead-exemption test), and a doc that ends
+  inside an unclosed fence now failing loudly instead of silently dropping
+  every citation after the stray delimiter, paired with an assertion that
+  every bundle doc yields at least one citation.
+- Review round 4 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): a third consecutive review classified every allowlist entry
+  by re-reading the two lines each `claim` names, rather than trusting the
+  prior round's verdicts; none certified real drift, but two claims were
+  inaccurate and one more citation was mis-paired in a shape the guard
+  itself cannot see. Rule (a)'s match compared only the finding's second
+  citation line, which a `return true;` mutant of that comparison
+  survives, and which also could not tell a two-citation entry's cleared
+  repeat from a THIRD, unreviewed repeat sharing the same second line;
+  fixed with a dedicated fixture and a repeat-count check. The allowlist
+  entry's match and its independent geometry re-check both gained
+  `paragraphLine`, the doc line of the finding's own first citation: an
+  entry was previously keyed by (doc, kind, real target, range, anchorKey,
+  recorded geometry) alone, so the same coincidence recurring in a SECOND,
+  unreviewed paragraph of a doc would silently inherit the first
+  paragraph's verdict -- exactly the shape one entry was carrying (the
+  same `init.ts` range cited, and separately drifting, from two paragraphs
+  of `model-preselection.md`); the second paragraph's citation is now
+  re-pointed to its own, different evidence instead, so the entry covers
+  one paragraph only. The geometry re-check's duplicate-citation branch
+  dropped a near-tautological "some citation exists at the recorded line"
+  check (true of any citation the extractor produces, by construction) for
+  one that reads the group's own citations, sorts them into document
+  order, and checks the recorded lines by POSITION -- closing a mutant
+  (`if (false)` on the old guard) no existing fixture caught. The bare
+  `claim.length > 40` sanity check now also rejects a claim that never
+  names one of its own entry's recorded lines, closing the gap that let
+  three `subagent-contracts-superset.md` entries carry a long claim that
+  never actually pointed at its own geometry. One inaccurate claim
+  (`model-preselection.md`) said an uncited line named a "codex-only
+  effort field"; it is opencode's own field for a non-Claude-family,
+  non-Ollama provider, not a codex field at all, and no anchor exists that
+  can widen the citation to cover it under this file's own occurrence-cap
+  rule, so the claim was corrected instead. One real mis-pairing:
+  `install-fence-mechanics.md` cited the OUTER per-dropped-role loop's
+  gate/note for a sentence about the tier-variant SUB-loop, and the
+  sub-loop's own gate/note for a sentence about the base-file note --
+  swapped, citation-only, no content change. Known limit, unclosed this
+  round: neither rule catches a citation that resolves and anchors cleanly
+  but simply names the WRONG target -- no duplication, no anchor text
+  recurring nearby -- which is exactly the shape this round's real
+  mis-pairing was; both citations passed every existing check (including
+  this guard) because nothing about either one, read alone or against its
+  paragraph's siblings, looks wrong.
+- Citation-sibling-drift guard, continuation-citation coverage (task
+  agent-dx b50fd903): closed the guard's own documented coverage gap
+  (round 1) that a path-less continuation citation (`:N-M#"..."`, whose
+  path is implied by the preceding FULL citation earlier in the same
+  paragraph) never matched `ANCHOR_CITATION_RE`, so the guard could not
+  see one at all -- the form `model-preselection.md` alone carries four
+  of. `extractSiblingGuardCitations` now also matches the anchored,
+  path-less tail on its own (`ANCHOR_CONTINUATION_CITATION_RE`, anchor
+  group required so a bare `:N-M` digit pair in ordinary prose is never
+  mistaken for one) and resolves it against `governingPathByParagraph`,
+  the nearest preceding full citation's own `citedPath` in the same
+  paragraph -- the same "nearest preceding, same paragraph" BINDING RULE
+  okf-kit's own short-form/continuation citations use in
+  `citations-resolve.ts`. That mirrors the binding rule only, not the
+  grammar (review round 3 correction: this bundle's anchored, path-less
+  `:N-M#"..."` form IS backtick-wrapped; an earlier version of this
+  bullet said it was not). okf-kit's own `CONT_COLON_RE` still misses it
+  because its own closing backtick has to follow the digit range
+  immediately, and this form's closing backtick follows the `#"anchor"`
+  tail instead; `SHORT_FORM_COLON_RE` misses it too, both because a match
+  right after a backtick is skipped and because no serial connective
+  ("and", "also", ...) precedes it either -- okf-kit sees these citations
+  as nothing at all, not merely as unresolved ones. Two fixtures pin the
+  closed gap: a path-less
+  continuation duplicating its governing citation's own range and anchor
+  is flagged by the duplicate rule (drifted/corrected), and a
+  discriminating fixture with two different full citations in one
+  paragraph before the continuation, which only passes when the
+  continuation binds to the NEARER of the two, not the paragraph's first.
+  Run against the current bundle, the newly-visible continuation
+  citations in `model-preselection.md` produced no new SIBLING-GUARD
+  finding (duplicate-citation/wrong-sibling-anchor), allowlisted or
+  otherwise -- see `docs/okf/log.md`. That measurement did not cover
+  whether each continuation's own anchor still resolved against its
+  target at head; it did not, by the time this round's own CHANGELOG line
+  shift landed a few commits later -- see the round-2 follow-up bullet
+  below.
+- Citation-sibling-drift guard, okf-kit-porting decision (task agent-dx
+  b50fd903, run `.ai/runs/2026-09-08-open-pool-batch44` D-006): the guard
+  stays kit-local (this package's own `test/docs-consistency.test.ts`),
+  not ported to okf-kit as an opt-in `citations-sibling` check. Who pays:
+  kit-local means only this package's own OKF bundle is guarded by it,
+  and every other fleet bundle with sibling citations (a paragraph
+  repeating, or near-duplicating, one of its own citations) stays
+  unguarded until each such bundle's own docs-consistency-style suite
+  grows the same check by hand; porting would instead put the maintenance
+  on okf-kit's maintainers, who would then carry the rule itself, the
+  allowlist shape (recorded geometry, a falsifiable one-sentence claim,
+  and the independent-review-classification process this file's own
+  allowlist process block already documents) as a public, cross-repo
+  contract, and a fleet-wide pin bump on every fix to it. Trigger to
+  revisit: a second fleet bundle observed carrying real sibling-citation
+  drift in a review pass (not merely plausible in the abstract) reopens
+  the port decision.
+- Citation-sibling-drift guard, continuation-citation coverage, review
+  round 2 (task agent-dx b50fd903): the round-1 bullet above added
+  continuation-citation EXTRACTION but not RESOLUTION at the three
+  `matchAll(ANCHOR_CITATION_RE)` sites that check "anchor on last content
+  line", "anchor <=3 times file-wide/exactly once in-range", "unanchored
+  citation", and "citation stays inside one describe/it/test block" --
+  and, separately (review round 3 correction: an earlier version of this
+  bullet blamed a same-round CHANGELOG.md line shift for staling
+  `src/init.ts`'s own line numbers; false, since editing CHANGELOG.md
+  cannot move a different file's lines, and this branch had not touched
+  `src/` yet at that point), all four of `model-preselection.md`'s
+  continuation citations were already stale at this task's own merge
+  base: `src/init.ts` last moved on 2026-09-05 (`60cb546`, task agent-dx
+  #184, native Codex routing), and nothing detected the drift, since this
+  round-1 bullet's own fix added continuation extraction only, not
+  resolution, at the three sites above -- so the round-1 bundle re-run's
+  "zero unallowlisted findings" never actually re-checked those four
+  anchors' text against `src/init.ts` at head. All four re-pointed
+  (citation-only) against `src/init.ts` at head; the fourth (into
+  `composeClaudeAgentVariant`'s own call site) needed a freshly-derived
+  anchor since its old text no longer occurs there at all (the call now
+  takes three arguments, not two). `extractSiblingGuardCitations` is now
+  also what the three resolution sites above call, instead of each
+  running its own bespoke `matchAll(ANCHOR_CITATION_RE)` loop, so a
+  resolved continuation is checked by those properties exactly like a
+  full citation is; this is what would have caught the stale
+  `model-preselection.md` anchors, had it existed in round 1. Four
+  further gaps closed in the same extractor: `governingPathByParagraph`
+  now resets (not merely leaves stale) on an unresolved/ambiguous full
+  citation, matching okf-kit's own reset behaviour; a continuation-match
+  overlap filter now also drops a match whose immediately preceding text
+  is path-shaped regardless of file extension, so a citation into an
+  extension `ANCHOR_CITATION_RE` does not recognise (a `.toml`, a `.tsx`)
+  cannot have its own tail misread as a phantom continuation; the
+  left-to-right, nearest-preceding ordering of full and continuation
+  matches on one line, and the paragraph-scoping property (a continuation
+  never resolves across a paragraph boundary), are now both pinned by
+  fixtures rather than only described in a comment; and
+  `ANCHOR_CONTINUATION_CITATION_RE`'s anchor alternation (previously a
+  hand copy of `ANCHOR_CITATION_RE`'s own group 4 pattern) is now asserted
+  to be a substring of it, throwing at module load on drift. Residual,
+  unclosed this round, named next to the pre-existing fenced-code-block
+  gap in the extractor's own comment: this guard's continuation form
+  mirrors okf-kit's short-form BINDING RULE only, not its grammar (see
+  the round-1 bullet above), so okf-kit's own `citations-resolve` rule
+  still cannot see one of these citations at all; closing that gap means
+  either changing okf-kit's own grammar (out of this task's scope) or
+  accepting the guard-only coverage as the design. Review round 3 (LOW
+  5): the three resolution sites above inherit the extractor's two other
+  latent costs too, since they now call it -- a citation inside a fenced
+  code block goes unchecked at those sites as well, and a document ending
+  inside an unclosed fence makes them throw, same as this guard -- both
+  accepted as the same currently-unused-shape cost, not a new one.
+- Citation-sibling-drift guard, docs/okf/log.md's own citations (task
+  agent-dx b50fd903, review round 3, D-037): review round 2 found that
+  `log.md` -- excluded from `ANCHOR_OKF_DOCS` and therefore from every
+  guard above, and from okf-kit's own citation grammar too -- is read by
+  nothing, so citation-shaped historical text written into a log entry
+  goes unchecked; round 1 of this task had already removed such text from
+  one entry (`0f054d2`) and round 2 wrote the same shape into its own
+  entry again. Rather than another round of rephrasing that recurs on the
+  next entry, `log.md` gets its own guard in
+  `test/docs-consistency.test.ts`: every full, anchored citation it writes
+  must still resolve at head (the target exists, the anchor text sits
+  somewhere inside the cited range), and it may never carry the bundle's
+  path-less continuation form at all, since that form has no
+  governing-citation semantics in `log.md` -- nothing resolves a
+  continuation written there against anything, so it can only be stale
+  prose dressed as a citation. Fixtures pin both rules both ways (a stale
+  full citation fails, an unresolvable path fails, a continuation form
+  fails even when it would resolve, a clean entry passes); run against
+  the current bundle, both checks are clean, and every citation-shaped
+  historical value the run reported was rephrased as plain prose, in the
+  round-2 entry and in an older entry from task 9f72ae6d. Review round 4
+  (D-050) removed this bullet's original hit counts rather than
+  correcting them: they were typed by hand and did not match what the
+  guard produces (see the round-4 bullet below for the rule and for where
+  the live figures live instead).
+  The round-2 entry's own false same-round-CHANGELOG-line-shift narration
+  is corrected in place (see the review round 3 correction two bullets
+  above for the identical fix here); `docs/okf/index.md`'s Maintenance
+  section now names the new guard.
+- Citation scanning is paragraph-joined, and the log guard is no longer
+  silenceable (task agent-dx b50fd903, review round 4, D-050): both
+  citation scanners in `test/docs-consistency.test.ts` matched per
+  physical line while every doc in this bundle hard-wraps its prose, so a
+  citation whose own text straddled a wrap matched neither regex and was
+  invisible to every check built on them -- and re-running the regexes
+  over raw document text cannot close that, since the string-anchor
+  alternation forbids a newline inside the anchor by construction. Both
+  scanners now consume one shared `citationScanParagraphs` helper that
+  joins each paragraph's lines the way a hard wrap split them and maps
+  every joined offset back to its physical line, so findings, allowlist
+  geometry and failure messages still name real doc lines; a wrapped full
+  citation with a stale anchor and a wrapped continuation form are each
+  pinned by their own fixture. The same helper carries the one fence
+  pass, so the `log.md` guard inherits the unbalanced-fence throw the
+  round-3 hand copy had left behind (a single stray ``` excused every
+  citation after it), and its non-vacuity floor now carries the live
+  count in its own computed test name. The unanchored-citation brake and
+  the block-straddle collector take their doc set and resolver as
+  parameters, like the string-anchor collector already did, so the
+  "a resolved continuation survives this collector" property is pinned by
+  a synthetic doc set at all three sites instead of by source text alone;
+  the brake's examined count is pinned as an exact delta (one added full
+  citation raises it by one, one added continuation by one more) rather
+  than by a floor a dropped-continuation mutant could sink under. The
+  `log.md` resolver rejects a cited path carrying a `..` segment and
+  asserts repository containment on its on-disk fallback, and a bare
+  basename that also exists at the repository root is reported ambiguous
+  with both candidates named instead of silently binding to this
+  package's own file; the deeper repo-wide basename ambiguity okf-kit
+  reports is still bound unconditionally by `anchorScopeResolve()`'s own
+  documented design, named as the residual. Convention this round
+  installs (D-050): a log entry or CHANGELOG bullet writes no hand-typed
+  count of what a guard found; the live figures are the guards' own
+  computed test names, read off a passing run.
+
+### Fixed
+
+- Three unpinned properties from the review round 4 lows above
+  (task agent-dx 4ece8e1e) now have a discriminating fixture each: the
+  `log.md` resolver's on-disk fallback is checked against an existing,
+  outside-the-repository absolute path so its own containment conjunct is
+  no longer redundant with the `..`-segment rejection; `extractSiblingGuard
+  Citations` gets its own wrapped-citation fixture (full citation and
+  continuation each straddling a hard line break), independent of the
+  `log.md` guard's; and the previously duplicated `PATH_SHAPED_BEFORE_RE`
+  path-shaped regex is now one module-scope const both call sites read,
+  so the two copies can no longer drift apart.
+
+## [0.31.0] - 2026-09-07
+
+### Changed
+
+- Tests only, no asset wording change. The reviewer prompt's output-contract
+  yaml-block negative pin now slices from the output-contract heading (and
+  requires exactly one yaml fence after it) instead of matching the first
+  yaml fence in the file, so an unrelated fence earlier in the prompt cannot
+  be mistaken for the output contract. The CHANGELOG's own prose copy of the
+  fix-round mutation-probe replay rule is now pinned, anchored on the
+  bullet's own opening text rather than the release heading above it, so
+  the pin survives the bullet moving under a version heading. A new guard
+  asserts every reviewer checklist item mirrored in SKILL.md (Placement,
+  the GitHub Actions run-step replay, identifier drift) still carries its
+  SKILL.md counterpart sentence, from one table of paired phrases, so
+  either half going missing fails the same test.
+
+- The implementer prompt now requires running every long test, build, or
+  mutation-probe command in the foreground and waiting for it to finish
+  before returning, never backgrounding it and ending the turn: a batch
+  review found a probe run left running in the background whose result
+  was only recovered by resuming the subagent later, which is not
+  evidence the orchestrator can trust unattended. The reviewer and
+  implementer prompts now both caution against a spawned-CLI test
+  calibrated to a byte-count ceiling that sits inside the tool's own
+  run-to-run noise (timing digits, temp-directory names): a batch review
+  found exactly such a test pass locally and fail on the next run one
+  byte off, with no code change, and the fix is to pin the argument
+  under test in-process or assert the actual contract (a bound, or the
+  presence of a warning), never a byte ceiling. SKILL.md's Delegate
+  review step now prohibits running mutation probes in place against a
+  worktree a reviewer subagent is concurrently reviewing, after a batch
+  review found a reviewer verifying findings against a tree that was
+  mutating under it from a concurrent probe; the fix is worktree
+  isolation or waiting until the reviewer has returned. Consumers refresh
+  their installs at the next release to pick up all three prompt changes.
+  Motivated by agent-tasks task 0e17fb63; see `docs/okf/log.md` for the
+  incident detail behind each of the three rules.
+
 ## [0.30.0] - 2026-09-06
 
 ### Added

package/assets/agents/implementer.md

@@ -53,6 +53,17 @@ Rules:
   criteria name and report its summary under `tests.executed`; when a
   mutation-probe runner is available, run the named probes through it and
   copy its fields into `mutation_probes`.
+- Run every long test, build, or mutation-probe command in the foreground
+  and wait for it to finish before returning. When one foreground call
+  cannot hold it to completion, poll the backgrounded run to completion
+  and report its result before ending your turn; never end your turn with
+  the run still outstanding, since a run that outlives your turn is not
+  evidence you can report.
+- A test that spawns a CLI and asserts its output against a byte-count
+  ceiling calibrated to sit inside the output's own run-to-run noise
+  (timing digits, temporary-directory names) is not a regression test; pin
+  the argument under test in-process, or assert the actual contract (a
+  bound, or the presence of a warning), never a byte ceiling.
 - For any diff that adds or changes a GitHub Actions `run:` step, replay it
   locally under the shell the step actually runs: `bash --noprofile --norc
   -eo pipefail` when `shell: bash` is set on the step or via

package/assets/agents/reviewer.md

@@ -22,6 +22,25 @@ a version. For a recorded original string-list contract, retain the original
 and `criterion_evidence` fields; keep all existing role output fields. This
 selection governs the rules and every YAML block below.
 
+Review method: the orchestrator names `review_method: normal | rigorous |
+adversarial` in every briefing; treat an unnamed method as `rigorous`. The
+three methods are obligation sets, not personas: they define what you must
+read, reproduce, and probe, and how a non-reproducing finding is withdrawn,
+not how skeptical to sound.
+
+| Method | Obligations |
+|---|---|
+| `normal` | Read the diff and the spec; run the declared tests once; findings come only from what you read. `normal` adds nothing beyond the obligations already stated in the Check list and the Rules below, and suspends none of them: the empirical-reproduction rule and the GitHub Actions shell replay rule apply under every method. `normal` only means no further independent reproduction beyond what those already require. Fits docs, renames, and batch cosmetics. |
+| `rigorous` (default) | Everything `normal` requires, plus: your own extract of the change, a base-attribution control, classifying every change, and reproducing every empirical claim yourself. `reproduction` and `matches_implementer_claim` are mandatory, as already required below. |
+| `adversarial` | Everything `rigorous` requires, plus: one discriminating probe or negative control per acceptance criterion; an active search of the neighbouring scenario space (environment, install modes, platform, ordering, concurrency); an attempt to break the claimed invariant; and an explicit list of break attempts that failed. |
+
+Withdrawal rule (`rigorous` and `adversarial`): a finding that does not
+reproduce on a second attempt with a corrected harness is withdrawn in the
+same round, not carried into the next one, and reported under `withdrawn`
+with the reason; this keeps the method from buying false positives. Emit
+`withdrawn: []` when nothing was withdrawn. Report the method you actually
+applied in `method_applied`.
+
 Check, at minimum:
 
 - Acceptance baseline: for a run explicitly adopted as `acceptance-baseline/v1`,
@@ -38,7 +57,12 @@ Check, at minimum:
 - Edge cases: empty inputs, error paths, concurrency, encoding, limits.
 - Security: injection, path traversal, secrets, permissions, unsafe defaults.
 - Test adequacy: are the new or changed behaviors covered, and would the new
-  tests actually fail if the change were reverted? Flag inert tests.
+  tests actually fail if the change were reverted? Flag inert tests. A test
+  that spawns a CLI and asserts its output against a byte-count ceiling
+  calibrated to sit inside the output's own run-to-run noise (timing digits,
+  temporary-directory names) is not a regression test; the fix is to pin
+  the argument under test in-process, or assert the actual contract (a
+  bound, or the presence of a warning), never a byte ceiling.
 - Maintainability: naming, dead code, needless abstraction, doc drift.
 - Placement: does the change add org-, machine-, or point-in-time-bound
   evidence (dates, sample sizes, task ids, home paths, incident tallies) to a
@@ -140,4 +164,8 @@ reproduction:
   sample_size: ""
   result: ""
   matches_implementer_claim: matched | mismatched | not_applicable
+method_applied: normal | rigorous | adversarial
+withdrawn:
+  - description: ""
+    reason: ""
 ```

package/assets/agents-md-section.md

@@ -49,6 +49,13 @@ default, not a ritual.
   orchestrator may review it itself; reserve the reviewer subagent for
   changes whose risk or size warrants an independent skeptical pass. Either
   way, review is never skipped.
+- Every reviewer briefing also names a `review_method`: `normal | rigorous |
+  adversarial`, an obligation set orthogonal to the effort tier below.
+  `adversarial` is the minimum for security judgment, install/deploy
+  scripts, hand-edited lockfiles, cross-major overrides, or anything the
+  operator flags high-risk; `normal` fits only docs, renames, or batch
+  cosmetics; `rigorous` is the default otherwise. Never pair `adversarial`
+  with the `-medium` reviewer tier; tiers themselves are unchanged.
 - When tier variants are installed (manifest `tiers: true`), the orchestrator
   picks the effort tier per task by complexity and risk, at its own judgment.
   The unsuffixed default subagent is the normal case; `-high`/`-xhigh` fit

package/assets/skill/SKILL.md

@@ -251,7 +251,16 @@ directory and the subagents.
    `reviewer-<tier>` subagents, if any) by the task's complexity and risk, at
    your own judgment, defaulting to the unsuffixed subagent when unsure; record
    a non-default tier choice with a one-line reason in `03-decisions.md` when
-   the task is non-trivial. When the reviewer's environment cannot use version
+   the task is non-trivial. Also name `review_method: normal | rigorous |
+   adversarial` in the briefing; every briefing names one. Pick it by risk
+   class: `adversarial` at minimum for security judgment, install/deploy
+   scripts, hand-edited lockfiles, cross-major overrides, or anything the
+   operator flags high-risk; `normal` only for docs, renames, or batch
+   cosmetics; `rigorous` otherwise. The method is orthogonal to the tier and
+   never substitutes for it: do not pair `adversarial` with the `-medium`
+   reviewer tier, a budget mismatch that names probes without the effort to
+   run them; tiers themselves are unchanged by this axis. When the
+   reviewer's environment cannot use version
    control to see the diff (for example a policy-gated repository), supply the
    diff as a pre-generated file in the briefing instead of expecting the
    reviewer to derive it, and have the reviewer report explicitly if it could
@@ -273,8 +282,8 @@ directory and the subagents.
    implementer's log — and record the method, sample size, and result against
    the implementer's claim in the reviewer output contract's `reproduction`
    field. This does not apply to deterministic checks (a single test run,
-   `tsc`, lint): only claims that could vary run to run trigger it. The
-   GitHub Actions shell replay named in step 6 is a second, explicitly
+   `tsc`, lint): only claims that could vary run to run trigger it. The GitHub
+   Actions shell replay named in step 6 is a second, explicitly
    non-probabilistic trigger for the same field, with `sample_size:
    not_applicable` allowed when the replay itself has no meaningful sample
    size. A change that deletes or renames an exported identifier, type, config
@@ -282,18 +291,21 @@ directory and the subagents.
    describing the old name as current), by the reviewer or by the orchestrator
    itself when it reviews a trivial rename per Scaling delegation, using a
    connected drift check when one exists. When this is not the task's first
-   review round, name the round
-   number in the briefing; the reviewer marks each finding's `recurrence` as
-   `new` or `repeated` against the earlier rounds it was told about, which is
-   what lets the orchestrator detect the Review-round escalation budget's
-   trigger (see below) without re-deriving it by hand. When the implementer's
-   report replays a prior round's mutation probe, the orchestrator's reviewer
-   briefing names the replayed probes the implementer reports as killed
-   together with their `mutant` and `verified_applied_via` values; the reviewer
-   may then skip re-running those. The reviewer output contract itself is
-   unchanged. For an explicitly adopted v1 run, ask the reviewer to compare the frozen delegated criteria with
-   the referenced evidence and judge semantic adequacy, including whether a
-   manual check is actually concrete and reasoned.
+   review round, name the round number in the briefing; the reviewer marks each
+   finding's `recurrence` as `new` or `repeated` against the earlier rounds it
+   was told about, which is what lets the orchestrator detect the Review-round
+   escalation budget's trigger (see below) without re-deriving it by hand. When
+   the implementer's report replays a prior round's mutation probe, the
+   orchestrator's reviewer briefing names the replayed probes the implementer
+   reports as killed together with their `mutant` and `verified_applied_via`
+   values; the reviewer may then skip re-running those. The reviewer output
+   contract itself is unchanged. Never run mutation probes in place against a
+   worktree a reviewer subagent is concurrently reviewing; isolate the probe in
+   a separate worktree or wait until the reviewer has returned before probing
+   that tree again. For an explicitly adopted v1 run, ask the reviewer to
+   compare the frozen delegated criteria with the referenced evidence and judge
+   semantic adequacy, including whether a manual check is actually concrete and
+   reasoned.
 8. **Decide acceptance.** Accept, request fixes, defer, or escalate to the
    operator. High or critical findings block acceptance until fixed or
    explicitly waived: critical findings require operator sign-off; high
@@ -517,6 +529,10 @@ reproduction:
   sample_size: ""
   result: ""
   matches_implementer_claim: matched | mismatched | not_applicable
+method_applied: normal | rigorous | adversarial
+withdrawn:
+  - description: ""
+    reason: ""
 ```
 
 `acceptance_recommendation` is mandatory: every reviewer return must set it.
@@ -529,6 +545,15 @@ one that already appeared in an earlier round. On a task's first review
 round every finding is `new` by definition. This is what feeds the
 Review-round escalation budget's trigger.
 
+`method_applied` echoes the `review_method` named in the briefing (see step
+7); `withdrawn` lists each finding the reviewer proposed and then retracted
+under the withdrawal rule (`rigorous` and `adversarial` only), with its
+reason; emit `withdrawn: []` when nothing was withdrawn. Until a
+grounding-mcp reader parses the marker (tracked as a cross-repo
+follow-up), the orchestrator checks by hand that the return's
+`method_applied` matches the briefing's `review_method`; a mismatch or
+omission is resupplied, not accepted.
+
 ## Task slicer output contract
 
 Use this v1 block subject to Contract selection above for every task.

package/assets/templates/05-review-findings.md

@@ -4,6 +4,11 @@
 
 <!-- Short summary. -->
 
+<!-- review-method[<round>] = normal|rigorous|adversarial -->
+Method: normal | rigorous | adversarial (the `review_method` named in this
+round's briefing and the `method_applied` the reviewer returned; not parsed
+by the grounding-mcp completeness reader yet).
+
 ## Findings
 
 <!-- The Severity and Decision column headers below are load-bearing: the orchestrator-workflow completeness reader locates this table by its header row and verifies unresolved findings from those two columns. Do not rename or drop them. -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orchestrator-workflow",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "Installer for an orchestrator-led agent workflow: .ai/ run state, an AGENTS.md policy section, and per-harness subagent definitions for Claude Code, OpenAI Codex, and opencode",
   "main": "dist/index.js",
   "type": "module",