orchestrator-workflow 0.31.0 → 0.33.0

package/CHANGELOG.md

@@ -7,6 +7,441 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-09-12
+
+### Changed
+
+- Implementer reports now paste non-empty commit lists from `git log --reverse
+  --format=%H <base>..HEAD`, and foreground verification/probe plans and
+  repeat tallies return in the same turn as the last check; a background
+  monitor does not substitute. Anchored by pandora batch48 evidence.
+
+- The implementer output contract now enumerates mutation-probe `result` as
+  `killed | survived | not_applicable` in both the installed prompt and the
+  SKILL.md reference. The docs-consistency guard separately pins each copy's
+  complete field block, including that enum, and now recognizes versioned
+  parenthesized headings in `see <name> below` forward pointers.
+
+- The implementer and reviewer prompts (`assets/agents/implementer.md`,
+  `assets/agents/reviewer.md`, mirrored in SKILL.md) now say: cite a
+  coverage gate's threshold and pass/fail counts, not a run-specific
+  coverage percentage; cite a percentage only together with the exact
+  commit and the run count, since branch coverage varies between runs of
+  the same commit. Anchored by pandora run
+  `.ai/runs/2026-09-11-memory-sync-wipe`.
+- The implementer `mutation_probes` output field (`assets/agents/
+  implementer.md`, mirrored in SKILL.md, and the `04-implementation-
+  summary.md` template's Mutation Probes table) now carries the mutant's
+  definition, not only its label: `file`, `anchor` (a line number or a
+  unique string), `before`, and `after` alongside the existing
+  `verified_applied_via`, `result`, `restored_verified`, and `replayed`
+  fields, so a later round can mechanically reapply the same edit instead
+  of only reading a prose description. Added `expectation: met | violated
+  | not_applicable` beside `result`, reporting whether the probe's
+  `result` matched its `--expect`, scoped to a measured `killed` or
+  `survived` `result` (a routine negative-control probe now reports
+  `result: survived, expectation: met`, which is not a regression) and
+  `not_applicable` otherwise (for example when the mutant could not be
+  applied and no `result` was measured). Added an eleventh sub-field,
+  `reason`: free text, required when `result` is `not_applicable`, empty
+  otherwise, carrying one of two canonical strings that distinguish a
+  non-regression from a regression: `no definition recorded` (a
+  prior-round probe recorded with only an id, no definition to reapply)
+  and `target text no longer present` (a replayed probe whose mutant can
+  no longer be applied). The fix-round replay rule now names a
+  probe to replay by its definition, not merely by its id, and treats a
+  replayed probe whose `expectation` is now `violated` (or which can no
+  longer be applied) as the regression signal, not `result` alone.
+  Anchored by pandora run `.ai/runs/2026-09-11-memory-sync-wipe` and the
+  agent-primitives `probe` result/expectation split (0.3.0).
+
+## [0.32.0] - 2026-09-11
+
+### Added
+
+- A review-method axis, orthogonal to the effort tier: every reviewer
+  briefing now names `review_method: normal | rigorous | adversarial`
+  (`assets/agents/reviewer.md`, SKILL.md step 7, the kit-fence
+  Scaling-delegation text). The three methods are obligation sets, not
+  personas: `normal` reads the diff and spec and runs the declared tests
+  once, for docs/renames/batch cosmetics; `rigorous` (the default when a
+  briefing names none) adds an independent extract, a base-attribution
+  control, and mandatory reproduction of every empirical claim (the
+  pre-existing `reproduction`/`matches_implementer_claim` requirement);
+  `adversarial` adds one discriminating probe or negative control per
+  acceptance criterion, an active search of the neighbouring scenario
+  space, an attempt to break the claimed invariant, and a list of break
+  attempts that failed. `adversarial` and `rigorous` both carry a
+  withdrawal rule: a finding that does not reproduce on a second attempt
+  with a corrected harness is withdrawn in the same round and reported
+  under a `withdrawn` list with the reason, so the method cannot buy false
+  positives; emit `withdrawn: []` when nothing was withdrawn. The reviewer
+  output contract (both copies, `reviewer.md` and SKILL.md) gains
+  `method_applied` and `withdrawn`; until the grounding-mcp reader parses
+  the marker (agent-grounding follow-up 5df7b809), the orchestrator checks
+  by hand that the return's `method_applied` matches the briefing's
+  `review_method`, resupplying a mismatch or omission rather than
+  accepting it.
+  `assets/templates/05-review-findings.md` gains a `Method` line per review
+  round, outside the pinned Findings table
+  (`test/template-markers.test.ts` pins it); the grounding-mcp
+  completeness reader does not parse it yet, tracked as a follow-up in the
+  agent-grounding repo. SKILL.md's selection rule: `adversarial` at
+  minimum for security judgment, install/deploy scripts, hand-edited
+  lockfiles, cross-major overrides, or anything the operator flags
+  high-risk; `normal` only for docs, renames, or batch cosmetics;
+  `rigorous` otherwise; never `adversarial` on the `-medium` reviewer tier
+  (budget mismatch). Tiers themselves are unchanged. Anchored by the
+  pandora run `2026-09-11-cve-sweep`: reviews R1, R5, R11, R13 and R14
+  found the Critical and High findings by probing; R4, R6 and R9 on the
+  default method returned no findings and R8 only two informational lows;
+  R5 withdrew a harness artefact. The selection rule stays advisory, not
+  an AGENTS.md rule, until an A/B (same tasks, run once under `rigorous`
+  and once under `adversarial`, counting real Critical/High findings and
+  findings withdrawn) is recorded.
+
+- A citation-sibling-drift guard (`test/docs-consistency.test.ts`, next to
+  the existing anchor-load-bearing checks) catches a citation that resolves
+  and anchors correctly on its own but names the wrong sibling among a run
+  of near-identical citations, a class neither okf-kit's `citations-resolve`
+  rule nor the local anchor guards can see, because both check an anchor
+  only inside its own cited range. Two rules, applied per paragraph: (a) the
+  same `file:range#anchor` cited twice in one paragraph, unless allowlisted
+  with a reason; (b) a string anchor's text also occurring, uncited, at
+  another line of the same target within a 20-line window (widened from 10
+  in review round 2, see below) while the paragraph cites a sibling range
+  of that file, unless allowlisted. Fixtures
+  reproduce three review findings that shared this shape and were the
+  motivation for the guard: three sibling `it`-block citations collapsing
+  onto one range twice, the third never cited; three per-harness bullet
+  citations doing the same; two logically distinct assertions collapsing
+  onto one shared range and anchor text, the second's own line never cited.
+  Run over the current bundle, every hit either rule reports is read
+  against its own target file and the citing paragraph, then fixed or
+  allowlisted; the measured per-rule hit counts live in `docs/okf/log.md`
+  with the classification that produced them, not here, so the two sites
+  cannot drift apart. The recurring coincidence shapes are a doc-wide
+  "topic sentence, then repeat as the closing list item" convention for
+  rule (a), and a short or common token -- a keyword, a mirrored field on
+  twin interfaces, a comment restating a literal, a test-assertion idiom on
+  an adjacent line, a reused local variable name -- recurring near a real
+  citation for rule (b). Lives in this file rather than as an okf-kit rule
+  because this
+  suite already runs on every PR while an okf-kit rule needs a release and
+  a fleet pin bump first; an opt-in okf-kit rule for the same class is a
+  named follow-up candidate once this guard has proven itself.
+- Review round 2 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): the round-1 review found 7 of the round's 18 raw hits were not
+  coincidental at all -- real mis-pointed citations that got allowlisted
+  instead of fixed, because the round-1 pass classified every hit by range
+  and reason without re-deriving each cited claim's real evidence line by
+  line. All seven re-pointed to their real evidence, citation-only, no
+  content changes: a duplicate `docs-consistency.test.ts` self-citation
+  whose second claim's real test sat 26 lines below the first
+  (`subagent-contracts-superset.md`); an `init.test.ts` range that stopped
+  6 lines short of the `model: opus` assertion it named
+  (`model-preselection.md`); a `SKILL.md` duplicate whose first claim's
+  real text sat just above the cited line (`run-state-lifecycle-and-
+  markers.md`); an `init.ts` comment cited in place of the real
+  `installKitFile` call it restates (`install-fence-mechanics.md`); an
+  `init.ts` range crossing from one branch of `installKitFile` into
+  another branch's own record line (`install-fence-mechanics.md`); an
+  `init.ts` range naming the wrong call for an `opencodeEffortLine(...)`
+  claim (`model-preselection.md`, cited from two spellings of the same
+  path); and a milder range that stopped 1 line short of the parameter its
+  own sentence's second half named (`install-fence-mechanics.md`). Widened
+  `SIBLING_GUARD_WINDOW` from 10 to 20 once a real case fell just outside
+  it (two genuinely distinct `init.ts` notes sharing one message, 18 lines
+  apart, both legitimate and now allowlisted per doc); re-triaged every
+  additional hit the wider window surfaced against the bundle, fixing or
+  allowlisting each with a reason stating what the cited line actually
+  says (see `docs/okf/log.md` for the full re-triage and the re-measured
+  counts). Added `anchorKey` (first 8 hex chars of a sha256 over the
+  finding's own anchor text, computed at test time, never stored literally
+  in the array) to every allowlist entry and to the match, plus a test
+  asserting every entry matched at least one finding on the current
+  bundle, closing a gap where a range-only match would silently exempt any
+  future, differently-anchored finding on the same range. Added a fixture
+  at the real batch-39 S3 geometry (a literal duplicate citation, its real
+  sibling 15 lines away, not the original fixture's 10-line near-miss
+  range) asserting both rules' behaviour, and a negative fixture pinning
+  that the duplicate-citation rule fires regardless of window, since it is
+  a pairing comparison, not a windowed one. Two coverage gaps noted in the
+  guard's own comment and here rather than closed this round: a path-less
+  continuation citation (`:N-M#"..."`, whose path is implied by the
+  preceding citation) never matches the citation regex, so this guard
+  cannot see one -- extending the regex to resolve a continuation's
+  implied path is a named follow-up; and a citation-shaped string inside a
+  fenced ` ``` ` code block is now skipped rather than matched (closing the
+  reverse risk of misreading a code sample as a citation), a cheap
+  addition alongside the rest of this round's work.
+- Review round 3 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): a second consecutive review round found allowlist entries that
+  certified real wrong-sibling drift, so this round changes the mechanism
+  rather than only the entries. An allowlist entry now records the
+  GEOMETRY it was cleared against -- the target-file line(s) carrying the
+  uncited identical anchor text for a rule-(b) entry, the doc line the
+  repeat sits on for a rule-(a) one -- and that geometry is part of the
+  match, so an entry exempts only the hit it was actually reviewed for: a
+  new uncited occurrence next to an already-cleared one, or a repeat that
+  moved to another doc line, fails instead of inheriting the old verdict. A
+  test re-reads those recorded lines against the current files
+  independently of the guard's own output (the anchor text is re-derived
+  from the doc's own citation, since the array deliberately stores a hash
+  rather than the literal text), so an entry whose situation no longer
+  exists goes red instead of silently exempting a different one. The
+  free-form `reason` field is replaced by `claim`: one sentence naming what
+  the citing sentence describes and why the cited line, rather than the
+  uncited sibling, is its evidence, written so a reviewer can falsify it by
+  reading exactly the two lines the entry names. Process, recorded in
+  `docs/okf/log.md` with each round's classification: an allowlist entry is
+  accepted only on an INDEPENDENT review classification of the hit, never
+  on the reading of whoever implemented or re-pointed the citation, which
+  is how both earlier rounds' wrong verdicts reached a green suite.
+  Re-pointed the pair this round's review found (a sentence about the
+  dropped-role tier-variant SUB-loop citing the enclosing loop's own note
+  range, in two docs) to the sub-loop's own note, dropped their entries,
+  and re-triaged every remaining hit at the current window against its
+  target file. Also citation-only: a fence-contract citation that stopped
+  short of the assertion its sentence names, a run-state citation one line
+  short of the sentence it supports, and a slicer-superset citation whose
+  sentence's second half is now cited from the test that actually pins it.
+  Two more fixtures: rule (b) firing at the guard's window and staying
+  silent at the round-1 value of 10 for an uncited occurrence 15 lines
+  outside the cited range (the window was previously pinned only
+  indirectly, through the no-dead-exemption test), and a doc that ends
+  inside an unclosed fence now failing loudly instead of silently dropping
+  every citation after the stray delimiter, paired with an assertion that
+  every bundle doc yields at least one citation.
+- Review round 4 of the citation-sibling-drift guard above (task agent-dx
+  9f72ae6d): a third consecutive review classified every allowlist entry
+  by re-reading the two lines each `claim` names, rather than trusting the
+  prior round's verdicts; none certified real drift, but two claims were
+  inaccurate and one more citation was mis-paired in a shape the guard
+  itself cannot see. Rule (a)'s match compared only the finding's second
+  citation line, which a `return true;` mutant of that comparison
+  survives, and which also could not tell a two-citation entry's cleared
+  repeat from a THIRD, unreviewed repeat sharing the same second line;
+  fixed with a dedicated fixture and a repeat-count check. The allowlist
+  entry's match and its independent geometry re-check both gained
+  `paragraphLine`, the doc line of the finding's own first citation: an
+  entry was previously keyed by (doc, kind, real target, range, anchorKey,
+  recorded geometry) alone, so the same coincidence recurring in a SECOND,
+  unreviewed paragraph of a doc would silently inherit the first
+  paragraph's verdict -- exactly the shape one entry was carrying (the
+  same `init.ts` range cited, and separately drifting, from two paragraphs
+  of `model-preselection.md`); the second paragraph's citation is now
+  re-pointed to its own, different evidence instead, so the entry covers
+  one paragraph only. The geometry re-check's duplicate-citation branch
+  dropped a near-tautological "some citation exists at the recorded line"
+  check (true of any citation the extractor produces, by construction) for
+  one that reads the group's own citations, sorts them into document
+  order, and checks the recorded lines by POSITION -- closing a mutant
+  (`if (false)` on the old guard) no existing fixture caught. The bare
+  `claim.length > 40` sanity check now also rejects a claim that never
+  names one of its own entry's recorded lines, closing the gap that let
+  three `subagent-contracts-superset.md` entries carry a long claim that
+  never actually pointed at its own geometry. One inaccurate claim
+  (`model-preselection.md`) said an uncited line named a "codex-only
+  effort field"; it is opencode's own field for a non-Claude-family,
+  non-Ollama provider, not a codex field at all, and no anchor exists that
+  can widen the citation to cover it under this file's own occurrence-cap
+  rule, so the claim was corrected instead. One real mis-pairing:
+  `install-fence-mechanics.md` cited the OUTER per-dropped-role loop's
+  gate/note for a sentence about the tier-variant SUB-loop, and the
+  sub-loop's own gate/note for a sentence about the base-file note --
+  swapped, citation-only, no content change. Known limit, unclosed this
+  round: neither rule catches a citation that resolves and anchors cleanly
+  but simply names the WRONG target -- no duplication, no anchor text
+  recurring nearby -- which is exactly the shape this round's real
+  mis-pairing was; both citations passed every existing check (including
+  this guard) because nothing about either one, read alone or against its
+  paragraph's siblings, looks wrong.
+- Citation-sibling-drift guard, continuation-citation coverage (task
+  agent-dx b50fd903): closed the guard's own documented coverage gap
+  (round 1) that a path-less continuation citation (`:N-M#"..."`, whose
+  path is implied by the preceding FULL citation earlier in the same
+  paragraph) never matched `ANCHOR_CITATION_RE`, so the guard could not
+  see one at all -- the form `model-preselection.md` alone carries four
+  of. `extractSiblingGuardCitations` now also matches the anchored,
+  path-less tail on its own (`ANCHOR_CONTINUATION_CITATION_RE`, anchor
+  group required so a bare `:N-M` digit pair in ordinary prose is never
+  mistaken for one) and resolves it against `governingPathByParagraph`,
+  the nearest preceding full citation's own `citedPath` in the same
+  paragraph -- the same "nearest preceding, same paragraph" BINDING RULE
+  okf-kit's own short-form/continuation citations use in
+  `citations-resolve.ts`. That mirrors the binding rule only, not the
+  grammar (review round 3 correction: this bundle's anchored, path-less
+  `:N-M#"..."` form IS backtick-wrapped; an earlier version of this
+  bullet said it was not). okf-kit's own `CONT_COLON_RE` still misses it
+  because its own closing backtick has to follow the digit range
+  immediately, and this form's closing backtick follows the `#"anchor"`
+  tail instead; `SHORT_FORM_COLON_RE` misses it too, both because a match
+  right after a backtick is skipped and because no serial connective
+  ("and", "also", ...) precedes it either -- okf-kit sees these citations
+  as nothing at all, not merely as unresolved ones. Two fixtures pin the
+  closed gap: a path-less
+  continuation duplicating its governing citation's own range and anchor
+  is flagged by the duplicate rule (drifted/corrected), and a
+  discriminating fixture with two different full citations in one
+  paragraph before the continuation, which only passes when the
+  continuation binds to the NEARER of the two, not the paragraph's first.
+  Run against the current bundle, the newly-visible continuation
+  citations in `model-preselection.md` produced no new SIBLING-GUARD
+  finding (duplicate-citation/wrong-sibling-anchor), allowlisted or
+  otherwise -- see `docs/okf/log.md`. That measurement did not cover
+  whether each continuation's own anchor still resolved against its
+  target at head; it did not, by the time this round's own CHANGELOG line
+  shift landed a few commits later -- see the round-2 follow-up bullet
+  below.
+- Citation-sibling-drift guard, okf-kit-porting decision (task agent-dx
+  b50fd903, run `.ai/runs/2026-09-08-open-pool-batch44` D-006): the guard
+  stays kit-local (this package's own `test/docs-consistency.test.ts`),
+  not ported to okf-kit as an opt-in `citations-sibling` check. Who pays:
+  kit-local means only this package's own OKF bundle is guarded by it,
+  and every other fleet bundle with sibling citations (a paragraph
+  repeating, or near-duplicating, one of its own citations) stays
+  unguarded until each such bundle's own docs-consistency-style suite
+  grows the same check by hand; porting would instead put the maintenance
+  on okf-kit's maintainers, who would then carry the rule itself, the
+  allowlist shape (recorded geometry, a falsifiable one-sentence claim,
+  and the independent-review-classification process this file's own
+  allowlist process block already documents) as a public, cross-repo
+  contract, and a fleet-wide pin bump on every fix to it. Trigger to
+  revisit: a second fleet bundle observed carrying real sibling-citation
+  drift in a review pass (not merely plausible in the abstract) reopens
+  the port decision.
+- Citation-sibling-drift guard, continuation-citation coverage, review
+  round 2 (task agent-dx b50fd903): the round-1 bullet above added
+  continuation-citation EXTRACTION but not RESOLUTION at the three
+  `matchAll(ANCHOR_CITATION_RE)` sites that check "anchor on last content
+  line", "anchor <=3 times file-wide/exactly once in-range", "unanchored
+  citation", and "citation stays inside one describe/it/test block" --
+  and, separately (review round 3 correction: an earlier version of this
+  bullet blamed a same-round CHANGELOG.md line shift for staling
+  `src/init.ts`'s own line numbers; false, since editing CHANGELOG.md
+  cannot move a different file's lines, and this branch had not touched
+  `src/` yet at that point), all four of `model-preselection.md`'s
+  continuation citations were already stale at this task's own merge
+  base: `src/init.ts` last moved on 2026-09-05 (`60cb546`, task agent-dx
+  #184, native Codex routing), and nothing detected the drift, since this
+  round-1 bullet's own fix added continuation extraction only, not
+  resolution, at the three sites above -- so the round-1 bundle re-run's
+  "zero unallowlisted findings" never actually re-checked those four
+  anchors' text against `src/init.ts` at head. All four re-pointed
+  (citation-only) against `src/init.ts` at head; the fourth (into
+  `composeClaudeAgentVariant`'s own call site) needed a freshly-derived
+  anchor since its old text no longer occurs there at all (the call now
+  takes three arguments, not two). `extractSiblingGuardCitations` is now
+  also what the three resolution sites above call, instead of each
+  running its own bespoke `matchAll(ANCHOR_CITATION_RE)` loop, so a
+  resolved continuation is checked by those properties exactly like a
+  full citation is; this is what would have caught the stale
+  `model-preselection.md` anchors, had it existed in round 1. Four
+  further gaps closed in the same extractor: `governingPathByParagraph`
+  now resets (not merely leaves stale) on an unresolved/ambiguous full
+  citation, matching okf-kit's own reset behaviour; a continuation-match
+  overlap filter now also drops a match whose immediately preceding text
+  is path-shaped regardless of file extension, so a citation into an
+  extension `ANCHOR_CITATION_RE` does not recognise (a `.toml`, a `.tsx`)
+  cannot have its own tail misread as a phantom continuation; the
+  left-to-right, nearest-preceding ordering of full and continuation
+  matches on one line, and the paragraph-scoping property (a continuation
+  never resolves across a paragraph boundary), are now both pinned by
+  fixtures rather than only described in a comment; and
+  `ANCHOR_CONTINUATION_CITATION_RE`'s anchor alternation (previously a
+  hand copy of `ANCHOR_CITATION_RE`'s own group 4 pattern) is now asserted
+  to be a substring of it, throwing at module load on drift. Residual,
+  unclosed this round, named next to the pre-existing fenced-code-block
+  gap in the extractor's own comment: this guard's continuation form
+  mirrors okf-kit's short-form BINDING RULE only, not its grammar (see
+  the round-1 bullet above), so okf-kit's own `citations-resolve` rule
+  still cannot see one of these citations at all; closing that gap means
+  either changing okf-kit's own grammar (out of this task's scope) or
+  accepting the guard-only coverage as the design. Review round 3 (LOW
+  5): the three resolution sites above inherit the extractor's two other
+  latent costs too, since they now call it -- a citation inside a fenced
+  code block goes unchecked at those sites as well, and a document ending
+  inside an unclosed fence makes them throw, same as this guard -- both
+  accepted as the same currently-unused-shape cost, not a new one.
+- Citation-sibling-drift guard, docs/okf/log.md's own citations (task
+  agent-dx b50fd903, review round 3, D-037): review round 2 found that
+  `log.md` -- excluded from `ANCHOR_OKF_DOCS` and therefore from every
+  guard above, and from okf-kit's own citation grammar too -- is read by
+  nothing, so citation-shaped historical text written into a log entry
+  goes unchecked; round 1 of this task had already removed such text from
+  one entry (`0f054d2`) and round 2 wrote the same shape into its own
+  entry again. Rather than another round of rephrasing that recurs on the
+  next entry, `log.md` gets its own guard in
+  `test/docs-consistency.test.ts`: every full, anchored citation it writes
+  must still resolve at head (the target exists, the anchor text sits
+  somewhere inside the cited range), and it may never carry the bundle's
+  path-less continuation form at all, since that form has no
+  governing-citation semantics in `log.md` -- nothing resolves a
+  continuation written there against anything, so it can only be stale
+  prose dressed as a citation. Fixtures pin both rules both ways (a stale
+  full citation fails, an unresolvable path fails, a continuation form
+  fails even when it would resolve, a clean entry passes); run against
+  the current bundle, both checks are clean, and every citation-shaped
+  historical value the run reported was rephrased as plain prose, in the
+  round-2 entry and in an older entry from task 9f72ae6d. Review round 4
+  (D-050) removed this bullet's original hit counts rather than
+  correcting them: they were typed by hand and did not match what the
+  guard produces (see the round-4 bullet below for the rule and for where
+  the live figures live instead).
+  The round-2 entry's own false same-round-CHANGELOG-line-shift narration
+  is corrected in place (see the review round 3 correction two bullets
+  above for the identical fix here); `docs/okf/index.md`'s Maintenance
+  section now names the new guard.
+- Citation scanning is paragraph-joined, and the log guard is no longer
+  silenceable (task agent-dx b50fd903, review round 4, D-050): both
+  citation scanners in `test/docs-consistency.test.ts` matched per
+  physical line while every doc in this bundle hard-wraps its prose, so a
+  citation whose own text straddled a wrap matched neither regex and was
+  invisible to every check built on them -- and re-running the regexes
+  over raw document text cannot close that, since the string-anchor
+  alternation forbids a newline inside the anchor by construction. Both
+  scanners now consume one shared `citationScanParagraphs` helper that
+  joins each paragraph's lines the way a hard wrap split them and maps
+  every joined offset back to its physical line, so findings, allowlist
+  geometry and failure messages still name real doc lines; a wrapped full
+  citation with a stale anchor and a wrapped continuation form are each
+  pinned by their own fixture. The same helper carries the one fence
+  pass, so the `log.md` guard inherits the unbalanced-fence throw the
+  round-3 hand copy had left behind (a single stray ``` excused every
+  citation after it), and its non-vacuity floor now carries the live
+  count in its own computed test name. The unanchored-citation brake and
+  the block-straddle collector take their doc set and resolver as
+  parameters, like the string-anchor collector already did, so the
+  "a resolved continuation survives this collector" property is pinned by
+  a synthetic doc set at all three sites instead of by source text alone;
+  the brake's examined count is pinned as an exact delta (one added full
+  citation raises it by one, one added continuation by one more) rather
+  than by a floor a dropped-continuation mutant could sink under. The
+  `log.md` resolver rejects a cited path carrying a `..` segment and
+  asserts repository containment on its on-disk fallback, and a bare
+  basename that also exists at the repository root is reported ambiguous
+  with both candidates named instead of silently binding to this
+  package's own file; the deeper repo-wide basename ambiguity okf-kit
+  reports is still bound unconditionally by `anchorScopeResolve()`'s own
+  documented design, named as the residual. Convention this round
+  installs (D-050): a log entry or CHANGELOG bullet writes no hand-typed
+  count of what a guard found; the live figures are the guards' own
+  computed test names, read off a passing run.
+
+### Fixed
+
+- Three unpinned properties from the review round 4 lows above
+  (task agent-dx 4ece8e1e) now have a discriminating fixture each: the
+  `log.md` resolver's on-disk fallback is checked against an existing,
+  outside-the-repository absolute path so its own containment conjunct is
+  no longer redundant with the `..`-segment rejection; `extractSiblingGuard
+  Citations` gets its own wrapped-citation fixture (full citation and
+  continuation each straddling a hard line break), independent of the
+  `log.md` guard's; and the previously duplicated `PATH_SHAPED_BEFORE_RE`
+  path-shaped regex is now one module-scope const both call sites read,
+  so the two copies can no longer drift apart.
+
 ## [0.31.0] - 2026-09-07
 
 ### Changed

package/assets/agents/implementer.md

@@ -31,28 +31,56 @@ Rules:
 - Touch only the files relevant to the assigned task. Respect the
   allowed_changes and forbidden_changes lists in your task contract.
 - Add or update tests where appropriate. Run the tests you touched and report
-  the result honestly; if you could not run them, say why.
+  the result honestly; if you could not run them, say why. Cite a coverage
+  gate's threshold and pass/fail counts, not a run-specific coverage
+  percentage; cite a percentage only together with the exact commit and the
+  run count, since branch coverage can vary between runs of the same commit.
 - When the task assignment names mutation probes to run, run each one and
-  report it in the `mutation_probes` field of your output (mutant,
-  verified_applied_via, result, restored_verified); an output missing that
-  field when probes were named is treated as a misfire, not evidence. When
-  the assignment names no mutation probes, return `mutation_probes: []`
-  rather than omitting the field. Each item also carries `replayed`:
-  `false` for a probe newly introduced this round.
+  report it in the `mutation_probes` field of your output (mutant, file,
+  anchor, before, after, verified_applied_via, result, expectation,
+  reason, restored_verified); an output missing that field when probes
+  were named is treated as a misfire, not evidence. `file` and `anchor`
+  (a line number or a unique surrounding string) locate the mutant;
+  `before` and `after` are the exact text swapped there, so a later round
+  can reapply the same edit without guessing instead of only a prose
+  description. `expectation` records whether `result` matched what the
+  probe was expected to do (`met`) or not (`violated`), independent of
+  `result` itself, only alongside a measured `killed` or `survived`
+  `result`; it is `not_applicable` otherwise (for example when the mutant
+  could not be applied and no `result` was measured). `reason` is free
+  text, required when `result` is `not_applicable`, empty otherwise,
+  carrying one of two canonical strings that distinguish a non-regression
+  from a regression: `no definition recorded` (a prior-round probe
+  recorded with only an id, no definition to reapply) and `target text no
+  longer present` (a replayed probe whose mutant can no longer be
+  applied). When the assignment names no mutation probes, return
+  `mutation_probes: []` rather than omitting the field.
+  Each item also carries `replayed`: `false` for a probe newly
+  introduced this round.
 - On any round after the task's first, the assignment also names every
   mutation probe named in an earlier round of this task (on the task's
   first round there are none), drawn from the run's
-  `04-implementation-summary.md`. Replay each one, not only this round's
-  new probes, before returning your report, and report each replayed
-  probe in `mutation_probes` with the four evidence fields plus
-  `replayed: true`. A replayed probe whose mutant now survives or can no
-  longer be applied is a regression signal: report it as such (`result`
-  `survived` or `not_applicable` with the reason) and resolve it before
-  the next reviewer spawn.
+  `04-implementation-summary.md`, naming each by its mutant definition
+  (file, anchor, before, after), not merely by its id; a probe recorded
+  with only an id and no definition to reapply cannot be replayed and is
+  `not_applicable` (reason: `no definition recorded`), not a regression.
+  Replay each one, not only this round's new probes, before returning your
+  report, and report each replayed probe in `mutation_probes` with the
+  evidence fields plus `replayed: true`. A replayed probe whose
+  `expectation` is now `violated`, or which can no longer be applied
+  (reason: `target text no longer present`), is the regression signal;
+  `result` alone is not: report it as such (`result` `survived` or
+  `not_applicable` with the reason) and resolve it before the next
+  reviewer spawn.
 - When a verify runner is available, run it for the checks the acceptance
   criteria name and report its summary under `tests.executed`; when a
   mutation-probe runner is available, run the named probes through it and
-  copy its fields into `mutation_probes`.
+  copy its fields into `mutation_probes`; when the runner reports a
+  probe's mutant record (`file`, `anchor`, `before`, `after`) separately
+  from its result fields (`verified_applied_via`, `result`, `expectation`,
+  `reason`, `restored_verified`), take the definition fields from that
+  mutant record so the copied report still carries all eleven
+  `mutation_probes` sub-fields.
 - Run every long test, build, or mutation-probe command in the foreground
   and wait for it to finish before returning. When one foreground call
   cannot hold it to completion, poll the backgrounded run to completion
@@ -80,6 +108,11 @@ Rules:
   when the task assignment asked for a commit is treated as a misfire, not
   evidence. When the task produced no commit, return `commits: []` rather
   than omitting the field.
+- Populate a non-empty `commits` field by pasting `git log --reverse
+  --format=%H <base>..HEAD`; never type or hand-complete commit shas.
+- Verification plans, probe plans, and repeat tallies run in the foreground,
+  and the implementer reports their returns in the same turn as the last
+  check. A background monitor is no substitute for those returns.
 - Only write a verification claim (for example "Verified by ...") in a code
   comment, commit message, or your report for a check you actually ran and
   measured yourself; never claim a run you did not execute.
@@ -131,8 +164,14 @@ tests:
   not_executed_reason: ""
 mutation_probes:
   - mutant: ""
+    file: ""
+    anchor: ""
+    before: ""
+    after: ""
     verified_applied_via: ""
-    result: ""
+    result: killed | survived | not_applicable
+    expectation: met | violated | not_applicable
+    reason: ""
     restored_verified: ""
     replayed: false | true
 risks:

package/assets/agents/reviewer.md

@@ -22,6 +22,25 @@ a version. For a recorded original string-list contract, retain the original
 and `criterion_evidence` fields; keep all existing role output fields. This
 selection governs the rules and every YAML block below.
 
+Review method: the orchestrator names `review_method: normal | rigorous |
+adversarial` in every briefing; treat an unnamed method as `rigorous`. The
+three methods are obligation sets, not personas: they define what you must
+read, reproduce, and probe, and how a non-reproducing finding is withdrawn,
+not how skeptical to sound.
+
+| Method | Obligations |
+|---|---|
+| `normal` | Read the diff and the spec; run the declared tests once; findings come only from what you read. `normal` adds nothing beyond the obligations already stated in the Check list and the Rules below, and suspends none of them: the empirical-reproduction rule and the GitHub Actions shell replay rule apply under every method. `normal` only means no further independent reproduction beyond what those already require. Fits docs, renames, and batch cosmetics. |
+| `rigorous` (default) | Everything `normal` requires, plus: your own extract of the change, a base-attribution control, classifying every change, and reproducing every empirical claim yourself. `reproduction` and `matches_implementer_claim` are mandatory, as already required below. |
+| `adversarial` | Everything `rigorous` requires, plus: one discriminating probe or negative control per acceptance criterion; an active search of the neighbouring scenario space (environment, install modes, platform, ordering, concurrency); an attempt to break the claimed invariant; and an explicit list of break attempts that failed. |
+
+Withdrawal rule (`rigorous` and `adversarial`): a finding that does not
+reproduce on a second attempt with a corrected harness is withdrawn in the
+same round, not carried into the next one, and reported under `withdrawn`
+with the reason; this keeps the method from buying false positives. Emit
+`withdrawn: []` when nothing was withdrawn. Report the method you actually
+applied in `method_applied`.
+
 Check, at minimum:
 
 - Acceptance baseline: for a run explicitly adopted as `acceptance-baseline/v1`,
@@ -116,6 +135,10 @@ Rules:
   shell replay above is a second, explicitly non-probabilistic trigger for
   the same field: report it in `reproduction` too, with `sample_size:
   not_applicable` when the replay itself has no meaningful sample size.
+- When citing a coverage gate, cite the threshold and pass/fail counts, not
+  a run-specific coverage percentage; cite a percentage only together with
+  the exact commit and the run count, since branch coverage can vary
+  between runs of the same commit.
 - When a mutation-probe runner is available in the session, run probes
   through it instead of editing files by hand, and carry its result fields
   into your findings and `reproduction`; when a verify runner is available,
@@ -145,4 +168,8 @@ reproduction:
   sample_size: ""
   result: ""
   matches_implementer_claim: matched | mismatched | not_applicable
+method_applied: normal | rigorous | adversarial
+withdrawn:
+  - description: ""
+    reason: ""
 ```

package/assets/agents-md-section.md

@@ -49,6 +49,13 @@ default, not a ritual.
   orchestrator may review it itself; reserve the reviewer subagent for
   changes whose risk or size warrants an independent skeptical pass. Either
   way, review is never skipped.
+- Every reviewer briefing also names a `review_method`: `normal | rigorous |
+  adversarial`, an obligation set orthogonal to the effort tier below.
+  `adversarial` is the minimum for security judgment, install/deploy
+  scripts, hand-edited lockfiles, cross-major overrides, or anything the
+  operator flags high-risk; `normal` fits only docs, renames, or batch
+  cosmetics; `rigorous` is the default otherwise. Never pair `adversarial`
+  with the `-medium` reviewer tier; tiers themselves are unchanged.
 - When tier variants are installed (manifest `tiers: true`), the orchestrator
   picks the effort tier per task by complexity and risk, at its own judgment.
   The unsuffixed default subagent is the normal case; `-high`/`-xhigh` fit

package/assets/skill/SKILL.md

@@ -211,20 +211,34 @@ directory and the subagents.
    for real, observe the named test fail, restore, re-verify). Hold the
    implementer's report to the claim-only-what-was-measured rule too: treat any
    verification claim there that is not backed by a check it actually ran as
-   unverified. On any round after the task's first, the briefing also names
+   unverified. The installed `implementer.md` prompt has the implementer cite
+   a coverage gate's threshold and pass/fail counts, not a run-specific
+   coverage percentage, citing a percentage only together with the exact
+   commit and the run count, since branch coverage can vary between runs of
+   the same commit. On any round after the task's first, the briefing also names
    every mutation probe named in an earlier round of this task (on the
    task's first round there are none), drawn from the run's
-   `04-implementation-summary.md`; the implementer replays each one, not
-   only the round's new probes, before the next reviewer spawn, and
-   reports each in `mutation_probes` with the four evidence fields plus
-   `replayed: true`. A replayed probe whose mutant now survives or can no
-   longer be applied is a regression signal, reported as such (`result`
-   `survived` or `not_applicable` with the reason) and resolved before the
-   next reviewer spawn. Record meaningful decisions in
+   `04-implementation-summary.md`, naming each by its mutant definition
+   (file, anchor, before, after), not merely by its id; a probe recorded
+   with only an id and no definition to reapply cannot be replayed and is
+   `not_applicable` (reason: `no definition recorded`), not a regression.
+   The implementer replays each one, not only the round's new probes,
+   before the next reviewer spawn, and reports each in `mutation_probes`
+   with the evidence fields plus `replayed: true`. A replayed probe whose
+   `expectation` is now `violated`, or which can no longer be applied
+   (reason: `target text no longer present`), is the regression signal;
+   `result` alone is not: reported as such (`result` `survived` or
+   `not_applicable` with the reason) and resolved before the next reviewer
+   spawn. Record meaningful decisions in
    `03-decisions.md` and consolidate evidence in
    `04-implementation-summary.md`, recording each probe the implementer
    reports as a row in `04-implementation-summary.md`'s Mutation Probes
-   subsection, with the round it was named in. For any diff that adds or
+   subsection, with the round it was named in. Each row's Before/After
+   cells hold a single-line excerpt; when the mutant's actual before/after
+   text is multi-line or contains an unescaped `|`, or the mutant is a
+   patch/diff rather than a text swap, the full text or diff goes in the
+   implementer report or a fenced block placed directly under the table,
+   with the row noting where it lives. For any diff that adds or
    changes a GitHub Actions `run:` step, the installed `implementer.md`
    prompt requires replaying it locally under the shell the step actually
    runs, with the expected-success and the expected-failure inputs, before
@@ -251,52 +265,67 @@ directory and the subagents.
    `reviewer-<tier>` subagents, if any) by the task's complexity and risk, at
    your own judgment, defaulting to the unsuffixed subagent when unsure; record
    a non-default tier choice with a one-line reason in `03-decisions.md` when
-   the task is non-trivial. When the reviewer's environment cannot use version
-   control to see the diff (for example a policy-gated repository), supply the
-   diff as a pre-generated file in the briefing instead of expecting the
-   reviewer to derive it, and have the reviewer report explicitly if it could
-   only reconstruct the delta some other way, rather than silently reviewing
-   less than the full change. The reviewer checks spec compliance, architecture
-   consistency, edge cases, security, test adequacy (including whether new
-   tests would fail if the change were reverted), and maintainability. Findings
-   go to `05-review-findings.md`; transfer each finding from the reviewer
-   output contract into the table's columns as-is, keeping the Severity and
-   Decision headers unchanged, since those two are what the
-   orchestrator-workflow completeness reader verifies. Replace the shipped
-   placeholder/legend row with the transferred findings; for a genuine
-   zero-findings review, delete that row instead of leaving it in place, since
-   the completeness reader treats an untouched placeholder row with no finding
-   rows as the template never having been filled in. When acceptance rests on
-   empirical or probabilistic evidence (flake rates, benchmarks, "n runs
-   green", performance/timing numbers), the reviewer must independently
-   reproduce it — its own runs or measurements, not a re-read of the
-   implementer's log — and record the method, sample size, and result against
-   the implementer's claim in the reviewer output contract's `reproduction`
-   field. This does not apply to deterministic checks (a single test run,
-   `tsc`, lint): only claims that could vary run to run trigger it. The GitHub
-   Actions shell replay named in step 6 is a second, explicitly
+   the task is non-trivial. Also name `review_method: normal | rigorous |
+   adversarial` in the briefing; every briefing names one. Pick it by risk
+   class: `adversarial` at minimum for security judgment, install/deploy
+   scripts, hand-edited lockfiles, cross-major overrides, or anything the
+   operator flags high-risk; `normal` only for docs, renames, or batch
+   cosmetics; `rigorous` otherwise. The method is orthogonal to the tier and
+   never substitutes for it: do not pair `adversarial` with the `-medium`
+   reviewer tier, a budget mismatch that names probes without the effort to run
+   them; tiers themselves are unchanged by this axis. When the reviewer's
+   environment cannot use version control to see the diff (for example a
+   policy-gated repository), supply the diff as a pre-generated file in the
+   briefing instead of expecting the reviewer to derive it, and have the
+   reviewer report explicitly if it could only reconstruct the delta some other
+   way, rather than silently reviewing less than the full change. The reviewer
+   checks spec compliance, architecture consistency, edge cases, security, test
+   adequacy (including whether new tests would fail if the change were
+   reverted), and maintainability. Findings go to `05-review-findings.md`;
+   transfer each finding from the reviewer output contract into the table's
+   columns as-is, keeping the Severity and Decision headers unchanged, since
+   those two are what the orchestrator-workflow completeness reader verifies.
+   Replace the shipped placeholder/legend row with the transferred findings;
+   for a genuine zero-findings review, delete that row instead of leaving it in
+   place, since the completeness reader treats an untouched placeholder row
+   with no finding rows as the template never having been filled in. When
+   acceptance rests on empirical or probabilistic evidence (flake rates,
+   benchmarks, "n runs green", performance/timing numbers), the reviewer must
+   independently reproduce it — its own runs or measurements, not a re-read of
+   the implementer's log — and record the method, sample size, and result
+   against the implementer's claim in the reviewer output contract's
+   `reproduction` field. This does not apply to deterministic checks (a single
+   test run, `tsc`, lint): only claims that could vary run to run trigger it.
+   The GitHub Actions shell replay named in step 6 is a second, explicitly
    non-probabilistic trigger for the same field, with `sample_size:
    not_applicable` allowed when the replay itself has no meaningful sample
-   size. A change that deletes or renames an exported identifier, type, config
-   key, or file is also checked for identifier drift (docs or comments still
-   describing the old name as current), by the reviewer or by the orchestrator
-   itself when it reviews a trivial rename per Scaling delegation, using a
-   connected drift check when one exists. When this is not the task's first
-   review round, name the round number in the briefing; the reviewer marks each
-   finding's `recurrence` as `new` or `repeated` against the earlier rounds it
-   was told about, which is what lets the orchestrator detect the Review-round
-   escalation budget's trigger (see below) without re-deriving it by hand. When
-   the implementer's report replays a prior round's mutation probe, the
-   orchestrator's reviewer briefing names the replayed probes the implementer
-   reports as killed together with their `mutant` and `verified_applied_via`
-   values; the reviewer may then skip re-running those. The reviewer output
-   contract itself is unchanged. Never run mutation probes in place against a
-   worktree a reviewer subagent is concurrently reviewing; isolate the probe in
-   a separate worktree or wait until the reviewer has returned before probing
-   that tree again. For an explicitly adopted v1 run, ask the reviewer to
-   compare the frozen delegated criteria with the referenced evidence and judge
-   semantic adequacy, including whether a manual check is actually concrete and
-   reasoned.
+   size. When citing a coverage gate, the installed `reviewer.md` prompt has
+   the reviewer cite the threshold and pass/fail counts, not a run-specific
+   coverage percentage, citing a percentage only together with the exact commit
+   and the run count, since branch coverage can vary between runs of the same
+   commit. A change that deletes or renames an exported identifier, type,
+   config key, or file is also checked for identifier drift (docs or comments
+   still describing the old name as current), by the reviewer or by the
+   orchestrator itself when it reviews a trivial rename per Scaling delegation,
+   using a connected drift check when one exists. When this is not the task's
+   first review round, name the round number in the briefing; the reviewer
+   marks each finding's `recurrence` as `new` or `repeated` against the earlier
+   rounds it was told about, which is what lets the orchestrator detect the
+   Review-round escalation budget's trigger (see below) without re-deriving it
+   by hand. When the implementer's report replays a prior round's mutation
+   probe, the orchestrator's reviewer briefing names the replayed probes the
+   implementer reports as killed together with their mutant definition
+   (`file`, `anchor`, `before`, `after`) and `verified_applied_via` value,
+   not merely their id; a probe recorded with only an id and no definition
+   cannot be skipped this way and is `not_applicable`. The reviewer may
+   then skip re-running the ones named by definition.
+   The reviewer output contract itself is unchanged. Never run mutation probes
+   in place against a worktree a reviewer subagent is concurrently reviewing;
+   isolate the probe in a separate worktree or wait until the reviewer has
+   returned before probing that tree again. For an explicitly adopted v1 run,
+   ask the reviewer to compare the frozen delegated criteria with the
+   referenced evidence and judge semantic adequacy, including whether a manual
+   check is actually concrete and reasoned.
 8. **Decide acceptance.** Accept, request fixes, defer, or escalate to the
    operator. High or critical findings block acceptance until fixed or
    explicitly waived: critical findings require operator sign-off; high
@@ -304,8 +333,8 @@ directory and the subagents.
    or critical finding counts as a waiver and follows the same rules. Record
    all decisions and waivers in `03-decisions.md` and summarize waivers in
    the Accepted Waivers section of `06-handoff.md`. A reviewer recommendation is not orchestrator acceptance and cannot authorize a critical waiver; only the operator may authorize a critical waiver. For newly created decision records, identify a stable ID, trigger/evidence, decision, accountable authority/source with concrete approval evidence, consequences, and a superseded decision ID when revising a prior decision. Link baseline revisions and waivers to those decision IDs. Established runs retain their recorded decision format; absent fields never create a retroactive blocker. Routine decisions within the delegated contract remain the orchestrator's responsibility; an out-of-scope change requires an operator decision. Markdown records evidence of real authority and never grant it by themselves. Do not accept while a
-   required baseline criterion in an explicitly adopted v1 run has an open residual; a residual retains its ID
-   and cannot be converted away. After independent review,
+   required baseline criterion in an explicitly adopted v1 run has an open
+   residual; a residual retains its ID and cannot be converted away. After independent review,
    the orchestrator may close a docs-only delta without another reviewer round only
    when the entire unreviewed delta contains only explanatory
    documentation, comments, or citations; contains no source- or test-file
@@ -445,8 +474,14 @@ tests:
   not_executed_reason: ""
 mutation_probes:
   - mutant: ""
+    file: ""
+    anchor: ""
+    before: ""
+    after: ""
     verified_applied_via: ""
-    result: ""
+    result: killed | survived | not_applicable
+    expectation: met | violated | not_applicable
+    reason: ""
     restored_verified: ""
     replayed: false | true
 risks:
@@ -472,19 +507,37 @@ identifies the reviewed artifact and revision, reviewer, method, pass/fail
 standard, reasoned result, and baseline/criterion identities; it stays manual.
 
 When the task assignment names mutation probes to run, the implementer
-reports each one in the `mutation_probes` field (mutant,
-verified_applied_via, result, restored_verified); when the assignment
-names none, it returns `mutation_probes: []` rather than omitting the
-field, so 'none asked for' is distinguishable from 'asked for and not
-reported'. Each item also carries `replayed`: `false` for a probe newly
-introduced this round, `true` for a prior round's probe replayed this
-round under the replay rule in step 6. On any round after the task's
-first, the implementer replays every probe named in an earlier round of
-this task (on the task's first round there are none), not only this
-round's new probes, before the next reviewer spawn, reporting each one in
-`mutation_probes` alongside the round's new probes. A replayed probe
-whose mutant now survives or can no longer be applied is a regression
-signal, reported as such and resolved before the next reviewer spawn.
+reports each one in the `mutation_probes` field (mutant, file, anchor,
+before, after, verified_applied_via, result, expectation, reason,
+restored_verified); `file` and `anchor` (a line number or a unique
+surrounding string) locate the mutant, `before` and `after` are the
+exact text swapped there, and `expectation` records whether `result`
+matched what the probe was expected to do (`met`) or not (`violated`),
+independent of `result` itself, only alongside a measured `killed` or
+`survived` `result`; it is `not_applicable` otherwise (for example when
+the mutant could not be applied and no `result` was measured). `reason`
+is free text, required when `result` is `not_applicable`, empty
+otherwise, carrying one of two canonical strings that distinguish a
+non-regression from a regression: `no definition recorded` (a
+prior-round probe recorded with only an id, no definition to reapply)
+and `target text no longer present` (a replayed probe whose mutant can
+no longer be applied). When the assignment names none, it returns
+`mutation_probes: []` rather than
+omitting the field, so 'none asked for' is distinguishable from 'asked
+for and not reported'. Each item also carries `replayed`: `false` for a
+probe newly introduced this round, `true` for a prior round's probe
+replayed this round under the replay rule in step 6. On any round after
+the task's first, the implementer replays every probe named in an
+earlier round of this task (on the task's first round there are none),
+naming each by its mutant definition, not merely by its id, not only
+this round's new probes, before the next reviewer spawn, reporting each
+one in `mutation_probes` alongside the round's new probes. A replayed
+probe whose `expectation` is now `violated`, or which can no longer be
+applied (reason: `target text no longer present`), is the regression
+signal, reported as such and resolved before the next reviewer spawn;
+`result` alone is not a regression signal, and a probe recorded with
+only an id and no definition to reapply is `not_applicable` (reason:
+`no definition recorded`).
 
 The `commits` field lists the full sha of every commit the implementer
 produced on the task branch, in the order produced; when the task
@@ -492,6 +545,12 @@ produced no commit, the implementer returns `commits: []` rather than
 omitting the field, so 'did not commit' is distinguishable from
 'forgot to report'.
 
+For a non-empty `commits` field, the implementer pastes `git log
+--reverse --format=%H <base>..HEAD`; it never types or hand-completes commit
+shas. Verification plans, probe plans, and repeat tallies run in the foreground, and the
+implementer reports their returns in the same turn as the last check. A
+background monitor is no substitute for those returns.
+
 ## Reviewer output contract
 
 The output shape remains the same for either selected contract. Compare the
@@ -520,6 +579,10 @@ reproduction:
   sample_size: ""
   result: ""
   matches_implementer_claim: matched | mismatched | not_applicable
+method_applied: normal | rigorous | adversarial
+withdrawn:
+  - description: ""
+    reason: ""
 ```
 
 `acceptance_recommendation` is mandatory: every reviewer return must set it.
@@ -532,6 +595,15 @@ one that already appeared in an earlier round. On a task's first review
 round every finding is `new` by definition. This is what feeds the
 Review-round escalation budget's trigger.
 
+`method_applied` echoes the `review_method` named in the briefing (see step
+7); `withdrawn` lists each finding the reviewer proposed and then retracted
+under the withdrawal rule (`rigorous` and `adversarial` only), with its
+reason; emit `withdrawn: []` when nothing was withdrawn. Until a
+grounding-mcp reader parses the marker (tracked as a cross-repo
+follow-up), the orchestrator checks by hand that the return's
+`method_applied` matches the briefing's `review_method`; a mismatch or
+omission is resupplied, not accepted.
+
 ## Task slicer output contract
 
 Use this v1 block subject to Contract selection above for every task.

package/assets/templates/04-implementation-summary.md

@@ -68,9 +68,15 @@ an optional row cannot stand in for a required criterion.
 
 ### Mutation Probes
 
-| Round | Mutant | Verified Applied Via | Result | Restored Verified | Replayed |
-|---|---|---|---|---|---|
-| <!-- round --> | <!-- mutant --> | <!-- verified_applied_via --> | <!-- result --> | <!-- restored_verified --> | <!-- replayed --> |
+Before/After cells hold a single-line excerpt. When the mutant's actual
+before/after text is multi-line or contains an unescaped `|`, or the mutant
+is a patch/diff rather than a text swap, put the full text or diff in the
+implementer report or a fenced block directly under the table, and note
+where it lives in the row's own cell.
+
+| Round | Mutant | File | Anchor | Before | After | Verified Applied Via | Result | Expectation | Reason | Restored Verified | Replayed |
+|---|---|---|---|---|---|---|---|---|---|---|---|
+| <!-- round --> | <!-- mutant --> | <!-- file --> | <!-- anchor --> | <!-- before --> | <!-- after --> | <!-- verified_applied_via --> | <!-- result --> | <!-- expectation --> | <!-- reason --> | <!-- restored_verified --> | <!-- replayed --> |
 
 ## Risks / Notes
 

package/assets/templates/05-review-findings.md

@@ -4,6 +4,11 @@
 
 <!-- Short summary. -->
 
+<!-- review-method[<round>] = normal|rigorous|adversarial -->
+Method: normal | rigorous | adversarial (the `review_method` named in this
+round's briefing and the `method_applied` the reviewer returned; not parsed
+by the grounding-mcp completeness reader yet).
+
 ## Findings
 
 <!-- The Severity and Decision column headers below are load-bearing: the orchestrator-workflow completeness reader locates this table by its header row and verifies unresolved findings from those two columns. Do not rename or drop them. -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orchestrator-workflow",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "Installer for an orchestrator-led agent workflow: .ai/ run state, an AGENTS.md policy section, and per-harness subagent definitions for Claude Code, OpenAI Codex, and opencode",
   "main": "dist/index.js",
   "type": "module",