pi-gauntlet 7.40.1 → 7.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-gauntlet",
-  "version": "7.40.1",
+  "version": "7.41.0",
   "description": "Opinionated, gated workflow skills, subagent personas, and runtime extensions for the pi coding agent.",
   "author": "Jacek Juraszek",
   "type": "module",
@@ -62,7 +62,7 @@
     "test": "node scripts/ci.mjs"
   },
   "peerDependencies": {
-    "pi-cohort": ">=7.6.3"
+    "pi-cohort": ">=7.6.4"
   },
   "dependencies": {
     "yaml": "^2.9.0"

package/skills/brainstorming/SKILL.md

@@ -67,7 +67,7 @@ Detection order: (1) infer from ticket labels, description, or paths; (2) use th
 
 The spec is the first commit in a dedicated worktree, never a separate commit on `main`. For a PR subject, the worktree is the PR's branch and the spec commit is appended to it.
 
-Invoke `/skill:using-git-worktrees`; use `.worktrees/` or the project-native location. Carry its `Worktree ready at <full-path>` value: spec path `<full-path>/<spec dir>/<filename>.md`; every dispatch uses that `cwd`; git uses `git -C <full-path>`. Keep the process cwd unchanged.
+Read [reference/legs.md](reference/legs.md) and settle membership before creation. Invoke `/skill:using-git-worktrees` for each member with explicit `$ROOT` = its primary and `$BRANCH` = the shared branch; carry every `Worktree ready at <full-path>` value, home first. Root the home spec at `<home worktree>/<home spec dir>/<filename>.md`; root each dispatch and `git -C` in its owning leg's worktree. Keep the process cwd unchanged. Gather each leg's rules and record portable contracts and companion artifacts using that reference; a one-member run adds only its one-block `## Legs` section.
 
 Spec, plan, and implementation share this worktree. The spec and its telemetry record (`<telemetry.dir>/<spec path with .md -> .yaml>`, default `.pi/gauntlet/telemetry/doc/specs/<spec>.yaml`) are deliverables and ship in the squash; only the plan is stripped. `/skill:finishing-a-development-branch` strips the plan, then seals the record before landing (a `telemetry:` commit under git; the working-copy snapshot in a plain jj workspace). Explicit trivial one-off edits outside this flow need no worktree.
 

package/skills/brainstorming/gatherer.md

@@ -12,6 +12,11 @@ Mint a temp dir outside the worktree (never committed):
 GATHER_DIR=$(mktemp -d)
 ```
 
+Read [reference/legs.md](reference/legs.md) for the settled member order and rules walk.
+Expand the scout task below once per leg, home first, using that leg's worktree
+as `cwd` and a distinct `<GATHER_DIR>/scout-<index>.md` output. Preserve one scout
+for a single-member run. Keep context-builder home-owned and conditional.
+
 Set the substep, then dispatch one foreground parallel-tasks `subagent` call (`async: false`; no
 `model:` — pi-cohort `agentOverrides` owns builder models). Preserve the parallel batch and await
 its terminal result before assembling the draft:
@@ -45,6 +50,13 @@ Use that SKILL.md directory, never `reference/` as the base.
 Scout (always dispatched):
 
 > Recon for an upcoming design discussion. The request: `<initial prompt verbatim>`.
+> Owning leg: `<repo>`; touched paths in this leg: `<paths or unresolved>`.
+> Apply `reference/legs.md`'s rules walk: root and touched-directory `AGENTS.md`
+> and `CLAUDE.md`, one hop of local documentation links in prose, bullets, and
+> tables, deduped by `realpath`; linked documents contribute no more links.
+> Emit repo-relative `Rules:` lines, `Rules: missing: <path>` for unresolved
+> links, or `Rules: root only - paths unresolved`. Include `pkg-x/AGENTS.md`
+> when touching `repo-a/pkg-x`; exclude untouched `pkg-y`.
 > Map the territory this change touches: relevant files with line ranges, existing
 > patterns and conventions the change must match, test conventions, integration
 > points, and whether the codebase or ecosystem already solves any of this. Trace retained
@@ -220,7 +232,8 @@ time:
 
 ## Draft assembly
 
-Read the temp files and write the draft **to the spec path** (normal filename
+Read every leg's temp file in member order, retaining each leg's repo identifier,
+Rules lines, recon and degraded status independently. Write the draft **to the spec path** (normal filename
 convention; slug minted from the initial prompt):
 
 ```markdown

package/skills/brainstorming/reference/amendment-surface.md

@@ -1,6 +1,6 @@
 # Amendment surface
 
-`read` this file (the `read` tool at its absolute path, never a shell command) from `skills/brainstorming/SKILL.md` § Amending an approved spec, from any phase, for amend-class changes; at approval, load only [Standing grants](#standing-grants), not the batch procedure. Keep redraws outside this procedure. Classify a change to an approved drafted acceptance-criteria row - its text, a row added, a row removed - as a redraw at batch preparation, before any standing grant, never a disposition amendment: re-draft from the new design and ratify at the full gate; keep a disposition-only change to such a row in this grammar so it keeps the cut question. Apply an item the human has answered by letter or custom text as recorded. Only the main loop holding `edit`/`write` authors amendments and human-facing amendment text. Use the human last: a fresh reviewer clears evidence-backed factual corrections; present the rest to the human once per batch plainly.
+`read` this file (the `read` tool at its absolute path, never a shell command) from `skills/brainstorming/SKILL.md` section Amending an approved spec, from any phase, for amend-class changes; at approval, load only [Standing grants](#standing-grants), not the batch procedure. Keep redraws outside this procedure. Classify a change to an approved drafted acceptance-criteria row - its text, a row added, a row removed - as a redraw at batch preparation, before any standing grant, never a disposition amendment: re-draft from the new design and ratify at the full gate; keep a disposition-only change to such a row in this grammar so it keeps the cut question. Apply an item the human has answered by letter or custom text as recorded. Only the main loop holding `edit`/`write` authors amendments and human-facing amendment text. Use the human last: a fresh reviewer clears evidence-backed factual corrections; present the rest to the human once per batch plainly.
 
 ## Standing grants
 
@@ -145,6 +145,18 @@ Before the aftermath, `read` this section again; never run it from memory.
 
 Apply accepted items only: reviewer clears, `accept`, `alt-n`, and state-changing `custom`. Print one line per applied item: `amended the spec: <title> - <what>`.
 
+Preserve scope indices on disposition-only amendments, including cuts; validate
+all blocks using [legs.md](legs.md)'s scope grammar before committing.
+Apply [legs.md](legs.md)'s companion aftermath in this same amendment: changes
+to Problem, shared Design/Errors/Out-of-scope, repo-binding clauses, or a leg
+block rewrite each affected companion artifact. Commit home, then the affected
+files through their own `git -C`; preserve the amendment audit in those commits.
+Do not complete the amendment while any carried text disagrees. For specs with
+`## Legs`, recorded contracts are authoritative, replacing finish Step 6's
+reread rule; amend the block before using a changed contract. Legacy specs
+without that section retain finish-time rereading. A one-member run has no
+companion artifact or companion aftermath.
+
 Aftermath, once per batch, only when at least one item applied (nothing applied -> skip to the commit below). Ledger exists (line 1 `# Ledger - loop engine` in the resolved plan dir) -> skip `plan-writer`, `plan_check`, and `plan_tracker`. Reconcile the ledger against the approved spec dispositions: `deviates:`, `deferred:`, or `elsewhere:` -> `cut`, evidence = the disposition; factual or requirement-preserving amendment -> preserve rows; re-bounded `done` row -> `open`, evidence = `reopened by amendment`. Preserve every row's attempts and the ledger's iterations. Never auto-edit ticket or approved drafted AC row texts; reconcile dispositions only, never text/add/remove changes. Commit spec + ledger together with subject `loop: cut row <n>` for a batch containing only one cut, otherwise `loop: amend` (including mixed batches), carrying the amendment audit body below (including each `granted` record and granting sentence); continue without task-plan aftermath. No plan yet -> commit the spec; continue. Plan exists -> read `git -C "<abs worktree path>" status --porcelain` (plain jj: `jj -R "<abs worktree path>" diff --summary`); collect the parent's in-flight workflow edits as worktree-relative paths, including the amended spec and staged in-place wave-repair deliverables. Dispatch `plan-writer` per `writing-plans` `## Author the plan` step 3 with an `Amend:` block naming the amended spec sections, an `In-flight:` list of those paths (the parent supplies the set; the child never infers it), and the rule "preserve every task title and wave position the amendment does not touch; edit only affected anchors and tasks", then run that section's steps 5-6 (the parent `plan_check` and its branches).
 
 At that return point, classify human-facing outcomes with this table; let writing-plans' first `Findings:` repair run as written.

package/skills/brainstorming/reference/legs.md

@@ -0,0 +1,187 @@
+# Legs
+
+Use this reference as the portable membership, leg-block, and companion-file grammar.
+Keep tracker and dispatch APIs unchanged.
+
+## Settle membership before Worktree First
+
+Read the home primary's first-found overrides file: `.pi/gauntlet-overrides.md`,
+`gauntlet-overrides.md`, `doc/gauntlet-overrides.md`. Treat `## shape-ticket`
+`- sibling: <clone url>` declarations as eligibility, not membership. Parse selected values
+with shape-ticket's [shared parser](../../shape-ticket/reference/repo-audit.md);
+use `PATH` = `<home PRIMARY parent>/<NAME>` as each companion primary.
+
+Match only companions explicitly selected by the ask (repo identifier, `NAME`,
+or declared clone URL) or the ticket's repo-group headings. Compare
+case-insensitively, trailing `owner/name` of `IDENTITY` before `NAME`. Derive each companion's portable identifier
+from the shared parser's trailing `owner/name` of `IDENTITY` for the validated stored origin
+read with `git -C <primary> config --get remote.origin.url`. Derive the home's identifier
+from `git -C <primary> remote get-url origin`'s `owner/name`, stripping `.git`;
+without origin use `repo:` from that member's own first-found overrides
+`## Issue tracker` section; without that value use the member's primary directory basename. Use the same identifier
+in `### Leg:`, task `Leg:`, and brief `repo:` fields. For an ambiguous basename,
+ask once before any creation; never guess. Order members home first, then selected siblings in declared order.
+An existing PR alone never activates membership; PR home provisioning still uses
+`using-git-worktrees/reference/pr-head.md`.
+
+Match identifiers before any filesystem or git probe; probe only matching siblings,
+or remaining declarations when nothing matches. Never probe unselected siblings. With no selected companion,
+keep the single-member flow. Validate every selected declaration before creating
+any tree: invalid configuration, missing `PATH`, not a checkout, no origin,
+unparseable origin, wrong repo, or `PATH` equal to home stops naming the line.
+Read origins with `git -C <PATH> config --get remote.origin.url` and compare the
+full parsed `IDENTITY`; canonicalize paths before the home comparison. Keep these machine paths in working state and briefs, never in committed blocks.
+
+## Resolve each member
+
+| Field | Contract |
+|---|---|
+| `repo` | Portable identifier above; preserve one spelling everywhere |
+| `primary` | Home checkout at brainstorm start, or selected sibling clone URL parsed to `<home PRIMARY parent>/<NAME>`; machine-local |
+| `worktree` | Absolute `Worktree ready` result; machine-local |
+| `branch` | One full caller `BRANCH` shared by all members |
+| `name` | Shared `NAME`, derived from `BRANCH` by replacing `/` with `-` |
+| `Rules:` | Repo-relative files from the rules walk below |
+
+Read each primary's first-found overrides using the ladder above. Read its
+`.pi/settings.json` by file and apply the existing preset rules in
+`extensions/lib/gauntlet-settings.ts`: repo top-level piGauntlet keys replace
+preset keys wholesale; absent keys fall through. Missing configuration uses defaults.
+Keep flow policy (council, grants, tracker, response channels, finish choice and
+home flow guards) under home `.pi/settings.json#piGauntlet` and home overrides.
+Never use `gauntlet_setting` for companions or add a `piGauntlet.*` key.
+
+Record portable templates, not expanded absolute paths:
+
+- Create: retain the leg's `## using-git-worktrees` keyed `home:`/`create:` contract,
+  native tool, discovered wrapper, or owned built-in. Resolve other wrapper tokens
+  from that leg's touched top-level directory; zero or several candidates ask once
+  for that leg. Retain the resolved portable value, not a machine path.
+- Destroy: prefer the `## cleanup` worktree line, then `destroy:`, then owned
+  built-in removal matching `home:`. Include configured
+  `subagents.worktreeTeardownHook` with pi-cohort's existing semantics. Never
+  bypass a wrapper with `git worktree remove`; unmatched homes remain host-owned.
+- Directories: resolve `flowGuards.specDirs` with the existing default
+  `doc/specs`, `docs/specs`; derive plan directories with `planDirsFor`.
+  Never read `planDirs` as settings input. Choose the leg's spec directory by the
+  existing spec-location convention. Keep plan and ledger home-owned.
+- Verification: retain commands from `## verification-before-completion` and
+  `## PR gate`, plus merged `piGauntlet.verifyBeforeShip`. Preserve templates
+  describing execution against the leg's worktree or primary.
+
+Invoke using-git-worktrees once per member with explicit `$ROOT` = primary and
+`$BRANCH` = shared branch; require the affirmative read-back in
+[Step 4](../../using-git-worktrees/SKILL.md#step-4--report-location).
+Carry every `Worktree ready at <path>` result, home
+first. On any failure stop naming repo and branch and list already-created legs;
+leave them preserved, never auto-remove them.
+
+## Gather rules
+
+Dispatch one scout per leg with its worktree as `cwd`. Collect root `AGENTS.md`
+and `CLAUDE.md` when present; walk root through every touched directory and
+collect those filenames on the path. For a touch in `repo-a/pkg-x`, include
+`repo-a/pkg-x/AGENTS.md`, not rules from untouched `pkg-y`.
+Read every local documentation link in those walked files, including prose,
+bullets, and tables, exactly one hop. Resolve targets relative to the linking
+file and require them to stay inside the leg. Dedupe files by `realpath` so a
+symlinked `CLAUDE.md` counts once. Linked documents contribute no further links.
+Emit `Rules: <repo-relative path>` for each file and `Rules: missing: <path>` for
+unresolved or outside-leg targets; never invent their contents. Without touched
+paths, retain root rules and emit `Rules: root only - paths unresolved`; the
+plan-writer's touched-path walk fills the task rules later. Every leg block
+carries at least one `Rules:` line; a block with no rules walk result carries
+`Rules: root only - paths unresolved`, never an omitted key or a deferral note.
+
+## Home block and companion files
+
+Place `## Legs` after `## Acceptance criteria` and optional `## Rework record`.
+Write one block per member, home first. Use repo-relative rules and design paths;
+the following shows the field grammar, not configuration values to copy:
+
+```markdown
+## Legs
+
+### Leg: repo-a
+branch: feature/shared-change
+contract:
+- create: git worktree add <home> -b <branch>
+- destroy: git worktree remove <home> && git worktree prune
+- home: .worktrees/<name>
+- spec-dir: doc/specs
+- plan-dir: doc/plans
+- verification: <resolved portable verification templates and policy>
+Rules: AGENTS.md
+Rules: pkg-x/AGENTS.md
+scope: AC 1, AC 3
+design: <owned paths, observable outcomes, and clauses binding this leg>
+```
+
+### Scope grammar and validation
+
+Write exactly one `scope:` line in each block: `scope: none` or a comma-separated
+list of `AC <index>` entries, as in the template. Use one-based original AC indices, including cut rows;
+count checkbox rows in their original order, not ledger entries or disposition-filtered rows.
+Repeat shared indices in each owning leg; indices unlisted across all legs default home.
+When all legs say `scope: none`, every original AC defaults home.
+Never infer ownership from `design:` prose or paths: `design: implements AC 2`
+does not claim AC 2 without an explicit scope entry. Put owned paths and
+observable outcomes in `design:` instead.
+
+Before committing home or companion artifacts, validate every block against the
+original AC count. Reject missing or duplicate scope lines, duplicate indices within one leg,
+malformed lists, and nonexistent original indices; the same index in different legs is valid.
+Use these rejection cases as the boundary checks:
+
+| Invalid line | Reason |
+|---|---|
+| `scope: AC 0` | Zero is not one-based |
+| `scope: AC 1.5` | Fractional index |
+| `scope: AC 1-3` | Range rather than individual indices |
+| `scope: 1` | Bare number without `AC ` |
+| `scope: AC 1,` | Trailing comma / empty entry |
+| `scope: none, AC 1` | Mixed sentinel and list |
+| `scope: AC 1, AC 1` | Duplicate within one leg |
+| `scope: AC 4` with only three original ACs | Nonexistent original index |
+
+Reject empty values, negative indices and any other entry not matching
+`AC [1-9][0-9]*`, separated by comma and space. Preserve scope indices on
+disposition-only amendments, including cuts; validate again before the amendment commit.
+Keep this grammar here; consumers refer to it rather than inventing ownership rules.
+
+Keep shared Design, Errors and edge cases, and Out of scope outside `## Legs`;
+those clauses bind every member. Assign member ticket groups `in-scope` and name
+their ownership through original AC indices in `scope:`. Unmatched groups retain ticket-acceptance's
+`this repo / elsewhere / repair` question; `elsewhere:` creates no leg.
+
+Commit home first using spec-finalization's existing gate and audit. Then write
+one companion file per companion in its own spec directory with the home's
+filename. Use `git -C <companion worktree>` to add and commit that file:
+
+```markdown
+# <home spec title>
+
+**Home:** <home repo> <shared branch> <home repo-relative spec path>
+
+## Problem
+<home Problem copied verbatim>
+
+## Decisions
+<shared Design, Errors and edge cases, Out of scope, and clauses naming this
+repo or its owned paths in design, copied from home>
+
+### Leg: repo-b
+<that companion's entire block verbatim>
+```
+
+Rewrite and commit affected companion files in the same amendment when Problem,
+shared decisions, repo-binding clauses, or their block changes. Do not call an
+amendment complete while a carried part disagrees.
+
+Treat recorded `contract:` lines as authority for every spec with `## Legs`,
+including one-member specs. This replaces finishing Step 6's creation-time
+reread rule; legacy specs without `## Legs` retain the finish-time reread and
+mean home-only. Amend a recorded contract before a later stage uses a change.
+
+For one member add exactly one block only: no companion artifact, no `legs:`
+brief block, no `--leg`, no receipt, and no companion loop.

package/skills/brainstorming/reference/spec-finalization.md

@@ -25,6 +25,13 @@ Spec-writing replaces the context draft, in this exact order:
    `### PR #<N>` provenance subsection per PR with lowercase claims. Carry every PR's
    stated intent and constraints added since fork into Problem. Open Design with the
    unresolved sync repair when present. Omit the record from a ticket or free-text spec.
+   Then write `## Legs` after `## Acceptance criteria` and optional `## Rework record`,
+   using [legs.md](legs.md): one `### Leg: <repo>` block per member, home first,
+   with `branch:`, portable `contract:`, `Rules:`, exactly one `scope:` line and
+   `design:` prose for owned paths and observable outcomes.
+   Validate every block using [legs.md](legs.md)'s scope grammar before committing.
+   Keep machine-local paths out of committed blocks. Even a single-member spec
+   carries exactly one block; legacy specs without the section remain home-only.
 3. **Immediately after the write**, confirm line 1 of the file is no longer
    `# CONTEXT DRAFT - NOT A SPEC - fully replaced at spec-writing` - before
    dispatching lint, critique, council, or summarizer. The phase-tracker commit
@@ -116,6 +123,13 @@ git -C <abs worktree path> add -- <spec path> [<predecessor path>] && git -C <ab
 EOF
 ```
 
+After the home commit, write and commit every companion leg file through
+`git -C <companion worktree>` using [legs.md](legs.md)'s artifact grammar:
+`**Home:**` tuple, copied `## Problem`, `## Decisions` from shared
+Design/Errors/Out-of-scope and repo-binding clauses, and its own block verbatim.
+Stop naming any failed companion; do not present artifact completion until all
+files agree. A single-member run writes no companion file.
+
 If the council path ran, the body is its audit (`Coverage:` when present, then `Applied:` / `Deferred:` / `Rejected:`, verbatim from `/skill:roasting-the-spec`'s return) - the durable, non-contractual record a finish-time revert and row 3 below read back; the audit is never a committed spec section. On the worker path the body is empty except for a main-loop drafted-AC repair audit line when a repair occurred. Append that repair line after the council audit on the council path; never alter its labels, cluster lines, or counts. `-m`, `-F <file>`, `printf | ... -F -`, and `$'...'` strings are not used for this commit. The `add` on the same line is required because the spec is untracked at its first commit and `commit -- <path>` rejects an untracked path.
 
 Evaluate the summary in two stages (the **Degrade path** referenced in each is defined just below):

package/skills/brainstorming/reference/ticket-acceptance.md

@@ -4,7 +4,7 @@ A ticket is guidance, not sole truth. Fetch it; propose scope, approach, or acce
 
 **Extract the ticket's ACs.** When the ticket body has a heading matching `/acceptance criteria/i`, every list item under it is an AC (numbered, bullet, or checkbox) until the next heading of that heading's level or higher, and no other list in the body is; a heading one level deeper inside the section is a repo group - it names the repo whose part delivers the rows under it and does not end extraction. When there is no such heading, every top-level checkbox row in the body is an AC, except rows under a `Post-deployment housekeeping`, `Out of scope`, or `Follow-up` heading. Otherwise the ticket has no ACs. A nested list under an AC row rides with its parent as one row; an AC heading holding prose and no list makes each paragraph one row. Carry checked and unchecked rows alike, all written `- [ ]`. Take the rows and their repo-group headings from the gather draft's `## Ticket acceptance criteria (verbatim)` heading; when the ticket was not fetched, the gate summary shows the `none` line so the user can paste the rows, which then become rows.
 
-**This repo** is the `repo:` value of the overrides `## Issue tracker` section, else the `owner/name` path of `git remote get-url origin` with any `.git` suffix stripped; a repo group matches it when the group name equals that value or its basename, case-insensitive. A ticket without repo groups holds only this repo's rows; never guess attribution. A grouped ticket with no group matching this repo stops the brainstorm with that fact.
+**This repo** is the `repo:` value of the overrides `## Issue tracker` section, else the `owner/name` path of `git remote get-url origin` with any `.git` suffix stripped; a repo group matches it when the group name equals that value or its basename, case-insensitive. Apply [legs.md](legs.md)'s identifier-before-basename membership resolution before attribution. A ticket without repo groups holds only this repo's rows; never guess attribution. A grouped ticket with no group matching any member stops the brainstorm with that fact.
 
 **Write the section in every spec**, after `## Problem`:
 
@@ -17,7 +17,7 @@ Ticket <ref>, <heading or "checkbox list">, rows verbatim:
   <disposition>
 ```
 
-Under `Ticket <ref>, <heading or "checkbox list">, rows verbatim:`, the section names the ticket contract only; the spec's own requirements stay in Design. Keep every provenance form flat - a row's repo lives in its disposition token, never in a heading. Disposition is exactly one of `in-scope`, `deviates: <why>`, `deferred: <where>`, `venue: <env> - <observation>`, `elsewhere: <repo>`; default `in-scope`. For ticket rows, never edit the row text: an ambiguous row stays `in-scope` with the chosen reading written as a Design clause, and a moved path or a workflow artifact (spec, plan, changelog, telemetry file) is a Design clause too, never a disposition and never asked. A row under a repo group that is not this repo is `elsewhere: <repo>`, stated, never asked; a group matching no repo asks `A) this repo B) elsewhere: <name> C) repair the ticket - /skill:shape-ticket <ref>`. Replace `<name>` with the supplied unmatched group heading verbatim in option B, not a request to name a repo. Name a `venue:` row's enabling change in Design; `venue:` states where the observation can happen and is never `prd`, `prod`, or `production` - a row observable only in production is a wrong row. An `in-scope` row is a requirement as written; disposition reasons are never normative for the plan or the reviewer, so a `deviates:` reason that adopts part of a row restates that part as a Design clause. A `deferred:` destination is a tracker ref (`#N`, `owner/repo#N`, `ABC-123`), a spec path, or a URL; a prose destination with none of these is a gap at the PR gate.
+Under `Ticket <ref>, <heading or "checkbox list">, rows verbatim:`, the section names the ticket contract only; the spec's own requirements stay in Design. Keep every provenance form flat - a row's repo lives in its disposition token, never in a heading. Disposition is exactly one of `in-scope`, `deviates: <why>`, `deferred: <where>`, `venue: <env> - <observation>`, `elsewhere: <repo>`; default `in-scope`. For ticket rows, never edit the row text: an ambiguous row stays `in-scope` with the chosen reading written as a Design clause, and a moved path or a workflow artifact (spec, plan, changelog, telemetry file) is a Design clause too, never a disposition and never asked. A row under a repo group matching a settled member is `in-scope`; encode that member's ownership through original AC indices in its leg's `scope:` using [legs.md](legs.md), with owned paths only in `design:`. A known nonmember repo group is `elsewhere: <repo>`, stated, never asked; `elsewhere:` creates no leg. A group matching no repo asks `A) this repo B) elsewhere: <name> C) repair the ticket - /skill:shape-ticket <ref>`. Replace `<name>` with the supplied unmatched group heading verbatim in option B, not a request to name a repo. Name a `venue:` row's enabling change in Design; `venue:` states where the observation can happen and is never `prd`, `prod`, or `production` - a row observable only in production is a wrong row. An `in-scope` row is a requirement as written; disposition reasons are never normative for the plan or the reviewer, so a `deviates:` reason that adopts part of a row restates that part as a Design clause. A `deferred:` destination is a tracker ref (`#N`, `owner/repo#N`, `ABC-123`), a spec path, or a URL; a prose destination with none of these is a gap at the PR gate.
 
 **Cut question.**
 

package/skills/finishing-a-development-branch/SKILL.md

@@ -29,9 +29,9 @@ The process cwd never changes; every command targets `$WORKTREE` or `$PRIMARY` e
 Then call `phase_tracker({ action: "start", phase: "ship" })`.
 
 ## The Process
-
 ### Step 1: Verify Tests
 **Hard verification gate.** Tests/format/lint must pass before presenting any options — including Discard. The user's stated intent to throw the branch away does not change whether the diff is in a verifiable state; verifying first surfaces accidental damage to unrelated code before the branch is gone forever. The skip rule below is the only exception.
+Read [coordinated finish](reference/legs.md) once for `## Legs` activation, recorded contracts, per-leg Steps 1/3.5, the single Step 4 choice, Step 5 receipts and home strip-and-seal, and Step 6 cleanup. Apply its coordinated mechanics for multiple members; retain the ordinary path for one member or no section.
 Reuse the selected run spec read in Input. Detect a rework PR subject by its `## Rework record`; use Input's header-linked route for `**PR:**`, never discover by an open PR on `$FEATURE`. For the rework route only, read every top-level `PR:`/`Pre-rework head:` pair, home first, retaining each full SHA; missing pre-head -> stop naming the spec path. Set `PRE_REWORK_HEAD` to home's SHA. Read only combined capitalized `Base:`, `Keeps:`, `Changes:`, `Dropped claims:`, `Scoped tests:` fields; ignore lowercase provenance under `### PR #<N>`. For N=1, read `Threads:` directly after `Pre-rework head:` and retain the provenance subsection without changing finish output. Confirm only home with `gh pr view <N> --json number,url,headRefName,baseRefName,state` (use the record's repository): non-`OPEN` -> stop: `PR #N is <state>; the rework cannot be pushed to it.`; headRefName != `$FEATURE` -> stop naming both branches. Retain baseRefName for Step 3.
 Recognize a ledger by line 1 exactly `# Ledger - loop engine`. For a ledger, use its `verification:` command throughout finish, including the minors round. For a rework PR subject with a task plan, use the union of every plan task's `Tests:` commands plus the executable lint/format commands in the header's `**Verification:**` line; treat `none - PR subject, scoped` as no header commands, not an empty task union. Capture this set and accepted-complete task evidence before stripping the plan. Apply the hard gate and skip rule below to this set. For every other subject with a task plan, run the plan header's `**Verification:**` set in the worktree: `(cd "$WORKTREE" && <command>)`. With no plan in this session, run the verification command(s) of the affected services from the gauntlet overrides file or `AGENTS.md` (look for "verification", "CI", or "test" sections).
 **Skip rule.** Skip the run only when this set passed on a known clean commit in the verify phase of this session and no edit or write landed outside `<telemetry.dir>` since. Check the current tree: `git -C "$WORKTREE" diff --quiet <commit the run passed on> -- . ':!<telemetry.dir>'` must exit 0, and `git -C "$WORKTREE" status --porcelain --untracked-files=all -- . ':!<telemetry.dir>'` must exit 0 with empty output (`<telemetry.dir>` defaults to `.pi/gauntlet/telemetry`). These checks cover committed, staged, unstaged, and untracked changes outside telemetry. Otherwise run it once; a missing verified commit, a failed check, or uncertainty means run.
@@ -380,7 +380,7 @@ If confirmed: Cleanup worktree (Step 6), then, if Step 6 removed the worktree, `
 
 **Only runs for the Squash-merge and Discard options (3 and 5).** The PR, draft PR, and Keep options always preserve the worktree.
 
-Read the gauntlet overrides file now (ladder in Project overrides) and its `## using-git-worktrees` section; nothing from creation time is carried - the file is the contract (keys written like `## cleanup` items: `using-git-worktrees/SKILL.md` Step 1a).
+Use recorded `contract:` lines when the spec carries `## Legs`, including one member; apply the recorded cleanup authority from the Step 1 reference. For a legacy spec without `## Legs`, read the gauntlet overrides file now (ladder in Project overrides) and its `## using-git-worktrees` section as the cleanup contract (keys written like `## cleanup` items: `using-git-worktrees/SKILL.md` Step 1a).
 
 **Keyed contract** - the section has at least one of `- home:`, `- create:`, `- destroy:`:
 

package/skills/finishing-a-development-branch/reference/legs.md

@@ -0,0 +1,76 @@
+# Coordinated finish
+
+## Activation and authority
+
+Read the home spec's `## Legs` once at Step 1. Use the membership, portable identifiers, scope validation and path resolution in [the leg grammar](../../brainstorming/reference/legs.md). Resolve selected primaries from home's declared siblings and worktrees from the brief or recorded `home:` pattern. Validate branch, repository identity and each companion's full `**Home:**` tuple before acting. Admit a missing delivered worktree only through a validated receipt below.
+
+Use recorded `contract:` lines for every spec with `## Legs`, including one member. Amend the home block and affected companion file before using a changed contract; do not reread overrides to replace it. For one member, return to the ordinary finish steps using that block's contract: keep exactly one `### Leg:`, no companion artifact, `legs:` brief block, receipt, `--leg` argument or companion loop. For no `## Legs`, use the ordinary home-only flow and Step 6's overrides reread.
+
+For more than one member, apply the following steps instead of the home-only verification, delivery and cleanup mechanics. Keep Step 3.5's disposition protocol, the home's review policy, Step 4 menu and confirmations. Keep machine-local paths out of committed bodies and messages.
+
+## Durable receipts
+
+Keep one home-owned file per delivered leg at `<home git common dir>/gauntlet/receipts/<spec filename>/<repo>`, where `<home git common dir>` is `git -C <home worktree> rev-parse --path-format=absolute --git-common-dir` (the home primary's `.git`, e.g. `/work/repo-a/.git/gauntlet/receipts/shared.md/repo-b`) - never inside any worktree, so a removed home tree never takes a receipt with it. Include the full spec filename, including `.md`, and preserve repo path segments; create directories before writing. Git metadata is never tracked, so no exclude entry is needed. Treat them as flow restoration artifacts, not telemetry, approval evidence or proof without validation.
+
+Write after each delivery attempt that produced a PR or squash commit, including failed post-squash verification:
+
+```text
+attempted-head: <full feature SHA attempted>
+delivered: pr <url> <full delivered PR head> | squash <full squash SHA>
+verification: passed | <actual verification failure>
+```
+
+Choose one `delivered:` alternative. Use `verification: passed` only for successful verification; preserve the error otherwise. Retain the selected spec path, recorded commands, membership and accepted task evidence before stripping the plan, and carry the receipt locations into the brief. On fresh-session retry admit a stripped plan only when every companion has a receipt; validate each receipt rather than inferring delivery from missing files. Recover commands from the spec's recorded contract, not the absent plan.
+
+Before checkout-based verification and conformance fan-out, validate receipt identity against the selected spec, repo and recorded delivery choice; reconcile it with the selected action before delivery. Malformed, mismatched or unverifiable receipts leave the leg unlanded; stop on an unavailable boundary rather than creating duplicate delivery. Apply these proofs:
+
+| Receipt | Required proof and retry action |
+|---|---|
+| PR | Fetch the receipt URL using `gh pr view <url> --json state,headRefOid` in its repository. Require `OPEN`, head equal to the attempted head, delivered head equal to attempted head, passed verification, and unchanged current feature head when the tree exists. A stale head must re-push the verified branch non-force and update the existing PR, not create another PR. Refresh and rewrite the receipt after success. A closed PR is not a validated skip; stop for disposition. |
+| Squash | Require `verification: passed` and the squash SHA reachable from the primary's default branch: `git -C <primary> merge-base --is-ancestor <squash SHA> <default branch>` must exit 0. Confirm the current attempted feature head when available. For recorded failed post-squash verification, rerun verification, not squash, against the delivered primary state; rewrite the receipt on pass. Require the recorded squash to remain reachable and stop on unrelated primary movement requiring review. |
+
+Never use feature-head ancestry as proof of squash delivery. Resolve the actual primary default branch, not an assumed `main`. Treat unexpected Git exits as errors, not negative proofs. Preserve receipts on every failure, including seal failure and cleanup refusal.
+
+## Verification and closure - Steps 1 and 3.5
+
+Exempt a leg with a validated receipt and a missing worktree from checkout-based verification and conformance. Run fresh checks for every unlanded leg; stop on a missing unlanded worktree. Handle failed-squash verification in the delivered primary through the receipt retry action above; replace feature-checkout checks with that primary verification even when the feature tree still exists.
+
+Before Step 4, run every leg's recorded verification set with that leg's worktree as command cwd, except the receipt-proven exemptions above, then perform conformance review with that leg's `cwd`, Rules and owned AC rows. Use original AC indices from `scope:`; shared rows belong to each named owner and unclaimed rows default home. Apply Step 1's hard gate and skip proof independently per leg. Route fixes and commits through `git -C <owning worktree>`, never home's checkout for companion code.
+
+Retain each present member's audited head and tree, including staged, unstaged and untracked state. Immediately before delivery compare them to the current checkout; re-verify and re-review every changed leg before its delivery. Apply the same freshness check after disposition fixes and minors fixes. Aggregate closure before presenting one menu; no leg bypasses open dispositions.
+
+Apply leg-local `piGauntlet.verifyBeforeShip` evidence to commands targeting that checkout. Read each primary's `.pi/settings.json` by file and merge the preset using the existing settings rules; do not use home's `gauntlet_setting` result or home's successful test flag as companion evidence. Use the recorded verification set, including when a retry has no plan.
+
+## Execute one choice - Steps 4 and 5
+
+Apply one chosen action to companions in declared sibling order, then home. Preserve every PR, draft and keep worktree and branch. Keep reports all retained locations without strip, seal, delivery or cleanup.
+
+For a PR-subject home, compose the supported existing home action with companion delivery: row 1 pushes and edits the existing home PR through its recipe, rows 2-3 retain the existing-PR disclosure and refusal rather than attempting a duplicate, and squash/keep/discard retain their existing disclosures and confirmations. Deliver companions before the supported home ship action; keep absorbed-PR closure authorization separate and unchanged. Do not start fan-out for a home action withheld by preflight.
+
+For PR, draft and squash:
+
+1. Validate existing receipts first. Skip only receipt-proven delivery. Check freshness for every unlanded leg before its delivery.
+2. Deliver each companion: for PR/draft, push with `git -C <worktree> push -u origin <branch>`, then run `gh pr create` in that worktree's cwd, adding `--draft` on every draft create. On retry of an existing PR use its URL and edit rather than duplicate create. For squash, use the existing Option 3 primary checkout/pull/merge/commit recipe and run that leg's recorded post-squash commands in the primary. Write its receipt even when those commands fail. No companion plan strip or telemetry seal runs.
+3. Collect complete companion results, including validated skips. Capture the spec path and evidence before the home plan strip. Run home's strip-and-seal block with repeated `--leg <repo>=<sha|pr-url>`, one per companion. Never seal partial results. Compare collected `{ repo, sha }` or `{ repo, pr }` entries with an existing seal's `legs:` set; differences stop naming stored and collected results. Retain all receipts when the bin fails and print its output. Never write companion `.pi/gauntlet/telemetry/`.
+4. Deliver home through the selected existing recipe after successful sealing, without running a second seal lacking the companion arguments. For PR-subject row 1 retain the whole-PR base and all body-edit/closure rules. Write home's receipt, including post-squash failures. Run cleanup only for squash, after successful post-squash verification.
+
+Put `Home: <repo> <shared branch> <home spec path>` in every companion PR body and squash message. Respect each leg's PR body style. List every companion PR URL in the home PR body (including the existing home PR's rework block), and every companion squash SHA in home's squash message.
+
+On the first delivery, verification or seal failure, stop fan-out and preserve delivered work and receipts. Print actual results, including validated skips, in member order:
+
+```text
+Shipped: <repo> <sha|pr> ...
+Not shipped: <repo> <reason> ...
+```
+
+A squash with failed post-verification belongs under Not shipped with its created SHA and error; do not conceal the commit. Include home when not delivered and every untouched remaining companion. Perform no rollback. A fresh-session retry validates the same receipts before continuing.
+
+## Discard and recorded cleanup - Steps 5 and 6
+
+List every member's branch, commit count, and worktree path as a resolved absolute path (the brief's or the recorded `home:` pattern expanded for this branch, e.g. `/work/repo-b/.worktrees/feature-shared-change`; never a pattern or placeholder) before one typed `discard` confirmation. Obtain exact confirmation once for the run, then clean every member, home included, through its recorded contract regardless of other members' refusals. Do not strip or seal for discard.
+
+For cleanup, use the recorded `## cleanup` worktree command, else `destroy:`, with the configured teardown hook using pi-cohort's existing semantics, else the owned built-in matched against that leg's recorded `home:`. Execute from that leg's primary. Expand recorded `<name>` and `<branch>` as single shell words using Step 6's escaping and ownership proof; resolve other tokens before execution. Never use `git worktree remove` past a wrapper or hook failure. Leave unmatched host-owned trees and their branches preserved.
+
+Clean companions in declared order, then home. Report a refusal as that leg's `failed` line, leave the tree intact, and continue the remaining cleanup attempts and the remaining report lines. After squash, stop only the refused companion's cleanup and attempt every remaining companion's recorded contract from its own primary; on any companion cleanup failure, skip home's cleanup and report `<home repo>: preserved - companion cleanup failed` to retain the home checkout for a fresh-session retry via /skill:gauntlet-resume. Delete a branch only after successful removal of its worktree. Run prune only for successful owned built-in removal, not after a wrapper. Report each repo's actual removed, preserved or failed state.
+
+Remove receipts only after home delivery and all required cleanup succeed, and report that removal in one explicit line (`Home delivery and required cleanup succeeded; receipts removed`). Receipts live in the home primary's git dir, so worktree removal never touches them; when any required cleanup failed, report `receipts retained - required cleanup failed` and leave every receipt in place for the retry. PR/draft success has no cleanup requirement and preserves every worktree, so its receipts are removed right after the home PR lands. Keep retains receipts for later validation. Mark ship complete only after the chosen action succeeds for every member; never mark discard as shipped.

package/skills/gauntlet-handoff/SKILL.md

@@ -65,7 +65,7 @@ Apply the first-line grammar in [menu-layout](../brainstorming/reference/menu-la
    (`disable-model-invocation: true`), so it is absent from the session skill list.
    Locate it by path: run `pi list`; the indented path under the `pi-cohort` entry
    (`npm:pi-cohort`, or a local path ending in `/pi-cohort`) is the package root. `Read` `<root>/skills/handoff/SKILL.md` and follow its procedure with the
-   output option resolved in step 1 - the brief's core (six headings, ending at
+   output option resolved in step 1. Read the run home's spec; with multiple members, explicitly supply `Run worktree: <home worktree>` through cohort's "was told to work in" snapshot clause. Pin the snapshot to that path, not the most-recently-used companion and not an `Also seen:` entry. The brief's core (six headings, ending at
    `## Skills loaded`) is cohort's to write, by cohort's rules. No `pi-cohort` entry, or
    the file missing -> STOP: "cohort `handoff` skill not found at
    `<root>/skills/handoff/SKILL.md` - install or upgrade to pi-cohort >= 7.1.0". No
@@ -85,7 +85,7 @@ Apply the first-line grammar in [menu-layout](../brainstorming/reference/menu-la
    - A phase `in_progress` (verify or ship included - resume stops at verify on its own)
      -> append the process-state section exactly as `## Producers` in
      `reference/brief-contract.md` lays it out: both status outputs verbatim
-     (`No plan active.` verbatim when there is no plan), the contract's artifact-specific fields, and the gate-history line. Recognize the loop alternative by ledger line 1; read the ledger from the run worktree for its durable last decision. Read the run worktree's spec; when it carries `## Rework record`, copy every top-level PR identity (without the title) and its full pre-rework head, home first in record order, into the optional fields in the contract's producer layout; copy the optional top-level rework base after the pairs as the contract specifies. Without that record, use the ordinary layout. Use only the contract's grammar; write no second state file. Append with a single
+     (`No plan active.` verbatim when there is no plan), the contract's artifact-specific fields, and the gate-history line. Recognize the loop alternative by ledger line 1; read the ledger from the run worktree for its durable last decision. Read the run worktree's spec; when it carries `## Rework record`, copy every top-level PR identity (without the title) and its full pre-rework head, home first in record order, into the optional fields in the contract's producer layout; copy the optional top-level rework base after the pairs as the contract specifies. Without that record, use the ordinary layout. For multiple members, read `reference/brief-contract.md` "Coordinated brief grammar" and append its ordered member snapshot, including missing trees and existing receipt paths, in that layout. Keep the core snapshot home-bound. Use only the contract's grammar; write no second state file. Append with a single
      `cat >> "<brief path>" <<'EOF' ... EOF` whose body is that block.
    - Re-read the file tail and confirm it ends with the gate-history line from the
      contract and nothing after.

package/skills/gauntlet-resume/SKILL.md

@@ -91,12 +91,13 @@ checks 2, 4, 5 do not apply; check 6 runs on the seed's pinned spec path.
    cwd with
    `realpath "$(git -C <worktree> rev-parse --path-format=absolute --git-common-dir)"`.
    If they differ, stop, name both paths, and say the resolved worktree belongs to a
-   different repository; restart pi in that repository's primary checkout and re-run.
+   different repository; restart pi in that repository's primary checkout and re-run. For member-primary entry on a coordinated brief, also print `home is <repo>; restart there`, naming the run home.
    Same-repository worktrees proceed by path: use `git -C <worktree>` for
    worktree Git commands and absolute artifact paths for `Read` and `plan_check`.
+3b. **Coordinated admission.** For a multi-member brief, read and apply `reference/brief-contract.md` "Coordinated admission" before any tracker write: resolve the home spec without inferring approval, compare ordered membership, validate each declared primary/common directory, shared branch and full home tuple, and live-validate receipts before admitting any missing tree. Preserve check 3's home binding.
 4. **Drift notice.** Compare the brief's `HEAD` and `dirty` fields in `## Repo state`
    with the live worktree (`git -C <worktree> rev-parse HEAD`, `git -C <worktree>
-   status --porcelain`). Announce differences. Informational, never a stop.
+   status --porcelain`). For coordinated briefs apply `reference/brief-contract.md` "Coordinated admission" per leg. Announce differences. Informational, never a stop.
 5. **Skills loaded.** For each name in `## Skills loaded` (none for
    `## Skills loaded: none`): match against the frontmatter `name` of every
    `skills/*/SKILL.md` in this package; `Read` each match's complete file into the

package/skills/gauntlet-resume/reference/brief-contract.md

@@ -27,7 +27,7 @@ Headings, fixed order. A consumer keys on headings, never prose.
 | `## Repo state` | one field per line: `toplevel`, `worktree: yes <path>` or `worktree: no`, `branch` (`detached` when none), `HEAD`, `base` (`unknown` when no remote resolves), `dirty: <porcelain>` or `dirty: clean`, `diff-stat` (`unavailable` when base unknown), `test cmd`; any field `unavailable` when its command failed; heading `## Repo state: not a git repo` outside git | always |
 | `## Decisions` | bullets; rejected alternatives marked `rejected:` | always |
 | `## Skills loaded` | frontmatter `name`s; `## Skills loaded: none` when none | always |
-| `## Process state` | `phase_tracker status` then `plan_tracker status` verbatim; `Active task: <name|none>`; optional one or more consecutive `PR: <owner/repo#N>` / `Pre-rework head: <40-char sha>` pairs, one per record group, home first, in record order, only for a PR subject; optional single `Rework base: <40-char sha>` after all PR pairs; the line `Gate history not restored - re-validate before advancing.` | only when a phase is `in_progress` and no hotfix flow is in context |
+| `## Process state` | `phase_tracker status` then `plan_tracker status` verbatim; `Active task: <name|none>`; optional one or more consecutive `PR: <owner/repo#N>` / `Pre-rework head: <40-char sha>` pairs, one per record group, home first, in record order, only for a PR subject; optional single `Rework base: <40-char sha>` after all PR pairs; optional coordinated block defined below after that line; the line `Gate history not restored - re-validate before advancing.` | only when a phase is `in_progress` and no hotfix flow is in context |
 
 For a loop ledger (line 1 exactly `# Ledger - loop engine`), replace `Active task` with these two fields, retaining both tracker status outputs and the gate-history line:
 
@@ -53,7 +53,7 @@ one blank line, the heading on its own line, a blank line, the `phase_tracker st
 output verbatim, a blank line, the `plan_tracker status` output verbatim, a blank line,
 `Active task: <name|none>`, then, only for a PR subject, one or more consecutive
 `PR: <owner/repo#N>` / `Pre-rework head: <40-char sha>` pairs, one per record group,
-home first, in record order, then optional single `Rework base: <40-char sha>` after all PR pairs and before the gate-history line -
+home first, in record order, then optional single `Rework base: <40-char sha>` after all PR pairs, then the optional coordinated block below, then the gate-history line after the last pair, rework-base line, or block -
 unfenced, nothing after.
 For a task plan, set `Active task` to the first `→` task name, else `none` (also for `No plan active.`). For a line-1 ledger, read its path and last decision and use the loop alternative above, retaining the optional PR pairs and rework base before the gate-history line. Copy the full rework base only from the top-level record when present; never invent a boundary for incomplete sync. Copy only top-level record pairs, without titles; `Threads:` and record `### PR #<N>` subsections are not brief fields. For N=1 emit one pair; without a Rework record use the ordinary layout.
 
@@ -80,6 +80,38 @@ Active task: W2: producer
 Gate history not restored - re-validate before advancing.
 ```
 
+## Coordinated brief grammar
+
+For more than one member only, append this block after the optional PR pairs and before the terminal gate-history line. Emit entries in the home spec's `### Leg:` order, home first. Keep the six core headings and `## Repo state` fields unchanged and bound to the run home. Distinguish PR home (the leading PR pair) from run home (the first member); do not infer one from the other.
+
+```text
+legs:
+  - repo: repo-a
+    worktree: <absolute home worktree>
+    branch: <shared branch>
+    HEAD: <full sha>
+    dirty: clean
+  - repo: repo-b
+    worktree: missing
+    branch: <shared branch>
+    HEAD: <last recorded full sha or unavailable>
+    dirty: unavailable
+    receipt: <absolute home-owned receipt path>
+Gate history not restored - re-validate before advancing.
+```
+
+Keep fields in this order. Use the portable repo identifier from `../../brainstorming/reference/legs.md`. Record the absolute worktree path or the literal `missing` when absent; record live HEAD and porcelain dirt (`clean` when empty), or last recorded HEAD and `unavailable` dirt for a missing tree. Include the optional receipt path only when a delivery receipt exists; transport is not proof. For a live tree without a receipt omit that field. Single-member and legacy briefs carry no coordinated block, leg file, receipt, `--leg` or companion loop.
+
+## Coordinated admission
+
+Run resume entry check 3 against the run home unchanged. Resolve the home spec through Candidates, retaining human approval/confirmation requirements; artifact presence supplies no approval. Before any tracker write, compare ordered brief membership with the home spec's `### Leg:` blocks exactly; name the missing, extra or reordered leg and both lists on mismatch. Use `../../brainstorming/reference/legs.md` for membership, companion-file and scope grammar; keep no duplicate grammar here.
+
+For each companion, parse the home overrides' selected sibling clone URL with shape-ticket's shared parser and use `<home PRIMARY parent>/<NAME>` as its declared primary. Canonicalize that primary's git common directory. Resolve an absent location from the leg's recorded `home:` contract and shared NAME (shared branch with `/` replaced by `-`), not a newly inferred wrapper. Require the companion worktree's canonical git common directory to equal the declared primary's, its live branch to equal the shared branch, and its leg file's full `**Home:**` tuple to equal the run home's repo, shared branch and repo-relative spec path. Stop naming the offending leg and expected/observed path, branch or full tuple. A live tree's branch or tuple mismatch is not informational drift.
+
+Admit a missing companion tree only after live receipt validation under `../../finishing-a-development-branch/reference/legs.md`. A copied receipt alone proves nothing. Announce per-leg HEAD and dirty drift against live trees without stopping; identify each leg. Keep approval, standing-grant validation, arming order and task snapshots unchanged. Dispatch task `Leg:` work in that leg's checkout, not the home by default.
+
+For a ship-stage retry with a correctly stripped plan, require every companion receipt to validate live before admitting the missing plan. Restore through the legal brainstorm start/skip, plan start/skip and implement skip sequence to verify, without inventing a plan_check stamp or conformance evidence. Re-validate unlanded home using recorded contracts and original scoped ACs, then run fresh home conformance and finish; use the finishing reference's retry route. Preserve receipts on seal or home delivery failure; do not repair or replace a correctly stripped plan. An absent plan without this fully validated ship retry remains a stop.
+
 ## Tracker output grammar
 
 Must match `formatStatus` in the phase-tracker and plan-tracker extensions.
@@ -163,7 +195,9 @@ Honor SKILL.md entry check 6's deferred stop before any process-state arming cal
 | implement with ledger | Read ledger line 1; resolve its path-only `**Spec:**` header; run entry checks 1-6, naming check 6 (Grant field); `start brainstorm`; `skip brainstorm` reason `resume: <spec path>`; `start plan`; `plan_check` on the absolute ledger path; on PASS `skip plan` reason `resume: <spec> (loop engine)` using the resolved absolute spec path as `<spec>`; `start implement`; no `plan_tracker init`; apply the shared cap boundary in `reconstruction.md` "Spec with ledger" step 4 before continuation; render cap, rows and decisions; continue at loop step 5. Follow `reconstruction.md` "Spec with ledger" for this self-contained ordered restore. On FAIL stop with findings, never `## Plan repair` or writing-plans. |
 | implement with task plan | `start brainstorm`; `skip brainstorm S`; `start plan`; `plan_check({ planPath })`; on FAIL run `## Plan repair`; on PASS `skip plan R`; `start implement`; `substep` if shown; `plan_tracker init` |
 | verify | `start brainstorm`; `skip brainstorm S`; `start plan`; `plan_check({ planPath })`; on FAIL run `## Plan repair`; on PASS `skip plan R`, then `skip implement R`; `start verify`; `substep` if shown; `plan_tracker init`. Never call `start implement`. |
-| ship | as verify. Restoration stops at verify in_progress: `complete verify` needs a fresh conformance dispatch and `skip verify` would bypass a real gate. Announce that the closure review re-runs before ship |
+| ship | With a correctly stripped coordinated plan, apply "Coordinated admission"'s fully receipt-validated retry route instead of plan repair; otherwise as verify. Restoration stops at verify in_progress: `complete verify` needs a fresh conformance dispatch and `skip verify` would bypass a real gate. Announce that the closure review re-runs before ship |
+
+For a coordinated ledger, apply reconstruction's pending companion return boundary before dispatch or verification, including verify/ship restores; record a validated interrupted return before continuing.
 
 For a ledger brief, pair by the ledger's path-only `**Spec:**` header, not basename; require the resolved spec under `flowGuards.specDirs` and the ledger under its sibling plans directory. Keep same-repository binding and human confirmation. For every ledger brief apply the shared cap boundary in `reconstruction.md` "Spec with ledger" step 4 before dispatch or verification, retaining its legacy stop and original-phase grant continuation. For verify/ship ledger briefs, use the ledger restore sequence through `skip plan`, then `skip implement R`; `start verify`, with no task tracker. Continue verify/ship ledger briefs in `/skill:loop-implementation` `After the loop` from step 1 (full ledger verification), after the already-restored `start verify`, retaining whole-diff code review, happy path when triggered, fresh conformance review and finishing without task-tracker calls. Ship still stops at verify for fresh conformance.
 

package/skills/gauntlet-resume/reference/reconstruction.md

@@ -62,6 +62,8 @@ plan commit; treat every task as `pending`.
 | one spec with ledger | "Spec with ledger" (takes precedence over a task plan) |
 | one spec with task plan only | "Spec with plan" |
 
+For a coordinated brief, use `brief-contract.md` "Coordinated admission" before tracker writes. Resolve the home spec, never a companion leg file, and retain every approval question. For a ship-stage retry whose plan is stripped, use that section's receipt-validated exception rather than proposing a new plan.
+
 ## Spec without plan
 
 Run SKILL.md entry check 6's deferred-header admission on the resolved spec before the approval/handoff question below; apply it to both routes, including the unapproved-draft brainstorming handoff. Keep grant decoding exempt for the unapproved route.
@@ -92,6 +94,8 @@ After confirmation:
 2. Call `phase_tracker({ action: "start", phase: "brainstorm" })`, then `phase_tracker({ action: "skip", phase: "brainstorm", reason: "resume: <spec path>" })`, then `phase_tracker({ action: "start", phase: "plan" })`.
 3. Call `plan_check({ planPath: <absolute ledger path> })`. On FAIL, stop with findings, retaining plan in_progress. Start the message with `gauntlet: stuck` followed by the findings reason on that line; never enter `## Plan repair` or writing-plans. On PASS, call `phase_tracker({ action: "skip", phase: "plan", reason: "resume: <spec> (loop engine)" })`, then `phase_tracker({ action: "start", phase: "implement" })`. Use the resolved absolute spec path as `<spec>` in the reason. Never call `plan_tracker init`.
 4. **Shared cap boundary (every ledger restore, before phase continuation).** Read `/skill:loop-implementation`. Skip Entry step 1 entirely; settings resolution and its unavailable-tool stop apply only to fresh seeding. Restore base, verification, iterations, `cap:`, row attempts, funding and retry allowances from the ledger/spec and branch without overwriting it. Render `cap: <n>`, rows, iterations, attempts, funding, retry allowances and all decisions; distinguish the latest operational `row <n> ...` decision from the last physical history line. A dirty tree takes the driver's discard-authorization stop without offering a cap grant. On a clean ledger missing `cap:`, stop with `ledger has no cap: line - seeded under the old loopEngine contract`, even when every row is closed. Use the driver's legacy `cap +N` grant (durable iterations + N), never settings. After the grant continue the original phase: implement at `Before each dispatch`; verify/ship at `After the loop` step 1, never reseed.
+Before continuation on a coordinated ledger, recover the pending companion return boundary. Read the durable `pending:` tuple (target row or seed, repo, pre-dispatch HEAD) and compare that companion's live head. Accept only exactly one new companion commit matching the tuple and carrying its consumed iteration and bounded result evidence. Validate the result, record its SHA and only that leg's target result or seeded state in the home ledger, and remove `pending:` in the home-ledger commit before dispatch. Preserve consumed iterations, attempts and cap; never rerun the recovered row. Unrelated head movement, multiple commits, or missing result evidence stops naming the leg and tuple. With no new commit, use the loop driver's interrupted-dispatch boundary, not a silent redispatch. Apply this boundary before dispatch or verification for every ledger restore.
+
 5. Continue at loop step 5, the delivered driver's `Before each dispatch`, with durable iterations and retry data. Never reset counters or reseed a validated seed.
 
 ## Spec with plan

package/skills/gauntlet-resume/reference/seed.md

@@ -4,6 +4,8 @@ Consumed only by `SKILL.md` in this directory, for a one-token `.md` argument cl
 as a spec seed. `<seed>` is its `realpath`; `<rel>` is `<seed>` relative to `<primary>`.
 Entry check 1 (idle session) runs first. Then, in order; every stop names the path.
 
+Before starting the seed sequence, read the seed's header. A `**Home:**` header marks a companion leg file: stop, name its home repo, branch and spec path, and direct resume to that home. Never create a run from a leg file.
+
 1. **Primary session.** `git rev-parse --git-dir --git-common-dir` in the session cwd
    prints two paths; their `realpath`s must agree. Otherwise stop:
    `seed from the primary checkout`.