pi-herdr-agents 2.0.4 → 3.0.0

package/AGENTS.md

@@ -6,6 +6,8 @@ These instructions apply to humans and coding agents changing `pi-herdr-agents`.
 
 `pi-herdr-agents` (Pi Herdr Agents) is a Pi extension that launches asynchronous Pi child agents exclusively in Herdr. Ordinary runs group child panes in extension-owned `Agents` tabs by default. Writing tasks may opt into one isolated Herdr-managed Git worktree per branch. Legacy role definitions that request an external CLI fail before Herdr creates resources.
 
+The package is a pack-neutral execution host: it ships no agent roles and no planning or review workflows. Its only skill is `pi-herdr-agents`, a general operating guide for the host; do not add methodology or workflow skills here. Roles come from project or global definitions and separately installed role packs. Do not add bundled roles, a privileged default pack, or name-keyed workflow behavior; see [ADR-0013](docs/adr/0013-pack-neutral-execution-host.md).
+
 The extension is fire-and-forget: `subagent` returns an acknowledgement, and completion is delivered to the parent automatically. Never add polling guidance that tells callers to sleep, tail sessions, or repeatedly check status.
 
 ## Read these first
@@ -14,26 +16,30 @@ The extension is fire-and-forget: `subagent` returns an acknowledgement, and com
 - [`docs/README.md`](docs/README.md) — map of shipped contracts, active design, ADRs, and background research
 - [`CONTEXT.md`](CONTEXT.md) — workflow-domain glossary; read it before changing orchestration design
 - [`docs/adr/0003-installable-role-packs.md`](docs/adr/0003-installable-role-packs.md) — installable role-pack discovery, precedence, and collision contract
+- [`docs/adr/0013-pack-neutral-execution-host.md`](docs/adr/0013-pack-neutral-execution-host.md) — role-free host ownership, removed commands, and `roles.bundled` deprecation
 - [`docs/worktree-subagents.md`](docs/worktree-subagents.md) — canonical worktree operating, review, recovery, and cleanup guide
 - [`RELEASING.md`](RELEASING.md) — release checks and publishing procedure
 
-Bundled role prompts live in [`agents/`](agents/). The native `/skill:orchestrate` public-review fan-out skill lives at [`skills/orchestrate/SKILL.md`](skills/orchestrate/SKILL.md). The `/plan` orchestration prompt lives at [`pi-extension/subagents/plan-skill.md`](pi-extension/subagents/plan-skill.md).
+Former bundled roles, `/plan`, its plan skill, and `/skill:orchestrate` now belong to the separately maintained `pi-herdr-roles` and `pi-herdr-pstack` packs. `/iterate`, `/btw`, and `/btw-close` were removed. Do not reintroduce them here.
 
 ## Code map
 
-- `pi-extension/subagents/index.ts` — public tools/commands, agent discovery, launch/watch lifecycle, completion delivery, worktree manifests and handoffs
-- `pi-extension/subagents/herdr.ts` — Herdr CLI calls, response parsing, and ID-based Agents tab placement and capacity
-- `pi-extension/subagents/terminal.ts` — terminal adapter used by the lifecycle
-- `pi-extension/subagents/lifecycle.ts`, `status.ts`, `activity.ts` — process/turn state and widget projection
-- `pi-extension/subagents/wake.ts`, `supervision.ts`, `supervision-config.ts` — file wake-ups, shared pane reconciliation, polling fallback, and supervision configuration
-- `pi-extension/subagents/persistent-config.ts` — strict persistent-specialist cap configuration
-- `pi-extension/subagents/completion.ts`, `session.ts`, `subagent-done.ts` — child completion, transcript handling, `caller_ping`, and `subagent_done`
+- `pi-extension/subagents/index.ts` — Pi composition root: public tools/commands, role-pack event bridge, host policy, widgets, and parent delivery
+- `pi-extension/subagents/model-registry.ts`, `config-path.ts` — permanent host-local SDK capability glue and configuration-path conventions
+- `maestro/core/` — seam interfaces and types; activity/lifecycle/status projection, routing, wake-ups, and supervision
+- `maestro/core/roles/discovery.ts`, `maestro/core/config/` — role parsing/discovery, injected-directory config loaders, and task-model init prompt construction
+- `maestro/core/worktree.ts`, `worktree-cleanup.ts` — manifest schema/state, handoff types, and cleanup eligibility/formatting
+- `maestro/adapters/pi/` — `PiHarnessAdapter`, launch transactions, completion evidence, session I/O, activity files, SDK model glue, and task-model registry projection
+- `maestro/adapters/pi/child/subagent-done.ts` — child protocol: `caller_ping`, `subagent_done`, and activity recording
+- `maestro/surfaces/herdr/` — `HerdrSurfaceProvider`, Herdr CLI driver, and terminal scripts/placement
+- `maestro/runtime/` — `RunSession`, Pi composition, run ownership, controls/retries, observation, delivery-gated cleanup, worktree operations/handoff, and task-model init composition
+- `maestro/adapters/fake/`, `maestro/surfaces/fake/`, `test/maestro/` — conformance fakes, seam tests, and the dependency-rule test
 - `CONTEXT.md` — orchestration-domain glossary
-- `docs/adr/` — hard-to-reverse architectural decisions
+- `docs/adr/` — hard-to-reverse architectural decisions; [ADR-0012](docs/adr/0012-adopt-maestro-seams-in-repo.md) records the maestro seams decision
 - `docs/research/` — evidence and alternatives, never the shipped contract
 - `test/test.ts` — unit tests for public subagent extension seams
-- `test/package-skill.test.js` — bundled skill and package manifest contract test
-- `test/integration/` — real Herdr and Pi lifecycle tests using the deterministic provider by default
+- `test/package-manifest.test.js` — package manifest and pack-neutral package-content contract test
+- `test/integration/` — real Herdr and Pi lifecycle tests using the deterministic provider by default; `test/integration/agents/` holds test-only role fixtures, including the multi-wave `test-coordinator`
 - `test/bench/supervision-bench.mjs` — manual isolated-Herdr supervision transport benchmark; raw samples stay in `/tmp/issue29-bench/`
 
 ## Worktree contract
@@ -69,8 +75,8 @@ When behavior changes, update every affected surface in the same commit:
 - public tool parameters, role-pack protocol, or lifecycle → `README.md`
 - role-pack discovery, precedence, or collision policy → `docs/adr/0003-installable-role-packs.md`
 - worktree behavior, handoff, recovery, or cleanup → `docs/worktree-subagents.md`
-- agent operating expectations → relevant files in `agents/`
-- `/plan` orchestration policy → `pi-extension/subagents/plan-skill.md`
+- role prompts, `/plan`, and review-workflow methodology → the owning role pack, not this repository
+- the `PI_SUBAGENT_ID` child-context hint → `README.md` and `CONTEXT.md`
 - contributor/release verification → this file, `.pi/skills/run-integration-tests/SKILL.md`, or `RELEASING.md`
 - domain terminology → `CONTEXT.md`
 - hard-to-reverse orchestration trade-offs → the relevant ADR; do not create an ADR for every design question
@@ -105,7 +111,7 @@ Use `PI_TEST_MODEL="openai-codex/gpt-5.6-luna" PI_TEST_TIMEOUT=180000 npm run te
 Before committing:
 
 - inspect `git status` and the final diff;
-- confirm the package preview includes `CHANGELOG.md`, `skills/orchestrate/SKILL.md`, `skills/orchestrate/adversarial-review.md`, and `skills/orchestrate/adversarial-review-example.js`, while excluding `pi-extension/subagents/workflow-worker.js`, plans, journals, sessions, prototypes, generated evidence, local config, and `openspec/`;
+- confirm the package preview includes `CHANGELOG.md`, `README.md`, `config.json.example`, and `pi-extension/subagents/index.ts`, contains no `agents/` resources, no `skills/` resources other than the host-owned `skills/pi-herdr-agents/SKILL.md`, and no `pi-extension/subagents/plan-skill.md`, and excludes `pi-extension/subagents/workflow-worker.js`, plans, journals, sessions, prototypes, generated evidence, local config, and `openspec/`;
 - run `npm pack --dry-run` when package contents or documentation paths changed; durable configuration is `$PI_CODING_AGENT_DIR/herdr-agents/config.json`, never package-root `config.json` (move old files manually or re-run `/subagents-init`);
 - confirm that no generated plans, journals, sessions, provider configuration, test scripts, or review artifacts are staged; and
 - confirm that no accidental empty directory exists at the repository root:

package/CHANGELOG.md

@@ -7,12 +7,74 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
-## [v2.0.4](https://github.com/giuseppecrj/pi-herdr-agents/compare/v2.0.3...v2.0.4)
+## [v3.0.0](https://github.com/giuseppecrj/pi-herdr-agents/compare/v2.0.5...v3.0.0)
+
+### Merged
+
+- Add subagent_cancel for ordinary managed subagents [`#73`](https://github.com/giuseppecrj/pi-herdr-agents/pull/73)
+- Add the pi-herdr-agents operating skill [`#72`](https://github.com/giuseppecrj/pi-herdr-agents/pull/72)
+- Conditional task-model writes with expectedConfigRevision [`#71`](https://github.com/giuseppecrj/pi-herdr-agents/pull/71)
+- Pack-neutral execution host: move bundled roles and workflows to optional packs [`#70`](https://github.com/giuseppecrj/pi-herdr-agents/pull/70)
+
+### Commits
+
+- refactor: compose Pi runs through owned sessions [`e9f8039`](https://github.com/giuseppecrj/pi-herdr-agents/commit/e9f803992894d304c4eb5b7608ab6cce4464ee16)
+- refactor: complete maestro core and dependency boundaries [`2ae8ba5`](https://github.com/giuseppecrj/pi-herdr-agents/commit/2ae8ba57b07d2f77b01363fe175f3b9084ebf6eb)
+- feat!: ship a pack-neutral execution host [`e262c58`](https://github.com/giuseppecrj/pi-herdr-agents/commit/e262c584f54a7c8d60eb1fa5510f47c1299e3801)
+- refactor: establish maestro seams and route Herdr surfaces [`20e5f2a`](https://github.com/giuseppecrj/pi-herdr-agents/commit/20e5f2aee1bebedf22f3b2e78dbf9b5a11f466ef)
+- refactor: route Pi child protocol through harness adapter [`891a533`](https://github.com/giuseppecrj/pi-herdr-agents/commit/891a533d517b4edc86dda19dc99476198741ea89)
+- chore: target Pi 1.0.0 dev dependencies [`a32e02f`](https://github.com/giuseppecrj/pi-herdr-agents/commit/a32e02ff4fed38f0d02a875ed6769f01266577e3)
+- fix: judge worktree cancel by launch-verified process identity [`37d8c62`](https://github.com/giuseppecrj/pi-herdr-agents/commit/37d8c62496aa7e4a421ca3e13d4dfeb8265a151a)
+- feat: add subagent_cancel for ordinary managed subagents [`05e53b8`](https://github.com/giuseppecrj/pi-herdr-agents/commit/05e53b87d3a7d7724f5d784b9eab5e51a1d33a79)
+- fix: bound worktree cancel by its deadline and judge late-captured identity [`f146db2`](https://github.com/giuseppecrj/pi-herdr-agents/commit/f146db2738a0c7fb557e73eaaff90b2845076553)
+- updates [`2b0a187`](https://github.com/giuseppecrj/pi-herdr-agents/commit/2b0a187aedbe2421c2966989cbff5e9c7adf1cc8)
+- feat: conditional task model config writes [`b04906b`](https://github.com/giuseppecrj/pi-herdr-agents/commit/b04906b6d6d0f81ac23a64753a5aec2b506c6423)
+- fix: require owned-process exit evidence and settle cancel edge cases [`3572b4f`](https://github.com/giuseppecrj/pi-herdr-agents/commit/3572b4f40dc004db83a90708234962ec7c10412b)
+- docs: add maestro seams design spec [`ce886f3`](https://github.com/giuseppecrj/pi-herdr-agents/commit/ce886f3660e9a995546904e625ca66a7ec55b9bb)
+- docs: record completed in-repo maestro seams [`d7291c2`](https://github.com/giuseppecrj/pi-herdr-agents/commit/d7291c26daa1b9aacdf0640fdccc27cab2dd0de8)
+- docs: replace subagent-lifecycle with general pi-herdr-agents operating skill [`7121f33`](https://github.com/giuseppecrj/pi-herdr-agents/commit/7121f33e9abe4a25f075dc1e2f96e10a90bc1004)
+- docs: add subagent-lifecycle host skill [`bfce217`](https://github.com/giuseppecrj/pi-herdr-agents/commit/bfce2177984a7b5fededc2b3a7fe255cc966e46c)
+- fix: keep a failed SIGTERM to a live identity unconfirmed and drop overdue provider answers [`4a3992d`](https://github.com/giuseppecrj/pi-herdr-agents/commit/4a3992d865eeb0a11a23350ff4de92dd892e30c2)
+- docs: fix host operating skill review findings and packaging wording [`bbeb580`](https://github.com/giuseppecrj/pi-herdr-agents/commit/bbeb580a5fb38d780209babcd8b5f7848b8543e2)
+- docs(skill): document subagent_cancel in host operating guide [`7a3508c`](https://github.com/giuseppecrj/pi-herdr-agents/commit/7a3508cfe886b5f7932bdf77d3d3a516d2a7dfcd)
+- test(integration): scope the untouched-pane check to the runner's own workspace [`fa483ea`](https://github.com/giuseppecrj/pi-herdr-agents/commit/fa483ea918f862da35162ca4d73ae6191288fa99)
+- docs: scope the pack-neutral claim to roles and workflows [`e75bea8`](https://github.com/giuseppecrj/pi-herdr-agents/commit/e75bea84a79218c9367ea5a165cbab161e2fb217)
+- fix: declare pi.skills so the lifecycle skill actually loads [`5b45e7f`](https://github.com/giuseppecrj/pi-herdr-agents/commit/5b45e7fb17080fe7b5d1d7e675d234fc140ed144)
+- docs(skill): cancel confirmation on absent pane; split requested vs unconfirmed guidance [`787f633`](https://github.com/giuseppecrj/pi-herdr-agents/commit/787f633f49a540a38665f76300d725037a4aaa45)
+- docs: correct subagent_done applicability in the host guide [`ea4602c`](https://github.com/giuseppecrj/pi-herdr-agents/commit/ea4602ce728348a42a332ac091380cc8552663ea)
+- docs: persistent interactive exception and thinking omission wording [`2692c51`](https://github.com/giuseppecrj/pi-herdr-agents/commit/2692c511696ffde339b235bbd146654ecc29562d)
+- Merge pull request #69: in-repo maestro seams [`c2177df`](https://github.com/giuseppecrj/pi-herdr-agents/commit/c2177dff835da44937e614e8a03d0405d442e848)
+
+## [v2.0.5](https://github.com/giuseppecrj/pi-herdr-agents/compare/v2.0.4...v2.0.5) - 2026-09-28
+
+### Merged
+
+- test(worktrees): fix path assertions and clarify cleanup scope [`#65`](https://github.com/giuseppecrj/pi-herdr-agents/pull/65)
+- fix(worktrees): support launches from linked checkouts [`#64`](https://github.com/giuseppecrj/pi-herdr-agents/pull/64)
+- fix(subagents): accept null worktree for strict tool clients [`#57`](https://github.com/giuseppecrj/pi-herdr-agents/pull/57)
+- fix(subagents): interactive mode time [`#62`](https://github.com/giuseppecrj/pi-herdr-agents/pull/62)
+
+### Commits
+
+- perf(startup): skip worktree inventory during session init [`8de2447`](https://github.com/giuseppecrj/pi-herdr-agents/commit/8de24470cb53fd345979cfe501a10645202403e0)
+- chore: release v2.0.5 [`ada6018`](https://github.com/giuseppecrj/pi-herdr-agents/commit/ada60185600383a207bb2a24e43d9b66b9ed8288)
+- test(worktrees): make quoting expectations independent [`a526824`](https://github.com/giuseppecrj/pi-herdr-agents/commit/a526824dcffd97fa09b158fba5cae05ff75fc100)
+- Merge commit '5fc2ea04b52a03df35b246cef6cb524516d34350' into maint/pr57-null-render-type [`e6fe747`](https://github.com/giuseppecrj/pi-herdr-agents/commit/e6fe747d5df44789df1e8fd42b585d4dbc36a144)
+- fix(worktrees): keep in-scope inventory rows visible [`41639a7`](https://github.com/giuseppecrj/pi-herdr-agents/commit/41639a7673e7a48c28e34e3f3f079c02f6454264)
+- refactor(cleanup): remove unused inventory notice [`330cc96`](https://github.com/giuseppecrj/pi-herdr-agents/commit/330cc9669eff14358e9eea8999f024e0ebfe4187)
+- docs: make worktree inventory on-demand [`e946dba`](https://github.com/giuseppecrj/pi-herdr-agents/commit/e946dba9ca246c15e581f35c098ccf88f003c4f9)
+- fix nullable worktree render args [`afc50bc`](https://github.com/giuseppecrj/pi-herdr-agents/commit/afc50bc6e96005f3a36c3e29a17be36f99d81845)
+
+## [v2.0.4](https://github.com/giuseppecrj/pi-herdr-agents/compare/v2.0.3...v2.0.4) - 2026-09-22
 
 ### Merged
 
 - perf: batch persistent delivery ledger reads [`#58`](https://github.com/giuseppecrj/pi-herdr-agents/pull/58)
 
+### Commits
+
+- chore: release v2.0.4 [`4cacc1a`](https://github.com/giuseppecrj/pi-herdr-agents/commit/4cacc1a65c3cb8627f05264b61684a8089cb7512)
+
 ## [v2.0.3](https://github.com/giuseppecrj/pi-herdr-agents/compare/v2.0.2...v2.0.3) - 2026-09-21
 
 ### Commits

package/CONTEXT.md

@@ -3,11 +3,48 @@
 ## Language
 
 **Pi subagent runtime**:
-The single execution path for fresh and resumed children. `launchPiSubagent()`
-owns the complete Pi and Herdr launch transaction; completion uses Pi sidecar
-evidence first and the terminal exit marker as fallback.
+The single real execution path for fresh and resumed children, coordinated by a
+run session through the Pi harness adapter. `launchPiSubagent()` still owns each
+complete launch transaction; completion uses Pi sidecar evidence first and the
+terminal exit marker as fallback.
 _Avoid_: Runtime dispatch, adapter registry, split launch ownership
 
+**Harness adapter**:
+An object implementing the core interface for child launch, observation,
+completion evidence, and controls. Pi is the only real implementation; the fake
+is for conformance tests.
+_Avoid_: Runtime selector, adapter registry, external CLI compatibility
+
+**Surface provider**:
+An object implementing the core interface for panes, commands, inspection, and
+worktree surfaces. Herdr is the only real implementation; the fake is for
+conformance tests.
+_Avoid_: Supported multiplexer catalog, harness adapter, security sandbox
+
+**Run session**:
+The runtime owner coordinating launched attempts, retries, observations,
+settlement, and delivery-gated surface cleanup. Pi composition supplies the
+real adapter, provider, and session I/O.
+_Avoid_: Pi session file, persistent specialist identity, historical run registry
+
+**Composition root**:
+The Pi host entry point that registers tools and commands, supplies current
+launch inputs and host policy, renders status, and delivers parent results.
+Runtime composition constructs adapters and providers behind its operations.
+_Avoid_: Direct adapter dispatch, duplicated launch owner, workflow engine
+
+**Dependency rule**:
+The test-enforced import boundaries between core, adapters, surfaces, runtime,
+and the Pi host. Core stays harness-neutral; the host consumes core and runtime
+without direct adapter or surface imports.
+_Avoid_: Runtime authorization, package split, hidden compatibility re-export
+
+**Conformance suite**:
+Shared seam-contract tests applied to an in-memory fake and the real
+implementation. Fake coverage is local; real Pi and Herdr coverage uses the
+deterministic integration suite.
+_Avoid_: Second supported harness, fake-only behavior proof, release certification
+
 **Child wake-up signal**:
 An internal indication that prompts fresh inspection of an owned child. It does
 not itself establish completion, failure, or a help request.
@@ -18,6 +55,22 @@ The parent-facing handoff of a child run's observed outcome and available
 evidence. Receiving it does not establish that the work is correct or accepted.
 _Avoid_: Wake-up signal, acceptance
 
+**Operator cancel**:
+A parent's `subagent_cancel` of one ordinary managed run. Its terminal intent is
+recorded before any abort, kill, or await, so no fallback, retry, or recovery
+follows. The run settles with one cancelled result only after its owned process
+or pane termination is confirmed; unconfirmed termination keeps it live for a
+retry, and shutdown suppression of it is not a cancellation. A natural result
+taken first stays authoritative.
+_Avoid_: Interrupt, suppression, persistent stop, pane-close fallback
+
+**Process identity**:
+A managed worktree child's Pi process named by immutable kernel facts (PID,
+start time, boot, and PID namespace), recorded by the child at launch and
+verified by the parent against the Herdr pane. A worktree cancel signals and
+judges exit only by it.
+_Avoid_: argv match, foreground process, shell visibility
+
 **No-progress advisory**:
 An internal warning that an active child shows no durable progress in its session
 JSONL or activity snapshot. It is advisory only and never changes the child's
@@ -30,18 +83,34 @@ diagnostic, and launch fails before Herdr creates a pane or worktree. Remove
 `cli` and `cli-model`, then select the model through Pi provider/model routing.
 _Avoid_: Silent Pi reinterpretation, compatibility adapter
 
-**Public review fan-out**:
-A parent procedure that materializes pinned evidence, launches fresh public
-reviewer subagents, receives automatic result delivery, and synthesizes every
-outcome. Reviewers use ordinary panes and do not poll for completion.
-_Avoid_: Hidden child runner, approval gate, parentless aggregation
-
-**Pinned review evidence**:
-The parent-captured repository identity, base and head SHAs, task/spec text,
-provenance, changed-file inventory, complete diff, and deleted or base-only
-content supplied to reviewers. Dirty state is included only when explicitly
-captured and fingerprinted.
-_Avoid_: Moving-checkout inference, head-only deleted-content review
+**Pack-neutral host**:
+This package as an execution host that ships no agent roles and no planning or
+review workflows. Its only skill, `pi-herdr-agents`, is a general operating guide for its own
+control tools. Role packs and project or global definitions supply every
+named role. An empty catalog is valid, and bare launches need no role.
+_Avoid_: Default role set, privileged pack, starter workflow
+
+**Role pack**:
+A separately installed Pi package that registers role definitions through the
+`pi-herdr-subagents:roles:discover:v1` event. Registered packs form the whole
+package layer below global and project definitions; duplicate names across
+packs are disabled. A pack owns its roles' workflows, skills, prerequisites, and
+workflow glossary.
+_Avoid_: Bundled layer, protected fallback, load-order winner
+
+**Child-context hint**:
+The `PI_SUBAGENT_ID` environment variable set for every fresh or resumed child
+this extension launches, and absent from `/worktree` handoff sessions. It
+distinguishes delegated children from user sessions for tool registration and
+pack state decisions. Nested processes inherit it, so it is not a security
+boundary.
+_Avoid_: Authentication token, permission check, second child protocol
+
+**Deprecated role setting**:
+A valid legacy `roles.bundled` boolean, accepted as a no-op and reported once per
+parent extension load. Malformed values remain configuration errors. The
+extension never rewrites user configuration.
+_Avoid_: Bundled-role toggle, automatic migration
 
 **Role allowlist**:
 The `tools:` inline comma-separated role-frontmatter scalar passed to Pi for a
@@ -49,20 +118,6 @@ public child. It is the enforced capability boundary available to a reviewer.
 `read,bash` is not read-only because Bash can mutate files.
 _Avoid_: Shell-as-read-only claim, implicit capability grant
 
-**Finding record**:
-A bounded review record with a stable ID, claimed P0–P3 severity, nullable
-confirmed severity, separate provenance, evidence status (`reproduced`,
-`trace-backed`, or `unverified`), preconditions, reproduction or trace, expected
-and actual behavior, impact, and minimal fix. An unverified potential P0/P1 is
-a candidate for verification, not a certified finding.
-_Avoid_: Confidence gate, provenance-as-severity, vote count
-
-**Incomplete review**:
-A review outcome for drift, failure, missing or truncated evidence, malformed
-output, coverage gaps, or unresolved serious candidates. A child-reported
-`INCOMPLETE` propagates to the parent result.
-_Avoid_: Hidden missing coverage, certified uncertainty
-
 **Persistent specialist**:
 A logical subagent that retains one policy-bound Pi session between sequential
 tasks until it is stopped or crashes.
@@ -156,9 +211,8 @@ model family than the author. For ordinary review, prefer a different
 authenticated model family. When no other authenticated model family is
 available, ordinary review may use a same-family reviewer in a fresh standalone
 session. Disclose that this review is context-isolated, not cross-family
-independent. Cross-family verification, `/skill:orchestrate`, and
-`adversarial-reviewer` must not use this fallback. Family is the independence
-boundary; project policy may separately require a
+independent. Cross-family verification must not use this fallback. Family is
+the independence boundary; project policy may separately require a
 different provider.
 _Avoid_: Generic tier, reviewer-family enforcement, per-step routing