prizmkit 1.1.131 → 1.1.134

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.131",
-  "bundledAt": "2026-07-18T08:21:47.386Z",
-  "bundledFrom": "c1378b1"
+  "frameworkVersion": "1.1.134",
+  "bundledAt": "2026-07-19T00:56:53.854Z",
+  "bundledFrom": "09d7b00"
 }

package/bundled/adapters/claude/command-adapter.js

@@ -7,8 +7,6 @@
  *   - Only `description` in frontmatter
  *   - `${SKILL_DIR}` references rewritten to relative paths
  *   - Skills with assets/scripts use directory structure
- *
- * Code-review-specific named agents are retired; review runs in the Main Agent.
  */
 
 import { parseFrontmatter, buildMarkdown } from '../shared/frontmatter.js';

package/bundled/dev-pipeline/assets/skill-subagent-integration.md

@@ -6,8 +6,9 @@
 
 Skill behavior is owned by canonical skills:
 
+- `/prizmkit-plan` runs its mandatory local Plan/Spec review, then may use its complete skill-local independent Plan Reviewer reference only when the host proves the strict semantic capability gate.
 - `/prizmkit-implement` executes plan tasks directly and may use its local implementation-subagent reference for narrow active-checkout delegation.
-- `/prizmkit-code-review` runs its complete bounded review and repair loop directly in the Main Agent.
+- `/prizmkit-code-review` runs its mandatory bounded Main-Agent review and repair loop, then may use its complete skill-local independent Code Reviewer reference under the same fail-closed capability model.
 
 ## Architecture
 
@@ -21,9 +22,9 @@ dev-pipeline (outer loop)
     +-- [per session] AI CLI
             |
             +-- Context snapshot + specify + plan (orchestrator)
-            +-- Local plan/spec review loop inside prizmkit-plan
+            +-- Mandatory local plan/spec review, then optional strict-gated independent Plan review
             +-- Implement through /prizmkit-implement
-            +-- Main-Agent code review through /prizmkit-code-review
+            +-- Mandatory Main-Agent code review, then optional strict-gated independent Code review
             +-- Scoped test gate and browser attempt
             +-- Retrospective & commit (orchestrator)
 ```
@@ -32,16 +33,20 @@ dev-pipeline (outer loop)
 
 | Skill | Reference | Purpose |
 |---|---|---|
+| `/prizmkit-plan` | skill-local `references/independent-plan-review.md` | Optional bounded Plan correctness review with strict capability gating and native continuation |
 | `/prizmkit-implement` | skill-local `references/implementation-subagent-procedure.md` | Optional narrow implementation delegation contract |
-| `/prizmkit-code-review` | skill-local `references/review-report-template.md` | Main-Agent review progress and terminal-result contract |
+| `/prizmkit-code-review` | skill-local `references/independent-code-review.md` | Optional bounded implementation correctness review with strict capability gating and native continuation |
+| `/prizmkit-code-review` | skill-local `references/review-report-template.md` | Main-Agent and independent-review progress plus terminal-result contract |
 
-The orchestrator role is handled by the Main Agent directly. Code review does not install or invoke a separate platform agent definition.
+The Main Agent remains the stage owner. No platform adapter installs a named Reviewer definition or maps platform-specific tools into the protocol. Each skill carries its own complete reference.
 
 ## Active Checkout Contract
 
 Any optional implementation subagent must run in the expected active git top-level. Its prompt contract forbids git worktrees, tool-created worktree isolation, copied repository checkouts, remote isolated checkouts, branch switching, and operating outside the expected active checkout.
 
-Code review always runs in the Main Agent's current workspace so staged, unstaged, and untracked content remains authoritative.
+The Main Agent captures bounded immutable review input from the active checkout after its mandatory review converges. This input includes the exact current Plan artifacts or the complete current implementation change plus only implicated supporting paths. The Reviewer does not discover workspace state by running Git commands and never creates a skill-level worktree.
+
+Independent review runs only when the host can structurally provide read-only access, no mutation, no arbitrary command execution, no downstream execution, and native resume of the same execution unit. If any capability is unavailable or unproven, the stage records strict downgrade and creates no weak substitute. A fresh Reviewer plus a summary is never continuation.
 
 Pipeline runner-owned linked worktrees are an outer runtime option. They do not authorize a skill-level execution unit to create or enter another worktree.
 

package/bundled/dev-pipeline/prizmkit_runtime/gitops.py

@@ -17,9 +17,8 @@ PIPELINE_METADATA_EXCLUDES = (
     ":(top,exclude,glob).*/worktree/**",
     ":(top,exclude,glob).*/worktrees",
     ":(top,exclude,glob).*/worktrees/**",
-    ":(top,exclude).prizmkit/state",
-    ":(top,exclude,glob).prizmkit/state/**",
-    ":(top,exclude).prizmkit/manifest.json",
+    ":(top,exclude).prizmkit",
+    ":(top,exclude,glob).prizmkit/**",
 )
 
 HIDDEN_TOOL_WORKTREE_EXCLUDES = (
@@ -34,12 +33,6 @@ HIDDEN_TOOL_WORKTREE_EXCLUDES = (
     ":(top,exclude,glob).codex/**",
     ":(top,exclude).agents",
     ":(top,exclude,glob).agents/**",
-    ":(top,exclude).prizmkit/prizm-docs",
-    ":(top,exclude,glob).prizmkit/prizm-docs/**",
-    ":(top,exclude).prizmkit/config.json",
-    ":(top,exclude).prizmkit/manifest.json",
-    ":(top,exclude).prizmkit/dev-pipeline",
-    ":(top,exclude,glob).prizmkit/dev-pipeline/**",
 )
 
 UNTRACKED_TRANSIENT_EXCLUDES = (

package/bundled/dev-pipeline/prizmkit_runtime/processes.py

@@ -6,8 +6,10 @@ import os
 import signal
 import subprocess
 import sys
+import threading
 import time
-from collections.abc import Mapping, Sequence
+from collections.abc import Iterator, Mapping, Sequence
+from contextlib import contextmanager
 from dataclasses import dataclass, field
 from pathlib import Path
 
@@ -62,6 +64,24 @@ class ProcessRunResult:
     termination: ProcessTerminationResult | None = None
 
 
+@contextmanager
+def shield_interruption_signals() -> Iterator[None]:
+    """Ignore repeated interruption signals while fail-closed cleanup runs."""
+    if threading.current_thread() is not threading.main_thread():
+        yield
+        return
+
+    previous_handlers: dict[int, object] = {}
+    try:
+        for signal_number in (signal.SIGINT, signal.SIGTERM):
+            previous_handlers[signal_number] = signal.getsignal(signal_number)
+            signal.signal(signal_number, signal.SIG_IGN)
+        yield
+    finally:
+        for signal_number, handler in previous_handlers.items():
+            signal.signal(signal_number, handler)
+
+
 def _creationflags_for_platform(start_new_process_group: bool) -> int:
     if os.name != "nt" or not start_new_process_group:
         return 0

package/bundled/dev-pipeline/prizmkit_runtime/runners.py

@@ -3,9 +3,12 @@
 from __future__ import annotations
 
 import json
+import signal
 import sys
+import threading
 import time
-from collections.abc import Mapping
+from collections.abc import Iterator, Mapping
+from contextlib import contextmanager
 from pathlib import Path
 
 from .commands import CommandResult  # type: ignore  # imported only at runtime by commands.py
@@ -27,6 +30,7 @@ from .gitops import (
     worktree_runtime_context,
     worktree_save_wip,
 )
+from .processes import shield_interruption_signals
 from .runner_bookkeeping import (
     commit_final_bookkeeping,
     commit_pre_branch_bookkeeping,
@@ -51,6 +55,26 @@ from .task_checkout import (
 )
 
 
+def _interrupt_from_sigterm(_signal_number, _frame) -> None:
+    """Translate daemon SIGTERM into the existing fail-closed interrupt path."""
+    raise KeyboardInterrupt
+
+
+@contextmanager
+def _bridge_sigterm_to_interrupt() -> Iterator[None]:
+    """Install a scoped SIGTERM bridge when running on the main thread."""
+    if threading.current_thread() is not threading.main_thread():
+        yield
+        return
+
+    previous_handler = signal.getsignal(signal.SIGTERM)
+    try:
+        signal.signal(signal.SIGTERM, _interrupt_from_sigterm)
+        yield
+    finally:
+        signal.signal(signal.SIGTERM, previous_handler)
+
+
 def run_pipeline_command(kind: str, action: str, legacy_args: tuple[str, ...], paths) -> CommandResult:
     """Dispatch a feature/bugfix/refactor Python foreground command."""
     family = family_for(kind, paths)
@@ -89,7 +113,8 @@ def run_pipeline_command(kind: str, action: str, legacy_args: tuple[str, ...], p
     if not invocation.list_path.is_file():
         return CommandResult(1, f"Python {kind} runner", f"Plan list not found: {invocation.list_path}")
     try:
-        result = _run_pipeline(family, invocation, paths)
+        with _bridge_sigterm_to_interrupt():
+            result = _run_pipeline(family, invocation, paths)
     except Exception as exc:  # keep CLI boundary traceback-free
         return CommandResult(1, f"Python {kind} runner failed", str(exc))
     details = result.details + ((f"last_status: {result.last_status}",) if result.last_status else ())
@@ -121,7 +146,8 @@ def _run_pipeline(family: RunnerFamily, invocation: RunnerInvocation, paths) ->
         try:
             status = _process_item(family, invocation, invocation.item_id, paths, initial_metadata={})
         except KeyboardInterrupt:
-            return PipelineRunResult(False, 1, "interrupted", "interrupted")
+            with shield_interruption_signals():
+                return PipelineRunResult(False, 1, "interrupted", "interrupted")
         return PipelineRunResult(status == "completed", 1, "single_item_done", status)
 
     while True:
@@ -157,15 +183,16 @@ def _run_pipeline(family: RunnerFamily, invocation: RunnerInvocation, paths) ->
         try:
             final_status = _process_item(family, invocation, item_id, paths, initial_metadata=next_result.data)
         except KeyboardInterrupt:
-            processed += 1
-            item_statuses[item_id] = "interrupted"
-            return PipelineRunResult(
-                False,
-                processed,
-                "interrupted",
-                "interrupted",
-                _render_item_statuses(item_statuses),
-            )
+            with shield_interruption_signals():
+                processed += 1
+                item_statuses[item_id] = "interrupted"
+                return PipelineRunResult(
+                    False,
+                    processed,
+                    "interrupted",
+                    "interrupted",
+                    _render_item_statuses(item_statuses),
+                )
         processed += 1
         item_statuses[item_id] = final_status
         if final_status in _completion_compatible_statuses(family):
@@ -768,14 +795,74 @@ def _process_item_locked(
                 classification_fatal_error_code=classification.fatal_error_code,
             )
     except KeyboardInterrupt:
-        _emit_warning(f"Interrupted while processing {item_id}; preserving work and returning to {base_branch}")
-        if use_worktree and worktree_runtime is not None:
-            worktree_save_wip(worktree_runtime)
-        else:
-            branch_ensure_return(paths.project_root, base_branch, branch_name)
+        with shield_interruption_signals():
+            _cleanup_interrupted_task(
+                item_id=item_id,
+                paths=paths,
+                base_branch=base_branch,
+                branch_name=branch_name,
+                use_worktree=use_worktree,
+                worktree_runtime=worktree_runtime,
+            )
         raise
 
 
+def _cleanup_interrupted_task(
+    *,
+    item_id: str,
+    paths,
+    base_branch: str,
+    branch_name: str,
+    use_worktree: bool,
+    worktree_runtime,
+) -> None:
+    """Preserve interrupted task work and report the verified checkout state."""
+    _emit_warning(f"Interrupted while processing {item_id}; preserving work safely")
+    if use_worktree and worktree_runtime is not None:
+        preserved = worktree_save_wip(worktree_runtime)
+        if getattr(preserved, "ok", True):
+            _emit_warning(
+                f"Interrupted task {item_id}: work preserved in {worktree_runtime.worktree_path}; "
+                "task worktree remains active"
+            )
+            return
+        _emit_interruption_cleanup_failure(
+            preserved,
+            f"Could not preserve interrupted work for {item_id}; leaving task worktree active",
+            f"Inspect the task worktree: {worktree_runtime.worktree_path}",
+        )
+        return
+
+    returned = branch_ensure_return(paths.project_root, base_branch, branch_name)
+    if getattr(returned, "ok", True) and current_branch(paths.project_root) == base_branch:
+        _emit_warning(f"Interrupted task {item_id}: work preserved and returned to {base_branch}")
+        return
+    _emit_interruption_cleanup_failure(
+        returned,
+        f"Could not safely return to {base_branch}; leaving {branch_name} active",
+        f"After resolving the Git blocker, run: git checkout {base_branch}",
+    )
+
+
+def _emit_interruption_cleanup_failure(result, message: str, recovery: str) -> None:
+    """Emit a concise failed Git step and a non-destructive recovery action."""
+    _emit_warning(message)
+    commands = tuple(getattr(getattr(result, "plan", None), "commands", ()))
+    results = tuple(getattr(result, "results", ()))
+    for index, command_result in enumerate(results):
+        if getattr(command_result, "return_code", 0) == 0:
+            continue
+        command = commands[index] if index < len(commands) else None
+        if command is not None and getattr(command, "allow_failure", False):
+            continue
+        args = " ".join(map(str, getattr(command_result, "args", ())))
+        detail = str(getattr(command_result, "stderr", "") or getattr(command_result, "stdout", "")).strip()
+        suffix = f": {detail.splitlines()[0][:500]}" if detail else ""
+        _emit_warning(f"git {args} failed{suffix}")
+        break
+    _emit_warning(recovery)
+
+
 def _is_retryable_ai_outcome(session_status: str, new_status: str) -> bool:
     """Return whether a persisted post-launch outcome should continue in-process."""
     if session_status in {"success", "stalled_context_continuation", "workflow_blocked"}:

package/bundled/dev-pipeline/prizmkit_runtime/sessions.py

@@ -20,7 +20,7 @@ from pathlib import Path
 from .checkpoint_state import load_checkpoint_state
 from .heartbeat import HeartbeatConfig, HeartbeatMonitor, HeartbeatState, observe_heartbeat_state, write_stale_marker
 from .launch_profiles import HeadlessLaunchProfile
-from .processes import ProcessHandle, ProcessSpec, launch_process, terminate_process_tree
+from .processes import ProcessHandle, ProcessSpec, launch_process, shield_interruption_signals, terminate_process_tree
 from .status import ProgressSummary
 
 
@@ -868,7 +868,8 @@ class AISessionLauncher:
                             )
                             last_progress_emit = now
         except KeyboardInterrupt:
-            terminate_process_tree(handle, "interrupted", grace_seconds=self.config.stale_kill_grace_seconds)
+            with shield_interruption_signals():
+                terminate_process_tree(handle, "interrupted", grace_seconds=self.config.stale_kill_grace_seconds)
             raise
         if self.config.live_output and (not self.config.verbose or self.config.suppress_stream_output):
             final_heartbeat_state = _display_heartbeat_state(

package/bundled/dev-pipeline/scripts/generate-bootstrap-prompt.py

@@ -681,7 +681,7 @@ SECTION_TO_SKILL = {
         "prizmkit-plan", "Plan & Tasks",
         [".prizmkit/specs/{slug}/plan.md"],
     ),
-    "phase-implement": checkpoint_step("prizmkit-implement", "Implement + Test", []),
+    "phase-implement": checkpoint_step("prizmkit-implement", "Implement", []),
     "phase-prizmkit-test": checkpoint_step(
         "prizmkit-test", "Scoped Feature Test Gate",
         [".prizmkit/specs/{slug}/test-report-path.txt",
@@ -1619,10 +1619,10 @@ def _tier_header(pipeline_mode):
             "# Dev-Pipeline Session Bootstrap — Tier 3 "
             "(Main-Agent Full Guardrails)\n",
             "**Tier 3 — Main-Agent Full Guardrails**: For complex "
-            "features, the main orchestrator handles context, planning, "
-            "implementation, and Code Review directly. No top-level Dev "
-            "implementation subagent is spawned, and Code Review never uses "
-            "direct or indirect delegation.\n",
+            "features, the main orchestrator handles context, planning, and "
+            "implementation directly, then runs mandatory Main-Agent review. "
+            "After convergence, the review skill may use only its strict-gated "
+            "skill-owned independent Reviewer.\n",
         ),
     }
     return headers.get(pipeline_mode, headers["lite"])
@@ -1658,8 +1658,8 @@ def _tier_reminders(pipeline_mode):
             "Code Review writes only review-report.md",
             "- Gate checks require the Implementation Log (with Gate Evidence) "
             "and a valid review-report.md Final Result before proceeding",
-            "- Code Review runs only in the current Main Agent and never uses "
-            "direct or indirect delegation",
+            "- Code Review keeps mandatory Main-Agent ownership; after convergence "
+            "it may use only its strict-gated skill-owned independent Reviewer",
             "- On timeout outside Code Review: check snapshot + git diff HEAD "
             "→ model:lite → remaining steps only → max 2 retries per phase → "
             "Main Agent fallback",
@@ -1667,13 +1667,13 @@ def _tier_reminders(pipeline_mode):
     else:  # full
         specific = [
             "- Tier 3: full orchestration — the Main Agent implements directly "
-            "and owns the complete Code Review loop",
+            "and owns the mandatory Code Review loop",
             "- context-snapshot.md is the implementation knowledge base; "
             "Code Review writes only review-report.md",
             "- Gate checks require the Implementation Log and a valid "
             "review-report.md Final Result before proceeding",
-            "- Code Review is excluded from normal work delegation and never "
-            "uses direct or indirect delegation or another review entry point",
+            "- Code Review excludes ordinary work delegation and permits only "
+            "the skill-owned independent Reviewer under its strict structural gate",
             "- Do NOT use `run_in_background=true` when spawning normal work "
             "agents outside Code Review",
             "- If a normal work Agent call fails with team/config/lock errors, "
@@ -1865,11 +1865,13 @@ def assemble_sections(pipeline_mode, sections_dir, init_done, is_resume,
                           load_section(sections_dir,
                                        browser_section_file)))
 
+    # --- Headless commit authorization ---
+    sections.append(("headless-commit-authorization",
+                      load_section(sections_dir, "headless-commit-authorization.md")))
+
     # --- Commit (tier-dependent) ---
     if pipeline_mode == "full":
-        sections.append(("phase-commit",
-                          load_section(sections_dir,
-                                       "phase-commit-full.md")))
+        sections.append(("phase-commit", load_section(sections_dir, "phase-commit-full.md")))
     else:
         sections.append(("phase-commit",
                           load_section(sections_dir,

package/bundled/dev-pipeline/scripts/generate-bugfix-prompt.py

@@ -300,12 +300,9 @@ def build_replacements(args, bug, global_context, script_dir):
     dev_url = "http://localhost:{}".format(dev_port) if dev_port.isdigit() else "<UNKNOWN_DETECT_FROM_PROJECT_CONFIG>"
 
     pipeline_mode = determine_bugfix_mode(args, bug)
-    recovery_like = is_recovery_like(args)
     manual_or_hybrid = verification_type in ("manual", "hybrid")
     manual_policy = (
-        "Recovery-class session: automated verification may substitute for manual/hybrid UAT when evidence is documented."
-        if manual_or_hybrid and recovery_like
-        else "Fresh manual/hybrid bugfix: stop as partial before commit after automated checks; manual UAT is required."
+        "Manual/hybrid verification is executed automatically in headless mode: use available browser, CLI, API, fixture, and test evidence; document the verification evidence and proceed through review, test, retrospective, and commit."
         if manual_or_hybrid
         else "Automated verification: complete tests/review and proceed to commit when gates pass."
     )
@@ -390,7 +387,7 @@ def _bugfix_header(pipeline_mode):
     title = "# Dev-Pipeline Bug Fix Session Bootstrap — {}\n".format(pipeline_mode.title())
     desc = {
         "lite": "**Tier 1 — Single Agent**: direct root-cause fix by the main orchestrator.",
-        "standard": "**Tier 2 — Main-Agent Review Gates**: direct implementation with Main-Agent-only review gates.",
+        "standard": "**Tier 2 — Main-Agent Review Gates**: direct implementation with mandatory Main-Agent review and optional strict capability-gated independent correctness review.",
         "full": "**Tier 3 — Full Bugfix Guardrails**: direct implementation with stronger diagnosis and review gates.",
     }.get(pipeline_mode, "**Bugfix pipeline**")
     return title + "\n" + desc + "\n"
@@ -422,13 +419,6 @@ def assemble_bugfix_sections(pipeline_mode, sections_dir, browser_enabled, manua
         sections.append(("phase-browser", load_section(sections_dir, browser_section_file)))
     if manual_gate:
         sections.append(("bugfix-manual-gate", load_section(sections_dir, "bugfix-phase-manual-verification.md")))
-        sections.extend([
-            ("bugfix-session-status", load_section(sections_dir, "bugfix-session-status.md")),
-            ("bugfix-critical-paths", load_section(sections_dir, "bugfix-critical-paths.md")),
-            ("failure-capture", load_section(sections_dir, "failure-capture.md")),
-            ("bugfix-reminders", load_section(sections_dir, "bugfix-reminders.md")),
-        ])
-        return sections
     sections.extend([
         ("headless-commit-authorization", load_section(sections_dir, "headless-commit-authorization.md")),
         ("bugfix-phase-commit-report", load_section(sections_dir, "bugfix-phase-commit-report.md")),
@@ -500,7 +490,7 @@ def main():
     replacements = build_replacements(args, bug, global_context, script_dir)
     pipeline_mode = replacements["{{PIPELINE_MODE}}"]
     browser_enabled = replacements["{{BROWSER_ENABLED}}"] == "true"
-    manual_gate = bug.get("verification_type", "automated") in ("manual", "hybrid") and not is_recovery_like(args)
+    manual_gate = bug.get("verification_type", "automated") in ("manual", "hybrid")
 
     use_sections = os.path.isdir(sections_dir) and not args.template
     sections = []

package/bundled/dev-pipeline/scripts/generate-recovery-prompt.py

@@ -97,10 +97,11 @@ Implement the minimal fix (red → green):
         """\
 Verify fix quality:
 1. Run `/prizmkit-code-review` with the current bugfix artifact directory.
-2. The current Main Agent is the only Code Review executor. It reviews the complete current change for up to ten rounds, directly repairs accepted findings, and verifies repairs.
-3. Converge only when accepted and unresolved findings are both zero; missing required evidence or round-ten non-convergence produces NEEDS_FIXES.
-4. Do not delegate review directly or indirectly. Do not invoke another review skill or review workflow. Do not relabel delegated work as a finder, verifier, audit, compatibility review, verification, or gap sweep.
-5. `review-report.md` is the only persisted review artifact. Continue only after its last Final Result is valid; preserve append-only progress for recovery.""",
+2. Run the mandatory Main-Agent review over the complete current change for up to ten rounds; directly repair accepted findings and verify repairs.
+3. After Main-Agent convergence, allow only the one skill-owned independent Reviewer under the strict structural capability gate. If any capability is unavailable or unproven, record downgrade and create none.
+4. Converge only when accepted and unresolved findings are both zero; missing required evidence or round-ten non-convergence produces NEEDS_FIXES.
+5. Do not invoke another review skill or add review execution outside the skill contract.
+6. `review-report.md` is the only persisted review artifact. Continue only after its last Final Result is valid; preserve append-only progress for recovery.""",
     ),
     6: (
         "User Verification",

package/bundled/dev-pipeline/scripts/generate-refactor-prompt.py

@@ -411,7 +411,7 @@ def _refactor_header(pipeline_mode):
     title = "# Dev-Pipeline Refactor Session Bootstrap — {}\n".format(pipeline_mode.title())
     desc = {
         "lite": "**Tier 1 — Single Agent**: direct behavior-preserving refactor by the main orchestrator.",
-        "standard": "**Tier 2 — Main-Agent Review Gates**: direct refactor with Main-Agent-only review gates.",
+        "standard": "**Tier 2 — Main-Agent Review Gates**: direct refactor with mandatory Main-Agent review and optional strict capability-gated independent correctness review.",
         "full": "**Tier 3 — Full Refactor Guardrails**: direct refactor with stronger behavior-preservation evidence.",
     }.get(pipeline_mode, "**Refactor pipeline**")
     return title + "\n" + desc + "\n"

package/bundled/dev-pipeline/templates/bootstrap-prompt.md

@@ -30,21 +30,21 @@ Infer what needs to be done from the feature context above and follow the standa
 
 3. **Implement**: Run `/prizmkit-implement` with `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` to execute the plan using TDD (write tests first, then implement).
 
-4. **Review**: Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/`. The current Main Agent is the only Code Review executor. It reviews the complete current change for up to ten internal rounds, directly repairs accepted findings, and requires the last `## Final Result`. `REVIEW_PASS` proceeds to test; `REVIEW_NEEDS_FIXES` increments the shared outer repair round and routes implement → code-review → test. Do not delegate review or use another review entry point.
+4. **Review**: Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/`. Its mandatory Main-Agent loop reviews the complete current change for up to ten internal rounds and directly repairs accepted findings. After convergence, its one skill-owned independent Reviewer is optional only under a strict structural capability gate; otherwise the skill records downgrade and creates none. Require the last `## Final Result`. `REVIEW_PASS` proceeds to test; `REVIEW_NEEDS_FIXES` increments the shared outer repair round and routes implement → code-review → test. Do not invoke another review entry point or add review execution outside the skill contract.
 
 5. **Test**: After review passes, run `/prizmkit-test scope=this-change artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/`. Treat the Markdown report only as a derived view. Consume `.prizmkit/test/evidence/<evidence-id>/manifest.json`, `verdict.json`, and `validation.json`; verify identity/scope, every manifest hash, verdict/validator agreement, and current target hashes before accepting `TEST_PASS`. `TEST_FAIL/test-infrastructure` routes implement → test; production/runtime/schema/dependency/public-interface routes implement → code-review → test; unknown unsafe scope blocks. `TEST_BLOCKED` allows bounded environment recovery or a test-stage resume but never speculative production edits. Stop outer repairs after three rounds; preserve evidence and truthful recovery metadata.
 
 6. **Retrospective**: Run `/prizmkit-retrospective` to sync `.prizmkit/prizm-docs/` with code changes.
 
-7. **Commit**: Run `/prizmkit-committer` to commit all changes. Do NOT push.
+7. **Commit**: Run `/prizmkit-committer` to commit all changes.
 
 ### Critical Rules
 
 - Do NOT ask for user input — decide autonomously.
-- Do NOT push to remote — the user will push manually.
+- Remote publication is controlled by the runtime after the local commit; do not make a publication decision in this session.
 - Write all artifacts to `.prizmkit/specs/{{FEATURE_SLUG}}/`.
 - If a step fails after 3 attempts, write a status report and stop.
-- **Never re-read unmodified files**: once you read a file into context, do NOT read it again unless it was modified by an Edit/Write after your last read — use `grep -n`/`sed -n` for specific lines. Before issuing a Read, ask: "Have I read this file before, and has it changed since?" If no — do NOT read it. Normal work delegation outside Code Review must rely on context-snapshot.md rather than re-reading files the Main Agent already read. Code Review runs only in the current Main Agent.
+- **Never re-read unmodified files**: once you read a file into context, do NOT read it again unless it was modified by an Edit/Write after your last read — use `grep -n`/`sed -n` for specific lines. Before issuing a Read, ask: "Have I read this file before, and has it changed since?" If no — do NOT read it. Normal work delegation outside the optional skill-owned review contract must rely on context-snapshot.md rather than re-reading files the Main Agent already read. Code Review keeps mandatory Main-Agent ownership and may use only its strict-gated skill-owned Reviewer after convergence.
 - **Read offset safety**: if Read returns "shorter than offset"/"empty" — run `wc -l` then `sed -n`, do NOT retry same offset.
 - **Hard Round Cap**: after 6 total test-fix rounds, STOP trial-and-error. Switch to read-once-then-rewrite. Do NOT exceed 7 rounds.
 - **Layered test**: debug with single-file tests, only run full suite as gate when single-file is green.

package/bundled/dev-pipeline/templates/bootstrap-tier3.md

@@ -10,12 +10,12 @@
 
 You are the **session orchestrator**. Implement Feature {{FEATURE_ID}}: "{{FEATURE_TITLE}}".
 
-**CRITICAL**: You MUST NOT exit until ALL work is complete and committed. Normal work delegation outside Code Review must finish before exit (`run_in_background=false`). Code Review never uses direct or indirect delegation.
+**CRITICAL**: You MUST NOT exit until ALL work is complete and committed. Normal work delegation outside the optional skill-owned review contract must finish before exit (`run_in_background=false`).
 
-**Tier 3 — Main-Agent Full Guardrails**: For complex features, the Main Agent handles context, planning, implementation, and Code Review directly. Do not spawn a top-level Dev implementation subagent. Code Review runs through `/prizmkit-code-review` without direct or indirect delegation.
+**Tier 3 — Main-Agent Full Guardrails**: For complex features, the Main Agent handles context, planning, and implementation directly, then runs the mandatory Main-Agent review in `/prizmkit-code-review`. After convergence, that skill may use one skill-owned independent Reviewer only when its strict structural capability gate passes; otherwise it records downgrade and creates none. Do not spawn a top-level Dev implementation subagent.
 
-**Agent spawn failure policy (all Agent tool calls)**:
-- Code Review must not invoke another review skill/workflow or relabel delegated work as a finder, verifier, audit, compatibility review, verification, or gap sweep.
+**Agent spawn failure policy (all execution-unit creation)**:
+- Code Review must not invoke another review skill/workflow or add review execution outside the single optional Reviewer owned and gated by `prizmkit-code-review`.
 - If the second attempt fails, do not keep spawning variants and do not enter artifact polling for Implementation Log, challenge report, or review report markers.
 - Use the documented inline/recovery fallback for that phase: write the required report yourself where possible, complete remaining work directly in the orchestrator when safe, or write `failure-log.md` with the spawn error and last observable state before stopping for recovery.
 - Apply the same cap to any re-spawn for report repair or resume prompts; do not burn multiple minutes on identical team/config/lock failures.
@@ -52,7 +52,7 @@ You are running in **headless non-interactive mode** with a FINITE context windo
 
 1. **context-snapshot.md is your single source of truth** — After Phase 1-2 makes it available, use it instead of re-reading individual source files. If you just created or updated it in this session, continue from the in-context content; read it only when resuming/continuing, after context compaction/loss, or when handing work to a subagent.
 2. **Never re-read your own writes** — After you create/modify a file, do NOT read it back to verify. Trust your write was correct.
-3. **Never re-read unmodified files** — Once you have read a file into context, do NOT read it again unless it was modified by an Edit/Write operation after your last read. Use platform file/search tools for targeted lookup; when shell-free helper lookup is needed, run `{{RUNTIME_HELPER_CMD}} text search <file> --pattern "<pattern>" --json`, then read only the smallest bounded range with the platform file-reading tool instead of full-file Read. Before issuing a Read, ask yourself: "Have I read this file before, and has it changed since?" If the answer is "no, it hasn't changed" — do NOT read it. This applies to all files including those summarized in context-snapshot.md Section 4. Normal work delegation outside Code Review must receive context-snapshot.md and rely on it rather than independently re-reading files the Main Agent already read. Code Review runs only in the current Main Agent.
+3. **Never re-read unmodified files** — Once you have read a file into context, do NOT read it again unless it was modified by an Edit/Write operation after your last read. Use platform file/search tools for targeted lookup; when shell-free helper lookup is needed, run `{{RUNTIME_HELPER_CMD}} text search <file> --pattern "<pattern>" --json`, then read only the smallest bounded range with the platform file-reading tool instead of full-file Read. Before issuing a Read, ask yourself: "Have I read this file before, and has it changed since?" If the answer is "no, it hasn't changed" — do NOT read it. This applies to all files including those summarized in context-snapshot.md Section 4. Normal work delegation outside the optional skill-owned review contract must receive context-snapshot.md and rely on it rather than independently re-reading files the Main Agent already read. Code Review keeps mandatory Main-Agent ownership and may use only its strict-gated skill-owned Reviewer after convergence.
 4. **Stay focused** — Do NOT explore code unrelated to this feature. No curiosity-driven reads.
 4. **One task at a time** — In Phase 4 (implement), complete and test one task before starting the next.
 5. **Minimize tool output** — Never load full command output into context. First capture command output to a temp file using the command/tool output option or the host-appropriate redirection, then inspect only the final relevant lines and use targeted search helpers to extract the information needed for the current task. Only read the filtered result — never the raw full output.
@@ -237,7 +237,7 @@ For each Verification Gate from the Task Contract, write one evidence line to Im
 
 ### Review — Code Review
 
-Review the completed implementation before the full Feature test gate. Run `/prizmkit-code-review artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` in the current Main Agent; never delegate review directly or indirectly. The current Main Agent is the only Code Review executor. Do not invoke another review skill or review workflow, and do not relabel delegated work as a finder, verifier, audit, compatibility review, verification, or gap sweep.
+Review the completed implementation before the full Feature test gate. Run `/prizmkit-code-review artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` in the current Main Agent. The mandatory Main-Agent loop reviews and repairs the complete change for up to ten rounds. After it converges, the skill may use its one skill-owned independent Reviewer only when every strict structural capability is proven; otherwise it records downgrade and creates none. Do not invoke another review skill or add any review execution beyond that skill contract.
 
 - `REVIEW_PASS` → record `stage=code-review`, `status=REVIEW_PASS`, `stage_result=PASS`, `next_stage=prizmkit-test`, and `resume_from=prizmkit-test`; then run the test gate.
 - `REVIEW_NEEDS_FIXES` → increment the shared outer `repair_round` and route `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`.
@@ -462,7 +462,7 @@ git add .prizmkit/prizm-docs/
 
 **6d.** Run `/prizmkit-committer` → THE ONLY commit for this feature:
 `feat({{FEATURE_ID}}): {{FEATURE_TITLE}}`
-This single commit includes: feature code + tests + .prizmkit/prizm-docs/ updates. Do NOT push.
+This single commit includes: feature code + tests + .prizmkit/prizm-docs/ updates.
 - MANDATORY: commit must be done via `/prizmkit-committer` skill. Do NOT run manual `git add`/`git commit` as a substitute.
 - Do NOT run `update-feature-status.py` here — the pipeline runner handles feature-list.json updates automatically after session exit.
 
@@ -524,10 +524,10 @@ If you encounter an unrecoverable error, context overflow, or are about to exit
 
 ## Reminders
 
-- Tier 3: orchestrator implements directly; `/prizmkit-code-review` handles review later
+- Tier 3: orchestrator implements directly; `/prizmkit-code-review` runs mandatory Main-Agent review and optional strict-gated skill-owned independent review
 - context-snapshot.md contains Main-Agent implementation context; Code Review writes only review-report.md
 - Gate checks require the Implementation Log and a valid review-report.md Final Result before proceeding
-- Code Review never uses direct or indirect delegation; normal work delegation outside review must not use `run_in_background=true`
+- Review execution outside the skill contract is forbidden; normal work delegation must not use `run_in_background=true`
 - Commit phase must use `/prizmkit-committer`; do NOT replace with manual git commit commands
 - **NEVER delete, modify, or touch any file under `.prizmkit/state/`** — those are pipeline runtime files managed by the runner
 - NEVER run `rm -rf`, `git clean`, or any destructive filesystem operations

package/bundled/dev-pipeline/templates/bugfix-bootstrap-prompt.md

@@ -11,7 +11,7 @@
 
 You are the **bug fix session agent**. Fix Bug {{BUG_ID}}: "{{BUG_TITLE}}".
 
-**CRITICAL**: You MUST NOT exit until ALL automated work is complete and committed, unless a fresh manual/hybrid verification gate requires stopping as `partial` before commit.
+**CRITICAL**: You MUST NOT exit until ALL automated work is complete and committed. Manual/hybrid verification labels do not authorize a partial stop: select deterministic local verification tooling and record its evidence.
 
 **SUBAGENT LIFECYCLE**: Any normal work subagent must be awaited with `run_in_background=false`. Do not spawn persistent background subagents for headless recovery.
 
@@ -214,10 +214,7 @@ Read the current structured `manifest.json`, `verdict.json`, and `validation.jso
 Only validated `TEST_PASS` may proceed to commit.
 
 {{IF_VERIFICATION_MANUAL_OR_HYBRID}}
-**MANUAL VERIFICATION GATE**:
-- Fresh manual/hybrid bugfix sessions stop after automated review and before commit.
-- Write session-status.json with status="partial", resume_from_phase=4, and STOP — manual UAT is required before commit.
-- Recovery/retry/continuation sessions may substitute automated verification for manual/hybrid UAT only when evidence is documented in fix-report.md and session-status.json.
+**MANUAL/HYBRID AUTOMATION**: This L4 session is always headless. Execute manual/hybrid verification with available deterministic browser, CLI/API, fixture, or test tooling. Document the method and evidence, then continue through `/prizmkit-retrospective` and `/prizmkit-committer`; never ask for UAT, wait for a user, or stop as `partial`.
 - Do not write `verifying` to the external bug-list status field; fine-grained verification is session/checkpoint metadata, while the external list status remains one of `pending`, `in_progress`, `completed`, `failed`, `skipped`, or `needs_info`.
 {{END_IF_VERIFICATION_MANUAL_OR_HYBRID}}
 
@@ -227,7 +224,7 @@ Only validated `TEST_PASS` may proceed to commit.
 
 ### Headless Commit Authorization
 
-This pipeline launch authorizes one local task commit only after review and authoritative test evidence pass. Never ask a question, wait for input, or request confirmation. Invoke `/prizmkit-committer` with `mode=l4-headless`, `owner=prizmkit-l4`, `local_commit_authorized=true`, and `push_authorized=false`. Never push.
+This pipeline launch authorizes one local task commit only after review and authoritative test evidence pass. Never ask a question, wait for input, or request confirmation. Invoke `/prizmkit-committer` with `mode=l4-headless`, `owner=prizmkit-l4`, and `local_commit_authorized=true`. The runtime controls any optional remote publication after the local commit; do not make a publication decision in this session.
 
 **Bug Fix Documentation Policy**:
 - **DEFAULT**: Run `/prizmkit-retrospective` with structural sync only (Job 1). Skip knowledge injection.
@@ -250,7 +247,7 @@ git add .prizmkit/prizm-docs/
 **d.** Run `/prizmkit-committer`:
    - Commit message prefix: `fix({{FIX_SCOPE}}): {{BUG_TITLE}}`
    - Include both fix code and reproduction test
-   - Do NOT push
+   - The runtime controls any optional remote publication after the local commit; do not make a publication decision in this session
 
 **e.** Final verification:
 ```bash