repo-harness 0.24.1 → 0.24.3

package/AGENTS.md

@@ -10,7 +10,7 @@
 - Keep four hard boundaries: main publication, deletion, credentials/permissions, and release/production operations.
 - Only when the current task explicitly authorizes main publication may a model squash-merge after automated checks pass and GitHub has no outstanding change requests or unresolved review threads; an explicit no-merge instruction always wins. Push/tag still require task authorization; credentials/permissions, other deletion and release/production retain their separate approval boundaries. Record authorized publication, the provider-confirmed merge SHA and parent SHA, `git revert <squash-commit>`, and the daily report. Do not create rollback tags.
 - Default worktrees are at `/tmp/<repo>-wt-<slug>` (Windows: `os.tmpdir()`). Commit or push before a reboot or a tmp cleanup.
-- Closeout and sweep remove only merged, clean and unowned worktrees. To keep one, give it an unmerged commit, keep it dirty, or mark or lease it. Details: [agentic-development-flow](docs/reference-configs/agentic-development-flow.md).
+- Closeout and sweep remove only merged, clean and unowned worktrees. To keep one, give it an unmerged commit, keep it dirty, or mark or lock it. Details: [agentic-development-flow](docs/reference-configs/agentic-development-flow.md).
 - Automatically delete only merged, clean worktrees/branches; ask the user for every other deletion. Credentials/permissions (including confirmation bypass) and release/production operations require user approval.
 - Select independent review by the diff's [Review by risk](docs/reference-configs/agentic-development-flow.md#review-by-risk) tier: none for low, one fresh-context review for medium, gatekeeper plus cross-model review for high; ordinary steps record diagnostics without approval loops.
 - When you delegate, investigate first, then split work by write ownership. Give each parallel writer its own worktree from a clean source. Implementation sub-agents edit only their scope. They do not run build, typecheck or tests. They commit early in their own worktree and return early. In a shared checkout they do not commit; the parent commits. Evidence roles run the named check that is their task and do not commit. The parent agent owns task management, conflict resolution, build, typecheck, tests and integration. After integration, the parent removes each sub-agent worktree and branch whose commits are in the task branch and whose checkout is clean. It also removes the intermediate build output and temporary files that the work created. Other deletion still needs the user.
@@ -53,6 +53,8 @@
 - Isolate mutable HOME, repositories and process state; use real synchronization signals and preserve complete failure output.
 - Report failed, timed-out, incomplete or omitted coverage explicitly; do not manufacture receipts, waiver files or pre-fix logs.
 - Never modify or delete test assertions just to make tests pass; justify every necessary test change item by item in the PR description.
+- Before you write or change tests, load the `repo-harness-test` skill (`assets/skills/repo-harness-test/SKILL.md`).
+- When a local check and CI disagree, CI is the authority. Reproduce the failure with `bash scripts/check-ci.sh <lane>` before you change code; a global `repo-harness` or `repo-harness-hook` on `PATH` can hide a missing test setup.
 
 ## Handoff
 - Create a checkpoint only when context/session rollover or unresolved work needs it; ordinary completion stays in the PR description.

package/CLAUDE.md

@@ -10,7 +10,7 @@
 - Keep four hard boundaries: main publication, deletion, credentials/permissions, and release/production operations.
 - Only when the current task explicitly authorizes main publication may a model squash-merge after automated checks pass and GitHub has no outstanding change requests or unresolved review threads; an explicit no-merge instruction always wins. Push/tag still require task authorization; credentials/permissions, other deletion and release/production retain their separate approval boundaries. Record authorized publication, the provider-confirmed merge SHA and parent SHA, `git revert <squash-commit>`, and the daily report. Do not create rollback tags.
 - Default worktrees are at `/tmp/<repo>-wt-<slug>` (Windows: `os.tmpdir()`). Commit or push before a reboot or a tmp cleanup.
-- Closeout and sweep remove only merged, clean and unowned worktrees. To keep one, give it an unmerged commit, keep it dirty, or mark or lease it. Details: [agentic-development-flow](docs/reference-configs/agentic-development-flow.md).
+- Closeout and sweep remove only merged, clean and unowned worktrees. To keep one, give it an unmerged commit, keep it dirty, or mark or lock it. Details: [agentic-development-flow](docs/reference-configs/agentic-development-flow.md).
 - Automatically delete only merged, clean worktrees/branches; ask the user for every other deletion. Credentials/permissions (including confirmation bypass) and release/production operations require user approval.
 - Select independent review by the diff's [Review by risk](docs/reference-configs/agentic-development-flow.md#review-by-risk) tier: none for low, one fresh-context review for medium, gatekeeper plus cross-model review for high; ordinary steps record diagnostics without approval loops.
 - When you delegate, investigate first, then split work by write ownership. Give each parallel writer its own worktree from a clean source. Implementation sub-agents edit only their scope. They do not run build, typecheck or tests. They commit early in their own worktree and return early. In a shared checkout they do not commit; the parent commits. Evidence roles run the named check that is their task and do not commit. The parent agent owns task management, conflict resolution, build, typecheck, tests and integration. After integration, the parent removes each sub-agent worktree and branch whose commits are in the task branch and whose checkout is clean. It also removes the intermediate build output and temporary files that the work created. Other deletion still needs the user.
@@ -53,6 +53,8 @@
 - Isolate mutable HOME, repositories and process state; use real synchronization signals and preserve complete failure output.
 - Report failed, timed-out, incomplete or omitted coverage explicitly; do not manufacture receipts, waiver files or pre-fix logs.
 - Never modify or delete test assertions just to make tests pass; justify every necessary test change item by item in the PR description.
+- Before you write or change tests, load the `repo-harness-test` skill (`assets/skills/repo-harness-test/SKILL.md`).
+- When a local check and CI disagree, CI is the authority. Reproduce the failure with `bash scripts/check-ci.sh <lane>` before you change code; a global `repo-harness` or `repo-harness-hook` on `PATH` can hide a missing test setup.
 
 ## Handoff
 - Create a checkpoint only when context/session rollover or unresolved work needs it; ordinary completion stays in the PR description.

package/README.md

@@ -115,10 +115,12 @@ bun test
 
 ### Success looks like this
 
-Successful init enables the architecture projection provider when that
-preference is unset. An explicit disabled choice is preserved. Dry-run does not
-write the preference. repo-harness supplies tools and evidence; the Bot decides
-what to schedule.
+Init writes repo-local files and two files under `HOME`: the repo registry
+entry and, when verification runs, the global Codex handoff packet under
+`~/.codex/handoffs/`. It writes no install-managed host files. When the
+required Herdr skill or the architecture projection preference is missing, init
+reports a skipped step that names `repo-harness update`. repo-harness supplies tools and evidence; the Bot
+decides what to schedule.
 
 Apply ends with `=== Migration Report ===`, naming where generated hook behavior
 comes from, the user-level `~/.claude/settings.json` and `~/.codex/hooks.json`
@@ -327,20 +329,39 @@ accepted suggestion goes through the normal plan and pull request workflow.
 
 ```bash
 repo-harness external-source refresh   # one bounded, explicitly enabled GitHub observation
-repo-harness external-source bind      # one immutable revision to one pending canonical task
+repo-harness external-source bind --repo <id> --source-revision <digest> --session <selector.json>
+repo-harness external-source historical-bindings --repo <id>  # retired V1 records only
 repo-harness external-source bindings  # binding edges and current drift attention
 ```
 
 Intake is inert by design. An observed Issue mints no execution authority and
 does not become a runnable task on its own; binding attaches an immutable source
-revision to a task that already has an approved plan and contract.
+revision to an existing admitted session selected by its provider issue, immutable
+claim, approved grant and session binding digest. The selector comes from task
+session discovery. Binding never creates a claim or approval.
 
 ### Persistent acceptance review
 
+Before review, configure the repository's manual `external_sources` policy and
+provide working provider access. The default policy is off; initialization does
+not enable it. The trusted upstream Bot must authenticate the human, authorize
+the scope, and supply the bound request. Its integration calls
+`repo-harness review admit --repo <execution-checkout> --request <authorized-request.json>`.
+The request contains `{admission, approval, expectedRevision}`. Admission requires
+an explicit `execution_mode`: `contract` or `inline`. The mode is part of the
+approved admission digest; changing it requires new approval. Do not create an
+approval from these examples: actor IDs and authorization references are binding
+data, not authentication. Select the resulting active grant and policy digests
+below, and supply the current immutable issue claim. A contract or plan file
+cannot grant permission. A user waiver requires a separate upstream-authorized
+decision; waiver eligibility in an admission does not grant one.
+
+See [the control Bot boundary](docs/control-bot-boundary.md) for the integration contract.
+
 ```bash
-repo-harness review round --contract tasks/contracts/<task>.contract.md --reviewer-repo <linked-checkout> --herdr-endpoint <address.json>
-repo-harness review status --contract tasks/contracts/<task>.contract.md
-repo-harness review close --contract tasks/contracts/<task>.contract.md
+repo-harness review round --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id> --reviewer-repo <linked-checkout> --herdr-endpoint <address.json> --verification <native-report> --claim-ref <claim-reference> --claim-revision <claim-sha256>
+repo-harness review status --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id>
+repo-harness review close --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id>
 ```
 
 In the Claude desktop app without Herdr, add `--launch app-terminal` and omit `--herdr-endpoint`. The first call prints the fixed host command. Claude runs it once in an app Terminal tab, then repeats the round. OAR, Seatbelt and the Receipt stay the same.
@@ -564,8 +585,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.24.1`
-- Generated workflow stamp: `repo-harness@0.24.1+template@0.24.1`
+- npm package: `repo-harness@0.24.3`
+- Generated workflow stamp: `repo-harness@0.24.3+template@0.24.3`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/reference-configs/agentic-development-flow.md

@@ -1,7 +1,7 @@
 # Agentic development flow
 
 - Default task worktrees use `/tmp/<repo>-wt-<slug>` on POSIX. Native Windows uses `os.tmpdir()` as the root. The stored default is `{{system_tmp}}/{{repo}}-wt-{{slug}}`. Runtime code resolves the temp token. Explicit stored templates stay unchanged. Commit or push work before a reboot or age-based tmp cleanup, such as `systemd-tmpfiles`. These cleaners can remove checkouts. Missing entries are pruned. The sweep saves missing registration identities before global prune. Later batches finish deferred branch cleanup. Unmerged branches remain.
-- Closeout removes a merged, clean checkout and its branch. It releases only that checkout's own canonical marker after merge proof under the topology lock. The sweep keeps dirty, locked, marked or leased worktrees. It keeps branch reflogs without a commit-creation message and missing or unreadable reflogs. Fast-forward, target-only automatic merges, reset and rebase-finish messages do not count. Dispatch must establish an unmerged commit or keep the worktree dirty, marked or leased. A merged, clean, unowned branch with its own commits can be swept.
+- Closeout removes a merged, clean checkout and its branch. It releases only that checkout's own canonical marker after merge proof under the topology lock. The sweep keeps dirty, locked and marked worktrees. It keeps branch reflogs without a commit-creation message and missing or unreadable reflogs. Fast-forward, target-only automatic merges, reset and rebase-finish messages do not count. Dispatch must establish an unmerged commit or keep the worktree dirty, locked or marked. A merged, clean, unowned branch with its own commits can be swept.
 - `start` recovers only a real target directory registered by this clone on the expected branch, under the topology lock, with no lock or other owner. Recovery requires a current-user-owned checkout directory without group or other write access, a regular owned Git pointer, its matching admin backpointer, and the original directory identity saved by start. Git metadata can be group-writable but must not be other-writable. Start still creates a checkout when uid is unavailable; recovery then refuses. Exact removal retires the identity after Git readback. Missing identity or a replacement directory blocks recovery. Files, symlinks, unregistered paths and other branches are refused. Cleanup refuses a registered worktree whose branch is missing. MCP cleanup also refuses active markers. Sweep reports name processed paths. Deferred entries are reported as counts. `kept` excludes deferred entries. A command timeout sends SIGTERM to the direct child only. A grandchild can briefly extend the deadline. No detached cleanup process starts. Herdr notifications accept registered default task worktrees and paths inside them. Other temporary paths and `rh-herdr-` labels stay filtered.
 
 ## Daily Flow
@@ -9,10 +9,24 @@
 2. Open a branch; isolate a worktree when concurrent edits overlap. Preserve unrelated work.
 3. Make small, bounded commits. Ordinary tasks live in the PR description: goal, changes, verification, risk and rollback.
 4. Freeze the candidate and verify once: typecheck plus affected tests. Reviewers and closeout consume the same evidence.
-5. A model may squash-merge into main only when the current task explicitly authorizes main publication, automatic checks pass, and GitHub has no outstanding change requests or unresolved review threads. An explicit no-merge instruction always wins. Record the GitHub merge SHA and parent SHA. Record `git revert --no-edit <squash-commit>`. Do not create rollback tags.
+5. A model may squash-merge into main only when the current task explicitly authorizes main publication, the branch contains the current main tip, the required checks pass on that exact head, and GitHub has no outstanding change requests or unresolved review threads. An explicit no-merge instruction always wins. The next merge does not wait for the main push CI of the previous merge. Main push CI is an alarm: when it fails, the next merge is the revert or the fix. Record the GitHub merge SHA and parent SHA. Record `git revert --no-edit <squash-commit>`. Do not create rollback tags.
 6. Run the full suite daily, automatically open a repair task on failure, and produce the daily merge/check/rollback report. Run the [Lessons Retro](#lessons-retro) in the same nightly window.
 7. Use the [Report SOP](#report-sop) for formal progress, phase and final reports to the user, including the daily user summary. Raw automated CI reports are evidence inputs; they do not replace that summary and do not require this format.
 
+## CI cost
+Size PR CI by the diff, the same as step 4. A full suite on each small PR spends runner time and adds no evidence that the affected tests and the daily run do not already give. The repo-harness source repository uses this shape in `.github/workflows/ci.yml`.
+
+- Triggers: run PR checks on `pull_request`. Do not also trigger `push` on feature branches; that runs each commit twice. A `push` to the default branch runs the affected selection for the merged diff, not the full suite.
+- Superseded runs: set `concurrency` to one group per PR number with `cancel-in-progress: true` for `pull_request` events only. Do not cancel scheduled runs.
+- Selection: a first job reads the diff against the PR base and outputs a mode. Later jobs read the mode in a job-level `if:`.
+  - A docs-only diff (`docs/**/*.md`, README, CHANGELOG, `tasks/`, `plans/`) skips build and test jobs when no test or script reads the changed files. Keep link and format checks. A document that is program input, such as a projected copy, a parsed contract or a generated region, runs its consumer tests.
+  - A code diff runs typecheck plus the tests that the diff affects. Use the runner's change detection (`vitest --changed`, `jest --changedSince`, `nx affected`, `turbo run --filter=...[<base>]`, `pytest --testmon`) or an import-graph selector.
+  - A change to a shared input (lockfile, root build or test config, CI workflow, a test helper with no mapped consumer) runs the full suite on that PR. A selector that cannot map a changed file widens the run; it never shrinks it.
+- Required checks: skip a job with a job-level `if:`, not with workflow-level `paths` or `paths-ignore`. GitHub counts a skipped job as passing for a required check. A workflow that never starts leaves its required check pending and blocks the merge.
+- Full suite: run it on `schedule` (daily) and `workflow_dispatch` against one default-branch SHA, and on the release SHA before a release. A daily failure opens a repair task (step 6).
+- Matrix: each axis must change the runtime that the tests run on. When the test runner is pinned, for example one Bun version, a Node-version axis reaches only the scripts and tests that spawn Node. Run only that subset on the axis; a full suite on 3 OS × 3 Node versions repeats each OS run three times. On a PR, run a matrix cell only when the diff touches code that depends on its axis. The daily run covers each cell with its dependent subset. Set `fail-fast: false` so one cell failure does not hide the others.
+- Limits: set `timeout-minutes` on each job; the GitHub default of 360 minutes lets a hung job spend all of it. Cache dependencies keyed on the lockfile.
+
 ## Report SOP
 - Give a Feynman report: explain the work to a reader who does not know this project. Use plain language. Explain the goal, user value, how it works, completed work and remaining gaps. Explain each technical term at first use.
 - State the conclusion, changes, reasons, verification and remaining risks. Link each claim to its source or label it as an inference. Use observed results. Name failed, incomplete and omitted checks.
@@ -109,6 +123,9 @@ Rules for every tier:
 - From the second round, the reviewer reads only the hunks that changed after the previous round. The three-round limit stays.
 - When an independent review ran, the PR description lists each finding with its disposition: fixed, or closed with the reason.
 - A low tier adds no review. A new test file or a rebase does not raise the tier.
+- A parent or coordinator reuses a worker's recorded independent review of the same diff when that review meets the diff's tier. Only a changed diff, or a missing tier review, needs a new review.
+- A downstream repository maps its own release surfaces, for example public API, wire format, DDL/SQL and permissions, to the High tier.
+
 A worker gets Goal, Scope, Context, Acceptance, Verify, Rollback, Timebox, Forbidden, Report and Standing as defined in [the delegation brief](sprint-contracts.md#delegation-brief), then loads concrete techniques on demand. Do not put routing catalogs or every technology guide in its brief.
 
 A coding session that spawns sub-agents is their parent. Investigate first, then split work by write ownership. Give each parallel writer its own worktree from a clean source. Implementation sub-agents edit only their scope. They do not run build, typecheck or tests. They commit early in their own worktree and return early. In a shared checkout they do not commit; the parent commits. An evidence role whose task is a named check, such as a root-cause reproduction or an evaluation profile, still runs that check and does not commit. The brief's Verify section names the checks that the parent runs after integration. The parent owns task management, conflict resolution, build, typecheck, tests and integration. After integration, the parent removes each sub-agent worktree and branch whose commits are in the task branch and whose checkout is clean. It also removes the intermediate build output and temporary files that the work created. Other deletion still needs the user.
@@ -121,3 +138,5 @@ Stop and ask the user when a command or result names `unknown`, `ambiguous`, `pe
 Architecture docs remain references. Update them only when responsibilities or boundaries change; no per-edit drift queue, workstream sync or automatic agent-context block. Ordinary work has no plan/contract/review/notes or promote/archive prerequisite. Notes are optional for non-obvious decisions; PRDs are for real new products.
 
 Park a gate; do not block on it. A gate is a decision that only the human can make. It is one of four kinds: an irreversible action, a product or preference call that no experiment settles, a standing rule that contradicts observed reality, or a dead end that survived a replan. Frontier nudges, retries, CI flake triage, review-thread triage, format fixes and "should I keep going" never reach the human. The GitHub issue and PR are the task authority. When the task has an issue, post a parked gate in the issue status comment (the `repo-harness issue status` format) under a `Gates:` list. When the task has a PR but no issue, park it under a `Gates:` list in the PR description. When the task has neither, park it in the catch-up reply of the current conversation. Give each gate an id, the question, the options, the recommended option, and what happens if no answer arrives by a stated time. Route the remaining work around the gate. The [catch-up reply](#report-sop) lists open gates first. A reply to a gate is a human comment on the same issue. The Bot reads that comment back before it acts on it.
+
+For a multi-PR coordination run, the issue and its PRs are the coordination state. An active plan's `## Task Breakdown` still lists the execution steps. A run log, when kept, is an append-only list of events. Derive an owner summary from the run log, or write the summary once at closeout. Approval text goes in the PR description, not in a separate file.

package/assets/reference-configs/external-tooling.md

@@ -59,13 +59,13 @@ For an explicitly reviewed one-shot batch, select exact Issue numbers instead of
 
 Exact-batch refresh resolves only those Issue endpoints and fails the whole attempt if any selected Issue is missing, malformed, a pull request, or exceeds a limit. GitHub assignees, labels, and open/closed state are evidence only: they do not prove whether local work has already been dispatched. Dispatch deduplication belongs to an authenticated binding against canonical repo-harness task identity. The triage, reproduce and fix stage contract for observed issues is in [issue pipeline](issue-pipeline.md).
 
-`repo-harness external-source refresh --repo <registered-repo-id>` invokes the locally authenticated `gh` client once and records immutable observations plus an attempt receipt under the repository Git common directory. `list` performs no provider call. These records are inert evidence: they do not create or change TaskOffer, priority, Claim, Lease, WorkEnvelope, collaboration, or Agent Runtime state.
+`repo-harness external-source refresh --repo <registered-repo-id>` invokes the locally authenticated `gh` client once and records immutable observations plus an attempt receipt under the repository Git common directory. `list` performs no provider call. These records are inert evidence: they do not create or change review admission, priority, provider claims, collaboration, or Agent Runtime state.
 
 ## External Source Binding WP2
 
-After planning has produced a canonical pending sprint row and its exact Approved work-package plan/contract, run `repo-harness external-source bind --repo <id> --source-revision <digest> --sprint <path> --task-id <id> --target-ref <ref>`. The command requires a strict `read_write` registry grant and persists one immutable provenance edge with exact observation, authorization, canonical task, and plan/contract revisions.
+Binding needs an existing admitted session for the same provider issue. Save one session `selector` object from `repo-harness state board --repository-id <id> --json` as a JSON file. Then run `repo-harness external-source bind --repo <id> --source-revision <digest> --session <file>`. The command requires a strict `read_write` registry grant. The observation's provider repository and issue must match the session admission. The command persists one immutable provenance edge with the exact observation, authorization revision, session selector and admission digest.
 
-`external-source bindings` reports source/canonical/authorization drift without mutating work. `external-source context` is the sole provider-content renderer and wraps canonical JSON in `[ExternalSourceUntrusted]`. The unchanged execution path remains canonical row + Approved plan/contract → TaskOffer → acquire → Claim/Lease → WorkEnvelope. Human acceptance stays at PR merge; only a true `installation_blocker` may pause earlier.
+`external-source bindings` reports source, session and authorization drift without mutating work. `external-source historical-bindings` reads retired V1 binding receipts as history only. `external-source context` is the sole provider-content renderer and wraps canonical JSON in `[ExternalSourceUntrusted]`. A binding does not create work or admission. Human acceptance stays at PR merge; only a true `installation_blocker` may pause earlier.
 
 Generated repos route external tooling by host/runtime shape. Task-level
 skill routing lives in `docs/reference-configs/agentic-development-flow.md`.
@@ -369,6 +369,7 @@ installed copy with `herdr --skill` and fails when a copy is absent or differs.
 The skill only controls Herdr from a real Herdr pane with `HERDR_ENV=1`.
 The persistent reviewer still requires POSIX process groups: use macOS/Linux or
 WSL. Native Windows review lifecycle support is not implied by Herdr support.
+Admitted task sessions start only in a Herdr pane, so they and their Task Inbox and operator diff consumers are POSIX-only; on Windows, session start fails closed with `herdr_endpoint_platform_unsupported`.
 Drain old tmux reviewers with the previous repo-harness version before upgrading.
 Rebind endpoints explicitly as `herdr-cli-agent`; old adapter policy, capabilities
 and live session metadata are not translated. The self-host runtime remains off.
@@ -856,11 +857,14 @@ to native-role-routing `invalid` and receives no implementation boundary.
 `install_mode`:
 
 - This repo's own `.ai/harness/policy.json` sets
-  `"install_mode": "auto-install-on-init"` — `init` and `migrate --apply`
-  install the fleet automatically.
-- Generated downstream repos default to `"install_mode": "advisory"` — `init`
-  and `migrate` only print a one-line reminder naming
+  `"install_mode": "auto-install-on-init"` — the scaffold helper
+  `scripts/init-project.sh` installs the fleet automatically on apply.
+- Generated downstream repos default to `"install_mode": "advisory"` — the
+  scaffold helper only prints a one-line reminder naming
   `repo-harness run install-agent-fleet`; nothing is written automatically.
+- `repo-harness init` never installs the fleet. The full-profile
+  `repo-harness install` and `repo-harness update` install it inside the host
+  transaction.
 
 `migrate --dry-run` never installs the fleet regardless of `install_mode`;
 dry-run makes no writes to the global agent-fleet directories at all.
@@ -884,8 +888,8 @@ The CLI entry rejects older or unparseable Bun runtimes before command dispatch.
 The top-level Unix and Windows bootstrap installers upgrade an older detected
 Bun before installing repo-harness, rather than relying on package-engine
 metadata that older Bun releases do not enforce.
-The shared global runtime setup used by mutating `repo-harness install`, `init`,
-and `update` binds every Bun subprocess to the exact executable it probes. It
+The shared global runtime setup used by mutating `repo-harness install` and
+`update` binds every Bun subprocess to the exact executable it probes. It
 runs and verifies `bun upgrade` only for Bun self-installer-owned binaries;
 older Homebrew, Scoop, npm, or other package-manager-owned binaries fail closed
 with an actionable manager upgrade command. This covers direct
@@ -1343,8 +1347,8 @@ instead. The command never creates an index, a model, a plan or a code edit.
 Read evidence and record a decision with:
 
 ```bash
-repo-harness refactor recommendations [--json] [--import-node-limit <n>]
-repo-harness refactor decide <recommendation-id> accept|defer|reject --reason "<text>" [--import-node-limit <n>]
+repo-harness refactor recommendations [--json] [--import-node-limit <n>] [--timeout-ms <ms>]
+repo-harness refactor decide <recommendation-id> accept|defer|reject --reason "<text>" [--import-node-limit <n>] [--timeout-ms <ms>]
 ```
 
 `recommendations` shows each open suggestion with its explanation, the metrics

package/assets/reference-configs/global-working-rules.md

@@ -36,6 +36,8 @@ Before non-trivial design or edits, complete P1/P2/P3:
 - Keep one source of truth for each datum. Other representations must be deterministic projections with drift checks; an authority cutover removes the old authoring path in the same approved work-package.
 - Add an abstraction only when it removes observed duplicate authority or complexity, serves at least two real consumers, or protects a cross-module invariant.
 - Create shared components only for observed reuse or invariants. When independently meaningful consumers need a shared package, prefer an existing monorepo workspace; do not convert a single-package repository into a monorepo without a second independently released or deployed consumer.
+- Validate an unknown value once, at the boundary that owns it, and pass the typed value inward. Do not check again a value that a schema, constructor or internal type already guarantees.
+- Before you add complexity for a speculative or very unlikely race, security or failure case, tell the user the concrete failure mode, its likelihood and the complexity cost, and get their approval. Do not expand scope silently for theoretical robustness.
 
 ## No Compatibility Fallbacks in Product Code
 

package/assets/reference-configs/harness-overview.md

@@ -4,7 +4,7 @@ This repo uses a shared long-running harness. The durable workflow lives in repo
 
 ## Adoption Model
 
-Use this file as the first onboarding map after `repo-harness init` installs
+Use this file as the first onboarding map after `repo-harness init` adopts
 or refreshes a repo. The harness gives agents three durable surfaces:
 
 - **Shared standards**: `docs/spec.md`, `docs/reference-configs/`, root
@@ -97,11 +97,11 @@ The roles and the state flow below apply to contract-level work only.
 - Evidence: Native execution evaluation supplies current check facts, while `.ai/harness/runs/*.json` keeps ignored local verification snapshots for the current workflow audit. Task-specific `.ai/harness/checks/*.latest.{json,md}` reports are ignored runtime cache; promote durable conclusions into reviews, contracts, notes, or research.
 - Human reading surface: `docs/spec.md`, `docs/architecture/`, and durable `docs/researches/` conclusions are the default entrypoint. Root workflow artifacts should describe active work only; completed plan/contract/review/notes/todo artifacts move to `plans/archive/` or `tasks/archive/`, and `.rgignore` keeps those archives plus runtime evidence out of default `rg` results.
 - Closeout order: promote durable truth first, then archive the workflow artifacts. If a fact only lives in a review/contract/checks file, the workflow is not ready to disappear from the active reading surface.
-- Local retention: `repo-harness retention` moves closed artifacts to a gitignored local archive root after 30 days. It scans four classes: closed plans in `plans/archive/`, closed task records in `tasks/archive/`, check logs (`.ai/harness/checks/*.log`), and run records that no code reads back (`.ai/harness/runs/verification-vx-*.log`, `*-heartbeat-triage.json`, and finished `contract-run-*` directories with a `manifest.json`). The command is a dry run by default. Add `--apply` to move the entries. It skips open work, entries in the `keep` list, entries newer than the window, and entries whose destination exists. It never deletes; the operator cleans the archive root. Other run records stay in place: verification records and reports are bound by hash or named by receipts, session directories keep a `closed.json` tombstone, ledgers and hook telemetry are live, and `evidence-gc` owns run summaries. Configure it in `.ai/harness/policy.json`:
+- Local retention: `repo-harness retention` moves closed artifacts to a gitignored local archive root after 30 days. It scans five classes: closed plans in `plans/archive/`, closed task records in `tasks/archive/`, check logs (`.ai/harness/checks/*.log`), run records that no code reads back (`.ai/harness/runs/verification-vx-*.log`, `*-heartbeat-triage.json`, and finished `contract-run-*` directories with a `manifest.json`), and fs-transaction backups (`.ai/harness/backups/fs-transaction/`). An archived backup no longer serves a rollback by manifest; restore it by hand. The command is a dry run by default. Add `--apply` to move the entries. It skips open work, entries in the `keep` list, entries newer than the window, and entries whose destination exists. An archived entry is deleted once its newest write is older than `archive_days` (default: `days` plus 60). Retention deletes nothing outside the archive root. `--json` also lists every harness storage root and its rule: archive, delete, writer rotation, or keep. The MCP logs under `.ai/harness/mcp/` rotate like hook telemetry. `install` keeps only the release tarball it installed in `~/.repo-harness/packages/`. `upgrade` keeps the newest 100 records in `~/.repo-harness/upgrade-cleanup.log.jsonl`. Other run records stay in place: verification records and reports are bound by hash or named by receipts, session directories keep a `closed.json` tombstone, ledgers and hook telemetry are live, and `evidence-gc` owns run summaries. Configure it in `.ai/harness/policy.json`:
 
   ```json
   "information_lifecycle": {
-    "retention": { "days": 30, "archive_root": ".ai/harness/archive/retention", "keep": [] }
+    "retention": { "days": 30, "archive_days": 90, "archive_root": ".ai/harness/archive/retention", "keep": [] }
   }
   ```
 
@@ -126,7 +126,7 @@ The roles and the state flow below apply to contract-level work only.
 
 ## Trace Evidence
 
-`repo-harness run verify-sprint` runs local checks. It writes no verification report. Run `repo-harness run verification-plan execute --repo . --contract <contract> --report-file .ai/harness/runs/<run-id>.report.json` to record declared checks. Before semantic review or acceptance, run `repo-harness run change-assessment prepare --contract <contract>` from the execution repository. This command writes the independent assessment. If a packet has a reviewer-disagreement overlay, pass its path with `--packet` when you prepare it again. Acceptance uses that explicit native report and its immutable backing events and runs. Missing or empty plans cannot pass.
+`repo-harness run verify-sprint` runs local checks. It writes no verification report. The trusted control Bot first supplies an approved admission through `repo-harness review admit --request <request.json> --repo .`. The Bot withdraws it through `repo-harness review revoke --request <revocation.json> --repo .`. The revocation request names the campaign (`repository_id`, `issue_id`, `campaign_id`), `expectedGrantSha256` and `expectedRevision`. The command revokes only that exact active grant. The admission must include the approved positive safe-integer `issue_number`, distinct from the provider global `issue_id`. Its digest binds this lookup locator; changing it requires new approval and does not change the campaign key. The admission must explicitly select `execution_mode: "contract"` or `execution_mode: "inline"`; no mode is inferred from a task or plan file. Changing mode requires new upstream approval. Verification and assessment consume that admission, not a contract path. Pass `--repository-id`, `--issue-id`, `--campaign-id`, `--grant-sha256`, `--policy-sha256` and `--actor` from the active admission to `repo-harness run verification-plan execute --repo . --report-file .ai/harness/runs/<run-id>.report.json` and `repo-harness run change-assessment prepare`. The latter writes the independent assessment. These selectors bind an existing approval; they do not grant permission. If a packet has a reviewer-disagreement overlay, pass its path with `--packet` when you prepare it again. Acceptance uses that explicit native report and its immutable backing events and runs. Missing or empty plans cannot pass.
 
 Required v1 fields:
 
@@ -247,19 +247,19 @@ rather than inferring those values from turns, tool names, or timestamps.
 Maintainer-facing detail on how the initializer and runtime defaults are wired.
 
 - Plan menu is tiered: **Core Plans (A-F)** first, **Custom Presets (G-K)** only when needed.
-- Skill routing is inspection-first: `scripts/inspect-project-state.ts`, `src/core/adoption/standard-plan.ts`, `assets/workflow-contract.v1.json`.
+- Skill routing is inspection-first: `scripts/inspect-project-state.ts`, `src/effects/adoption/standard-plan.ts`, `assets/workflow-contract.v1.json`.
 - Generated repos support an optional contract-level flow: `docs/spec.md -> plans/ -> tasks/contracts/ -> tasks/reviews/ -> .ai/context/context-map.json -> .ai/harness/*`. Ordinary tasks use the PR description and need no plan, contract or review file.
 - Generated and self-hosted repos use `.ai/harness/workflow-contract.json` as the opt-in marker.
-- The marker can declare `minimum_harness_version`, a release version such as `0.22.1`. A hook that runs an older repo-harness then reports an upgrade instruction (`repo-harness update`) on SessionStart, UserPromptSubmit, Stop and SubagentStop. It exits 1, which does not block, and does not resolve state for these events. PreToolUse and PostToolUse skip this check, so every edit guard still runs. `repo-harness doctor` and `repo-harness update --check` report the same instruction. Declare it when a release changes the model shape that older readers cannot parse. Adoption keeps the declared value.
+- The marker can declare `minimum_harness_version`, a release version such as `0.22.1`. A hook that runs an older repo-harness then reports an upgrade instruction (`repo-harness update`) on SessionStart, UserPromptSubmit and Stop. It exits 1, which does not block, and does not resolve state for these events. PreToolUse skips this check, so every edit guard still runs. `repo-harness doctor` and `repo-harness update --check` report the same instruction. Declare it when a release changes the model shape that older readers cannot parse. Adoption keeps the declared value.
 - The package asset `assets/workflow-contract.v1.json` defines the workflow contract.
-- `repo-harness init` writes the marker, `.ai/harness/policy.json` and the root `CLAUDE.md` and `AGENTS.md`. `src/core/adoption/standard-plan.ts` is the only writer of the root context files. Shell scaffold scripts do not write the marker or the root context files.
+- `repo-harness init` writes the marker, `.ai/harness/policy.json` and the root `CLAUDE.md` and `AGENTS.md`. `src/effects/adoption/standard-plan.ts` is the only writer of the root context files. Shell scaffold scripts do not write the marker or the root context files.
 - Host events use the user-level managed adapter projection, the 11-tuple
   `route-registry.ts`, and exactly one typed in-process handler per tuple.
   Operator helpers run from the installed package through
   `repo-harness run <helper>`. Init preserves legacy repo copies of the retired
   shell library. Doctor reports them with migration steps.
 - Generated and migrated repos keep discovery and complex/design planning in the parent agent: `geju` opens the pre-contract frame, then the parent completes P1/P2/P3 and freezes the accepted direction. Daily small/medium work uses Waza with Codex-first runtime copies in `~/.codex/skills`; durable knowledge stays in repo-authored research and lessons.
-- `repo-harness install` bootstraps the package-owned Codex/Claude runtime pieces for the default workflow: refreshes `repo-harness` skill aliases, installs global Codex/Claude hook adapters, persists the brain root in `~/.repo-harness/config.json`, and configures CodeGraph MCP for selected host agents. Mutable Waza and Mermaid providers are installed only after explicit selection. `repo-harness init` remains a compatibility alias for existing automation.
+- `repo-harness install` bootstraps the package-owned Codex/Claude runtime pieces for the default workflow: refreshes `repo-harness` skill aliases, installs global Codex/Claude hook adapters, persists the brain root in `~/.repo-harness/config.json`, and configures CodeGraph MCP for selected host agents. Mutable Waza and Mermaid providers are installed only after explicit selection. `repo-harness init` adopts the repo-local workflow only and installs none of these host runtime pieces.
 - The recommended `reverse-skill-router` remains explicit-only through `--with-reverse-skill` because its upstream authorization assumption cannot replace independently verified scope; the pinned selected tree is integrity-checked before host projection.
 - Read-only external-tooling audit stays advisory: `repo-harness run check-agent-tooling --host both --check-updates`. The explicit mutating boundary is `repo-harness update`, which reconciles mandatory ArchContext packages and runtime and updates the global CodeGraph CLI/MCP; mutable Waza/Mermaid providers require `--with-external-skills`. It does not initialize or sync a repository CodeGraph index.
 - Manual distillation stays repo-local: repeated corrections -> `tasks/lessons.md`; deep findings and hidden contracts -> topic-scoped `docs/researches/*.md`; sprint verification evidence -> `tasks/reviews/*.review.md`; durable capability progress -> `tasks/workstreams/`; release history -> `docs/CHANGELOG.md`.
@@ -282,7 +282,7 @@ Maintainer-facing map of which package file owns which contract:
 | `assets/workflow-contract.v1.json` | Workflow contract manifest |
 | `docs/reference-configs/*.md` | Source-repo projection of the runtime reference docs |
 | `scripts/inspect-project-state.ts` | State inspector |
-| `src/core/adoption/standard-plan.ts` | Canonical adoption planner |
+| `src/effects/adoption/standard-plan.ts` | Canonical adoption planner |
 | `scripts/check-agent-tooling.sh` | External tooling detector |
 | `scripts/init-project.sh`, `scripts/create-project-dirs.sh` | Scaffolding steps |
 

package/assets/reference-configs/hook-operations.md

@@ -102,7 +102,9 @@ manual removal. Review local changes first.
 No hook answers `/delegate` or `/parallel`. `.ai/harness/delegation/` holds
 only the native-role evidence.
 
-`SessionStart` resolves Effective State once. The `[HarnessState]` section, or
+`SessionStart` resolves Effective State once, read-only. It writes no state,
+and its `state_version` is the last version that `repo-harness state resolve`
+published. The `[HarnessState]` section, or
 `[HarnessStateUnavailable]` when the resolution fails, comes first and always.
 The `architecture-debt` section follows at priority 2 and is mandatory when
 present. Its 800-byte limit keeps it bounded. `pending-plan-capture` remains
@@ -128,8 +130,9 @@ spawn an LLM or a long-running worker.
 
 ## Host and Adoption Operations
 
-`repo-harness init` installs the user-level adapters, writes the workflow
-contract, and writes package helper guidance in `.ai/hooks/README.md`.
+`repo-harness init` writes the workflow contract and package helper guidance
+in `.ai/hooks/README.md`. It does not install user-level adapters;
+`repo-harness install` and `repo-harness update` own them.
 It does not copy the operator library into consumer repositories.
 It removes retired generated hook entry scripts by exact manifest ownership and
 does not create a repo-local dispatcher. Project-level `.claude/settings.json`
@@ -390,7 +393,7 @@ history:
 | `${runId}.json` carrying the resolved projection paths | none now; Stop and the shell `prepare-handoff` writer wrote it | `evidence-gc` deletes this shape for one release |
 | `${runId}-${contractSlug}.json` (`schema: repo-harness-run-trace.v1`) | `verify-sprint.sh` | none; a checks projection reads it back at acceptance finalization |
 | `verification-${executionId}.json` / `.log` | `verification-execution.ts` | none; immutable, bound by sha256 in the evidence ledger |
-| `hook-events.jsonl` | hook telemetry | `hook-event-log.ts`, on rotation: 8 MB segments, 256 MB or 32 archived segments |
+| `hook-events.jsonl` | hook telemetry | `segmented-log.ts`, on rotation: 8 MB segments, 256 MB or 32 archived segments |
 | ad-hoc `*.json` reports | operator scripts | none; each report owns its own file |
 
 Evidence checkpoints under `.ai/harness/evidence/checkpoints/` are owned by

package/assets/reference-configs/minimal-change-hooks.md

@@ -27,16 +27,17 @@ closed. Run `repo-harness run evidence-gc --repo <path>` once to remove it.
 
 ## What Remains
 
-The smallest coherent change is a review rule, not a hook. The active plan,
-the contract scope, the tests and the review decide whether a change grew too
-large. Change Assessment is the deterministic boundary.
+The smallest coherent change is a review rule, not a hook. The approved admission scope,
+verification plan, tests and review decide whether a change grew too large. Change Assessment is the deterministic boundary.
 
 ## Change Assessment Boundary
 
 Hook output and `.ai/harness/events.jsonl` remain advisory and fail-open: a
 hook crash must not create or remove merge authority. Before semantic review or acceptance, run
-`repo-harness run change-assessment prepare --contract <contract>` from the
-execution repository. Change Assessment v1 then recomputes the normalized final subject from the sole policy-owned base
+`repo-harness run change-assessment prepare` from the execution
+repository with the active admission selectors: `--repository-id`, `--issue-id`,
+`--campaign-id`, `--grant-sha256`, `--policy-sha256` and `--actor`. The trusted
+control Bot supplies the approval; selector values alone do not grant permission. Change Assessment v1 then recomputes the normalized final subject from the sole policy-owned base
 `.ai/harness/policy.json#worktree_strategy.review_base`. Missing/malformed
 policy, an unobservable final subject, an invalid packet, or an unmet declared
 oracle fails the assessment boundary closed. `verification-plan execute`
@@ -47,8 +48,8 @@ reason vocabulary `authority_change`, `irreversible_effect`,
 `pattern_novelty`, `reviewer_disagreement`, and `oracle_gap`. A later reviewer
 may append `reviewer_disagreement` for paths already bound to the packet, but
 cannot remove a reason, lower a selection, or change the packet subject/target.
-Prepare it again with `change-assessment prepare --contract <contract>
---packet .ai/harness/checks/change-assessment.latest.json` to preserve the
+Prepare it again with the same admission selectors and
+`change-assessment prepare --packet .ai/harness/checks/change-assessment.latest.json` to preserve the
 overlay. The acceptance owner recomputes the base assessment and validates the
 packet against the current subject and target. A missing or stale packet fails
 closed. Native execution facts remain separate.

package/assets/reference-configs/strategy.md

@@ -161,7 +161,7 @@ unsupported and fails closed. Git file modes use normalized booleans and the
 owner execute bit. Both command output streams count in the shared budget on
 success and failure.
 
-## Repository pilot and fixture Host wake contract
+## Repository pilot
 
 `repo-harness strategy pilot --repo <root>` explicitly reads
 `docs/strategy/repository-pilot.json` with canonical state observation. The
@@ -169,31 +169,15 @@ repository pilot owner is Aimpact. README and the approved first-scope plan are
 pinned evidence. The command does not create docs/strategy/context.json or
 change ordinary activation. Its explicit repository-pilot profile permits
 128 KiB per file, 4 MiB per request and a 5 second observation deadline.
-Ordinary context and wake reads keep their 64 KiB/1 MiB defaults. Larger limits
+Ordinary context reads keep their 64 KiB/1 MiB defaults. Larger limits
 are rejected, and this profile requires the fixed pilot document path.
 `strategy pilot <proposal>` validates against a fresh canonical pilot context.
 Use `--load strategy-boundaries` to select the pilot's memory body. A source-budget violation fails closed. Within each canonical read-only pass,
 policy and capability text is shared with its hash projection. Each subsequent
 pass reopens those sources. All four passes and final comparisons remain. There is no business-success verdict.
 
-The one-shot export adapter in src/effects/strategy/wake.ts has no CLI scheduler
-or live host integration. Its pure contract consumes at most 32 events in a
-16 KiB JSON request. The host assigns an epoch and monotonic sequence. Exact
-repeats deduplicate, old sequences are ignored, conflicts fail and the newest
-sequence wins independent of batch order. It retains at most 64 event identities
-in caller memory. Restart requires a new epoch. Old-epoch events fail. A replay
-in a fresh epoch can produce another export; no durable exactly-once guarantee
-is claimed. The host owns coalescing intervals, waking and any persistence.
-
-The adapter compares the selected wake digest with fresh context and validates
-proposals against that context. It can only return packets. Host capability
-claims remain unverified, including readOnly=true or resume=true. They unlock
-no provider, resume, controller call, task claim or intent mutation. Real
-integration needs a chosen host, verified capability and separate approval.
-
 Source IO defaults to a 1 MiB request limit, 64 KiB per payload and a 128 KiB
-packet bound. Wake observation adds a five-second cooperative deadline and
-shortens each command timeout to the remaining time. Smaller byte/time limits
-are allowed. Synchronous filesystem IO cannot be interrupted in-process; the
-host must enforce a hard whole-invocation deadline. No new execution ledger,
-daemon, scheduler or automatic memory edit is added.
+packet bound. Smaller byte/time limits are allowed. Synchronous filesystem IO
+cannot be interrupted in-process; the host must enforce a hard whole-invocation
+deadline. No new execution ledger, daemon, scheduler or automatic memory edit is
+added.

package/assets/reference-configs/workflow-orchestration.md

@@ -21,6 +21,9 @@ separate rollback surface, needs independent verification, needs its own
 review/acceptance boundary, touches a high-risk surface, or cannot remain a
 checklist row in the active plan or sprint backlog.
 
+Slices that write the same files in sequence go into one PR. Split a slice
+into its own PR only when it runs in parallel with disjoint write ownership.
+
 Inline sprint rows stay in the sprint backlog or the active plan's
 `## Task Breakdown`. Contract rows may expand through the full plan -> contract
 -> review -> notes flow.

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.24.1",
-  "templateVersion": "0.24.1",
+  "version": "0.24.3",
+  "templateVersion": "0.24.3",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {

package/assets/skills/repo-harness-chatgpt/references/orchestrate.md

@@ -8,16 +8,17 @@ add a provider, runtime adapter, schema, fleet role, or second Skill.
 
 GPT Pro is an external chief planner/reviewer. Local Codex is the accountable
 coordinator and executor, including the Codex built-in browser (IAB) transport.
-Repository artifacts, the effective-state resolver, task contract, lease,
-allowed paths, real checks, and acceptance gate remain the only control-plane
-and execution authority.
+The upstream Bot owns human authentication and scope authorization. Local
+execution uses the current approved admission, admitted task/session, immutable
+claim reference, allowed paths, real checks, and acceptance gate. Plans and
+contracts remain optional planning records.
 
 ## Authority Boundary
 
 | Participant | May do | May not do |
 | --- | --- | --- |
-| GPT Pro Web | Read the exact context supplied to it, use the authorized GitHub Connector when visibly available, propose a plan, identify risks, and review the returned diff/evidence | Edit the local worktree, run local commands, create or change tasks, claim/release/steal a lease, widen `allowed_paths`, assert that local checks ran, or authorize commit/push/PR/merge/deploy |
-| Local Codex | Resolve state, select the remote revision, build and secret-scan the local bundle, dispatch work through the normal task/lease path, run checks, and decide acceptance | Treat GPT Pro prose or a tool-use claim as permission or as proof of a local fact |
+| GPT Pro Web | Read the exact context supplied to it, use the authorized GitHub Connector when visibly available, propose a plan, identify risks, and review the returned diff/evidence | Edit the local worktree, run local commands, create or change tasks, change task/session admission or claim provenance, widen `allowed_paths`, assert that local checks ran, or authorize commit/push/PR/merge/deploy |
+| Local Codex | Resolve state, select the remote revision, build and secret-scan the local bundle, dispatch work through the admitted task/session path, run checks, and decide acceptance | Treat GPT Pro prose or a tool-use claim as permission or as proof of a local fact |
 | GitHub Connector | Supply remote repository facts at an exact revision when its invocation is observable | Describe uncommitted local changes or replace the local repository source of truth |
 
 This is an advisory planning/review loop, not a managed `agent-fleet` role.
@@ -124,7 +125,7 @@ does not upgrade itself into `verified`; `unverified` blocks the round.
 
 ### 1. Prepare and send the plan turn
 
-1. Confirm the current task contract, active plan, effective state, lease, and
+1. Confirm the current admission, task/session, immutable claim reference, and
    allowed paths locally. Preserve unrelated dirty worktree state.
 2. Resolve and record the exact remote repository/ref/SHA. Do not let GPT Pro
    choose a moving branch or silently substitute another revision.
@@ -152,10 +153,10 @@ local-delta identity. GPT Pro cannot amend any of them through its response.
    evidence.
 2. Classify GitHub evidence as `verified`, `bundle_only`, or `unverified`.
    Recheck the proposed paths and assumptions against the current local
-   contract and effective state. If the remote SHA or local delta changed,
+   admission and current task/session. If the remote SHA or local delta changed,
    discard the proposal and rebuild the bundle.
 3. Treat the proposal as advisory input. The local coordinator may dispatch
-   only work already authorized by the task contract and lease. It runs edits
+   only work already authorized by the current admission and task/session. It runs edits
    and real checks locally; GPT Pro never claims those results for it.
 4. Stop closed on stale state, missing evidence, path widening, a proposed
    commit/push/PR/deploy, or any instruction that crosses the authority table.
@@ -178,7 +179,7 @@ local-delta identity. GPT Pro cannot amend any of them through its response.
    termination/read-back evidence blocks the orchestration round.
 5. The local gatekeeper reruns the task's real checks and decides acceptance.
    Record GPT Pro's response as review evidence only; it cannot approve the
-   task, release a lease, or override a failed gate.
+   task, revoke an admission, or override a failed gate.
 
 ## Required Canary Evidence
 
@@ -213,7 +214,7 @@ evidence and report the concrete stop reason.
 Never ask for passwords, 2FA codes, cookies, browser storage, session tokens,
 or GitHub credentials. Never retry through native/CDP or a different
 conversation to manufacture a passing canary. Never turn GPT Pro's plan or
-review into a task, lease, code edit, acceptance receipt, or publication
+review into a task/session admission, code edit, acceptance receipt, or publication
 authority.
 
 ## Existing References

package/assets/skills/repo-harness-cross-review/references/generic-review.md

@@ -6,10 +6,27 @@ address file `{endpoint:{session,configPath?,home?},parent_pane}`. Trust the exa
 checkout through the normal operator workflow before starting; never respond to
 trust/update/approval prompts automatically.
 
+Before review, configure the repository's manual `external_sources` policy and
+provide working provider access. The default policy is off; initialization does
+not enable it. The trusted upstream Bot must authenticate the human, authorize
+the scope, and supply the bound request. Its integration calls
+`repo-harness review admit --repo <execution-checkout> --request <authorized-request.json>`.
+The request contains `{admission, approval, expectedRevision}`. To withdraw that
+approval, the Bot integration calls
+`repo-harness review revoke --repo <execution-checkout> --request <revocation-request.json>`.
+That request contains
+`{repository_id, issue_id, campaign_id, expectedGrantSha256, expectedRevision}`.
+The store revokes only the exact active grant at the expected revision. Do not create an
+approval from these examples: actor IDs and authorization references are binding
+data, not authentication. Select the resulting active grant and policy digests
+below, and supply the current immutable issue claim. A contract or plan file
+cannot grant permission. A user waiver requires a separate upstream-authorized
+decision; waiver eligibility in an admission does not grant one.
+
 ```bash
-repo-harness review round --contract tasks/contracts/<task>.contract.md --reviewer-repo <linked> --herdr-endpoint <address.json>
-repo-harness review status --contract tasks/contracts/<task>.contract.md
-repo-harness review close --contract tasks/contracts/<task>.contract.md
+repo-harness review round --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id> --reviewer-repo <linked> --herdr-endpoint <address.json> --verification <native-report> --claim-ref <claim-reference> --claim-revision <claim-sha256>
+repo-harness review status --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id>
+repo-harness review close --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id>
 ```
 
 Default selection uses an existing typed task binding for the parent pane and chooses
@@ -28,7 +45,7 @@ consumes OAR Session model observation and calls the existing generic-review
 Receipt writer/verifier. Receipt validity is launcher-independent.
 
 Close requires the current passing Receipt to equal the final accepted round.
-On failure use `repo-harness review cancel --contract <path>` for identity-proven
+On failure use `repo-harness review cancel` with the same six admission selectors for identity-proven
 cleanup without acceptance. Preserve unknown delivery and cleanup evidence.
 The server and attached parent/workspace remain with their existing owner.
 Drain pre-cutover sessions with the prior version; archive old evidence read-only.
@@ -60,7 +77,7 @@ Use this mode when an operator works in the Claude desktop app without Herdr.
 The Claude app session is the owner, so the default reviewer is Codex.
 
 ```bash
-repo-harness review round --launch app-terminal --contract tasks/contracts/<task>.contract.md --reviewer-repo <linked> --verification <report>
+repo-harness review round --launch app-terminal --repository-id <repository-id> --issue-id <issue-id> --campaign-id <campaign-id> --grant-sha256 <approved-grant-sha256> --policy-sha256 <policy-sha256> --actor <actor-id> --reviewer-repo <linked> --verification <report> --claim-ref <claim-reference> --claim-revision <claim-sha256>
 ```
 
 1. The first call prepares the packet, the Seatbelt profile and the host spec.