trantor 0.18.33 → 0.18.34

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.33",
+  "version": "0.18.34",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -399,9 +399,15 @@ trantor setup | doctor | connect | profile | provider | models
 
 - **`trantor new <name>`** — project genesis in one command: makes the dir under your dev root
   (`TRANTOR_DEV_ROOT` or `~/development`), git on main (or `--from <git-url>`, or `--adopt` an
-  existing folder), seeds CLAUDE.md from `--brief <file>`, installs the auto-card hook, posts
-  the brief to the hub, and opens the first card "genesis: <name>". `--json` for machines.
-  It never spawns a session — firing the crew stays your call.
+  existing folder), installs the auto-card hook, posts the brief to the hub, and opens the first
+  card "genesis: <name>". `--json` for machines. It never spawns a session — firing the crew
+  stays your call. Two paths in: **blank** (no brief) wakes the orchestrator plainly and you work
+  with it iteratively; **from a brief** (`--brief <file>`, or a PRD dropped on the app's Genesis
+  sheet) stores it in `docs/PRD.md` with a small CLAUDE.md pointer, and the wake runs
+  **`/trantor:prd-review`**: every live crew seat plus two Scrooge readers review the PRD
+  independently against one rubric, the orchestrator synthesizes the consensus and asks you,
+  the TDD gets the same review, and only then do the build cards open. A parked project with
+  `docs/PRD.md` and no build cards takes the same path on its next Wake.
 
 - **`trantor provider`** — `list` every crew seat (built-in + brought) with availability + tier ·
   `add <name> --key … [--plan api] [--base-url <url> --models a,b]` to bring any provider (custom

package/bin/cli.mjs

@@ -70,6 +70,7 @@ switch (cmd) {
   case "reconcile": run("bin/reconcile.mjs"); break;
   case "init-hooks": run("bin/init-hooks.mjs"); break;
   case "new": run("bin/new.mjs"); break;
+  case "genesis-kickoff": run("bin/genesis-kickoff.mjs"); break;
   case "balances": case "balance": case "credits": run("bin/balances.mjs"); break;
   case "recost": run("bin/recost.mjs"); break;
   case "handoff": run("bin/baton.mjs"); break;
@@ -209,7 +210,8 @@ switch (cmd) {
   trantor gates       verification gates: "must verify before shipping" claims that survive handoffs — [--all] [--json]
   trantor backfill    card past GIT work onto the board (solo commits that were never carded) — [--since "14 days ago"] [--dry-run]
   trantor init-hooks  install a git post-commit hook so EVERY commit auto-cards on the board (reliable solo-work backstop) — [--uninstall]
-  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
+  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, docs/PRD.md + small CLAUDE.md, hooks, hub brief + first card (never spawns a session)
+  trantor genesis-kickoff  internal wake prompt selector from the checkout + signed project board
   trantor balances    how much credit is left on each CONFIGURED provider (from your profile) — refill before you stall — [--json]
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)

package/bin/crew-runner.mjs

@@ -510,7 +510,11 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
       { detached: true, stdio: "ignore" });
     wd.unref();
   } catch {}
-  const r = spawnSync("/bin/bash", ["-c", `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF})`], {
+  // Preserve the CLI's exit before waiting for the stderr process substitution. Without the
+  // explicit wait, a short failing CLI can return while its error is still in the scrub pipe;
+  // under load the classifier then reads an empty ERRF and reports the wrong failure reason.
+  const shell = `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}); turn_exit=$?; wait; exit $turn_exit`;
+  const r = spawnSync("/bin/bash", ["-c", shell], {
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : "inherit",
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
@@ -527,9 +531,8 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     maxBuffer: 16 * 1024 * 1024,
   });
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  // #5869: scrub AT REST, synchronously, before anything reads the file back. The stderr hop is
-  // a process substitution bash does not wait for, so this pass also catches its tail — the
-  // auth classifier and the empty-output check below must judge REDACTED text and a settled file.
+  // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
+  // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
   try { writeFileSync(ERRF, redactKeys(readFileSync(ERRF, "utf8"))); } catch {}
   // #5868: classify only what the CLI itself said. The transcript replays the whole turn prompt
   // (rules, lessons, the wake text) — and those lines once classified healthy codex turns as

package/bin/genesis-kickoff.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// trantor genesis-kickoff [<project>] — which boot prompt a WOKEN orchestrator gets (#6112).
+//
+// Two paths into a project (operator ruling 2026-09-02 23:15). Path A, blank: the orchestrator
+// wakes plainly and works iteratively with the operator. Path B, from a brief: the PRD sits in
+// docs/PRD.md and the wake CONVENES the crew review (/trantor:prd-review) before anything is
+// built. Waking an adopted project that has docs/PRD.md and no build cards takes path B too, so
+// a project that parked with its PRD in place needs no re-genesis: the next Wake convenes it.
+//
+// The decision needs two facts only the CLI holds together — the checkout's durable docs/PRD.md
+// and the project's SIGNED board — so it lives here. The desktop app (genesis sheet, sidebar
+// Wake, workspace open) runs this in the checkout and relays the one line it prints; on exit 1
+// the app types its own plain wake instead. A board that cannot be read therefore fails CLOSED
+// to the plain wake, never to a review nobody verified was due: the plain-woken orchestrator
+// still sees docs/PRD.md and the CLAUDE.md pointer and can convene by hand.
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadIdentity, signedGet } from "../hooks/lib/api.mjs";
+import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
+import { hostId, resolveHub, resolveProject } from "../lib/project.mjs";
+
+export const PRD_REVIEW_KICKOFF = "docs/PRD.md is the brief; run /trantor:prd-review";
+// Word for word the app's WAKE_KICKOFF_PROMPT (desktop terminal.rs): a project without a brief to
+// review gets exactly the wake it always got.
+export const PLAIN_WAKE_KICKOFF = "You were just woken via Trantor. Catch up from your context — the handoff you were handed if one exists, otherwise the project board and memory — then recap where things stand in at most 3 sentences and wait.";
+
+// Cards that exist BEFORE a build starts, and must not be mistaken for one: the genesis card
+// `trantor new` opens, the review cards this flow opens, and the auto-cards a session sheds
+// (operator prompts, sub-agents) which say a conversation happened, not that work was cut.
+const PRE_BUILD_PHASES = new Set(["genesis", "prd", "tdd"]);
+const PRE_BUILD_TITLE = /^(genesis:|prd review:|tdd review:)/i;
+const CONVERSATION_SOURCES = new Set(["session", "cc-subagent", "cc-bg-agent"]);
+
+export function isBuildCard(task) {
+  if (!task || typeof task !== "object") return false;
+  const phase = String(task.phase || "").trim().toLowerCase();
+  if (phase === "build") return true;
+  if (PRE_BUILD_PHASES.has(phase)) return false;
+  if (CONVERSATION_SOURCES.has(String(task.source || "").trim().toLowerCase())) return false;
+  const title = String(task.title || "").trim();
+  return Boolean(title) && !PRE_BUILD_TITLE.test(title);
+}
+
+// The pure decision: dir = the checkout, tasks = the board (an array), or null when it could not
+// be read. Exported so the drill can pin every branch without a hub.
+export function selectGenesisKickoff({ dir, tasks }) {
+  if (!existsSync(join(dir, "docs", "PRD.md"))) return PLAIN_WAKE_KICKOFF;
+  if (!Array.isArray(tasks)) return PLAIN_WAKE_KICKOFF;
+  return tasks.some(isBuildCard) ? PLAIN_WAKE_KICKOFF : PRD_REVIEW_KICKOFF;
+}
+
+async function readBoard(project) {
+  const hub = resolveHub(project);
+  // Sign as the identity the orchestrator in this checkout will use (RELAY_SESSION when a runner
+  // set one, else host:project). On an enforce hub that identity may be brand new for a project
+  // `trantor new` made seconds ago, and TOFU is refused there — so enrol the way crew seats and
+  // genesis itself do: the operator's owner key mints a project-scoped invite and this identity
+  // spends it. A no-op when the hub already knows us; a soft failure when it does not, in which
+  // case the signed read below reports the refusal and the caller falls back.
+  const session = process.env.RELAY_SESSION
+    || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
+  const identity = loadIdentity(session);
+  const enrolment = await enrollViaOwnerInvite(hub, identity, project, { timeoutMs: 4000 });
+  if (!enrolment.ok && enrolment.reason !== "no-owner-key") {
+    console.error(`genesis kickoff: enrolment on ${hub} did not succeed (${enrolment.reason}); trying the read anyway`);
+  }
+  const response = await signedGet(`/tasks?project=${encodeURIComponent(project)}`, { session, project, timeoutMs: 4000 });
+  if (!response.ok) {
+    return { ok: false, hub, reason: response.status ? `hub ${response.status}${response.json?.error ? `: ${response.json.error}` : ""}` : "unreachable" };
+  }
+  const tasks = Array.isArray(response.json) ? response.json : response.json?.tasks;
+  return Array.isArray(tasks) ? { ok: true, hub, tasks } : { ok: false, hub, reason: "malformed /tasks response" };
+}
+
+async function main() {
+  const dir = process.cwd();
+  const project = process.argv[2] || resolveProject(dir);
+  if (!existsSync(join(dir, "docs", "PRD.md"))) {
+    console.log(PLAIN_WAKE_KICKOFF);
+    return;
+  }
+  const board = await readBoard(project);
+  if (!board.ok) {
+    console.error(`genesis kickoff: docs/PRD.md is present but ${project}'s board on ${board.hub} could not be read (${board.reason}) — the app falls back to the plain wake`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(selectGenesisKickoff({ dir, tasks: board.tasks }));
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();

package/bin/new.mjs

@@ -6,8 +6,8 @@
 // It makes the project directory at <parent>/<name> — --dir names the PARENT, never the project
 // directory itself (default parent: TRANTOR_DEV_ROOT or ~/development). The name is always
 // appended under it, so `--dir P` with name N creates P/N. Starts git on main (or clones --from,
-// or adopts an existing folder with --adopt), seeds CLAUDE.md from the
-// brief (verbatim brief + the trantor conventions block), installs the same auto-card hook as
+// or adopts an existing folder with --adopt), stores the brief in docs/PRD.md and seeds a small
+// CLAUDE.md pointer plus the trantor conventions block, installs the same auto-card hook as
 // `trantor init-hooks`, posts the brief as the hub project brief (POST /project — the same call
 // relay_project_brief makes), and opens the first card "genesis: <name>" on the new board.
 //
@@ -17,7 +17,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureEnrolled as enrollTofu, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
 import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
@@ -28,7 +28,7 @@ const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 
 // The trantor conventions block — what every trantor-wired project's CLAUDE.md carries so the
 // first session knows the board, the crew, and the gates exist. Kept SHORT and factual; the
-// brief above it is the project's own voice.
+// project brief stays in docs/PRD.md so a large PRD cannot exceed the harness instruction limit.
 const CONVENTIONS = [
   "",
   "## Trantor conventions",
@@ -94,13 +94,22 @@ if (from) {
   branch = git(["branch", "--show-current"]).stdout.trim() || "main";
 }
 
-// ── CLAUDE.md — verbatim brief + the conventions block ──────────────────────────────────────────
+// ── durable brief + small CLAUDE.md pointer ─────────────────────────────────────────────────────
+if (brief) {
+  const docs = join(dir, "docs");
+  mkdirSync(docs, { recursive: true });
+  writeFileSync(join(docs, "PRD.md"), `${brief}\n`);
+}
+
 const claude = join(dir, "CLAUDE.md");
 if (existsSync(claude)) {
   const current = readFileSync(claude, "utf8");
   if (!current.includes("## Trantor conventions")) appendFileSync(claude, `\n${CONVENTIONS}\n`);
 } else {
-  const head = brief ? `${brief}\n` : `# ${name}\n\n(Genesis — no brief was given. Add this project's what/why/goal here.)\n`;
+  const importedFrom = briefFile ? ` (imported from \`${basename(briefFile)}\`)` : "";
+  const head = brief
+    ? `# ${name}\n\nThe project brief is stored at \`docs/PRD.md\`${importedFrom}. Read and maintain it there.\n`
+    : `# ${name}\n\nNo project brief was supplied. Begin with the operator's first instruction.\n`;
   writeFileSync(claude, `${head}${CONVENTIONS}`);
 }
 
@@ -161,7 +170,9 @@ if (json) {
   console.log(JSON.stringify({ name, parent: devRoot, dir, branch, hub, card }));
 } else {
   console.log(`✓ ${dir} (${branch}${from ? ", cloned" : adopt ? ", adopted" : ""})`);
-  console.log(`✓ CLAUDE.md seeded${brief ? " from the brief" : " (no brief — add the project's what/why/goal)"}`);
+  console.log(brief
+    ? "✓ docs/PRD.md seeded from the brief; CLAUDE.md kept small"
+    : "✓ blank project seeded; CLAUDE.md kept small");
   console.log(`✓ auto-card hook installed (trantor init-hooks)`);
   if (card !== null) console.log(`✓ hub ${hub}: brief posted, card #${card} ("genesis: ${name}")`);
   else if (hubError) console.log(`! hub ${hub}: brief/card not posted (${hubError})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.33",
+  "version": "0.18.34",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-cursor-rewind.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-persist-safety.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-prd-review.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [

package/skills/prd-review/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: prd-review
+description: |
+  Convene the crew's review of a project's brief (docs/PRD.md) and then of its design
+  (docs/TDD.md): every live crew seat plus two Scrooge readers review the document independently
+  against one rubric, the orchestrator synthesizes their verdicts into one consensus and puts it
+  to the operator, and the build cards open only after the TDD passes. Use when a wake says
+  "docs/PRD.md is the brief; run /trantor:prd-review", when asked to have the crew review a PRD
+  or a TDD, or to resume at the TDD phase. Trigger: /trantor:prd-review [prd|tdd]
+user-invocable: true
+argument-hint: "[prd|tdd]"
+---
+
+# PRD review: the crew reads the brief before anyone builds
+
+Ruled by the operator on 2026-09-02: every PRD that gets ingested is reviewed by as many members
+of the crew as are live, the crew reaches consensus on whether it is good enough to move on to the
+TDD, the TDD gets the same review, and only then does the build start. A solo orchestrator that
+recaps the brief and proposes a plan is exactly what this replaces: one reader's blind spots become
+the product's. Lateral cross-review is the reliability argument, so the reviews are INDEPENDENT.
+
+You are the project's ORCHESTRATOR. You convene, you dispatch, you synthesize, you record. You do
+not review the document yourself and you never vote: a verdict of yours would be one more opinion
+from the one seat that also decides what the opinions mean.
+
+Phase argument: none or `prd` runs the PRD phase and continues into the TDD phase on a pass;
+`tdd` resumes at the TDD phase when the PRD card is already done (a turn or a session ended in
+between).
+
+## 0. The board first
+
+1. `relay_board`. A card titled `PRD review: <project>` (for `tdd`: `TDD review: <project>`)
+   that is not done is THE card: continue on it, never open a second one. Its notes hold the
+   roster and every verdict so far.
+2. `docs/PRD.md` must exist in the checkout. If it does not, say so and stop: there is nothing to
+   review, and a review of a brief that is not written down is not a review.
+
+## 1. Establish the reviewers
+
+The reviewers are, by the ruling, every live seat of the project's crew plus two Scrooge readers
+on two different models.
+
+1. **Crew seats.** `relay_peers` lists the live sessions. A reviewer is every online
+   `<cli>:<project>` seat of THIS project (`codex:<project>`, `glm:<project>`, `kimi:<project>`,
+   …). Not reviewers: you, the operator's host session (`<host>:<project>`), and tool
+   identities such as `genesis:<project>`.
+2. **No crew live?** Bring one up FIRST through `/trantor:crew`: `relay_advise` with the review
+   as the work, then `trantor up …` with the SUBSCRIPTION seats the operator's profile declares
+   (`trantor profile`), and read the launcher's verdict: only a seat that verified on the bus
+   reviews. Choosing the brief path already authorized a review crew; do not ask again, and do
+   not substitute metered API seats the profile did not select.
+3. **Two Scrooge readers.** `relay_scrooge` twice with the identical rubric and the full text of
+   `docs/PRD.md` in the prompt (the cheap model sees only the prompt; use `task: "reason"`, or
+   `task: "long-context"` for a brief beyond about 40k characters). Each receipt names its
+   `provider/model`; the two must differ. If the second lands on the same model, retry it at a
+   different `difficulty` (the router escalates to a different model). If two distinct models
+   cannot be had, proceed with one and say so on the card: never describe one model twice as two
+   independent readers.
+
+The roster (seat ids plus the two `provider/model` receipts) goes into the review card's opening
+note and is FROZEN: the TDD phase uses the same seats and the same two models. A seat that dies
+between phases is restored with `trantor up`, not replaced by a different reviewer.
+
+## 2. The rubric
+
+One rubric for every reviewer, in this order, in these words:
+
+1. **completeness** — what the brief covers and what it leaves unsaid;
+2. **ambiguity** — statements that two builders would implement differently;
+3. **feasibility and risk** — what is hard, what could fail, what depends on the unknown;
+4. **missing requirements** — what the brief needs and does not contain;
+5. **a proposed scope cut** — the one thing to drop or defer first;
+6. **VERDICT: READY** or **VERDICT: REVISE**, with the gaps listed.
+
+A review note that lacks any of the six parts is incomplete: bounce it to the reviewer with a
+direct message naming the missing part. Never fill a part in on a reviewer's behalf.
+
+## 3. One card, one item per reviewer
+
+Run the two Scrooge reads first (they are stateless and need no card id), then open the card with
+`relay_task_add`:
+
+- title `PRD review: <project>`, phase `PRD`, difficulty `hard`, assigned to you, status `doing`;
+- `checklist`: exactly ONE item per reviewer, labelled with the reviewer's identity
+  (`codex:<project>`, `glm:<project>`, `scrooge deepseek/deepseek-v4-flash`, …);
+- the opening `note`: the document path, the frozen roster, the six-part rubric, and the consensus
+  rule from §4.
+
+Append each Scrooge verdict UNCHANGED as a card note prefixed with its receipt's model, then tick
+that model's item. Carrying a reader's verdict onto the card is transport, not a vote of yours.
+
+Then `relay_send` every crew seat the same contract, as a DIRECT message (broadcasts do not wake
+a seat), under 280 characters:
+
+> PRD review card #<id>: read docs/PRD.md in your worktree. Note on the card, in order:
+> completeness, ambiguity, feasibility+risk, missing requirements, one proposed scope cut, then
+> VERDICT READY|REVISE with the gaps. Tick your item (index <n>). No file edits.
+
+A seat records its review with `relay_task_move` to the card's CURRENT status carrying the note
+(the note is the review; the move is how a note lands), then ticks only its own checklist item
+with `relay_task_check`. Reviews are independent: a seat that quotes another seat's note gets a
+bounce, not a tick.
+
+## 4. Consensus, then the operator
+
+Supervise as the crew skill's foreman loop: `relay_wait`, sweep the card and `relay_peers`, nudge
+a silent seat by direct message, `trantor up` a dead one and resend its contract. The review is
+in when every checklist item is ticked and every note has the six parts.
+
+- **All READY** = the crew's pass.
+- **Any REVISE** = you merge every gap from every reviewer, READY ones included, into ONE
+  revision request: deduplicated, attributed, ordered by how many reviewers raised it.
+
+Either way the outcome goes to the OPERATOR in ask mode: this gate is always asked, never
+auto-fired. Present the roster, one line per verdict, the merged revision request when there is
+one, and the crew's outcome, then ask (`AskUserQuestion` when the harness offers it, plain chat
+otherwise). The operator may confirm the consensus, override a REVISE into a pass, or send a
+unanimous READY back for revision. Record the decision and its reason as a card note.
+
+- **Pass:** move the card to `testing` with the tally (`n READY / m REVISE`, the decision), then
+  to `done`. Continue with the TDD phase.
+- **Revise:** hand the operator the revision request; the operator revises `docs/PRD.md` or asks
+  you to draft the revision for their approval. When the file changes, untick every item
+  (`relay_task_check` with `done: false`), re-dispatch the same roster on the SAME card, and
+  repeat §3 and §4.
+
+## 5. TDD phase (`/trantor:prd-review tdd` resumes here)
+
+The PRD card is done. Now one author writes the design and the same reviewers review it.
+
+1. **Author.** Pick ONE live crew seat as the author (the strongest coding seat the profile
+   gives you; say which and why on the card). Its contract: write `docs/TDD.md` from the accepted
+   PRD, covering architecture, the interfaces and data flow (the event/interface contract between
+   agents), file ownership as one file-set per seat, dependencies, the verification plan, risks,
+   and a work breakdown of build packages each tagged `easy|medium|hard`. The author does not
+   review its own design.
+2. **Card.** Open or reuse exactly one `TDD review: <project>` card in phase `TDD`. Its checklist
+   starts with `author <seat>: docs/TDD.md written`, followed by one item per reviewer of the
+   frozen roster minus the author. The author ticks its item only once the file exists.
+3. **Rubric, adapted to a design:** completeness (every PRD requirement has a home in the design),
+   ambiguity, feasibility and risk, missing design pieces (interfaces, ownership, verification),
+   a proposed scope cut, `VERDICT: READY` or `VERDICT: REVISE` with the gaps. Same Scrooge reads
+   with `docs/TDD.md` in the prompt, same direct contracts to the seats, same note shape, same
+   ticking rule.
+4. **Same consensus, same operator gate** as §4, on the TDD card. A revision goes back to the
+   author, not to the operator to write.
+
+## 6. On a TDD pass: the build cards open themselves
+
+The confirmed TDD is the gate. Do not ask the operator again merely to open its build cards.
+
+1. Move the TDD card through `testing` to `done` with the tally and the decision.
+2. `relay_advise` with the work breakdown's packages, then one `relay_task_add` per package:
+   phase `build`, the advisor's assignee and `model`, its `difficulty`, `deps` on the packages it
+   needs first, and a `checklist` of its acceptance tests from the TDD's verification plan. A
+   build card without its model set is a defect.
+3. Start the build as the crew skill's phase 3: contracts over the bus, one file-set per seat.
+   How far the build may go on its own (commit, push, deploy, handing off) is the project's
+   autonomy dial (`trantor autonomy`); the dial governs the build, not the opening of its cards.