triad-plus 1.0.0

package/runtime/triad-runtime-capabilities.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const argv = process.argv.slice(2);
+const option = (name) => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : null;
+};
+
+function versionParts(value) {
+  const match = String(value).match(/(\d+)\.(\d+)\.(\d+)/);
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function atLeast(actual, minimum) {
+  const a = versionParts(actual);
+  const b = versionParts(minimum);
+  if (!a || !b) return false;
+  for (let index = 0; index < a.length; index += 1) {
+    if (a[index] > b[index]) return true;
+    if (a[index] < b[index]) return false;
+  }
+  return true;
+}
+
+function expandHome(candidate) {
+  return candidate.startsWith("~/") ? path.join(process.env.HOME ?? "", candidate.slice(2)) : candidate;
+}
+
+function commandVersion(binary, overriddenOutput) {
+  const candidates = Array.isArray(binary) ? binary : [binary];
+  for (const candidate of candidates) {
+    const result = overriddenOutput ? { status: 0, stdout: overriddenOutput } : spawnSync(expandHome(candidate), ["--version"], { encoding: "utf8" });
+    if (result.status === 0) return { binary: expandHome(candidate), version: versionParts(result.stdout)?.join(".") ?? null };
+  }
+  return { binary: expandHome(candidates[0]), version: null };
+}
+
+function validHookRule(rule, lifecycle) {
+  if (!rule || typeof rule !== "object") return false;
+  let matcher;
+  try {
+    matcher = new RegExp(rule.matcher ?? "");
+  } catch {
+    return false;
+  }
+  if (!matcher.test(lifecycle.agent_type)) return false;
+  const hooks = Array.isArray(rule.hooks) ? rule.hooks : [];
+  return hooks.some((hook) => {
+    const command = String(hook?.command ?? "");
+    return hook?.type === "command" &&
+      !command.includes("<TRIAD_") &&
+      command.includes("triad-verify.mjs") &&
+      command.includes("--project") &&
+      (!lifecycle.requires_async || hook.async === true);
+  });
+}
+
+async function loadAdapter() {
+  const adapterPath = option("--adapter");
+  if (adapterPath) return JSON.parse(await readFile(path.resolve(adapterPath), "utf8"));
+  const adapters = JSON.parse(await readFile(new URL("./legacy-adapters.json", import.meta.url), "utf8"));
+  const id = option("--host") ?? "codex";
+  const adapter = adapters[id];
+  if (!adapter) throw new Error(`unsupported adapter: ${id}`);
+  return adapter;
+}
+
+async function hookConfiguration(pathname, lifecycle) {
+  if (!lifecycle) return { configured: false, reason: "adapter_has_no_lifecycle_hook", minimum: null };
+  if (!pathname) return { configured: false, reason: "hook_configuration_not_declared", minimum: lifecycle.minimum_version ?? null };
+  try {
+    const source = await readFile(pathname, "utf8");
+    const parsed = JSON.parse(source);
+    const rules = parsed?.hooks?.[lifecycle.kind];
+    if (!Array.isArray(rules) || !rules.some((rule) => validHookRule(rule, lifecycle))) {
+      return { configured: false, reason: "hook_configuration_has_no_usable_triad_rule", minimum: parsed.minimum_version ?? parsed.minimum_codex_cli_version ?? lifecycle.minimum_version ?? null };
+    }
+    return { configured: true, reason: null, minimum: parsed.minimum_version ?? parsed.minimum_codex_cli_version ?? lifecycle.minimum_version ?? null };
+  } catch (error) {
+    return { configured: false, reason: `hook_configuration_unreadable:${error.code ?? "error"}`, minimum: lifecycle.minimum_version ?? null };
+  }
+}
+
+const requestedMode = option("--requested-mode") ?? "auto";
+const versionOutput = option("--version-output");
+const adapter = await loadAdapter();
+if (adapter?.schema_version !== 1 || typeof adapter.id !== "string" || typeof adapter.binary !== "string") {
+  throw new Error("adapter metadata must contain schema_version 1, id, and binary");
+}
+const lifecycle = adapter.lifecycle ?? null;
+const hostRuntime = commandVersion(option("--host-bin") ?? adapter.binary_candidates ?? adapter.binary, versionOutput);
+const hostBinary = hostRuntime.binary;
+const hostVersion = hostRuntime.version;
+const nodeBinary = option("--node-bin") ?? "node";
+const nodeRuntime = commandVersion(nodeBinary);
+const nodeVersion = nodeRuntime.version;
+const hook = await hookConfiguration(option("--hook-config"), lifecycle);
+const lifecycleAvailable = Boolean(lifecycle && hostVersion && (!hook.minimum || atLeast(hostVersion, hook.minimum)));
+const hookAvailable = lifecycleAvailable && hook.configured;
+const explicitAvailable = Boolean(hostVersion && nodeVersion);
+let selectedMode = "unavailable";
+let reason = "verification_runtime_unavailable";
+if (hookAvailable && (requestedMode === "auto" || requestedMode === "async_hook" || requestedMode === "hook_dispatch")) {
+  selectedMode = lifecycle.requires_async ? "async_hook" : "hook_dispatch";
+  reason = lifecycle.requires_async ? "validated_async_hook_available" : "validated_hook_dispatch_available";
+} else if (explicitAvailable) {
+  selectedMode = "explicit_dispatch";
+  reason = ["async_hook", "hook_dispatch"].includes(requestedMode)
+    ? "requested_hook_unavailable_using_explicit_dispatch"
+    : "explicit_dispatch_available";
+}
+
+process.stdout.write(`${JSON.stringify({
+  schema_version: 1,
+  detected_at: new Date().toISOString(),
+  host: adapter.id,
+  host_runtime: { binary: hostBinary, version: hostVersion, available: Boolean(hostVersion) },
+  verifier_runtime: { binary: nodeBinary, version: nodeVersion, available: Boolean(nodeVersion) },
+  lifecycle_async: {
+    kind: lifecycle?.kind ?? null,
+    minimum_version: hook.minimum,
+    available: lifecycleAvailable,
+    configured: hook.configured,
+    reason: hook.reason
+  },
+  verification: { requested_mode: requestedMode, selected_mode: selectedMode, reason }
+}, null, 2)}\n`);

package/runtime/triad-verify.mjs

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+import { createHash, randomUUID } from "node:crypto";
+import { access, readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { writeAtomicJson } from "./lib/evidence.mjs";
+import { calculateCandidateFingerprint, worktreeBranch } from "./lib/fingerprint.mjs";
+import { executeGates, loadTrustedGates } from "./lib/gates.mjs";
+
+const argv = process.argv.slice(2);
+const option = (name) => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : null;
+};
+
+async function readStdin() {
+  let input = "";
+  for await (const chunk of process.stdin) input += chunk;
+  return input.trim() ? JSON.parse(input) : {};
+}
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+async function sha256File(value) {
+  return sha256(await readFile(value));
+}
+
+function triggerFrom(payload) {
+  return {
+    event: payload.event ?? payload.hook_event_name ?? "manual",
+    session_id: payload.session_id ?? payload.sessionId ?? null,
+    agent_id: payload.agent_id ?? payload.agentId ?? payload?.agent?.id ?? null,
+    agent_type: payload.agent_type ?? payload.agentType ?? payload?.agent?.type ?? null,
+  };
+}
+
+async function resolveAssignment(projectRoot, trigger, explicitAssignment) {
+  const assignmentPath = explicitAssignment
+    ? path.resolve(explicitAssignment)
+    : path.join(projectRoot, ".loop", "runtime", "assignments", `${trigger.agent_id}.json`);
+  const source = await readFile(assignmentPath, "utf8");
+  return { assignmentPath, assignment: JSON.parse(source), assignmentHash: sha256(source) };
+}
+
+async function buildInvalidEvidence({ runId, trigger, assignment, reason, outputPath }) {
+  const evidence = {
+    schema_version: 1,
+    run_id: runId,
+    feature_id: assignment?.feature_id ?? "unknown",
+    attempt: assignment?.attempt ?? null,
+    assignment_id: assignment?.assignment_id ?? null,
+    assignment_sha256: null,
+    trigger,
+    baseline: {
+      prd_sha256: assignment?.expected_prd_sha256 ?? null,
+      card_sha256: assignment?.expected_card_sha256 ?? null,
+      git_head: null,
+      candidate_fingerprint: null,
+    },
+    gates: [],
+    required_gates_passed: false,
+    status: "invalid_context",
+    failure: { code: "verification_context_invalid", reason },
+    created_at: new Date().toISOString(),
+  };
+  if (outputPath) await writeAtomicJson(outputPath, evidence);
+  return evidence;
+}
+
+async function main() {
+  const payload = await readStdin();
+  const trigger = triggerFrom(payload);
+  const requestedRunId = payload.run_id ?? option("--run-id") ?? null;
+  let runId = requestedRunId ?? randomUUID();
+  const projectArgument = option("--project") ?? payload.project_root ?? process.cwd();
+  const projectRoot = await realpath(projectArgument);
+  let assignment;
+  let assignmentPath;
+  let outputPath;
+  try {
+    let assignmentHash;
+    ({ assignmentPath, assignment, assignmentHash } = await resolveAssignment(projectRoot, trigger, option("--assignment")));
+    if (assignment.verification_run_id && requestedRunId && assignment.verification_run_id !== requestedRunId) throw new Error("verification run ID does not match assignment");
+    runId = assignment.verification_run_id ?? runId;
+    const evidenceDirectory = assignment.evidence_directory
+      ? path.resolve(projectRoot, assignment.evidence_directory)
+      : path.join(projectRoot, ".loop", "evidence", assignment.feature_id, `attempt-${String(assignment.attempt).padStart(3, "0")}`);
+    outputPath = path.join(evidenceDirectory, "verification.json");
+    if (assignment.status !== "active") throw new Error("assignment is not active");
+    if (!assignment.assignment_id) throw new Error("assignment ID is required");
+    if (assignment.agent_id !== trigger.agent_id || assignment.agent_type !== "triad_developer") throw new Error("developer assignment does not match trigger");
+    if ((await realpath(path.resolve(assignment.project_root ?? projectRoot))) !== projectRoot) throw new Error("assignment project root mismatch");
+    const worktree = await realpath(path.resolve(projectRoot, assignment.worktree));
+    if (!worktree.startsWith(`${projectRoot}${path.sep}`) && !assignment.allow_external_worktree) throw new Error("undeclared external worktree");
+    const prdPath = path.resolve(projectRoot, assignment.prd_path ?? "artifacts/prd.md");
+    const cardPath = path.resolve(projectRoot, assignment.card_path);
+    await access(prdPath);
+    await access(cardPath);
+    if ((await sha256File(prdPath)) !== assignment.expected_prd_sha256) throw new Error("PRD baseline hash mismatch");
+    if ((await sha256File(cardPath)) !== assignment.expected_card_sha256) throw new Error("feature card hash mismatch");
+    const before = await calculateCandidateFingerprint(worktree);
+    const branch = await worktreeBranch(worktree);
+    if (assignment.expected_branch && assignment.expected_branch !== branch) throw new Error("worktree branch does not match assignment");
+    const gatesPath = path.resolve(projectRoot, assignment.gates_path ?? ".loop/quality-gates.yaml");
+    const trusted = await loadTrustedGates(gatesPath, assignment.expected_gates_sha256);
+    if (!trusted.valid) throw new Error("quality gates are missing or changed from their declared hash");
+    const logDirectory = path.join(evidenceDirectory, "logs");
+    const gates = await executeGates(trusted.gates, worktree, logDirectory);
+    const after = await calculateCandidateFingerprint(worktree);
+    const candidateChanged = before.value !== after.value;
+    const requiredGatesPassed = !candidateChanged && gates.filter((gate) => gate.required).every((gate) => gate.status === "pass");
+    const evidence = {
+      schema_version: 1,
+      run_id: runId,
+      feature_id: assignment.feature_id,
+      attempt: assignment.attempt,
+      assignment_id: assignment.assignment_id,
+      assignment_sha256: assignmentHash,
+      trigger,
+      assignment_ref: path.relative(projectRoot, assignmentPath),
+      baseline: {
+        prd_sha256: assignment.expected_prd_sha256,
+        card_sha256: assignment.expected_card_sha256,
+        gates_sha256: trusted.actualHash,
+        git_head: before.git_head,
+        candidate_fingerprint: before.value,
+        branch,
+      },
+      gates,
+      required_gates_passed: requiredGatesPassed,
+      status: candidateChanged ? "invalidated" : requiredGatesPassed ? "pass" : "fail",
+      failure: candidateChanged ? { code: "candidate_changed_after_verification", reason: "worktree changed while gates ran" } : null,
+      created_at: new Date().toISOString(),
+    };
+    await writeAtomicJson(outputPath, evidence);
+    process.stdout.write(`${JSON.stringify({ run_id: runId, status: evidence.status, evidence: outputPath })}\n`);
+    process.exitCode = evidence.status === "pass" ? 0 : 2;
+  } catch (error) {
+    const fallbackAssignment = assignment ?? null;
+    if (!outputPath && fallbackAssignment?.feature_id) {
+      const directory = path.join(projectRoot, ".loop", "evidence", fallbackAssignment.feature_id, `attempt-${String(fallbackAssignment.attempt).padStart(3, "0")}`);
+      outputPath = path.join(directory, "verification.json");
+    }
+    const evidence = await buildInvalidEvidence({ runId, trigger, assignment: fallbackAssignment, reason: error.message, outputPath });
+    process.stdout.write(`${JSON.stringify({ run_id: runId, status: evidence.status, evidence: outputPath ?? null })}\n`);
+    process.exitCode = 3;
+  }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main();

package/schemas/evaluator-plus-result.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://triad.engineering/schemas/evaluator-plus-result.schema.json",
+  "title": "Triad Evaluator+ report",
+  "type": "object",
+  "required": ["schema_version", "feature_id", "candidate_fingerprint", "verdict", "summary", "evidence_refs", "created_at"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "feature_id": { "type": "string", "minLength": 1 },
+    "candidate_fingerprint": { "type": "string", "minLength": 1 },
+    "verdict": { "enum": ["PASS", "FAIL", "INDETERMINATE"] },
+    "summary": { "type": "string", "minLength": 1 },
+    "evidence_refs": { "type": "array", "items": { "type": "string" } },
+    "created_at": { "type": "string", "format": "date-time" }
+  },
+  "additionalProperties": false
+}

package/schemas/runtime-capabilities.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://triad.engineering/schemas/runtime-capabilities.schema.json",
+  "title": "Triad runtime capability snapshot",
+  "type": "object",
+  "required": ["schema_version", "detected_at", "host", "host_runtime", "verifier_runtime", "lifecycle_async", "verification"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "host": { "enum": ["codex", "opencode", "claude-code", "antigravity"] },
+    "host_runtime": { "type": "object", "required": ["binary", "version", "available"] },
+    "verifier_runtime": { "type": "object", "required": ["binary", "version", "available"] },
+    "lifecycle_async": { "type": "object", "required": ["kind", "minimum_version", "available", "configured", "reason"] },
+    "verification": { "type": "object", "required": ["requested_mode", "selected_mode", "reason"], "properties": { "requested_mode": { "enum": ["auto", "async_hook", "hook_dispatch", "explicit_dispatch"] }, "selected_mode": { "enum": ["async_hook", "hook_dispatch", "explicit_dispatch", "unavailable"] }, "reason": { "type": "string" } } }
+  }
+}

package/schemas/verification-evidence.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://triad.engineering/schemas/verification-evidence.schema.json",
+  "title": "Triad verification evidence",
+  "type": "object",
+  "required": ["schema_version", "run_id", "feature_id", "attempt", "assignment_id", "assignment_sha256", "trigger", "baseline", "gates", "required_gates_passed", "status", "created_at"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "run_id": { "type": "string", "minLength": 1 },
+    "feature_id": { "type": "string", "minLength": 1 },
+    "attempt": { "type": ["integer", "null"], "minimum": 1 },
+    "assignment_id": { "type": ["string", "null"] },
+    "assignment_sha256": { "type": ["string", "null"] },
+    "trigger": { "type": "object", "required": ["event", "agent_id", "agent_type"], "properties": { "event": { "type": "string" }, "agent_id": { "type": ["string", "null"] }, "agent_type": { "type": ["string", "null"] } } },
+    "baseline": { "type": "object", "required": ["prd_sha256", "card_sha256", "git_head", "candidate_fingerprint"], "properties": { "prd_sha256": { "type": ["string", "null"] }, "card_sha256": { "type": ["string", "null"] }, "git_head": { "type": ["string", "null"] }, "candidate_fingerprint": { "type": ["string", "null"] }, "branch": { "type": ["string", "null"] } } },
+    "gates": { "type": "array" },
+    "required_gates_passed": { "type": "boolean" },
+    "status": { "enum": ["pass", "fail", "invalid_context", "infrastructure_error", "invalidated"] },
+    "created_at": { "type": "string", "format": "date-time" }
+  }
+}

package/skills/triad-loop-bootstrap/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: triad-loop-bootstrap
+description: Create an isolated Triad project-control workspace from a PRD, including a frozen PRD baseline, manifest, feature plan, core work queue, verification templates, and delivery evidence templates. Use before the Orchestrator starts a new software initiative.
+---
+
+# Triad Bootstrap
+
+Create the project-control workspace outside product repositories. It is the
+human/agent record of planning and evidence; it is not an executable workflow
+engine.
+
+Collect only missing essentials: project ID/title, readable PRD source, target
+repositories with base/project branches and worktrees, measurable success
+conditions, runnable quality gates, practical-test need, and integration need.
+
+1. Create `<control-repository>/projects/<project-id>/`.
+2. Copy `assets/project.yaml` to `project.yaml`; register only declared product
+   repositories, branches, and worktrees.
+3. Copy the approved PRD to `artifacts/prd.md`; record source, collection time,
+   snapshot, revision when available, and SHA-256.
+4. Copy `assets/loop-template/` to `.loop/`, then create bounded feature cards
+   under `features/` and a complete `feature-plan.md`.
+5. Replace every gate placeholder. Gate executors in v1 are only
+   `control-plane`; remove a non-applicable gate with a recorded reason instead
+   of declaring manual or MCP execution.
+6. Create `.loop/runtime/assignments/` and record the active adapter metadata in
+   `.loop/runtime/capabilities.json` by running
+   `.triad-runtime/triad-runtime-capabilities.mjs --adapter
+   .triad-runtime/adapter.json`.
+7. Show the full card division before delivery work. Continue unless the owner
+   changes it or an escalation condition exists.
+
+The normal state route is `draft → ready → in_progress → verifying → in_review
+→ approved|rework|blocked`. The Orchestrator owns those records. Before each
+Developer dispatch, write an active assignment with a unique assignment ID,
+feature, attempt, expected branch, worktree, PRD/card/gate hashes, and verifier
+run ID. The verifier produces environment-derived evidence; it never changes
+card state.
+
+Use local worktrees for enabled multi-repository integration and declare a final
+integration card. Do not publish packages, alter registry versions, or create a
+release as a bootstrap/integration step. Re-baseline only after an explicit owner
+requirement change; preserve the previous PRD snapshot and record both hashes.

package/skills/triad-loop-bootstrap/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Triad Loop Bootstrap"
+  short_description: "Prepare an evidence-driven loop"
+  default_prompt: "Use $triad-loop-bootstrap to prepare a triad engineering project from a PRD."

package/skills/triad-loop-bootstrap/assets/loop-template/decision-policy.md

@@ -0,0 +1,22 @@
+# Triad decision policy
+
+| Current state | Next state | Owner | Required basis |
+| --- | --- | --- | --- |
+| `draft` | `ready` | Orchestrator | Complete card, declared plan, runnable gates. |
+| `ready` | `in_progress` | Orchestrator | Dependencies approved and new attempt recorded. |
+| `in_progress` | `verifying` | Orchestrator | Developer leaves a bounded candidate. |
+| `verifying` | `in_review` | Orchestrator | Current passing environment-derived verifier evidence. |
+| `verifying` | `rework` | Orchestrator | Failed, stale, missing, invalid, timed-out, or invalidated evidence. |
+| `in_review` | `approved` | Orchestrator | Reviewer approves against current evidence. |
+| `in_review` | `rework` | Orchestrator | Reviewer gives bounded actionable findings. |
+| active state | `blocked` | Orchestrator | Material owner decision or external blocker. |
+| `blocked` | `ready` or `deferred` | Orchestrator | Owner records the required decision. |
+
+Only the Orchestrator records transitions. The verifier writes evidence only.
+Developer and Reviewer reports are agent-reported claims; a `control-plane` gate
+is authoritative only through matching verifier evidence. Every new patch needs
+a new verifier run. Stop automatic retry at the declared limit and record the
+owner decision needed. Normal delivery requires all non-deferred cards approved,
+project gates passed, one local commit per approved card, and declared branches
+pushed. Pull requests, releases, publication, force pushes, and demo start/stop
+remain owner decisions.

package/skills/triad-loop-bootstrap/assets/loop-template/feature-card.template.md

@@ -0,0 +1,32 @@
+# <feature ID> — <title>
+
+## Outcome and scope
+
+- Target repository: `<repository ID or integration/local-worktrees>`
+- Branch/worktree: `<declared branch and worktree>`
+- Outcome: `<observable user or system result>`
+- In scope: `<allowed files, behavior, and tests>`
+- Out of scope: `<prohibited changes>`
+- Dependencies: `<approved card IDs or none>`
+
+## Acceptance criteria
+
+1. `<pass/fail observable criterion>`
+2. `<pass/fail observable criterion>`
+
+## Metrics and gates
+
+| ID | Target | Evidence command or observation |
+| --- | --- | --- |
+| `<metric>` | `<exact target>` | `<command/measurement>` |
+
+- Required gates: `<gate IDs>`
+- Allowed dependencies: `<names or none>`
+- Test fixtures/examples: `<paths>`
+
+## Integration, practical test, and risk
+
+- Local-worktree setup: `<not applicable or command>`
+- Data/event/callback scenario: `<not applicable or exact scenario>`
+- Owner practical test: `<steps and expected result>`
+- Risks and rollback: `<known risk and recovery>`

package/skills/triad-loop-bootstrap/assets/loop-template/feature-plan.template.md

@@ -0,0 +1,13 @@
+# Feature plan — <project ID>
+
+PRD baseline SHA-256: `<project.prd_baseline.sha256>`
+
+| ID | Outcome | Repository | Depends on | Metrics | Required gates | Optimization | Owner practical test |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `<ID>` | `<observable result>` | `<repository ID or integration/local-worktrees>` | `<IDs or none>` | `<exact target>` | `<gate IDs>` | `<none or bar/enforcement>` | `<scenario/environment>` |
+
+Plan status: `declared | changed_by_owner`
+
+Show this complete table before delegating the first card. Continue unless the
+owner changes it or an escalation condition exists. If integration is enabled,
+include one final card whose dependencies are all component cards.

package/skills/triad-loop-bootstrap/assets/loop-template/handoff-report.template.md

@@ -0,0 +1,60 @@
+# Delivery handoff — <project ID>
+
+## Decision
+
+`delivered | delivery_blocked | delivered_without_demo`
+
+## Evidence
+
+- PRD baseline: `<source and SHA-256>`
+- Approved cards: `<IDs and count>`
+- Branches and commits: `<repository: branch @ SHA>`
+- Push evidence: `<remote and branches>`
+- Gates and metrics: `<summary>`
+- Deferred items or waivers: `<none or owner decision>`
+- Known risks: `<none or list>`
+
+## Review and verification audit
+
+| Feature | Verification runs | Final candidate fingerprint | Reviewer decision | Optional Evaluator+ report |
+| --- | --- | --- | --- | --- |
+| `<ID>` | `<count>` | `<SHA-256>` | `<approved|rework|blocked>` | `<none or report reference>` |
+
+- Evidence/review chain: `<verification/review/evaluator references>`
+
+## Local-worktree integration
+
+| Card | Consumer worktree | Provider worktree | Branch/commit map | Setup command | Data/event/callback gate |
+| --- | --- | --- | --- | --- |
+| `<not applicable or ID>` | `<path>` | `<path>` | `<repo: branch @ SHA>` | `<command/result>` | `<command/result>` |
+
+Package publication/release: `not performed by this loop`
+
+## Orchestrator exception audit
+
+- Exceptions: `<0 or count>` / `<total cards>`
+- Normal roles restored: `<yes/no; evidence>`
+
+| Exception ID | Trigger | Scope | Independent review | Return to normal delegation |
+| --- | --- | --- | --- |
+| `<none or ID>` | `<reason>` | `<bounded task>` | `<report/waiver>` | `<when/how>` |
+
+## Owner-controlled demo
+
+State: `not_applicable | ready_to_start | active | closed | start_failed`
+
+| Service | Worktree | Command | Local check | Remote URL | Remote check | Process group |
+| --- | --- | --- | --- | --- | --- |
+| `<id>` | `<path>` | `<command>` | `<not started/pass/fail>` | `<declared URL>` | `<not started/pass/fail>` | `<none or reference>` |
+
+- Start: `<only on owner request>`
+- Stop: `<only on owner completion>`
+- Closure evidence: `<timestamp, process result, port-release check>`
+
+## Practical test and follow-up
+
+| Feature | Environment | Steps | Expected result | Owner result |
+| --- | --- | --- | --- | --- |
+| `<ID>` | `<URL or none>` | `<steps>` | `<observable result>` | `to be tested` |
+
+Feedback does not reopen this handoff. Follow-up: `none | feature card <ID> | successor project <ID> | owner decision required`.

package/skills/triad-loop-bootstrap/assets/loop-template/quality-gates.yaml

@@ -0,0 +1,20 @@
+version: 2
+gates:
+  - id: test
+    description: Replace with the project test command.
+    command: REPLACE_ME_TEST_COMMAND
+    required: true
+    executor: control-plane
+    timeout_seconds: 600
+  - id: lint
+    description: Replace with the project lint command or remove with a recorded reason.
+    command: REPLACE_ME_LINT_COMMAND
+    required: true
+    executor: control-plane
+    timeout_seconds: 600
+  - id: build
+    description: Replace with the project build command or remove with a recorded reason.
+    command: REPLACE_ME_BUILD_COMMAND
+    required: true
+    executor: control-plane
+    timeout_seconds: 600

package/skills/triad-loop-bootstrap/assets/loop-template/review-report.template.md

@@ -0,0 +1,32 @@
+# Review — <feature ID> attempt <n>
+
+## Scope reviewed
+
+- Branch/worktree: `<branch and path>`
+- Commit or diff: `<SHA/range>`
+- Card and PRD baseline: `<references>`
+- Candidate fingerprint: `<verification/reviewed candidate SHA-256>`
+- External verification evidence: `<run ID, status, and reference>`
+- Quality bar/evaluation trail: `<not applicable or ID/hash/rounds/stop>`
+
+## Findings
+
+| Severity | Finding | Evidence | Required action |
+| --- | --- | --- | --- |
+| `<critical/high/medium/low>` | `<finding>` | `<file/command/observation>` | `<action>` |
+
+## Independent evidence
+
+- Acceptance criteria: `<pass/fail mapping>`
+- Metrics: `<pass/fail mapping>`
+- Gates rerun: `<command/result>`
+- Scope/dependency check: `<result>`
+- Evidence freshness and state-transition check: `<pass/fail>`
+- Residual quality gap: `<none or preserved aspirational gap>`
+- Residual risk: `<none or exact risk>`
+
+## Recommendation
+
+`approved | rework | blocked`
+
+Rationale: `<evidence-based rationale>`

package/skills/triad-loop-bootstrap/assets/loop-template/run-state.yaml

@@ -0,0 +1,22 @@
+version: 2
+updated_at: null
+project_decision: not_started
+
+feature_plan:
+  path: feature-plan.md
+  status: declared
+  presented_at: null
+
+bootstrap_verification: []
+attempts: []
+verification_runs: []
+post_run_evaluations: []
+runtime_errors: []
+runtime_capabilities: []
+escalations: []
+arbitrations: []
+coordinator_exceptions: []
+git_delivery: []
+post_delivery_feedback: []
+demo_sessions: []
+prd_rebaselines: []

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/assignments/assignment.template.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "assignment_id": "REPLACE_ME_UUID",
+  "status": "active",
+  "agent_id": "REPLACE_ME_RUNTIME_AGENT_ID",
+  "agent_type": "triad_developer",
+  "feature_id": "REPLACE_ME_FEATURE_ID",
+  "attempt": 1,
+  "project_root": "REPLACE_ME_ABSOLUTE_CONTROL_WORKSPACE",
+  "worktree": "REPLACE_ME_DECLARED_WORKTREE_OR_ABSOLUTE_PATH",
+  "expected_branch": "REPLACE_ME_PROJECT_BRANCH",
+  "allow_external_worktree": false,
+  "prd_path": "artifacts/prd.md",
+  "card_path": "features/REPLACE_ME_FEATURE_ID.md",
+  "gates_path": ".loop/quality-gates.yaml",
+  "expected_prd_sha256": "REPLACE_ME_SHA256",
+  "expected_card_sha256": "REPLACE_ME_SHA256",
+  "expected_gates_sha256": "REPLACE_ME_SHA256",
+  "verification_run_id": "REPLACE_ME_UUID",
+  "evidence_directory": ".loop/evidence/REPLACE_ME_FEATURE_ID/attempt-001"
+}

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/capabilities.template.json

@@ -0,0 +1,27 @@
+{
+  "schema_version": 1,
+  "detected_at": null,
+  "host": "codex",
+  "host_runtime": {
+    "binary": "codex",
+    "version": null,
+    "available": false
+  },
+  "verifier_runtime": {
+    "binary": "node",
+    "version": null,
+    "available": false
+  },
+  "lifecycle_async": {
+    "kind": "SubagentStop",
+    "minimum_version": "0.148.0",
+    "available": false,
+    "configured": false,
+    "reason": "not_detected"
+  },
+  "verification": {
+    "requested_mode": "auto",
+    "selected_mode": "explicit_dispatch",
+    "reason": "not_detected"
+  }
+}