triad-plus 1.1.1 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 1.3.0 — 2026-08-26
+
+- Keep the declared card chain unattended from Developer completion through
+  verification, review, and the next dependency-satisfied card.
+- Bind repository skill files and hashes to attempts as verifier evidence, and
+  make role activations observable to the owner.
+- Require a formal owner delivery closure: final push evidence, optional
+  Evaluator+ report, handoff, run-record update, and practical-test guidance.
+- Make local versus remote demo access explicit; `localhost` is never reported
+  as a remote endpoint.
+- Use explicit verification dispatch by default on Codex; retain the async
+  `SubagentStop` hook as an experimental opt-in path.
+
+## Unreleased
+
+_No changes beyond the 1.3.0 review candidate._
+
+## 1.2.0 — 2026-08-25
+
+- Add safe dry-run/apply upgrades for existing project-control workspaces.
+- Maintain a narrowly scoped Triad+ role-run instruction overlay and report
+  potential host identity-policy conflicts in `doctor`.
+- Require the configured Orchestrator to introduce itself at the beginning of
+  every Triad+ run.
+
 ## 1.1.1 — 2026-08-25
 
 - Ensure every supported host adopts the configured Orchestrator display name

package/README.md

@@ -16,7 +16,7 @@ implementation, review, and orchestration.
 | | What changes |
 | --- | --- |
 | **Independent review** | A Reviewer examines the candidate and verifier evidence instead of asking the Developer to grade its own work. |
-| **Different models per role** | Choose a runtime, model, persona, and supported effort for each role. |
+| **Different models per role** | Choose models, personas, and supported effort per role within one selected runtime. |
 | **Evidence-backed verification** | A claim that tests passed is not proof: `triad-verify` records environment-derived gate evidence. |
 | **Works across coding agents** | Use Codex, Claude Code, OpenCode, Antigravity, or Hermes Agent through peer adapters. |
 
@@ -138,7 +138,7 @@ It sees only the goal, quality target, final candidate, and verifier evidence.
 
 | Runtime | Orchestrator | Developer | Reviewer | Evaluator+ | Verification dispatch |
 | --- | --- | --- | --- | --- | --- |
-| Codex | Yes | Yes | Yes | Yes | Explicit fallback; validated async hook when available |
+| Codex | Yes | Yes | Yes | Yes | Explicit dispatch by default; experimental async hook opt-in |
 | Claude Code | Yes | Yes | Yes | Yes | Explicit fallback; validated hook when available |
 | OpenCode | Yes | Yes | Yes | Yes | Explicit dispatch |
 | Antigravity | Yes | Yes | Yes | Yes | Explicit dispatch |
@@ -147,9 +147,12 @@ It sees only the goal, quality target, final candidate, and verifier evidence.
 ## Configuration and verification
 
 The installer writes `.triad-plus/team.json`, which separates stable role IDs
-from user-facing names, personas, models, and supported effort/options. Roles
-can use different models and, where the adapter supports it, different hosts.
-Read [configuration](docs/configuration.md) and [runtime details](docs/runtimes.md).
+from user-facing names, personas, models, and supported effort/options. A control
+workspace selects one host adapter for the whole run; its roles can use different
+models where that host supports them. To use another host, create another control
+workspace with that adapter. Triad+ does not dispatch different roles across
+different hosts in one run. Read [configuration](docs/configuration.md) and
+[runtime details](docs/runtimes.md).
 
 `triad-verify` validates assignment/candidate binding, runs declared
 control-plane gates, detects mutation, and writes evidence. It supports the

package/adapters/antigravity/.agents/agents/triad-orchestrator/agent.md

@@ -19,6 +19,14 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+If the current Triad+ invocation has not yet introduced the Orchestrator, its
+first owner-facing message is a presentation, not a generic acknowledgement or
+bootstrap report. Before any other owner-facing content, begin with a
+first-person sentence that includes `<displayName>` and "Triad+ Orchestrator",
+localized to the configured interaction language; then state whether the run is
+new or resumed and what input was received. If the entry point already made that
+presentation for this invocation, do not repeat it.
+
 Detect the runtime with `.triad-runtime/triad-runtime-capabilities.mjs --host
 antigravity`. Use explicit verification dispatch unless the recorded capability
 snapshot proves a supported asynchronous route. Govern ordinary disagreements

package/adapters/antigravity/.agents/skills/triad/SKILL.md

@@ -18,6 +18,13 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+The first owner-facing message of a Triad+ invocation is a presentation, not a
+generic acknowledgement or bootstrap report. Before any other owner-facing
+content, begin with a first-person sentence that includes `<displayName>` and
+"Triad+ Orchestrator", localized to the configured interaction language; then
+state whether the run is new or resumed and what input was received. Do not
+repeat this presentation when an already-introduced run loads its role skill.
+
 Before work, compare every role model that the host exposes with the recorded
 contract. If Antigravity does not expose a model identity, say that it cannot be
 verified and ask the owner to select or confirm it; never claim a model match

package/adapters/claude-code/.claude/commands/triad.md

@@ -26,6 +26,13 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+The first owner-facing message of a Triad+ invocation is a presentation, not a
+generic acknowledgement or bootstrap report. Before any other owner-facing
+content, begin with a first-person sentence that includes `<displayName>` and
+"Triad+ Orchestrator", localized to the configured interaction language; then
+state whether the run is new or resumed and what input was received. Do not
+repeat this presentation when an already-introduced run loads its role skill.
+
 Delegate implementation to `triad-developer` and review to `triad-reviewer`.
 After Triad approval, automatically invoke fresh `triad-evaluator` when
 `.triad-plus/team.json` has `roles.evaluator.enabled: true`; false or omitted

package/adapters/codex/README.md

@@ -33,7 +33,9 @@ Before it starts work, configure the four named role profiles described in
 does not edit profile or model configuration, because their availability and
 model routing are host-owner decisions.
 
-At bootstrap and resume, the Orchestrator runs the runtime capability detector.
-It chooses the configured Codex asynchronous hook only when that hook is really
-available; otherwise it performs explicit verification dispatch. On Codex CLI
-0.142, explicit dispatch is the safe expected route.
+At bootstrap and resume, the Orchestrator runs the runtime capability detector
+with the project's `control_plane.dispatch_mode`. Codex `auto` selects explicit
+verification dispatch even when an async hook is available. The async
+`SubagentStop` route remains an experimental opt-in (`async_hook`) and falls
+back to explicit dispatch when unavailable. On Codex CLI 0.142, explicit
+dispatch is the safe expected route.

package/adapters/codex/prompts/triad.md

@@ -8,10 +8,13 @@ $ARGUMENTS
 
 Act as the Triad Orchestrator. Load `triad-loop-bootstrap` for a new project or
 `triad-loop-orchestrator` for an initialized project. At bootstrap and resume,
-run `.triad-runtime/triad-runtime-capabilities.mjs --adapter .triad-runtime/adapter.json` and record the
-result. Follow its selected verification mode: use `async_hook` only when the
-installed Codex lifecycle hook has been configured and verified; otherwise
-explicitly invoke the verifier after Developer completion.
+read `project.control_plane.dispatch_mode` (defaulting to `auto`) and pass it as
+`--requested-mode` to `.triad-runtime/triad-runtime-capabilities.mjs --adapter
+.triad-runtime/adapter.json`; when `.codex/hooks.json` exists, pass it as
+`--hook-config .codex/hooks.json`. Record the result. Codex `auto` selects
+`explicit_dispatch`; use `async_hook` only when `dispatch_mode: async_hook` was
+explicitly configured and the installed Codex lifecycle hook has been validated.
+Otherwise explicitly invoke the verifier after Developer completion.
 
 If `.triad-plus/team.json` exists, load it before replying. Use its interaction
 language, owner address, display names, personas, and model contract in communication;
@@ -26,6 +29,14 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+The first owner-facing message of a Triad+ invocation is a presentation, not a
+generic acknowledgement or bootstrap report. Before any other owner-facing
+content, begin with a first-person sentence that includes `<displayName>` and
+"Triad+ Orchestrator", localized to the configured interaction language; then
+state in one sentence whether the run is new or resumed and what input was
+received. Do not repeat this presentation when an already-introduced run later
+loads `triad-loop-orchestrator`.
+
 Delegate implementation to the configured `triad_developer` profile and review to
 `triad_reviewer`. Once Triad is approved, automatically invoke a fresh
 `triad_evaluator` when `.triad-plus/team.json` has `roles.evaluator.enabled: true`.
@@ -33,3 +44,16 @@ When false or omitted, do not invoke it. Its report never reopens the completed
 `--evaluator` and `--no-evaluator` are per-run overrides when supplied. Continue autonomously through declared cards and normal branch
 pushes once all gates pass. Escalate only the decision types defined by the
 Triad skills. Do not start or stop a demo without an owner instruction.
+
+After each Reviewer `approved` verdict, immediately promote every
+dependency-satisfied draft card to `ready`, select the next ready card, create
+its assignment, and delegate it. Do not ask the owner to continue or pause
+between cards while a dependency-satisfied card remains. Stop only for a
+declared escalation, a blocked card, or when every required card is terminal.
+
+The ordinary chain is unattended: Developer completion → verifier → Reviewer →
+rework or approval → next card. A Developer report is never a reason to wait
+for owner input: immediately wait for configured hook evidence or invoke the
+verifier, then dispatch the Reviewer on a pass. Ask the owner only for a
+declared escalation, a blocked verdict, an unrecoverable runtime error, or an
+explicit owner pause.

package/adapters/codex/runtime.json

@@ -2,6 +2,10 @@
   "schema_version": 1,
   "id": "codex",
   "binary": "codex",
+  "verification": {
+    "default_mode": "explicit_dispatch",
+    "experimental_modes": ["async_hook"]
+  },
   "lifecycle": {
     "kind": "SubagentStop",
     "agent_type": "triad_developer",

package/adapters/hermes/skills/triad/SKILL.md

@@ -19,6 +19,13 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+The first owner-facing message of a Triad+ invocation is a presentation, not a
+generic acknowledgement or bootstrap report. Before any other owner-facing
+content, begin with a first-person sentence that includes `<displayName>` and
+"Triad+ Orchestrator", localized to the configured interaction language; then
+state whether the run is new or resumed and what input was received. Do not
+repeat this presentation when an already-introduced run loads its role skill.
+
 For a normal run, govern only Orchestrator, Developer, and Reviewer. Delegate
 ordinary implementation with `hermes chat -q --in <worktree> --no-restore-cwd`
 using `--skills triad-loop-developer`; obtain a separate Reviewer result with

package/adapters/opencode/.opencode/agents/triad-developer.md

@@ -22,6 +22,10 @@ feature card in its declared worktree. Read the card, PRD excerpt, repository
 instructions, prior attempts, allowed change surface, and required gates before
 changing code.
 
+At activation, read `.triad-plus/team.json`. Your first report to the
+Orchestrator identifies the configured `roles.developer.displayName` as the
+Triad+ Developer and names the assigned card.
+
 Verify the worktree and branch. Do not expand scope, silently change project
 policy, add dependencies without authorization, or make delivery decisions. Run
 the required gates, measure the declared metrics, and report exact commands and

package/adapters/opencode/.opencode/agents/triad-evaluator.md

@@ -1,5 +1,5 @@
 ---
-description: Freshly evaluates a verified Gauntlet candidate against its quality bar and returns one bounded largest remaining gap.
+description: Freshly evaluates an approved Triad+ result against its stated quality target.
 mode: subagent
 hidden: true
 temperature: 0.1
@@ -23,7 +23,10 @@ snapshotted quality bar, real candidate artifact, and valid verification
 summary. Do not request developer reports, prior evaluator or reviewer findings,
 attempt history, or implementation narrative.
 
-Return only `candidate_wins`, `bar_wins`, or `indeterminate`. A `bar_wins`
-result contains exactly one evidence-based largest remaining gap and one bounded
-repair scope. Do not edit source, make delivery decisions, commit, push, or
-change workflow state.
+At activation, read `.triad-plus/team.json`. Your first report identifies the
+configured `roles.evaluator.displayName` as Evaluator+ and names the completed
+result being assessed.
+
+Return `PASS`, `FAIL`, or `INDETERMINATE` with concise evidence. Do not edit
+source, make delivery decisions, commit, push, or change workflow state. A
+verdict never reopens Triad or starts repair.

package/adapters/opencode/.opencode/agents/triad-orchestrator.md

@@ -36,6 +36,14 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+If the current Triad+ invocation has not yet introduced the Orchestrator, its
+first owner-facing message is a presentation, not a generic acknowledgement or
+bootstrap report. Before any other owner-facing content, begin with a
+first-person sentence that includes `<displayName>` and "Triad+ Orchestrator",
+localized to the configured interaction language; then state whether the run is
+new or resumed and what input was received. If the entry point already made that
+presentation for this invocation, do not repeat it.
+
 Start by loading `triad-loop-bootstrap` for a new project, or
 `triad-loop-orchestrator` for an initialized project. Follow the loaded skill
 exactly. Keep the project-control workspace separate from product repositories,

package/adapters/opencode/.opencode/agents/triad-reviewer.md

@@ -22,6 +22,10 @@ Review the actual card, PRD excerpt, diff, worktree, developer evidence,
 repository instructions, prior attempts, gates, and metrics. Independently rerun
 enough required gates to verify claims.
 
+At activation, read `.triad-plus/team.json`. Your first report to the
+Orchestrator identifies the configured `roles.reviewer.displayName` as the
+Triad+ Reviewer and names the feature and attempt under review.
+
 Return one evidence-based recommendation: `approved`, `rework`, or `blocked`.
 List severity-ranked findings before gate and metric evidence, residual risks,
 and the recommendation. A blocked recommendation must identify the exact owner

package/adapters/opencode/.opencode/commands/triad.md

@@ -19,6 +19,13 @@ non-empty display name, use `Triad Orchestrator`; never present a hidden
 intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity.
 
+The first owner-facing message of a Triad+ invocation is a presentation, not a
+generic acknowledgement or bootstrap report. Before any other owner-facing
+content, begin with a first-person sentence that includes `<displayName>` and
+"Triad+ Orchestrator", localized to the configured interaction language; then
+state whether the run is new or resumed and what input was received. Do not
+repeat this presentation when an already-introduced run loads its role skill.
+
 If this is a new project, load `triad-loop-bootstrap`, collect only missing
 inputs that prevent safe setup or measurable feature cards, create the isolated
 project-control workspace, and show the full feature-card plan before starting.

package/bin/triad-plus.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { access, cp, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { access, cp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -19,22 +19,24 @@ Usage:
   npx triad-plus
   npx triad-plus init --host <adapter-id> --control <path> [--global] [--team-config <path>] [--allow-product-repo]
   npx triad-plus doctor --host <adapter-id> --control <path> [--hook-config <path>]
+  npx triad-plus upgrade --host <adapter-id> --control <path> [--global] [--apply]
 
 Adapters: ${listAdapters().map((adapter) => adapter.id).join(', ')}
 
 The control path is a project-control workspace, not a product repository.
-Installation refuses every asset overwrite. Doctor is read-only.
+Installation refuses every asset overwrite. Upgrade is a dry run unless --apply is supplied.
 `);
   process.exit(exitCode);
 }
 
 function parseArgs(args) {
   const [command, ...rest] = args;
-  const options = { command, global: false, allowProductRepo: false };
+  const options = { command, global: false, allowProductRepo: false, apply: false };
   for (let index = 0; index < rest.length; index += 1) {
     const argument = rest[index];
     if (argument === '--global') options.global = true;
     else if (argument === '--allow-product-repo') options.allowProductRepo = true;
+    else if (argument === '--apply') options.apply = true;
     else if (['--host', '--control', '--team-config', '--hook-config'].includes(argument)) {
       const value = rest[index + 1];
       if (!value || value.startsWith('--')) throw new Error(`${argument} requires a value.`);
@@ -100,10 +102,74 @@ async function installAssets(assets, root, installContext) {
   for (const asset of assets) await copyAsset(asset, root, installContext);
 }
 
+async function replaceManagedPath(source, destination, backup, apply) {
+  const present = await exists(destination);
+  process.stdout.write(`  ${apply ? 'Update' : 'Would update'} ${destination}${present ? ' (backup)' : ''}\n`);
+  if (!apply) return;
+  if (present) {
+    await mkdir(dirname(backup), { recursive: true });
+    await cp(destination, backup, { recursive: true });
+    await rm(destination, { recursive: true, force: true });
+  }
+  await mkdir(dirname(destination), { recursive: true });
+  await cp(source, destination, { recursive: true });
+}
+
+async function refreshAssets(assets, root, installContext, backupRoot, apply) {
+  for (const asset of assets) {
+    const destination = resolveDestination(asset.destination, root, installContext);
+    if (asset.source === 'shared-skills') {
+      for (const name of sharedSkillNames) await replaceManagedPath(join(packageRoot, 'skills', name), join(destination, name), join(backupRoot, name), apply);
+    } else {
+      await replaceManagedPath(sourcePath(asset.source), destination, join(backupRoot, asset.source.replaceAll('/', '__')), apply);
+    }
+  }
+}
+
 function teamConfigPath(controlRoot) {
   return join(controlRoot, '.triad-plus', 'team.json');
 }
 
+const overlayStart = '<!-- triad-plus:managed-instructions:start -->';
+const overlayEnd = '<!-- triad-plus:managed-instructions:end -->';
+function instructionOverlay(team) {
+  const displayName = typeof team?.roles?.orchestrator?.displayName === 'string' && team.roles.orchestrator.displayName.trim()
+    ? team.roles.orchestrator.displayName.trim()
+    : 'Triad Orchestrator';
+  return `${overlayStart}
+## Triad+ role-run overlay
+
+When a Triad+ entry point is invoked in this control workspace, read
+\`.triad-plus/team.json\` before the first owner-facing reply. The active
+Orchestrator is \`${displayName}\` for this run. Its first owner-facing message
+is a presentation, not a bootstrap report: begin with a first-person sentence
+that explicitly names \`${displayName}\` and says it is the Triad+ Orchestrator,
+then state whether the run is new or resumed and the received input. Do this
+before reporting bootstrap, inspecting artifacts, delegating, or asking a
+question. This is a role-run presentation rule; it does not change technical
+authority, repository policy, safety instructions, or the host's identity
+outside Triad+.
+${overlayEnd}`;
+}
+
+async function overlayPlan(controlRoot, team) {
+  const target = join(controlRoot, 'AGENTS.md');
+  const overlay = instructionOverlay(team);
+  if (!(await exists(target))) return { target, action: 'create', content: `# Project instructions\n\n${overlay}\n` };
+  const source = await readFile(target, 'utf8');
+  const start = source.indexOf(overlayStart);
+  const end = source.indexOf(overlayEnd);
+  if (start === -1 && end === -1) return { target, action: 'append', content: `${source.replace(/\s*$/, '')}\n\n${overlay}\n` };
+  if (start < 0 || end < start) throw new Error(`Cannot safely update managed instruction block: ${target}`);
+  return { target, action: 'update', content: `${source.slice(0, start)}${overlay}${source.slice(end + overlayEnd.length)}` };
+}
+
+async function applyOverlay(controlRoot, apply, team) {
+  const plan = await overlayPlan(controlRoot, team);
+  process.stdout.write(`  Instructions ${apply ? plan.action : `would ${plan.action}`} ${plan.target}\n`);
+  if (apply) await writeFile(plan.target, plan.content, 'utf8');
+}
+
 async function loadTeamConfig(options) {
   if (options.team) return options.team;
   if (!options.teamConfig) return null;
@@ -144,6 +210,7 @@ async function writeRoleProfiles(paths, team) {
       `Act as ${configuration.displayName}, the ${role.label} role in Triad+.`,
       `Persona: ${configuration.persona || 'professional and role-focused'}.`,
       'Read .triad-plus/team.json in the active project-control workspace before working.',
+      `At the beginning of each activation, identify yourself as ${configuration.displayName}, the Triad+ ${role.label}, in your first role report.`,
       'Technical role IDs define authority; display names never change it.'
     ].join('\n');
     const profile = [
@@ -236,6 +303,7 @@ async function init(options) {
   if (existing.length > 0) throw new Error(`Installation aborted; existing paths would be overwritten:\n${existing.map((target) => `  ${target}`).join('\n')}`);
   await installAssets(adapter.projectAssets, controlRoot, installContext);
   if (team) await writeTeamConfig(controlRoot, team);
+  if (team) await applyOverlay(controlRoot, true, team);
   if (team) await applyTeamBinding(adapter, controlRoot, team, installContext);
   if (options.global) await installAssets(adapter.globalAssets, controlRoot, installContext);
   process.stdout.write(`Triad+ installed for ${adapter.label} in ${controlRoot}\n`);
@@ -245,6 +313,64 @@ async function init(options) {
   process.stdout.write(`Open the control workspace and use ${adapter.entry} <PRD path>. Configured Evaluator+ runs automatically post-approval.\n`);
 }
 
+async function currentTeam(controlRoot) {
+  const target = teamConfigPath(controlRoot);
+  if (!(await exists(target))) return null;
+  try { return JSON.parse(await readFile(target, 'utf8')); }
+  catch { throw new Error(`Cannot safely upgrade an invalid team config: ${target}`); }
+}
+
+const deliveryStateDefault = `
+delivery:
+  status: not_delivered
+  handoff: null
+  branches: []
+  evaluator_report: null
+  delivered_at: null
+  owner_message: null
+`;
+
+async function upgradeRunStateDelivery(controlRoot, backupRoot, apply) {
+  const target = join(controlRoot, '.loop', 'run-state.yaml');
+  if (!(await exists(target))) {
+    process.stdout.write('  Delivery state skipped: no initialized .loop/run-state.yaml\n');
+    return;
+  }
+  const source = await readFile(target, 'utf8');
+  if (/^delivery:\s*$/m.test(source)) {
+    process.stdout.write(`  Delivery state already present ${target}\n`);
+    return;
+  }
+  process.stdout.write(`  ${apply ? 'Initialize' : 'Would initialize'} delivery state ${target} (backup)\n`);
+  if (!apply) return;
+  const backup = join(backupRoot, 'project', 'run-state.yaml');
+  await mkdir(dirname(backup), { recursive: true });
+  await cp(target, backup);
+  await writeFile(target, `${source.replace(/\s*$/, '')}\n${deliveryStateDefault}`, 'utf8');
+}
+
+async function upgrade(options) {
+  const adapter = getAdapter(options.host);
+  if (!adapter) throw new Error(`Choose --host ${listAdapters().map((item) => item.id).join(', ')}.`);
+  if (!options.control) throw new Error('Provide --control <project-control-path>.');
+  const controlRoot = resolve(options.control);
+  await requireDirectory(controlRoot);
+  const team = await currentTeam(controlRoot);
+  const installContext = context(controlRoot);
+  const stamp = new Date().toISOString().replaceAll(':', '-').replaceAll('.', '-');
+  const backupRoot = join(controlRoot, '.triad-plus', 'backups', stamp);
+  process.stdout.write(`Triad+ upgrade ${options.apply ? 'applying' : 'plan'} for ${adapter.label}\n`);
+  await refreshAssets(adapter.projectAssets, controlRoot, installContext, join(backupRoot, 'project'), options.apply);
+  await upgradeRunStateDelivery(controlRoot, backupRoot, options.apply);
+  if (team) await applyOverlay(controlRoot, options.apply, team);
+  else process.stdout.write('  Instructions skipped: .triad-plus/team.json is not configured\n');
+  if (options.global) {
+    await refreshAssets(adapter.globalAssets, controlRoot, installContext, join(backupRoot, 'global'), options.apply);
+    if (team) await applyTeamBinding(adapter, controlRoot, team, installContext);
+  }
+  if (!options.apply) process.stdout.write('Dry run only. Re-run with --apply to update managed assets.\n');
+}
+
 async function doctor(options) {
   if (!options.control) throw new Error('Provide --control <project-control-path>.');
   const controlRoot = resolve(options.control);
@@ -270,6 +396,14 @@ async function doctor(options) {
     process.stdout.write(`  Adapter      ${manifest ? 'OK' : 'missing or different adapter'}\n`);
     process.stdout.write(`  Team config  ${team === 'invalid' ? 'invalid' : team ? 'OK' : 'not configured'}\n`);
     process.stdout.write(`  Evaluator+   ${team?.roles?.evaluator?.enabled === true ? 'configured' : 'not configured'}\n`);
+    const overlay = await overlayPlan(controlRoot, team).catch(() => null);
+    process.stdout.write(`  Instructions ${overlay ? overlay.action === 'update' ? 'managed' : `needs ${overlay.action}` : 'invalid managed block'}\n`);
+    const globalAgents = join(codexHome(), 'AGENTS.md');
+    if (await exists(globalAgents)) {
+      const globalText = await readFile(globalAgents, 'utf8');
+      const fixedIdentity = /(?:identity|name)[\s\S]{0,100}(?:always|only|must)/i.test(globalText);
+      process.stdout.write(`  Identity policy ${fixedIdentity ? 'host rule detected; review for Triad role conflicts' : 'no fixed host rule detected'}\n`);
+    }
     if (options.hookConfig && adapter.lifecycle) {
       process.stdout.write(`  Hook config  declared; run runtime capability detection for detailed status\n`);
     }
@@ -302,6 +436,7 @@ try {
   const options = parseArgs(process.argv.slice(2));
   if (options.command === 'init') await init(options);
   else if (options.command === 'doctor') await doctor(options);
+  else if (options.command === 'upgrade') await upgrade(options);
   else if (!options.command) await interactiveInit();
   else if (options.command === '--help' || options.command === '-h') usage(0);
   else throw new Error(`Unknown command: ${options.command}`);

package/docs/codex-replication.md

@@ -4,7 +4,11 @@ Install with `npx triad-plus init --host codex --control <path> --global`.
 Open the control workspace and run `/prompts:triad <absolute-prd-path>`.
 
 Codex uses role profiles for the Orchestrator, Developer, Reviewer, and optional
-Evaluator+. The command detects whether a complete, version-compatible async
-`SubagentStop` verification hook is installed. If it is not, the Orchestrator
-explicitly invokes the verifier. Hook output is evidence only; it never changes
-Triad state by itself.
+Evaluator+. Verification uses explicit dispatch by default, even when a complete,
+version-compatible async `SubagentStop` hook is installed. This keeps the normal
+unattended path on the directly auditable verifier route.
+
+The async hook remains available as an experimental opt-in by setting
+`requested_mode=async_hook` in capability detection. Hook output is evidence
+only; it never changes Triad state by itself. If the requested experimental hook
+is unavailable, capability detection fails safe to explicit dispatch.

package/docs/compatibility.md

@@ -2,7 +2,7 @@
 
 | Runtime | Install | Orchestrator | Developer | Reviewer | Evaluator+ | Verification dispatch | Hook support |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| Codex | Yes | Yes | Yes | Yes | Yes | Explicit fallback; async hook when validated | Optional async `SubagentStop` |
+| Codex | Yes | Yes | Yes | Yes | Yes | Explicit dispatch by default; experimental async `SubagentStop` opt-in | Optional async `SubagentStop` |
 | Claude Code | Yes | Yes | Yes | Yes | Yes | Explicit fallback; hook when validated | Optional `SubagentStop` |
 | OpenCode | Yes | Yes | Yes | Yes | Yes | Explicit dispatch | No adapter hook |
 | Antigravity | Yes | Yes | Yes | Yes | Yes | Explicit dispatch | No adapter hook |

package/docs/configuration.md

@@ -24,8 +24,9 @@ When enabled, Evaluator+ is automatically dispatched by the Orchestrator after
 Triad reaches Reviewer approval. It receives a fresh post-run packet and cannot
 change the closed Triad result. Set `enabled` to `false` to disable this default.
 
-The runtime adapter is selected per installed control workspace (`--host`). The
-team file records role-level models and effort, but an adapter writes those into
-host-native profiles only where the host supports that facility. A blank model
-means the host default. Never put tokens, API keys, or private deployment data in
-this file.
+The runtime adapter is selected once per installed control workspace (`--host`).
+All roles in that run use that adapter; Triad+ does not orchestrate roles across
+different hosts. The team file records role-level models and effort, but an
+adapter writes those into host-native profiles only where the selected host
+supports that facility. A blank model means the host default. Never put tokens,
+API keys, or private deployment data in this file.

package/docs/npx-installation.md

@@ -18,6 +18,23 @@ npx triad-plus init --host codex --control /path/to/project-control --global
 npx triad-plus doctor --host codex --control /path/to/project-control
 ```
 
+## Upgrade an existing control workspace
+
+`upgrade` refreshes only Triad-managed runtime, skill, adapter, and optional
+host-entry assets. It never changes `team.json`, `.loop/`, PRD files, evidence,
+or product repositories. The default is a dry run:
+
+```bash
+npx triad-plus upgrade --host codex --control /path/to/project-control --global
+npx triad-plus upgrade --host codex --control /path/to/project-control --global --apply
+```
+
+Before replacing a managed asset, the applied upgrade saves its prior copy under
+`.triad-plus/backups/`. Triad+ also maintains a clearly marked role-run block in
+the control workspace `AGENTS.md`; existing instructions are preserved. Review
+`doctor` output when host-level instructions impose a fixed identity, because a
+higher-priority host policy can prevent the configured Orchestrator identity.
+
 Supported hosts: `codex`, `opencode`, `claude-code`, `antigravity`, `hermes`.
 Use `--global` to install a host-level entry point where desired. The installer
 refuses overwrites. If the control path is recognizably a product Git repository,

package/docs/operating-guide.it.md

@@ -26,10 +26,18 @@ PRD/card e definizione dei gate. “I test passano” detto dall’agente è una
 l’output del verifier è evidence derivata dall’ambiente. Evidence fallita o
 invalida non può essere trattata come pass.
 
+Per Codex la modalità `auto` usa intenzionalmente il dispatch esplicito. Il
+percorso asincrono `SubagentStop` resta disponibile solo come opt-in
+sperimentale: gli hook producono evidence, mentre l’Orchestrator mantiene
+l’autorità sull’avanzamento del loop.
+
 Il Reviewer riceve card, diff, report Developer, rilievi precedenti ed evidence.
 `rework` torna al Developer con una correzione delimitata; `blocked` richiede
 all’Orchestrator di escalare la decisione. Le push normali possono essere autonome
-dopo i goal dichiarati. Avvio e stop della demo restano del proprietario.
+dopo i goal dichiarati. La consegna formale al proprietario è un gate distinto:
+registra push finale, eventuale valutazione, handoff, stato finale della run e
+prova pratica prima di dichiarare il progetto consegnato. Avvio e stop della demo
+restano del proprietario.
 
 ## Evaluator+
 
@@ -48,3 +56,8 @@ eventuali report Evaluator+ e handoff in un workspace di controllo separato. Non
 inserire token o segreti. Gli hook sono un’ottimizzazione, non autorità: il
 dispatch esplicito della verification resta sempre disponibile. Vedi la
 [matrice di compatibilità](compatibility.md).
+
+Per ogni demo configurata, registra nel progetto e nell’handoff comando, URL
+locale, modalità di accesso remoto e URL remoto. `localhost` è solo locale: non
+va indicato a chi prova da remoto. Avvia il servizio soltanto su richiesta del
+proprietario e verifica l’URL remoto dichiarato prima di comunicarlo.

package/docs/operating-guide.md

@@ -27,10 +27,18 @@ hash. A developer saying tests pass is a claim; verifier output is
 environment-derived evidence. Failed or invalid evidence cannot be treated as a
 pass.
 
+Codex is intentionally an exception to automatic hook selection: its `auto`
+mode uses explicit dispatch. The async `SubagentStop` route remains an
+experimental opt-in; this does not change the rule that hooks produce evidence
+and the Orchestrator governs progress.
+
 The Reviewer sees the card, diff, Developer report, previous findings, and
 verifier evidence. `rework` returns a bounded finding to Developer; `blocked`
 asks the Orchestrator to escalate the stated decision. Normal pushes may happen
-autonomously once declared goals pass. Demo start and stop remain owner-controlled.
+autonomously once declared goals pass. A final owner delivery is a separate
+closure gate: it records the final push, optional evaluation, handoff, final run
+record, and practical test before the project is called delivered. Demo start and
+stop remain owner-controlled.
 
 ## Evaluator+
 
@@ -48,3 +56,8 @@ immutable PRD, cards, assignments, evidence, review reports, optional Evaluator+
 reports, and handoff in a separate project-control workspace. Never place tokens
 or secrets there. Hooks are an optimization, not authority; explicit verification
 is always the fallback. See the [compatibility matrix](compatibility.md).
+
+For a configured demo service, record its command, local URL, remote-access mode,
+and remote URL in the project and handoff. `localhost` is local-only; do not give
+it to a remote tester as a reachable endpoint. Start the service only on the
+owner's request and validate any declared remote URL before presenting it.

package/docs/runtimes.md

@@ -5,7 +5,7 @@ host-specific entry points and configuration behavior.
 
 | Runtime | Prerequisite | Entry point | Verification | Hook limitation |
 | --- | --- | --- | --- | --- |
-| Codex | Codex CLI | `/prompts:triad` | Explicit dispatch; async hook when validated | Hook is optional and requires trusted configuration. |
+| Codex | Codex CLI | `/prompts:triad` | Explicit dispatch by default; experimental async hook opt-in | Hook is optional, requires trusted configuration, and is not selected by `auto`. |
 | Claude Code | Claude Code CLI | `/triad` | Explicit dispatch; hook when validated | Hook is optional and requires trusted configuration. |
 | OpenCode | OpenCode | `/triad` | Explicit dispatch | No Triad lifecycle hook. |
 | Antigravity | Antigravity | `/triad` | Explicit dispatch | No Triad lifecycle hook. |

package/docs/verification.md

@@ -1,5 +1,18 @@
 # Verification and evidence
 
+## Repository skill bindings
+
+When a target repository declares a skill router, the Orchestrator binds the
+router, routed task skills, and completion skill to the Developer assignment as
+worktree-relative paths and SHA-256 values. `triad-verify` checks that every
+declared skill exists inside the declared worktree and still matches its bound
+hash, then records the result in environment-derived verification evidence.
+
+This proves the exact repository skill policy available to the attempt; it does
+not claim to observe an LLM's private reasoning. Developer, Reviewer, and
+Evaluator+ must separately report their use of the same bound skills, so a
+missing or inconsistent attestation is visible to the Orchestrator.
+
 An agent-reported claim is not the same as verification evidence. A Developer can
 report the commands it ran; `triad-verify` independently observes declared
 required `control-plane` gates and writes atomic evidence.
@@ -15,3 +28,15 @@ it does not itself approve, rework, or transition a run.
 
 Evidence files and logs are diagnostics. Users normally need only the
 Orchestrator's summary and the Reviewer verdict.
+
+## Codex dispatch modes
+
+Codex uses `explicit_dispatch` by default, including when a compatible async
+`SubagentStop` hook is installed. This is the directly auditable path used for
+normal unattended progress. The async hook remains supported as an experimental
+opt-in with `requested_mode=async_hook`; it is selected only when the requested
+hook is valid and available. If that requested hook is unavailable, capability
+detection fails safe to `explicit_dispatch` and records the reason.
+
+Hooks may produce evidence; the Orchestrator governs progress. The hook never
+dispatches a Reviewer, selects a card, reopens a run, or performs repair.

package/integrations/codex/README.md

@@ -1,9 +1,11 @@
 # Triad Codex hook adapter
 
-This adapter is for Codex CLI 0.148.0 or newer. It dispatches the Node
-verification runner when a subagent whose type is exactly `triad_developer`
-stops. It is deliberately an asynchronous command hook: it writes immutable
-evidence and has no authority to approve, reject, or transition a feature card.
+This adapter is for Codex CLI 0.148.0 or newer. Its normal verification route is
+explicit dispatch by the Orchestrator. It also provides an experimental,
+opt-in asynchronous command hook that can dispatch the Node verification runner
+when a subagent whose type is exactly `triad_developer` stops. The hook writes
+immutable evidence and has no authority to approve, reject, or transition a
+feature card.
 
 ## Install only after verifying the local Codex schema
 
@@ -44,18 +46,24 @@ The JSON payload needs an `agent_id` matching an active assignment under
 assignment and emits only structured evidence. The orchestrator still validates
 the evidence against the active candidate before changing state.
 
-## Let Triad choose the route
+## Default and experimental routes
 
-Do not select this route by memory. Keep
-`project.control_plane.dispatch_mode: auto` and run:
+Keep `project.control_plane.dispatch_mode: auto` for the normal Codex path and
+run:
 
 ```bash
 node /absolute/path/to/triad-plus-engineering-loop/runtime/triad-runtime-capabilities.mjs \
   --hook-config /absolute/path/to/installed-triad-hooks.json
 ```
 
-Store the JSON output at `.loop/runtime/capabilities.json`. A CLI below 0.148,
-an uninstalled hook, or a configuration with placeholders selects
-`explicit_dispatch`; a supported, configured hook selects `async_hook`. The
-orchestrator follows that snapshot and re-detects only before a new assignment or
-on resume after runtime configuration changes.
+Store the JSON output at `.loop/runtime/capabilities.json`. For Codex, `auto`
+always selects `explicit_dispatch`, including when the async hook is detected as
+available. This is the default because the live Codex collaboration path did
+not reliably emit `SubagentStop` during the validation runs.
+
+To deliberately test the experimental route, pass
+`--requested-mode async_hook`. A compatible Codex version and a valid trusted
+hook configuration select `async_hook`; an unavailable or invalid hook falls
+back to `explicit_dispatch` with a diagnostic reason. The Orchestrator follows
+the snapshot and re-detects only before a new assignment or on resume after
+runtime configuration changes.

package/integrations/codex/hooks.json

@@ -1,6 +1,5 @@
 {
-  "minimum_codex_cli_version": "0.148.0",
-  "purpose": "Triad external verification dispatch only; this hook never changes card state.",
+  "description": "Triad external verification dispatch only; requires Codex CLI 0.148.0 or newer and never changes card state.",
   "hooks": {
     "SubagentStop": [
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triad-plus",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "description": "A lightweight, evidence-backed engineering loop for coding agents.",
   "license": "Apache-2.0",
   "type": "module",

package/runtime/legacy-adapters.json

@@ -3,6 +3,7 @@
     "schema_version": 1,
     "id": "codex",
     "binary": "codex",
+    "verification": { "default_mode": "explicit_dispatch", "experimental_modes": ["async_hook"] },
     "lifecycle": { "kind": "SubagentStop", "agent_type": "triad_developer", "requires_async": true, "minimum_version": "0.148.0" }
   },
   "opencode": { "schema_version": 1, "id": "opencode", "binary": "opencode", "lifecycle": null },

package/runtime/triad-runtime-capabilities.mjs

@@ -104,12 +104,40 @@ const hookAvailable = lifecycleAvailable && hook.configured;
 const explicitAvailable = Boolean(hostVersion && nodeVersion);
 let selectedMode = "unavailable";
 let reason = "verification_runtime_unavailable";
-if (hookAvailable && (requestedMode === "auto" || requestedMode === "async_hook" || requestedMode === "hook_dispatch")) {
+const defaultMode = adapter.verification?.default_mode ?? null;
+const experimentalModes = new Set(adapter.verification?.experimental_modes ?? []);
+const experimentalHookRequested = requestedMode === "async_hook" && experimentalModes.has("async_hook");
+
+// An adapter may declare a safer automatic mode. This keeps runtime policy in
+// adapter metadata instead of adding host-specific branches to the Core.
+if (requestedMode === "auto" && defaultMode) {
+  if (defaultMode === "explicit_dispatch" && explicitAvailable) {
+    selectedMode = "explicit_dispatch";
+    reason = `${adapter.id}_default_explicit_dispatch`;
+  } else if (defaultMode === "async_hook" && hookAvailable) {
+    selectedMode = "async_hook";
+    reason = `${adapter.id}_default_async_hook`;
+  } else if (defaultMode === "hook_dispatch" && hookAvailable) {
+    selectedMode = "hook_dispatch";
+    reason = `${adapter.id}_default_hook_dispatch`;
+  } else if (explicitAvailable) {
+    selectedMode = "explicit_dispatch";
+    reason = `${adapter.id}_default_${defaultMode}_unavailable_using_explicit_dispatch`;
+  }
+} else if (experimentalHookRequested && hookAvailable) {
+  selectedMode = "async_hook";
+  reason = "experimental_async_hook_requested";
+} else if (experimentalHookRequested && explicitAvailable) {
+  selectedMode = "explicit_dispatch";
+  reason = "requested_async_hook_unavailable_using_explicit_dispatch";
+} else if (hookAvailable && (requestedMode === "auto" || requestedMode === "async_hook" || requestedMode === "hook_dispatch") && (!lifecycle?.requires_async || requestedMode === "async_hook")) {
   selectedMode = lifecycle.requires_async ? "async_hook" : "hook_dispatch";
   reason = lifecycle.requires_async ? "validated_async_hook_available" : "validated_hook_dispatch_available";
 } else if (explicitAvailable) {
   selectedMode = "explicit_dispatch";
-  reason = ["async_hook", "hook_dispatch"].includes(requestedMode)
+  reason = requestedMode === "explicit_dispatch"
+    ? "explicit_dispatch_requested"
+    : ["async_hook", "hook_dispatch"].includes(requestedMode)
     ? "requested_hook_unavailable_using_explicit_dispatch"
     : "explicit_dispatch_available";
 }

package/runtime/triad-verify.mjs

@@ -27,6 +27,26 @@ async function sha256File(value) {
   return sha256(await readFile(value));
 }
 
+async function validateRepositorySkills(required, worktree) {
+  if (required === undefined) return { declared: false, skills: [] };
+  if (!Array.isArray(required) || required.length === 0) throw new Error("repository skill binding must declare at least one skill");
+  const root = await realpath(worktree);
+  const skills = [];
+  for (const item of required) {
+    if (!item || typeof item.path !== "string" || typeof item.sha256 !== "string") {
+      throw new Error("repository skill binding entries require path and sha256");
+    }
+    const candidate = path.resolve(root, item.path);
+    if (!candidate.startsWith(`${root}${path.sep}`)) throw new Error("repository skill path escapes worktree");
+    try { await access(candidate); }
+    catch { throw new Error(`repository skill missing: ${item.path}`); }
+    const actual = await sha256File(candidate);
+    if (actual !== item.sha256) throw new Error(`repository skill hash mismatch: ${item.path}`);
+    skills.push({ path: item.path, sha256: actual });
+  }
+  return { declared: true, skills };
+}
+
 function triggerFrom(payload) {
   return {
     event: payload.event ?? payload.hook_event_name ?? "manual",
@@ -100,6 +120,7 @@ async function main() {
     await access(cardPath);
     if ((await sha256File(prdPath)) !== assignment.expected_prd_sha256) throw new Error("PRD baseline hash mismatch");
     if ((await sha256File(cardPath)) !== assignment.expected_card_sha256) throw new Error("feature card hash mismatch");
+    const repositorySkills = await validateRepositorySkills(assignment.required_repository_skills, worktree);
     const before = await calculateCandidateFingerprint(worktree);
     const branch = await worktreeBranch(worktree);
     if (assignment.expected_branch && assignment.expected_branch !== branch) throw new Error("worktree branch does not match assignment");
@@ -128,6 +149,7 @@ async function main() {
         candidate_fingerprint: before.value,
         branch,
       },
+      repository_skills: repositorySkills,
       gates,
       required_gates_passed: requiredGatesPassed,
       status: candidateChanged ? "invalidated" : requiredGatesPassed ? "pass" : "fail",

package/skills/triad-loop-bootstrap/SKILL.md

@@ -26,7 +26,9 @@ conditions, runnable quality gates, practical-test need, and integration need.
 6. Create `.loop/runtime/assignments/` and record the active adapter metadata in
    `.loop/runtime/capabilities.json` by running
    `.triad-runtime/triad-runtime-capabilities.mjs --adapter
-   .triad-runtime/adapter.json`.
+   .triad-runtime/adapter.json --requested-mode <project.control_plane.dispatch_mode>`.
+   Use `auto` when the project does not declare a mode. For Codex, `auto` is
+   explicit dispatch; `async_hook` is an experimental opt-in only.
 7. Show the full card division before delivery work. Continue unless the owner
    changes it or an escalation condition exists.
 

package/skills/triad-loop-bootstrap/assets/loop-template/feature-card.template.md

@@ -24,6 +24,12 @@
 - Allowed dependencies: `<names or none>`
 - Test fixtures/examples: `<paths>`
 
+## Repository skill binding
+
+- Repository policy/router: `<path to the repository router SKILL.md or not applicable>`
+- Required skills: `<router, routed skills, and completion skill>`
+- Assignment evidence: `<relative SKILL.md paths and SHA-256 values>`
+
 ## Integration, practical test, and risk
 
 - Local-worktree setup: `<not applicable or command>`

package/skills/triad-loop-bootstrap/assets/loop-template/handoff-report.template.md

@@ -50,6 +50,14 @@ State: `not_applicable | ready_to_start | active | closed | start_failed`
 - Start: `<only on owner request>`
 - Stop: `<only on owner completion>`
 - Closure evidence: `<timestamp, process result, port-release check>`
+- Remote access contract: `<none | declared remote URL and access mode>`.
+  `localhost` is local-only and must not be presented as a remote endpoint.
+
+## Delivery closure record
+
+- Run record updated: `<path and final decision>`
+- Final branch/commit map recorded: `<yes/no; reference>`
+- Final delivery message issued: `<yes/no; timestamp or reference>`
 
 ## Practical test and follow-up
 

package/skills/triad-loop-bootstrap/assets/loop-template/run-state.yaml

@@ -2,6 +2,14 @@ version: 2
 updated_at: null
 project_decision: not_started
 
+delivery:
+  status: not_delivered # not_delivered | delivered | delivery_blocked | delivered_without_demo
+  handoff: null
+  branches: []
+  evaluator_report: null
+  delivered_at: null
+  owner_message: null
+
 feature_plan:
   path: feature-plan.md
   status: declared

package/skills/triad-loop-bootstrap/assets/loop-template/runtime/assignments/assignment.template.json

@@ -16,6 +16,16 @@
   "expected_prd_sha256": "REPLACE_ME_SHA256",
   "expected_card_sha256": "REPLACE_ME_SHA256",
   "expected_gates_sha256": "REPLACE_ME_SHA256",
+  "required_repository_skills": [
+    {
+      "path": ".agents/skills/router/SKILL.md",
+      "sha256": "REPLACE_ME_SHA256"
+    },
+    {
+      "path": ".agents/skills/agent-completion/SKILL.md",
+      "sha256": "REPLACE_ME_SHA256"
+    }
+  ],
   "verification_run_id": "REPLACE_ME_UUID",
   "evidence_directory": ".loop/evidence/REPLACE_ME_FEATURE_ID/attempt-001"
 }

package/skills/triad-loop-bootstrap/assets/project.yaml

@@ -37,7 +37,17 @@ project:
       enabled: false
       start_policy: only_on_owner_request
       stop_policy: only_on_owner_completion
+      # Declare a service only when the owner needs a practical demo. A remote
+      # URL is optional and must never be inferred from a localhost URL.
       services: []
+      # Example service shape:
+      # - id: component-demo
+      #   worktree: worktrees/product-repository
+      #   start_command: npm run dev -- --host 0.0.0.0
+      #   stop_command: <owner-completion procedure>
+      #   local_url: http://127.0.0.1:6006
+      #   remote_access: tailscale # none | tailscale | proxy | public
+      #   remote_url: http://host.example:6006
 
 integration:
   enabled: false

package/skills/triad-loop-developer/SKILL.md

@@ -10,6 +10,18 @@ project manifest, repository instructions, allowed surface, prior findings, and
 gates. Verify the declared worktree and branch before editing. Do not change
 scope, policy, assignments, queue, state, or evidence records.
 
+At the beginning of every activation, read `.triad-plus/team.json` when it
+exists. Your first report to the Orchestrator must identify you as its configured
+`roles.developer.displayName` and the Triad+ Developer, then name the assigned
+card. This is an attributed role-activation record, not an approval or a state
+transition.
+
+When the assignment declares `required_repository_skills`, read every bound
+file from the declared worktree before editing. Include their relative paths and
+SHA-256 values in the report as a **repository-skill attestation**. If a bound
+skill is missing or its hash differs, stop and report the mismatch; do not
+replace it with external context or a similarly named skill.
+
 Implement the smallest complete change and focused tests. Run useful local
 checks and measure declared criteria. Report changed files, tests, exact command
 results, metrics, worktree/branch, risks, and blockers to the Orchestrator.

package/skills/triad-loop-evaluator/SKILL.md

@@ -11,6 +11,18 @@ artifact/observation instructions, and current verifier evidence. Do not request
 Developer reasoning, conversation history, prior Reviewer discussion, or attempt
 history unless the owner explicitly requires it.
 
+At the beginning of every activation, read `.triad-plus/team.json` when it
+exists. Your first report must identify you as its configured
+`roles.evaluator.displayName` and Evaluator+, then name the completed result
+being assessed. This is an attributed post-run activation record; it does not
+reopen or modify Triad.
+
+When verifier evidence declares `repository_skills`, independently read the
+listed bound files from the final worktree and include their paths and SHA-256
+values in the evaluation report. A missing or mismatched binding makes the
+evaluation `INDETERMINATE`; it never starts repair or changes the closed Triad
+result.
+
 Return a report conforming to `schemas/evaluator-plus-result.schema.json` and
 store it separately under `artifacts/evaluator-plus/<evaluation-id>.json`:
 

package/skills/triad-loop-orchestrator/SKILL.md

@@ -18,12 +18,28 @@ intermediary or another Triad role to the owner. You may report delegated roles'
 outputs, but never claim their identity. Technical role IDs and authority remain
 unchanged.
 
+If the current Triad+ invocation has not yet introduced the Orchestrator, its
+first owner-facing message is a presentation, not a generic acknowledgement or
+bootstrap report. Before any other owner-facing content, begin with a
+first-person sentence that includes `<displayName>` and "Triad+ Orchestrator",
+localized to the configured interaction language; then state whether the run is
+new or resumed and what input was received. If the entry point already made that
+presentation for this invocation, do not repeat it.
+
 ## Run one card
 
 1. Verify the PRD hash, declared worktree/branch, repository instructions,
-   runnable gates, and capability snapshot.
+   runnable gates, and capability snapshot. The snapshot must reflect
+   `project.control_plane.dispatch_mode` as `requested_mode` (default `auto`).
+   When repository instructions define
+   a skill router, read it, select the router, routed skills, and completion
+   skill required by the card, and bind their worktree-relative paths plus
+   SHA-256 values in `required_repository_skills` on the Developer assignment.
+   Do not assign the card if this binding cannot be made.
 2. Choose one dependency-approved `ready` card, mark it `in_progress`, append an
-   attempt, and create an active assignment before delegating.
+   attempt, and create an active assignment before delegating. Before each
+   delegation, publish an owner-facing activation notice that attributes the
+   configured display name, technical role, and card/attempt to that role.
 3. Give the Developer the card, relevant PRD excerpt, allowed surface, gates,
    risks, and prior findings. Treat its command results and report as
    **agent-reported claims**, never as control-plane gate truth.
@@ -32,17 +48,37 @@ unchanged.
    the verifier explicitly. Accept only current evidence whose assignment ID,
    feature, attempt, PRD/card/gate hashes, expected branch, and candidate
    fingerprint match the active candidate.
+   A Developer report is never a human-input wait condition: immediately wait
+   for the configured hook evidence or invoke the verifier, then immediately
+   dispatch the Reviewer on a verifier pass. Do not ask the owner to continue
+   between Developer completion, verification, and review.
 5. A passing verifier result is **environment-derived evidence**. Move only then
    to `in_review`. Missing, stale, failed, timed-out, invalid-context, or
    invalidated evidence never advances the card.
 6. Give the Reviewer the card, diff, developer report, verifier evidence, prior
    attempts, and risks. Record its recommendation:
-   - `approved`: verify scope/evidence, commit the card locally, then select the
-     next ready card;
+   - `approved`: verify scope/evidence, commit the card locally, promote every
+     dependency-satisfied draft card to `ready`, then immediately select and
+     assign the next ready card;
    - `rework`: preserve findings and return the card to `in_progress` for a new
      attempt and new verification;
    - `blocked`: record the exact external condition or owner decision required.
 7. Stop automatic retry at the declared limit and escalate the decision needed.
+   Do not ask the owner to continue, pause between cards, or finish the run
+   while a dependency-satisfied card remains `ready`; stop only for a declared
+   escalation, a blocked card, or when every required card is terminal.
+
+## Unattended continuation rule
+
+The normal chain is unattended: Developer completion → verification → Reviewer
+→ rework or approval → next dependency-satisfied card. Do not stop for an
+acknowledgement, progress update, or agent-reported claim. The only valid human
+wait conditions are an escalation named by the policy, a `blocked` verdict, an
+unrecoverable runtime error, or an explicit owner pause.
+
+An owner-facing activation or progress update is informational output, never an
+implicit pause. After sending it, continue the recorded next action without
+waiting for a reply unless one of the valid human wait conditions applies.
 
 ## Authority and delivery
 
@@ -55,8 +91,30 @@ review, and restoration of normal roles.
 After all required cards and project gates pass, commit each approved card if
 needed and normally push declared branches. Never force-push, create/update a
 pull request, publish, release, or start/stop a demo without owner direction.
-Write a final handoff with cards, commits, pushes, verifier evidence, reviewer
-decisions, risks, exceptions, and practical-test instructions.
+
+## Delivery closure gate
+
+`approved` is not an owner delivery. Do not declare a project delivered, closed,
+or ready for owner testing until this gate has completed:
+
+1. Record the final commit and normal-push evidence for every declared branch.
+2. If configured, complete the isolated Evaluator+ dispatch and record its
+   report. Its verdict still cannot reopen Triad.
+3. Write the final handoff from the handoff template with cards, commits,
+   pushes, verifier evidence, reviewer decisions, risks, exceptions, and
+   practical-test instructions.
+4. Update the control-workspace run record with the delivery decision, handoff
+   reference, final branch/commit map, and optional Evaluator+ reference.
+5. Give the owner one final delivery message that links the handoff, names the
+   practical test, and states the demo status.
+
+For every configured demo service, copy its declared command, local URL, remote
+URL, and remote-access mode into the handoff. Never present `localhost` as a
+remote endpoint. If the service is loopback-only or has no configured remote
+URL, explicitly say that remote testing is unavailable. On an owner request to
+start a demo, validate the declared local URL and, when a remote URL is
+configured, validate that endpoint before reporting it. Keep the service running
+until the owner explicitly ends the demo.
 
 Evaluator+ is outside the Triad production run. After final Triad approval,
 read `roles.evaluator.enabled` from `.triad-plus/team.json`: when it is `true`,
@@ -66,3 +124,5 @@ false or omitted, finish without evaluation. Record the report separately;
 `PASS`, `FAIL`, and `INDETERMINATE` cannot reopen, rework, assign Developer work,
 or change the already closed Triad run. A per-run `--evaluator` or
 `--no-evaluator` request may override the configuration when the host exposes it.
+Before dispatching it, publish the corresponding attributed Evaluator+
+activation notice.

package/skills/triad-loop-reviewer/SKILL.md

@@ -11,6 +11,19 @@ instructions, actual diff/worktree, and verifier evidence. You may know prior
 attempts and correction history; independence means assess the artifact and
 evidence yourself, not blindness.
 
+At the beginning of every activation, read `.triad-plus/team.json` when it
+exists. Your first report to the Orchestrator must identify you as its configured
+`roles.reviewer.displayName` and the Triad+ Reviewer, then name the feature and
+attempt under review. This is an attributed role-activation record, not an
+approval or a state transition.
+
+When the assignment declares `required_repository_skills`, independently read
+the same bound files from the declared worktree and compare their paths and
+SHA-256 values with the Developer attestation and verifier evidence. A missing,
+mismatched, or unreported required repository skill is a `blocked` result until
+the Orchestrator creates a valid assignment; external context never substitutes
+for the repository skill policy.
+
 Confirm scope, dependencies, candidate fingerprint, assignment ID, feature,
 attempt, expected branch, and PRD/card/gate hashes. Reject stale, missing,
 invalidated, or failed verifier evidence. Independently rerun enough required