chore(main): release 7.181.1

[github-actions]

rework_required gains an architect-only audited exit (issue #2755)

• New recover_rework_task tool (architect-only). A task stranded at
  rework_required by a Stage B verdict that did not require a code change
  (e.g. a SKIPPED verdict scored from a tool-argument mistake) can now be
  returned to Stage B dispatch without re-running the coder. The tool writes
  a supervised stage_a_passed for the task's current generation and appends
  a stage_a_repair audit event (action rework_recovered, with the
  sanitized reason) to .swarm/events.jsonl; the durable transition id is
  prefixed rework-recovery: so a supervised recovery stays distinguishable
  from a mechanical Stage A pass.
• Fail-closed preconditions. Requires the active session to be the
  architect, the exact plan task id, durable workflow state exactly
  rework_required, and green pre-check proof for the wedged generation
  (both secretscan and sast_scan bundles green and newer than the failure
  transition — the same [Workstream A] PR 10 of 12: Connect existing task recovery and status to authoritative transition receipts #2665 bar the Stage A wedge repair uses; bundle
  recency is global, not correlated to the task's changed files). Every
  refusal is a distinct typed error (RECOVER_REWORK_*, PLAN_*). Known
  limitation: a project with gates.sast_scan.enabled disabled never
  persists a sast_scan bundle, so recover_rework_task cannot succeed
  there by design — use the coder repair loop instead (or re-enable SAST).
• Durable distinguishability. The supervised pass also persists a
  supervisedRecovery marker in the task's workflow evidence (mirroring the
  forcedCompletion precedent: preserved across same-generation
  transitions, cleared when repair_idle opens a new generation), so a
  supervised recovery stays distinguishable from a mechanical Stage A pass
  even after later transitions overwrite the transition id; the append
  outcome of the .swarm/events.jsonl audit event is surfaced in the tool
  result (audit_event_recorded) instead of being asserted.
• Mechanical guardrail unchanged. The reducer admits stage_a_passed
  from rework_required only when the new supervisedRecovery event flag is
  set, which only this tool sets. The guardrails recorder and the
  /swarm recover wedge scan are untouched: a genuine code defect still
  requires an accepted coder mutation before Stage A passes again, and the
  automatic repair scan still skips rework_required tasks.
• Truthful dispatch remediation. The TASK_WORKFLOW_STAGE_A_REQUIRED
  refusal for reviewer/test_engineer dispatch now branches on state: from
  rework_required it names recover_rework_task (and the coder repair loop
  for real defects) instead of the human-only /swarm recover; the
  attribution-wedge guidance (coder_delegated after /swarm reset-session)
  keeps the /swarm recover advice where it actually applies.

🤖 I have created a release beep boop

7.181.1 (2026-09-14)

Bug Fixes

• workflow: address PR #2760 review findings (audit honesty, supervised marker, pins, tests) (c1d7801)
• workflow: architect-only audited exit from rework_required (#2755) (c49125a)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Drift check report

Found 2 drift finding(s): 0 error, 0 warning, 2 notice.

required-check-contract (2)

• 🔵 notice scripts/required-check-contract.json: [RULESET_DIVERGENCE] intended-required context "drift" is not yet required by the captured ruleset
• 🔵 notice scripts/required-check-contract.json: [RULESET_DIVERGENCE] intended-required context "drift" is not present for every expected event in captured external workflow evidence

[github-actions]

🤖 Created releases:

• v7.181.1

🌻