diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index 293d0d7..18066fd 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -70,23 +70,42 @@ private-context reference at source. Per item: (a) SEED BRIEF: 1 self-contained brief embedding all needed context (problem, exact file/line facts, constraints, deliverable shape, acceptance criteria). -(b) SEEDS: `orch-verify claude|codex|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the - same brief to all 3 in parallel. A family genuinely unreachable OR at its cost cap is - skip-and-note (combine at a minimum of 2, queue a re-combine when it returns), never a block. -(c) COMBINE with Fable: `orch-verify claude ... --expensive` (the --expensive claude tier - is claude-fable-5). The combiner ADJUDICATES (state settled design; name disagreements + recommend; +(b) SEEDS: `orch-verify claude|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the + same brief to both in parallel. A family genuinely unreachable OR at its cost cap is + skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed, + given the same facts but a different framing and run in a separate clean context, drawn from + the reachable family; queue a re-combine when the skipped family returns), never a block to seeding; + when neither combiner in (c) can combine, the COMBINE step is still HELD, as (c) states. If no seed + family can run (each is unreachable or at its cost cap), the SEED step is HELD as (c) holds the + COMBINE step: the item is not execution-ready, the hold is recorded, and the run routes to the next + independent item. +(c) COMBINE with Fable: `orch-verify claude ... --super-expensive` (claude-fable-5 at + high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend; do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is - exhausted: `orch-verify codex ... --model gpt-5.6-sol --effort xhigh` (an explicit - override; note --expensive codex is gpt-6-astra, not this). NEVER gemini as combiner of record; + exhausted or unreachable: `orch-verify claude ... --expensive` (claude-opus-5-5 at + xhigh effort). + NEVER codex or gemini as a combiner, of record or otherwise; NEVER orchestrator self-synthesis as the combiner. + The ONLY lawful combiners are Fable and that fallback (NEVER any other claude tier); + when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the + hold is recorded, and the run routes to the next independent item. (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape. (e) IMPLEMENT (serial): the orchestrator VERIFIES the plan against the seeds + live tree, may dispatch an - implementation DRAFT to a worker, then FINALIZES it serially, re-verifying every line at source, as - the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge. + implementation DRAFT to a claude worker, then FINALIZES it serially, re-verifying every line at + source, as the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the + tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge. GEMINI ROLE LIMIT: gemini may SEED and QA but NEVER plan-combines or drafts the implementation. +CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the implementation, or fixes. +Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security +control (a review whose task is to find inputs, commands, or paths that a guard, hook, sandbox, filter, +or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an +independent, differently-primed claude pass in a separate clean context, recorded as a fleet-rule +substitution, where the tier needs a third family. The orchestrator classifies each review at brief +time and records the classification in the item QA record. + PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -95,18 +114,26 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. ## Tiers (per the machine-local /opt/cleanlanguage/.claude/CLAUDE.md) - LIGHT (quick fix / bookkeeping / version bumps / record edits): implement directly; mechanical gates; - DUAL-family QA (claude + codex; gemini excluded on cost, which is allowed only because 2 families still - meet the verifier-diversity floor). + DUAL-family QA (claude + codex, or claude + gemini where the CODEX ROLE LIMIT bars codex; gemini is + otherwise excluded on cost, which is allowed only because 2 families still meet the verifier-diversity + floor). - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value / - citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex; + citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex + within the CODEX ROLE LIMIT; where that limit bars codex, that weighting passes to gemini, and the + codex seat is filled as the CODEX ROLE LIMIT states; validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session. - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent register). No de-escalation without a maintainer decision. -VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, never -for cost; cost never buys the reduction. When a required family is genuinely unreachable, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run the dropped family once it returns. QA is dispatched read-only via `orch-verify`; judge by the -result signal, not by grepping worker output. +VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, +never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled +by gemini only where gemini does not already hold a seat (a dual-family tier); where it does, the +CODEX ROLE LIMIT claude pass fills it. Either way, the substitute is recorded as a fleet-rule +substitution, not as an unavailability drop. When a required family is genuinely unreachable, run an +independent, differently-primed second pass in a separate clean context as the recorded fallback, and +re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by +the result signal, not by grepping worker output. ## Gates and merge (cleanlanguage)