From c60337b8323ba05718ceff0254044774bae2c0bb Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Thu, 29 Oct 2026 04:51:12 +0000 Subject: [PATCH 1/4] Limit codex to QA review in the /flow command (item 47) The fleet rule now limits codex to QA review legs. It sets ORCH_MAX_FAILOVERS=1 on every codex leg and keeps any review that hunts for ways past a security control off codex. The /flow command still sent seeds and a combine fallback to codex, and it named the old models for each orch-verify tier. - Seeds now go to claude and gemini. If one family drops out, an independent, differently-primed second seed keeps the minimum of two. - The Fable combine runs at --super-expensive. Its fallback is claude at --expensive, never codex or gemini. - Implementation drafts go to claude workers only. - A new CODEX ROLE LIMIT paragraph states the rule. The light and substantive QA text and the verifier-diversity paragraph refer to it. The QA-round structure is unchanged, pending the separate DISCOVERY/VERIFY decision (item 46). --- .claude/commands/flow.md | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index 293d0d7..f472a90 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -70,23 +70,29 @@ private-context reference at source. Per item: (a) SEED BRIEF: 1 self-contained brief embedding all needed context (problem, exact file/line facts, constraints, deliverable shape, acceptance criteria). -(b) SEEDS: `orch-verify claude|codex|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the - same brief to all 3 in parallel. A family genuinely unreachable OR at its cost cap is - skip-and-note (combine at a minimum of 2, queue a re-combine when it returns), never a block. -(c) COMBINE with Fable: `orch-verify claude ... --expensive` (the --expensive claude tier - is claude-fable-5). The combiner ADJUDICATES (state settled design; name disagreements + recommend; +(b) SEEDS: `orch-verify claude|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the + same brief to both in parallel. A family genuinely unreachable OR at its cost cap is + skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed + from the reachable family; queue a re-combine when it returns), never a block. +(c) COMBINE with Fable: `orch-verify claude ... --super-expensive` (claude-fable-5 at + high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend; do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is - exhausted: `orch-verify codex ... --model gpt-5.6-sol --effort xhigh` (an explicit - override; note --expensive codex is gpt-6-astra, not this). NEVER gemini as combiner of record; + exhausted: `orch-verify claude ... --expensive` (claude-opus-5-5 at xhigh effort). + NEVER codex or gemini as combiner of record; NEVER orchestrator self-synthesis as the combiner. (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape. (e) IMPLEMENT (serial): the orchestrator VERIFIES the plan against the seeds + live tree, may dispatch an - implementation DRAFT to a worker, then FINALIZES it serially, re-verifying every line at source, as + implementation DRAFT to a claude worker, then FINALIZES it serially, re-verifying every line at source, as the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge. GEMINI ROLE LIMIT: gemini may SEED and QA but NEVER plan-combines or drafts the implementation. +CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the implementation, or fixes. +Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security +control NEVER goes to codex: run it on claude + gemini, adding an independent, differently-primed claude +pass in a separate clean context, recorded as the fallback, where the tier needs a third family. + PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -95,17 +101,19 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. ## Tiers (per the machine-local /opt/cleanlanguage/.claude/CLAUDE.md) - LIGHT (quick fix / bookkeeping / version bumps / record edits): implement directly; mechanical gates; - DUAL-family QA (claude + codex; gemini excluded on cost, which is allowed only because 2 families still - meet the verifier-diversity floor). + DUAL-family QA (claude + codex, or claude + gemini where the CODEX ROLE LIMIT bars codex; gemini is + otherwise excluded on cost, which is allowed only because 2 families still meet the verifier-diversity + floor). - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value / - citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex; + citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex + within the CODEX ROLE LIMIT; validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session. - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent register). No de-escalation without a maintainer decision. -VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, never -for cost; cost never buys the reduction. When a required family is genuinely unreachable, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run the dropped family once it returns. QA is dispatched read-only via `orch-verify`; judge by the +VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE or barred +by the CODEX ROLE LIMIT, never for cost; cost never buys the reduction. When a required family is genuinely unreachable or so barred, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by the result signal, not by grepping worker output. ## Gates and merge (cleanlanguage) From d7755f33949086fb305e6c08c09638ffaedfe64e Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Thu, 29 Oct 2026 05:07:13 +0000 Subject: [PATCH 2/4] Close the gaps QA found in the codex role limit (item 47, round 1) - When no claude tier can combine, the COMBINE step is now held: the item is not execution-ready, the hold is recorded, and the run moves to the next independent item. Seed drop-out is never a block to seeding only. - Only genuine unreachability drops a family. Gemini fills a codex seat barred by the role limit. A same-family pass is used only where the tier needs a third family and gemini already holds a seat. This matches the verifier-diversity rule. - The role limit now defines a security-control bypass review, and the orchestrator classifies each review when it writes the brief. - The substantive tier says gemini takes the weighted codex seat when codex is barred. - The second seed gets the same facts with a different framing, in a separate clean context. - The implementation lines are rewrapped to the width of the block. --- .claude/commands/flow.md | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index f472a90..f13e363 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -72,26 +72,34 @@ Per item: constraints, deliverable shape, acceptance criteria). (b) SEEDS: `orch-verify claude|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the same brief to both in parallel. A family genuinely unreachable OR at its cost cap is - skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed - from the reachable family; queue a re-combine when it returns), never a block. + skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed, + given the same facts but a different framing and run in a separate clean context, drawn + from the reachable family; queue a re-combine when it returns), never a block to seeding; when no + claude tier can combine, the COMBINE step is still HELD, as (c) states. (c) COMBINE with Fable: `orch-verify claude ... --super-expensive` (claude-fable-5 at high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend; do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is exhausted: `orch-verify claude ... --expensive` (claude-opus-5-5 at xhigh effort). NEVER codex or gemini as combiner of record; NEVER orchestrator self-synthesis as the combiner. + When no claude tier can combine, the COMBINE step is HELD: the item is not execution-ready, the + hold is recorded, and the run routes to the next independent item. (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape. (e) IMPLEMENT (serial): the orchestrator VERIFIES the plan against the seeds + live tree, may dispatch an - implementation DRAFT to a claude worker, then FINALIZES it serially, re-verifying every line at source, as - the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge. + implementation DRAFT to a claude worker, then FINALIZES it serially, re-verifying every line at + source, as the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the + tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge. GEMINI ROLE LIMIT: gemini may SEED and QA but NEVER plan-combines or drafts the implementation. CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the implementation, or fixes. Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security -control NEVER goes to codex: run it on claude + gemini, adding an independent, differently-primed claude -pass in a separate clean context, recorded as the fallback, where the tier needs a third family. +control (a review whose task is to find inputs, commands, or paths that a guard, hook, sandbox, filter, +or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an +independent, differently-primed claude pass in a separate clean context, recorded as the fallback, +where the tier needs a third family. The orchestrator classifies each review at brief time and records +the classification. PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -106,14 +114,14 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. floor). - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value / citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex - within the CODEX ROLE LIMIT; + within the CODEX ROLE LIMIT, or gemini, which takes the codex seat where that limit bars codex; validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session. - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent register). No de-escalation without a maintainer decision. -VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE or barred -by the CODEX ROLE LIMIT, never for cost; cost never buys the reduction. When a required family is genuinely unreachable or so barred, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by the +VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, +never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled by gemini. When a required family is genuinely unreachable, or codex is so barred where the tier needs a third family and gemini already holds a seat, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by the result signal, not by grepping worker output. ## Gates and merge (cleanlanguage) From 5e42da62ee70265840eb1b13938a2262d1a2de6b Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Thu, 29 Oct 2026 05:20:26 +0000 Subject: [PATCH 3/4] Resolve QA round 2 findings in the codex role limit (item 47) - When codex is barred, the substantive tier gives its extra weighting to gemini, and the codex seat is filled as the role limit states. Before this, the text could be read as giving gemini a second seat. - Gemini fills a barred codex seat only where it does not already hold one. Otherwise the role limit fallback applies. Either way, the substitute is recorded as a fleet-rule substitution, not as an unavailability drop. - If no seed family can run, the SEED step is held, as the COMBINE step is. - The combine fallback applies when Fable is exhausted or unreachable. Fable and that fallback are the only lawful combiners. - The re-combine wording names the returning family. The review classification is recorded in the item QA record. The verifier-diversity paragraph is rewrapped. --- .claude/commands/flow.md | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index f13e363..add2032 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -74,15 +74,20 @@ Per item: same brief to both in parallel. A family genuinely unreachable OR at its cost cap is skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed, given the same facts but a different framing and run in a separate clean context, drawn - from the reachable family; queue a re-combine when it returns), never a block to seeding; when no - claude tier can combine, the COMBINE step is still HELD, as (c) states. + from the reachable family; queue a re-combine when that family returns), never a block to seeding; + when neither combiner in (c) can combine, the COMBINE step is still HELD, as (c) states. If no seed + family can run (each is unreachable or at its cost cap), the SEED step is HELD as (c) holds the + COMBINE step: the item is not execution-ready, the hold is recorded, and the run routes to the next + independent item. (c) COMBINE with Fable: `orch-verify claude ... --super-expensive` (claude-fable-5 at high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend; do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is - exhausted: `orch-verify claude ... --expensive` (claude-opus-5-5 at xhigh effort). + exhausted or unreachable: `orch-verify claude ... --expensive` (claude-opus-5-5 at + xhigh effort). NEVER codex or gemini as combiner of record; NEVER orchestrator self-synthesis as the combiner. - When no claude tier can combine, the COMBINE step is HELD: the item is not execution-ready, the + The ONLY lawful combiners are Fable and that fallback (NEVER any other claude tier); + when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the hold is recorded, and the run routes to the next independent item. (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape. @@ -99,7 +104,7 @@ control (a review whose task is to find inputs, commands, or paths that a guard, or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an independent, differently-primed claude pass in a separate clean context, recorded as the fallback, where the tier needs a third family. The orchestrator classifies each review at brief time and records -the classification. +the classification in the item QA record. PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -114,15 +119,21 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. floor). - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value / citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex - within the CODEX ROLE LIMIT, or gemini, which takes the codex seat where that limit bars codex; + within the CODEX ROLE LIMIT; where that limit bars codex, that weighting passes to gemini, and the + codex seat is filled as the CODEX ROLE LIMIT states; validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session. - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent register). No de-escalation without a maintainer decision. VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, -never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled by gemini. When a required family is genuinely unreachable, or codex is so barred where the tier needs a third family and gemini already holds a seat, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by the -result signal, not by grepping worker output. +never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled +by gemini only where gemini does not already hold a seat (a dual-family tier); where it does, the +CODEX ROLE LIMIT fallback applies. Either way, the substitute is recorded as a fleet-rule +substitution, not as an unavailability drop. When a required family is genuinely unreachable, run an +independent, differently-primed second pass in a separate clean context as the recorded fallback, and +re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by +the result signal, not by grepping worker output. ## Gates and merge (cleanlanguage) From 92729547dcb9c4857c92c25e11b9205736fd01af Mon Sep 17 00:00:00 2001 From: Jeff Posluns Date: Thu, 29 Oct 2026 05:31:19 +0000 Subject: [PATCH 4/4] Resolve QA round 3 wording findings in /flow (item 47) - The seed re-combine waits for the skipped family, not the reachable one. - The extra claude pass in the codex role limit is recorded as a fleet-rule substitution, matching the verifier-diversity paragraph. - Neither codex nor gemini may combine, of record or otherwise. - The verifier-diversity paragraph names the role-limit claude pass directly. --- .claude/commands/flow.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index add2032..18066fd 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -73,8 +73,8 @@ Per item: (b) SEEDS: `orch-verify claude|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the same brief to both in parallel. A family genuinely unreachable OR at its cost cap is skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed, - given the same facts but a different framing and run in a separate clean context, drawn - from the reachable family; queue a re-combine when that family returns), never a block to seeding; + given the same facts but a different framing and run in a separate clean context, drawn from + the reachable family; queue a re-combine when the skipped family returns), never a block to seeding; when neither combiner in (c) can combine, the COMBINE step is still HELD, as (c) states. If no seed family can run (each is unreachable or at its cost cap), the SEED step is HELD as (c) holds the COMBINE step: the item is not execution-ready, the hold is recorded, and the run routes to the next @@ -84,7 +84,7 @@ Per item: do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is exhausted or unreachable: `orch-verify claude ... --expensive` (claude-opus-5-5 at xhigh effort). - NEVER codex or gemini as combiner of record; + NEVER codex or gemini as a combiner, of record or otherwise; NEVER orchestrator self-synthesis as the combiner. The ONLY lawful combiners are Fable and that fallback (NEVER any other claude tier); when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the @@ -102,9 +102,9 @@ CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the i Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security control (a review whose task is to find inputs, commands, or paths that a guard, hook, sandbox, filter, or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an -independent, differently-primed claude pass in a separate clean context, recorded as the fallback, -where the tier needs a third family. The orchestrator classifies each review at brief time and records -the classification in the item QA record. +independent, differently-primed claude pass in a separate clean context, recorded as a fleet-rule +substitution, where the tier needs a third family. The orchestrator classifies each review at brief +time and records the classification in the item QA record. PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -129,7 +129,7 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled by gemini only where gemini does not already hold a seat (a dual-family tier); where it does, the -CODEX ROLE LIMIT fallback applies. Either way, the substitute is recorded as a fleet-rule +CODEX ROLE LIMIT claude pass fills it. Either way, the substitute is recorded as a fleet-rule substitution, not as an unavailability drop. When a required family is genuinely unreachable, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by