diff --git a/.claude/commands/flow.md b/.claude/commands/flow.md index 18066fd..9b0503c 100644 --- a/.claude/commands/flow.md +++ b/.claude/commands/flow.md @@ -73,12 +73,14 @@ Per item: (b) SEEDS: `orch-verify claude|gemini /opt/cleanlanguage/cleanlanguage --expensive`, the same brief to both in parallel. A family genuinely unreachable OR at its cost cap is skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed, - given the same facts but a different framing and run in a separate clean context, drawn from - the reachable family; queue a re-combine when the skipped family returns), never a block to seeding; + given the same facts but a different framing and run in a separate clean context, drawn from the seed + family that can run; queue a re-combine when the skipped family returns), never a block to seeding; when neither combiner in (c) can combine, the COMBINE step is still HELD, as (c) states. If no seed - family can run (each is unreachable or at its cost cap), the SEED step is HELD as (c) holds the - COMBINE step: the item is not execution-ready, the hold is recorded, and the run routes to the next - independent item. + family can run (each is unreachable or at its cost cap), the SEED step is HELD in the same way that + (c) holds the COMBINE step: the item is not execution-ready, the hold is recorded as a ?HOLD on + this STEP, the run routes to the next independent item, and each later FEED THE PIPELINE step + (cycle step 2) retries the seeds only when a seed family can run: `orch-verify --pick` for that + family succeeds AND that family is not at its cost cap. (c) COMBINE with Fable: `orch-verify claude ... --super-expensive` (claude-fable-5 at high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend; do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is @@ -87,8 +89,11 @@ Per item: NEVER codex or gemini as a combiner, of record or otherwise; NEVER orchestrator self-synthesis as the combiner. The ONLY lawful combiners are Fable and that fallback (NEVER any other claude tier); - when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the - hold is recorded, and the run routes to the next independent item. + when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the hold is + recorded as a ?HOLD on this STEP (self-authored, so a proposal and never a grant, per + Blocked-verification), the run routes to the next independent item, and each later FEED THE + PIPELINE step (cycle step 2) retries the COMBINE only when a lawful combiner can run: + `orch-verify --pick claude` succeeds AND claude is not at its cost cap. (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape. (e) IMPLEMENT (serial): the orchestrator VERIFIES the plan against the seeds + live tree, may dispatch an @@ -99,12 +104,25 @@ Per item: GEMINI ROLE LIMIT: gemini may SEED and QA but NEVER plan-combines or drafts the implementation. CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the implementation, or fixes. -Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security -control (a review whose task is to find inputs, commands, or paths that a guard, hook, sandbox, filter, -or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an -independent, differently-primed claude pass in a separate clean context, recorded as a fleet-rule -substitution, where the tier needs a third family. The orchestrator classifies each review at brief -time and records the classification in the item QA record. +Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1` (one account, no failover). A codex leg that +ends at that bound in any form (`orch-verify` `FAILOVER_LIMIT` (exit 4), or an empty, degenerate, or +5xx chain), or that ends `EXHAUSTED` (exit 5, rate-limited or out of quota), or that is stopped by a +cost cap, is a failed leg, NOT an unreachable family, whatever `orch-verify` advises about the family. +It is recorded, then re-issued at most once, after a wait between attempts +(not cycle step 8, PAUSE), never with a higher limit; the single re-issue happens at the +first later FEED THE PIPELINE step (cycle step 2) at which `orch-verify --pick codex` succeeds +AND codex is not at its cost cap. While undelivered, its seat is OWED, a ?HOLD on +that QA STEP (a proposal, per Blocked-verification): while it is owed, the run limits work on +other items to pipeline top-up and read-only prep on upcoming verified-DISJOINT items, as +cycle step 9 allows, and starts no other apply while this branch is open; the seat is never +dropped or substituted on that basis. A review that hunts for ways past a security +control (a review whose task includes, in whole or in part, finding inputs, commands, or paths that a +guard, hook, sandbox, filter, or permission check fails to block) NEVER goes to codex: run it on +claude + gemini and, where the tier needs a third family, add an independent, differently-primed +claude pass in a separate clean context, recorded as a fleet-rule substitution (a seat change that a +fleet rule, such as this limit, requires). The orchestrator classifies each review at brief time and +records the classification in the item QA record (the QA notes on the item's entry in +`/opt/cleanlanguage/private/TODO.md`, carried into `DONE.md` at CLOSE). PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT PROMISE: collect through the tracked background mechanism that survives to completion. @@ -114,14 +132,18 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA. ## Tiers (per the machine-local /opt/cleanlanguage/.claude/CLAUDE.md) - LIGHT (quick fix / bookkeeping / version bumps / record edits): implement directly; mechanical gates; - DUAL-family QA (claude + codex, or claude + gemini where the CODEX ROLE LIMIT bars codex; gemini is - otherwise excluded on cost, which is allowed only because 2 families still meet the verifier-diversity - floor). + DUAL-family QA (claude + codex, or claude + gemini where the CODEX ROLE LIMIT bars codex or codex is + genuinely unreachable; gemini is otherwise excluded on cost, which is allowed only because 2 families + still meet the verifier-diversity floor). - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value / citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex - within the CODEX ROLE LIMIT; where that limit bars codex, that weighting passes to gemini, and the - codex seat is filled as the CODEX ROLE LIMIT states; - validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session. + within the CODEX ROLE LIMIT; where that limit bars codex or codex is genuinely unreachable, that + weighting passes to gemini (or, if gemini is also genuinely unreachable, to the fallback pass for + the gemini seat under VERIFIER DIVERSITY), and the codex seat is filled as VERIFIER DIVERSITY states; + validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise + review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds + flag and recommendation, continuing other authorized work. The round limit alone never closes the + session. - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent register). No de-escalation without a maintainer decision. @@ -130,10 +152,14 @@ VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genu never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled by gemini only where gemini does not already hold a seat (a dual-family tier); where it does, the CODEX ROLE LIMIT claude pass fills it. Either way, the substitute is recorded as a fleet-rule -substitution, not as an unavailability drop. When a required family is genuinely unreachable, run an -independent, differently-primed second pass in a separate clean context as the recorded fallback, and -re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by -the result signal, not by grepping worker output. +substitution, not as an unavailability drop. When a required family is genuinely unreachable, record +the drop and give its seat to a reachable, unbarred family that holds no seat (gemini, for codex on a +dual-family tier); only where there is none, run an independent, differently-primed second pass in a +separate clean context as the recorded fallback, and re-run an unreachable family once it returns. +Each lost seat gets its own substitute, so a tri-family tier with codex barred and gemini genuinely +unreachable runs claude plus 2 independent, differently-primed claude passes, each in its own clean +context: the fallback pass for the gemini seat and the fleet-rule substitution pass for the codex seat. +QA is dispatched read-only via `orch-verify`; judge by the result signal, not by grepping worker output. ## Gates and merge (cleanlanguage)