gstack/test/fixtures/multi-agent-wave/reference-run/ceo-native.md

INPUT: ceo 2937ab4ea148f3a53969c36337bdca53476892d5f7e8d8b1556bfa8763df6845

Reviewed from the native prompt file (202 lines, 41937 bytes, read in full). Receipts below are from the live checkout at origin/main 91bbd9e (v1.91.69.0), the plan's stated base.

Step 0

Mode: SELECTIVE EXPANSION. Expand where the plan under-builds the contract a parent agent depends on (artifact schema, adoption measurement, a session kind that does not collide with the eval harness); hold or defer where it builds breadth no incident in the feedback paid for.

Premise table

#	Premise (from the plan)	Receipt	Verdict
1	Capy user-scope installer --check is a bare test -x chain that prints nothing on failure	~/.capy/drive/user-garry-tan/skills/gstack/scripts/install.sh:7-16 (test -x ... || return 1 chain), :32-35 (--check calls check_install; exit 0 with no output on the failure path)	VALID
2	bin/gstack-doctor has one check_* row per component, fix lines, exits 1 on fail	bin/gstack-doctor:8-12 (contract), :441-456 (row calls and [ "$N_FAIL" -eq 0 ])	VALID
3	Doctor has no --check, --json, --require or Node row	grep of bin/gstack-doctor for those tokens: only an unrelated server-node.mjs hit at :296	VALID
4	gstack-session-kind classifies spawned | headless | interactive; only spawned is honored as an explicit GSTACK_SESSION_KIND override	bin/gstack-session-kind:33-36 (spawned override), :47-50 (GSTACK_HEADLESS → headless), :59-62 (CI/GITHUB_ACTIONS → headless)	VALID
5	headless means BLOCK on any question; only spawned auto-continues	scripts/resolvers/preamble/generate-ask-user-format.ts:15 (spawned auto-chooses), :28 (headless → BLOCKED — AskUserQuestion unavailable)	VALID
6	Upgrade/telemetry/lake/proactive prompts are suppressed for spawned only	bin/gstack-skill-start:96 (if [ "$_SESSION_KIND" != "spawned" ] around update-check), :394 (same guard around the emission block)	VALID
7	Snapshot init wraps a raw plan in ## Implementation plan	bin/gstack-autoplan-snapshot.ts:413-417	VALID
8	Review-log status/unresolved are model-written; nothing derives them from findings	bin/gstack-review-log:88-93 (passes the record straight to bindReview), lib/review-evidence.ts:178-186 (binds commit/tree only)	VALID, with a nuance the plan omits: reviewFreshness already downgrades status: clean with issues_found > 0 to UNVERIFIED at read time (lib/review-evidence.ts:238-240). The gap is write-time derivation, not detection.
9	gstack-version-bump write stamps VERSION/package.json/locks with one hard-coded post-write hook	bin/gstack-version-bump:373-402 (regenAgentsDigest, opt-in via --regen-digest, hard-coded path)	VALID
10	bin/gstack-next-version already reads the live PR queue and sibling worktrees	bin/gstack-next-version:78-106 (claimed, siblings, active_siblings, pickNextSlot)	VALID
11	gstack-evidence records tree fingerprints	bin/gstack-evidence:10-13, :388-396 (tree, dirty, wtree TOCTOU guard)	VALID
12	ship/sections/measure.md.tmpl:3-16 holds a never-loosen rerun discipline	ship/sections/measure.md.tmpl:3-7	VALID
13	codex_reviews defaults to enabled	bin/gstack-config:251	VALID
14	Paid evals (Step 6) run before Step 16's cheap generation checks	ship/sections/tests.md.tmpl:54 (Step 6 evals), ship/SKILL.md.tmpl:371-389 (Step 16 stage 1 runs declared generation/build commands)	VALID
15	/investigate has no flake, polluter, race or backlog content	grep of investigate/SKILL.md.tmpl: one table row Race condition at :165, no recipe; no flake/polluter/backlog hits	VALID (one-line mention of race, no recipe)
16	Preregistration/panels/budgets are gstack-internal	scripts/ship-measure.ts:22-28 (admission budget), scripts/judge-calibration.ts:42 (split: 'dev' | 'heldout'), test/helpers/periodic-exclude-data.ts:79-92 (EVAL_POLICY)	VALID
17	Doctor's codex fix line does not name the OPENAI_API_KEY login path	bin/gstack-doctor:186 (codex login, or export CODEX_API_KEY), TODOS.md:1639-1641 (CI-only use of codex login --with-api-key)	VALID
18	./setup --status always exits 0	setup:146 (exit 0 unconditionally after status lines)	VALID
19	--no-browser is undocumented; only GSTACK_SKIP_PLAYWRIGHT=1 exists	grep for --no-browser in setup: none; setup:2071-2072 (GSTACK_SKIP_PLAYWRIGHT), setup:1505-1512 (GSTACK_SKIP_FONTS)	VALID
20	GSTACK_CODEX_MODEL is honored by select-model	bin/gstack-codex-probe:143-147, :456, :497	VALID
21	No resolver reads capabilities.questions (basis for "no capy host")	only scripts/host-config.ts:178 validates the value; no reader under scripts/resolvers/	VALID
22	Module-size ratchet is 800 lines / 150 per function; gstack-next-version 822, snapshot 865, setup 4662 must not grow	test/module-size-ratchet.test.ts:2; wc -l: 822 / 865 / 4662	VALID
23	nativeDispatchPrompt already exists in snapshot.json	bin/gstack-autoplan-snapshot.ts:661-669	VALID
24	Running Bun 1.3.14 vs repo requirement 1.4.2	bun --version → 1.3.14; package.json:80-81 (engines.bun: ">=1.4.2"), .github/workflows/arm-setup-smoke.yml:33	VALID (note: engines is a range >=, not a pin)
25	"13 of 27 threads ran no gstack workflow beyond the installer" and the causal reading that tooling gaps (not low perceived value) explain it	No artifact in the repo or the prompt file; the plan offers no per-thread reason	UNVERIFIED (the load-bearing premise of the wave)
26	Effort: A 1.5 d, B 1.5 d, C 1 d, D 1.5 d CC+gstack	No basis given; PR B alone names 5 new binaries, 4 lib modules, 11 pre-gate checks each with a fixture	UNVERIFIED (see Section 3)
27	bin/gstack-hermetic-run can be "reused" by the hermetic check	no such file in bin/; buildHermeticEnv() exists at test/helpers/hermetic-env.ts	FALSE as worded (the bin is new; the helper is reusable)

What already exists (relevant to scope)

Capability	Where	Plan's use
Readiness rows with fix lines and exit 1 on fail	bin/gstack-doctor:441-456	A1 adds a mode, not a tool. Correct.
Session kind classification and preamble branching	bin/gstack-session-kind, generate-ask-user-format.ts:15-28	A3 reuses; see Section 6 for the collision.
Raw plan wrapping	bin/gstack-autoplan-snapshot.ts:413-417	A4 documents it. Correct.
Native dispatch prompt in snapshot	bin/gstack-autoplan-snapshot.ts:661	A6 exposes it. Correct.
Queue-aware next version	bin/gstack-next-version:78-106	B2 --next wraps it. Correct.
Tree/wtree fingerprints	bin/gstack-evidence:388-396, gstack-wtree	B3 composes them. Correct.
Read-time inconsistency guard on review rows	lib/review-evidence.ts:238-240	A7 should cite it and add only the write-time derivation.
Opt-in code execution posture for repo-declared regen	bin/gstack-version-bump:373-385	B4/B8 should inherit it; they currently do not (Section 6).
Admission budget, calibration splits, EVAL_POLICY	scripts/ship-measure.ts:22-28, scripts/judge-calibration.ts:42, periodic-exclude-data.ts:79-92	D1 generalizes all three at once.
Hermetic env builder	test/helpers/hermetic-env.ts	B8 hermetic check; the bin wrapper is new.

Dream state

A parent agent on any machine runs one install line, greps one gstack: ok line, then runs /autoplan or /ship unattended and receives versioned, schema-checked JSONL it can act on without reading prose, while the owner receives a one-page numbered gate list. The plan's PR A reaches most of that for autoplan. PR B reaches it for ship if the receipt and restamp land together. PRs C and D are breadth that the dream state does not need in this wave.

Alternatives considered against the plan

1. Ship PR A alone as the wave, then B trimmed, then measure adoption before C/D. Rejected by the plan implicitly (four stacked PRs, D1). This review recommends it (Section 1, 3).
2. A fourth session kind (unattended) instead of redefining headless. Not considered by the plan; required (Section 6).
3. One artifact-schema module with a version field instead of six independently described files. Not considered; required (Section 2).
4. Chromium always lazy, dropping --light as a user-facing mode. Not considered; optional simplification (Section 4).
5. Premise table + three rows instead of 17 reality rows in plan reviews. Not considered; recommended (Section 4).

Sections 1-11

1. Is this the right problem? Could a reframing yield 10x?

Finding 1.1 (High): the wave treats "13 of 27 threads ran nothing" as a supply failure and never measures whether PR A changes it. Premise 25 is unverified; an equally plausible reading is that in a coordinator-driven serial queue, an agent with a working harness still prefers the repo's own tooling because the gstack workflows cost context and time they cannot see the return on. If that is the cause, PR A fixes the install lie and nobody runs autoplan anyway, and PRs B-D build on an unmeasured assumption. Fix: make adoption a release promise. A10 already writes analytics/autoplan-timing.jsonl; add a session_kind and consumer field there and to the ship receipt, and define P7: "of the next 10 Capy threads that install gstack, at least 6 run one headless workflow whose artifacts the parent consumed (grep/jq in the parent transcript)". Gate PR C and D on that number, not on the queue.

The thesis itself (machine-readable first) is right and is the 10x lever: a parent agent that can jq a decision list is the product. The reframing that follows is that the artifact contract is the product, and the tools are implementations of it. The plan has it backwards: 17 new binaries, zero schema.

2. Are the premises stated or assumed? Which could be wrong?

The repo-level premises are stated and almost all hold (table above; 23 VALID, 1 FALSE as worded, 3 UNVERIFIED). The ones that could be wrong and matter:

Finding 2.1 (High): six output files, five JSONL shapes, no schema owner, no version field. tasks.jsonl is said to reuse today's per-phase schema; decisions.jsonl and findings.jsonl list fields inline; the ship receipt is a fenced block; pregate.json and timing.json are described by example. In six months a parent agent written against PR A's findings.jsonl breaks when PR C adds incident and PR D adds contributor. Fix: one lib/headless-artifacts.ts that owns every schema with schema_version, exports the TypeScript types, and backs a bin/gstack-artifact validate <file> that phase-close, gstack-ship-receipt and gstack-pregate call before writing. Align findings.jsonl rows with the review-log row shape so A7's derivation is one function over one type.

Finding 2.2 (Medium): A7's "becomes impossible" overstates. reviewFreshness already returns UNVERIFIED for clean with open issues (lib/review-evidence.ts:238-240); the real gap is that the inconsistent row is still written and the log reader trusts the model's unresolved count. Fix: scope A7 to "bindReview rejects at write time when --findings is given; interactive rows without --findings are tagged status_source: claimed", and cite the existing read-time guard so a reviewer does not believe detection is new.

Finding 2.3 (Medium): runtime-pin semantics are underdefined for the machine the promise is made on. engines.bun is >=1.4.2, a range (package.json:80-81); the plan's message prints pinned 1.4.2. More important, the Capy cloud image ships Bun 1.3.14, so on the default image --check can never end gstack: ok unless the installer upgrades Bun, and A2 does not say it does. P1 ("on a healthy machine it ends with gstack: ok") is then unmeetable on the primary target. Fix: A2 runs bun upgrade --version <pin> (or mise) when the row fails and the pin is satisfiable, and A1 distinguishes range from exact pins in the message.

3. 6-month regret scenario

Finding 3.1 (High): the effort table is not credible and the delivery shape depends on it. PR B is five new binaries (restamp, tree-receipt, regen, ship-receipt, pregate), four lib modules, a queue-replay test with three PRs, a mirror repo and a CHANGELOG re-header, plus eleven pre-gate checks each with its own fixture, in 1.5 CC-days. PR D is a new skill with thirteen sections and three lib extractions in 1.5 days. If the real multiplier is 3-4x, PRs C and D sit behind A and B for weeks, the stacked base drifts, and the plan's own queue incident (restamp after reorder) hits this wave first, before B2 exists to fix it. Fix: re-estimate per binary with a fixture count; cut PR B to B1, B2 (--version, --next only; --after and mirror in a follow-up), B3, B5 and the four pre-gate checks whose incidents the plan actually names fixtures for (regen, strays, literals, lanes+pipefail). Ship guards, patches, integrator, hermetic, links, lint, ratchets as a second pre-gate PR after one repo has run the first four for a week.

Finding 3.2 (Medium): the pre-gate becomes a second CI that drifts from the repo's real CI. lanes, guards, platform, integrator re-derive what .github/workflows/*.yml already encode. Six months out, a repo changes its CI matrix and the pre-gate still reports Tiers ran: unit serial from a stale mapping. Fix: lanes and platform read the workflow files for the lane list (A1's runtime pins already parses them); the pre-gate never carries its own lane taxonomy.

Finding 3.3 (Medium): seventeen reality rows make plan reviews longer at the moment context budget is the binding constraint. The plan notes every template edit must clear test/parity-suite.test.ts and the budget ratchets but adds 17 conditional rows plus incident notes to four templates. The regret is a plan review that spends its budget on rows whose scope detector misfires (Transaction semantics, Recall, Units need a scope signal that does not exist today). Fix: ship the four rows that this review itself demonstrates value for and that need no scope detection (premise table with receipts, already-done git check, surface check, binding decisions); defer the other 13 to a follow-up gated on scope-detection evidence from detectDxScope.

4. Alternatives dismissed without sufficient analysis

Finding 4.1 (Medium): D1 (four stacked PRs) is argued on reviewability, not on the queue cost the plan itself calls an incident. Stacked PRs in a repo whose /ship cannot yet gate ahead (B2 --after is in PR B) means PR B restamps by hand after A merges, PR C after B, PR D after C: exactly the "manual stamp edits" P3 promises to eliminate. Fix: land A; land a minimal B (B1+B2 --next+B3+B5) next; dogfood on C and D so the queue tool is proven by the wave that ships it.

Finding 4.2 (Low): --light as a user mode versus Chromium always lazy. D9 picks flag plus lazy install. If gstack-browser-ensure exists, the flag is redundant: default installs skip Chromium and the first browser skill installs it. One less mode in the installer, one less SKIP browser (light mode) state, and A2 shrinks. Fix: make lazy the default; keep --with-browser for machines that want the 86 s up front.

Finding 4.3 (Low): A9's free-text owner reply grammar (all except 3=b 7=no, d10 yes, 1a 2a). The plan correctly refuses to guess, but five accepted dialects is a parser that grows with every owner. Fix: one grammar (<id><option> tokens plus all), and the rendered gate list prints the exact reply shape it accepts; the quoted feedback replies become fixtures that must parse under that one grammar or be reported as unparsed.

Finding 4.4 (Medium): D1 /eval-plan is a product, not a section. Thirteen bullets, three lib extractions (pricing, spend-ledger, measure-bar), a QA soak section and sealed-path self-checks, for one known consumer (gbrain-evals). The alternative never weighed: ship the three steps that prevent spend incidents (preregistration checklist, $0 stub dry run, priced pilot with the ledger) and leave instrument audit, sealed paths, memory preflight and soak to the repo that needs them until a second consumer appears.

5. Competitive risk

Harness vendors (Claude Code, Codex, Capy itself) are converging on native structured subagent protocols and plan modes. The durable advantage gstack can hold is the opinionated artifact contract and the incident-derived checks, not the plumbing. The risk is that a harness ships a native "decision list" format first and gstack's five ad-hoc JSONL shapes become a translation burden. Finding 2.1's single versioned schema module is the hedge: a stable contract a harness can adopt or map to. No further finding; nothing in the plan is uniquely exposed beyond that.

6. Risks the plan does not cover

Finding 6.1 (Critical): redefining headless changes behavior for every existing GSTACK_HEADLESS and CI session. Today GSTACK_HEADLESS (set by the eval/E2E harness, bin/gstack-session-kind:47-50) and CI/GITHUB_ACTIONS (:59-62) both classify as headless, and headless means BLOCK on any question (generate-ask-user-format.ts:28). A3 makes headless take the recommended option and continue. Every paid eval and E2E case that today proves a skill BLOCKS correctly at a question would instead auto-continue, which changes measured behavior under the same case names and silently rewrites what a PASS means. The plan's own validation discipline (AGENTS.md "never rejudge a failure to manufacture a pass") is violated by construction. Fix: add a fourth kind, unattended, honored only as an explicit GSTACK_SESSION_KIND=unattended override; leave headless semantics untouched; the autoplan headless section and {{HOST_ADAPTATION}} key on unattended. The Capy installer and skill set unattended. Rename P2's wording accordingly.

Finding 6.2 (High): pin files that execute repo-declared commands drop the opt-in posture gstack-version-bump deliberately adopted. .gstack/generated.json commands (B4), .gstack/pregate.json guard patterns and ratchet commands (B8), and release_tool (B1/B2) all run code from the target repo. bin/gstack-version-bump:373-385 explains why the same class of action is behind --regen-digest: presence-sniffing in a hostile clone is arbitrary code execution. Fix: gstack-regen, gstack-pregate and gstack-restamp run declared commands only when invoked from /ship or with --allow-repo-commands; standalone invocations list the commands and exit 3 with repo commands not executed (pass --allow-repo-commands).

Finding 6.3 (Medium): B3's "same-modulo-stamps" verdict depends on stamp_paths listing everything release_tool touches. A repo's restamp script that regenerates a lockfile or a docs index outside stamp_paths produces TREE: changed gate=required, and P3's "a tree that already passed never gets a second gate" fails for exactly the repos the policy was built for. Fix: the receipt classifies the diff against stamp_paths plus .gstack/generated.json paths, and reports the residual set by name.

Finding 6.4 (Medium): B2 --after <pr> merges the predecessor's head into the branch. Under history: squash-ok the PR then shows the predecessor's commits until it merges, and a later predecessor force-push leaves a merge commit the receipt's PREDECESSOR MOVED refusal cannot undo. Fix: gate-ahead builds the predecessor merge in a throwaway worktree (gstack-wtree already exists), gates there, records the predecessor head in gate-ahead.json, and never touches the PR branch's history.

Finding 6.5 (Medium): D3 auto-detects contributor mode from "the maintainer set" that nothing defines. Fix: read CODEOWNERS when present, else gh api repos/:owner/:repo/collaborators with push permission, else off; record the source in the finding.

Finding 6.6 (Low): A2's thin wrapper "fetches the repo script" before the repo exists on the machine. Fix: the wrapper clones (or reuses) the repo under the existing lock and then executes bin/gstack-capy-install from the clone; say so, because that is the only path that does not depend on a raw-content URL.

7. Scope: NOT in scope (confirmed and additions)

The plan's four exclusions hold and are correctly reasoned (capy host target verified against premise 21). This review adds: --after/mirror in B2, seven of eleven pre-gate checks, thirteen of seventeen reality rows, ten of thirteen /eval-plan bullets, and the free-text gate grammar dialects. See Required outputs.

8. Release promises vs. delivery

P1, P2 (with unattended), P3 (with 6.3/6.4), P4 (trimmed) are deliverable and testable as stated. P5 is deliverable at four rows. P6 is three products in one promise; split it into P6a (lane-check and evidence bundle, cheap and consumed by the coordinator today) and defer P6b (/eval-plan) and P6c (owner brief beyond the gate list, which A9 and D3's first paragraph already give). Nothing flagged beyond that.

9. Validation plan

Validation item 2 (headless autoplan end to end on this plan with an API-key Codex login) is the strongest proof in the document and should be the PR A merge gate. Item 3's queue replay is good but must include the squash-history case (6.4) and a release_tool that touches a non-stamp path (6.3). Item 1's incident fixtures need the incident-to-test map committed as a file (test/fixtures/multi-agent-wave/INCIDENTS.md) rather than a PR body, or it is lost on merge. Low; no further flag.

10. Gate decisions D1-D10 (auto-decided per instruction, recommended option taken unless amended)

D1 four stacked PRs: taken as recorded, amended by 3.1/4.1 (A, then minimal B, then C/D gated on adoption). D2 session kind not host: taken, amended by 6.1 (unattended, not headless). D3 installer in repo: taken. D4 .gstack/*.json pin files: taken, amended by 6.2 (opt-in execution). D5 pre-gate blocks by default: taken for the four shipped checks. D6 never approves: taken. D7 /eval-plan: taken as the name, scope amended by 4.4. D8 forced-CRITICAL list: taken. D9 lazy Chromium: taken, amended by 4.2 (lazy by default). D10 contributor mode on by default: taken, amended by 6.5 (defined maintainer source).

11. Trajectory and compounding

If PR A lands with a versioned artifact module and an adoption metric, every later tool has a contract to write to and a number to justify itself against. If it lands as specified, the wave compounds the wrong thing: more binaries over an unversioned contract, measured by nothing. That is the only strategic fork in the document.

Required outputs

NOT in scope (this wave)

• A capy host target (plan's exclusion, verified: scripts/host-config.ts:178 is the only reader of capabilities.questions).
• Installing semgrep/gitleaks; native Windows /cso; closing issues from investigate --backlog (plan's exclusions, hold).
• B2 --after <pr> and mirror (deferred until B2 --version/--next has one week of use).
• Pre-gate checks guards, patches, integrator, hermetic, links, lint, ratchets (second pre-gate PR).
• Reality rows other than premise table, already-done, surface check, binding decisions.
• /eval-plan beyond preregistration checklist, $0 stub dry run, priced pilot with ledger; QA soak section.
• Owner-reply dialects beyond one grammar.

What already exists

See the Step 0 table. Net: every P0 item is a mode, a derivation or a composition over an existing tool, which is the right shape; the plan correctly avoids rebuilding doctor, next-version, evidence or the snapshot.

Error & Rescue registry

Error	Where	Rescue
gstack: fail <components>	A1 --check	Each FAIL row carries the exact command; installer reruns --check after fixing.
FAIL runtime pins on the default Capy image (Bun 1.3.14)	A1/A2	Installer upgrades Bun when the pin is satisfiable (2.3); otherwise the row names the image.
BLOCKED — AskUserQuestion unavailable under GSTACK_HEADLESS	A3 as written	Preserved by introducing unattended (6.1); evals keep today's semantics.
AUTOPLAN_RESULT: gate_pending	A4	Parent reads decisions.jsonl; never auto-approved (D6).
review-log: status mismatch exit 2	A7	Caller re-derives from findings.jsonl; interactive rows tagged status_source: claimed.
artifact: schema_version N unsupported	new gstack-artifact validate (2.1)	Parent upgrades gstack or pins the reader.
repo commands not executed (pass --allow-repo-commands) exit 3	B4/B8/B2 standalone (6.2)	/ship passes the flag; operators opt in explicitly.
TREE: changed gate=required (<paths>) after a pure restamp	B3	Receipt names residual paths; add them to generated.json or stamp_paths (6.3).
PREDECESSOR MOVED <old> -> <new>	B3	Re-run gate-ahead in the throwaway worktree (6.4).
Spec loop at cap without 7+	A8	Headless default: one cheap pass over the listed issues; approval gate blocked by spec not re-verified.
Outside voice auth failure in unattended	A5	gstack-codex-login from OPENAI_API_KEY; policy text names it.

Failure Modes registry

Failure mode	Likelihood	Impact	Mitigation
Eval semantics silently change under headless (6.1)	High if shipped as written	Critical: PASS redefined without a case change	Fourth kind unattended.
Artifact schema drift across PRs A-D (2.1)	High	High: parent agents break	One versioned schema module + validator.
Repo-declared command execution in untrusted clones (6.2)	Medium	High	Opt-in flag, exit 3 standalone.
PR A ships, adoption unchanged (1.1)	Unknown, unmeasured	High: wave built on a false premise	Adoption metric as P7; gate C/D on it.
Effort 3-4x the table (3.1)	High	Medium: C/D rot, manual restamps of the wave itself	Trim B; A then minimal B.
Pre-gate lane taxonomy drifts from CI (3.2)	Medium over 6 months	Medium	Derive lanes from workflow files.
Review context budget exceeded by 17 rows (3.3)	Medium	Medium: parity-suite red or review quality diluted	Four rows now.
same-modulo-stamps never true for repos with a regenerating release tool (6.3)	Medium	Medium: P3 unmet	Classify against generated registry too.
Bun pin unmeetable on default image (2.3)	Certain today	Medium: P1 unmet on primary target	Installer upgrades Bun.

Dream state delta

Dream: one install line, one grep, unattended autoplan/ship with versioned artifacts, owner sees a numbered gate list. Plan as written reaches: install line and grep (A1/A2), unattended autoplan (A3/A4, once 6.1 is fixed), owner gate list (A9/D3). Missing from the plan: the versioned contract (2.1) and the proof anyone drives it (1.1). Over-reaching relative to the dream: eleven pre-gate checks, seventeen rows, thirteen eval-plan bullets.

Completion Summary

• Premises checked: 27; VALID 23, FALSE as worded 1 (#27), UNVERIFIED 3 (#25 adoption cause, #26 effort, and the range-vs-pin nuance in #24 counted under VALID).
• Findings: 1 Critical (6.1), 5 High (1.1, 2.1, 3.1, 6.2, and 3.1's shape consequence in 4.1 counted once), 9 Medium, 4 Low.
• Unverified claims remaining in the plan after this review: 2 (adoption cause, effort table).
• Gate decisions auto-decided: 10 of 10, 6 amended.

Scores

Dimension	Score	Note
Premises valid	8	Repo facts are right; the wave's causal premise is unmeasured.
Right problem	8	Machine-readable-first is the correct thesis; the contract should be the product.
Scope calibration	4	~17 binaries, 1 skill, 4 schemas, 17 rows in 5.5 claimed days.
Alternatives explored	6	D1-D10 are real decisions; the trim-and-measure path and unattended were not weighed.
Risks covered	5	Headless/eval collision and repo-command execution are uncovered.
6-month trajectory	6	Strong if the schema and metric land in A; weak if breadth lands first.

Tasks

[
  {"id": "T1", "priority": "P1", "component": "session-kind", "title": "Add `unattended` session kind as an explicit override; leave `headless` semantics unchanged; key autoplan headless section and HOST_ADAPTATION on it", "files": ["bin/gstack-session-kind", "scripts/resolvers/preamble/generate-ask-user-format.ts", "bin/gstack-skill-start", "test/gstack-session-kind.test.ts", "test/gstack-skill-start.test.ts", "test/spawned-consent-rule.test.ts"], "effort_human": "3 days", "effort_cc": "3 hours", "source_finding": "6.1"},
  {"id": "T2", "priority": "P1", "component": "artifacts", "title": "One versioned schema module for tasks/decisions/findings/timing/pregate/ship-receipt with `gstack-artifact validate`", "files": ["lib/headless-artifacts.ts", "bin/gstack-artifact", "lib/autoplan-export.ts", "lib/review-evidence.ts", "test/headless-artifacts.test.ts"], "effort_human": "1 week", "effort_cc": "5 hours", "source_finding": "2.1"},
  {"id": "T3", "priority": "P1", "component": "measurement", "title": "Adoption metric P7: record session_kind and consumer in autoplan-timing.jsonl and the ship receipt; gate PRs C/D on it", "files": ["lib/autoplan-export.ts", "bin/gstack-ship-receipt", "docs/TESTING_INTERNALS.md"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "1.1"},
  {"id": "T4", "priority": "P1", "component": "pin-files", "title": "Repo-declared commands (generated.json, pregate.json, release_tool) run only under /ship or --allow-repo-commands; standalone exits 3", "files": ["lib/regen.ts", "lib/pregate/index.ts", "lib/restamp.ts", "bin/gstack-regen", "bin/gstack-pregate", "bin/gstack-restamp"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "6.2"},
  {"id": "T5", "priority": "P1", "component": "delivery-shape", "title": "Re-estimate per binary with fixture counts; cut PR B to B1, B2 (--version/--next), B3, B5 and pre-gate checks regen/strays/literals/lanes", "files": [".gstack/tmp/autoplan/*/ceo-implementation.md"], "effort_human": "1 day", "effort_cc": "1 hour", "source_finding": "3.1, 4.1"},
  {"id": "T6", "priority": "P2", "component": "installer", "title": "Installer upgrades Bun when the pin is satisfiable; runtime-pins row distinguishes range from exact pins", "files": ["bin/gstack-capy-install", "lib/runtime-pins.ts", "bin/gstack-doctor", "test/gstack-doctor.test.ts"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "2.3"},
  {"id": "T7", "priority": "P2", "component": "tree-receipt", "title": "Classify the receipt diff against stamp_paths plus generated.json paths; name residuals", "files": ["lib/tree-receipt.ts", "bin/gstack-tree-receipt", "test/gstack-restamp-queue.test.ts"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "6.3"},
  {"id": "T8", "priority": "P2", "component": "restamp", "title": "Gate-ahead in a throwaway worktree; never merge the predecessor into the PR branch; add squash-history replay case", "files": ["lib/restamp.ts", "test/gstack-restamp-queue.test.ts"], "effort_human": "3 days", "effort_cc": "3 hours", "source_finding": "6.4"},
  {"id": "T9", "priority": "P2", "component": "plan-reviews", "title": "Ship four reality rows (premise table, already-done, surface check, binding decisions); defer 13 behind scope-detection evidence", "files": ["scripts/resolvers/plan-reality.ts", "plan-eng-review/SKILL.md.tmpl", "plan-ceo-review/SKILL.md.tmpl", "autoplan/sections/*.tmpl", "test/parity-suite.test.ts"], "effort_human": "3 days", "effort_cc": "3 hours", "source_finding": "3.3"},
  {"id": "T10", "priority": "P2", "component": "review-log", "title": "Scope A7 to write-time derivation; tag rows without --findings as status_source: claimed; cite existing read-time guard", "files": ["lib/review-evidence.ts", "bin/gstack-review-log", "test/review-evidence.test.ts"], "effort_human": "1 day", "effort_cc": "1 hour", "source_finding": "2.2"},
  {"id": "T11", "priority": "P2", "component": "pregate", "title": "Derive lanes and platform tiers from .github/workflows/*.yml rather than a pre-gate-owned taxonomy", "files": ["lib/pregate/lanes.ts", "lib/runtime-pins.ts"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "3.2"},
  {"id": "T12", "priority": "P3", "component": "review", "title": "Define the maintainer set source for contributor mode (CODEOWNERS, then collaborators API, else off) and record it", "files": ["review/SKILL.md.tmpl", "bin/gstack-issue-guard"], "effort_human": "1 day", "effort_cc": "1 hour", "source_finding": "6.5"},
  {"id": "T13", "priority": "P3", "component": "installer", "title": "Make Chromium lazy by default via gstack-browser-ensure; replace --light with --with-browser", "files": ["bin/gstack-capy-install", "bin/gstack-browser-ensure", "scripts/resolvers/browse.ts", "setup"], "effort_human": "2 days", "effort_cc": "2 hours", "source_finding": "4.2"},
  {"id": "T14", "priority": "P3", "component": "gate-list", "title": "One reply grammar for the gate list; quoted owner replies become parse fixtures", "files": ["lib/gate-list.ts", "bin/gstack-gate", "test/gate-list.test.ts"], "effort_human": "1 day", "effort_cc": "1 hour", "source_finding": "4.3"},
  {"id": "T15", "priority": "P3", "component": "eval-plan", "title": "Cut /eval-plan to preregistration checklist, $0 stub dry run, priced pilot with ledger; defer the rest", "files": ["eval-plan/SKILL.md.tmpl", "lib/spend-ledger.ts", "lib/pricing.ts"], "effort_human": "1 day", "effort_cc": "1 hour", "source_finding": "4.4"}
]

Recommendation: Proceed with PR A amended (an unattended session kind instead of redefining headless, one versioned artifact-schema module, and an adoption metric as a release promise), then a trimmed PR B, and defer the bulk of C and D until adoption is measured, because the repo-level premises hold and the thesis is right, but as written the wave silently changes eval semantics for every GSTACK_HEADLESS session and builds seventeen binaries over an unversioned contract that nothing proves a parent agent will drive.