[ovhirup]

Fixes #36. Closes #39, #40, #41 and #42.

This changes the policy every installed session reads on every turn. The two design choices, the ladder and the scan routing, were made by the owner in this session.

Problem

The <!-- stackwich:v1 --> block was 952 words. It had two internal conflicts:

• Overlapping stop rules: the 2-cycle cap overlapped the two-strike rule, and executor.md had a third stop rule of its own.
• Two routes for scans: read-heavy scans went to a fork in Context but to executor in Graph.

It also restated behavior Claude Code already has.

Policy changes (policy-rev 7 → 8)

• One failure ladder (Merge the overlapping failure stops into one ladder #39). A first GATE: FAIL or REVISE: goes back to executor with the original plan. A second goes to advisor to re-plan from what was tried. A third stops and goes to the user, and the count never resets. This matches tools/verify_gate.py, which already allows the first run plus 2 correction cycles. executor.md's stop rule now points at the ladder.
• Scans go to a fork (Route read-heavy scans one way: fork, not executor #40). Read-heavy scans never go to executor. This is in the policy, executor.md's description, and the Codex executor template.
• Trimmed to 700 words, −26% (Trim the policy block to a word budget enforced in CI #41). Each cut, and where the behavior still lives:
  • The memory/plans/tasks bullet: these are Claude Code's own mechanisms, and it already says what each is for.
  • "Don't re-read a file you just wrote": Claude Code's own instructions say this.
  • The separate "Consult advisor before…" bullet: merged into the mandatory-sandwich bullet, which had the same trigger list.
  • Rationale clauses such as "Work handed off without one comes back unverifiable": wording only, no rule removed.
• Not cut, correcting Trim the policy block to a word budget enforced in CI #41: the orchestrator bullet. Claude Code shows the main session only each agent's description:, not its body, so this bullet is the main session's only source for what each agent must receive. I compressed it and kept every item.
• Handoff: the handoff rule now says to keep .stackwich/ out of git. It complements Keep .stackwich/ out of git when the tools create it #44, which makes the tools do this themselves.
• CI: a new step fails if the block passes a 735-word budget. It sits at the end of the skill-lint job so it doesn't conflict with Run CI's repository checks with one local command #45; once both merge, it can move into tools/validate.py.

Ports

• Codex, stackwich-codex-rev 6: the ladder, and scans never go to executor.
• Grok, stackwich-grok-rev 5: the ladder as EXECUTE → PLAN → user. Grok has no separate executor, so the scan rule doesn't apply.
• I left the ports' other bullets alone. The cuts above rely on Claude Code's own behavior, which those runtimes may not share.

Release 3.5.0

• plugin.json, the SKILL metadata, and step 4 check 2.
• CHANGELOG.md, which says to re-run the installer and to accept the agent refresh, because executor.md changed.
• The README Versions table, layer table, and "Loops are capped" paragraph, and the port READMEs.
• evals/evals.json cases 1 and 2, and docs/enforcement.md.
• docs/first-task.md keeps its recorded 3.4.0 output. Only its prose now says "the checkout's current policy-rev".

Verification

• Every step of this branch's validate.yml skill-lint job, run locally, passes, ending with policy block: 700 of 735 words OK.
• tools/: 45 tests pass, with none skipped. measured/: 12 tests pass.
• Budget check: a copy with 20 extra words in the block fails with ::error::policy block is 760 words, over its 735-word budget…, exit 1.
• Upgrade from a real rev-7 install (the block from main beneath user notes):
  • Before: check_install.py reports FAIL: policy-rev … found 7, and diagnose.py reports policy-rev 7, current is 8.
  • After replacing the block in place: INSTALL: PASS, including unrelated content preserved.
• No leftover references to "two-strike" or "2-cycle cap", apart from the CHANGELOG history and verify_gate.py's own counter row, which is still accurate.

Risk and limits

• Whether agents behave better under the new wording isn't measured. That needs the runtime evals parked in Execute installation fixtures and agent-behavior eval scenarios #12.
• Merge order: this PR and Detect and refresh stale scaffolded agents on upgrade #43 both edit evals/evals.json case 2 and SKILL.md. Whichever merges second needs a small conflict resolution: keep the rev 8 numbers from this PR and the stale-agent text from Detect and refresh stale scaffolded agents on upgrade #43.
• Publishing 3.5.0 (Actions → release) stays a manual step after merge.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T08:02:31.663835Z	60a27c7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.