The Herdr team round contract. rules/agent-team-operation.md Two Modes decides when it applies: a Herdr team round (HERDR_ENV set) follows every section below, and a standalone session follows none of it. The foreman reads this file through skills/herdr-foreman/SKILL.md, and every worker brief names it as a required read.

Bounded Factual Lookup

Narrow exception for a foreman answering a read-only fact request without a consultation round. Preconditions, all required:

The requested output is a factual chat answer, not a durable document, recommendation, assessment, design, security judgment, edit, acceptance or release decision.
The answer is already in the foreman's context, or one named source/file or one bounded read-only query can establish it. State the source and the observed revision or observation time when relevant.
The lookup changes no repository, owner record, native session or external resource. It sends no worker input and performs no cleanup or recovery.
Missing evidence stays unknown. Conflicting evidence, causal analysis, specialist judgment or a broader search returns to normal consultation.
The answer grants no task authority, capacity assumption, contributor clearance, acceptance, gate waiver or release permission.

Every other lookup follows the normal team-round contract. A durable output or substantive judgment requested alongside a fact uses its required responsibility and gates; splitting off the fact never bypasses them.

The flow is bounded source read → cited chat fact; a failed boundary goes to normal consultation or implementation delivery. This route needs no roster measurement, unrelated provider availability, brief, enrollment, worker report, round log or context reset. Existing enrolled work still follows Fleet Supervision; answering a fact neither resolves it nor permits stopping its watch. Context already holding a factual answer needs no extra source read.

Trade-off: the foreman may retrieve facts but may not interpret their adequacy or safety. Revisit the boundary if repeated requests need synthesis; that work is consultation, not an expanded lookup exception. Report action counts or token/cost reductions only from measured executions. Unmeasured token use and monetary savings remain unknown.

Delegation

Follow rules/agent-team-operation.md Delegation for every delegated task.
The foreman uses the existing planning, assignment, dispatch, supervision and report owners.
Preserve responsibility, model/effort selection, account/capacity checks, contribution exclusion, checkout ownership and lifecycle evidence.
A worker needing delegated help records the staffing need and its evidence in its report for the foreman.
A worker gains no dispatch authority from that need and starts no child agent, managed or native.
Reviewer, tester, specialist and judge delegation prohibitions remain intact.
If Herdr or an eligible worker is unavailable, the foreman owns the staffing gap and uses the existing readiness, dispatch-recovery and escalation routes.
Preserve recoverable work and continue independent authorized work that the unavailable seat does not gate.
Escalate only a decision, authority, information or usable account the operator must supply.
An unavailable delegation route never authorizes native fallback or an unowned halt.

Foreman Seat

The operator's config.json foreman block declares the seat like a worker: its agent, kind, launch options and an optional tier table
The operator's tier table supplies the foreman's rows, as it does for every worker
No rule, plugin default or hardcoded value pins the foreman's model or effort
The foreman's tier is the operator's coordination row, resolved through select_tier
The capability table refuses that row when it records it inadequate
No escalation applies to the coordination round
Measured headroom never changes the foreman's row
The foreman's headroom is the measured headroom of the window_group its block declares, recorded with the selection
A foreman declaring no window_group reads as unmeasured
The foreman's agent is never a configured worker or the pinned judge's
foreman start-foreman launches the selected tier and proves it from the launch argv
The round preflight proves the running foreman's argv carries the selected tier, after it measures headroom
A running tier other than the selected one blocks the round
An absent foreman block is a visible preflight warning naming the config file and the block to add, never a round block
The seat's config, selection and launch contracts are in skills/herdr-foreman/references/model-tiers.md Foreman Seat

Team Composition

Bounded factual lookup follows Bounded Factual Lookup and creates no specialist assignment
The foreman selects the responsibilities needed at each stage of the task
Preserve developer, reviewer, tester and release responsibilities for implementation delivery
Activate a specialist consultation for a bounded question or deliverable the task needs, and whenever a trigger below fires
A new or substantially changed package above the size the repo states triggers the architect, before implementation
A new or changed trust boundary — anything deciding whether foreign input, generated content or a proposed change is safe — triggers security
A new user-facing command, flag or refusal path triggers UX and product
A new user-facing document triggers documentation
Fix rounds reaching the task's allowance without converging trigger the investigator
Each trigger names its deliverable in skills/herdr-foreman/references/specialists.md
The repo states each trigger surface and its package size in its own trigger declaration
foreman detect-triggers classifies the round against that declaration before the roles are planned
A round with work already written classifies its diff
A round before implementation declares the surfaces the work will touch, and classifies those
A round that writes no repository content declares that explicitly
Such a round seats read-only responsibilities alone
Such a round fires no trigger
A tracked diff refuses that declaration
A round that classifies neither is refused, never read as no trigger fired
The four non-exhaustion triggers fire from that detection, never from the foreman's reading of the diff
An absent declaration is allowed for an explicit, validated no-write round
Narrow exception for the first trigger declaration in a writing round.
Preconditions (all required):
1. The recorded base has no .herdr/triggers.json
2. An existing accepted consultation reviewed the external declaration artifact; the owner assessment binds its unchanged report to the artifact digest
3. The planned surfaces add .herdr/triggers.json and bind the artifact's SHA-256
4. detect-triggers --bootstrap-declaration validates and classifies the artifact before dispatch
5. The planned installation is byte-identical to the bound artifact
A changed artifact returns to trigger classification before dispatch
A pushed head uses its in-repo declaration and must prove the accepted byte-identical bootstrap when the recorded task base lacks one; an existing declaration at the task base is sole authority
Every other incomplete or absent writing declaration is refused
A fired trigger is consulted, or recorded as a staffing decision with its reason the detector reads
Silence is never that decision
The exhaustion trigger has no such alternative: a diagnosis without its accepted consultation is refused
A diagnosis is not dispatched at an exhausted allowance before that assessment exists
An adjudication at that same allowance is unaffected; it rules on a contested verdict and needs no assessment
Separate responsibility, specialty and execution worker in each specialist assignment
Ground capability declarations in available skills, tools and observed work
Apply capability and contribution eligibility before task familiarity and measured subscription headroom through the owner planner
Headroom is the minimum remaining window per worker, never the average
Measure the declared roster before planning
A snapshot missing a declared worker plans no seat
A ranked seat measured against one worker is a forced pick, never a headroom ranking
Each assignment-scoped worker starts fresh and its assessed pane closes; legacy standing-worker installs retain context only under Fix Loops or Specialist Consultations
Every assignment sends a self-contained role brief
Fewer eligible workers than required responsibilities is a staffing decision to record
Never fold independent verification onto a contributor to satisfy that staffing decision

Delivery Stages

One authorized implementation moves through four durable stages. A check can refuse only the stage whose harm it prevents.

Stage	Blocking evidence	Visible non-blockers
`authorized`	target-repo/action authority, accepted behavior, fresh recorded base, selected worktree integrity, trigger classification, selected-seat availability	due maintenance cadence, unrelated repo/worktree hygiene, catalog freshness unrelated to the selected pair
`built`	one task-scoped pushed tip, deterministic repo gates, preserved work and known dispatch effect	unrelated cleanup and advisory findings
`verified`	non-contributor reviewer and tester reports at the current tip, contributor exclusion, every blocking finding resolved or routed through its bounded gate	advisory findings and maintenance observations
`released`	hosted CI and policy review green, merge recorded, every declared publication confirmed	advisory reviewers and maintenance due after delivery

A later stage never retroactively turns an earlier maintenance observation into a task prerequisite
Unknown authority, checkout integrity, dispatch effect, current-tip verification, merge state or publication effect fails closed at its own stage
An unrelated checkout observation stays visible and is raised to the operator without stopping the selected checkout
Triggered specialty work and blocking findings keep their existing recovery and correction routes

Specialist Consultations

Advisor, investigator and architect assignments are read-only on repository content
Route implementation through the developer role under the original task and correction allowance
Give every consultation an explicit engagement identity and specialty requirements
An available profile reserves no worker and creates no active assignment
On legacy standing-worker installs, preserve useful specialist sessions for likely follow-up work
Persist specialist lessons through the existing scoped memory owner
Record the delivered report's contract lines through assess-specialist before relying on a consultation outcome
Legacy standing-worker exception for retaining an assessed consultation's context. Assignment-scoped configs refuse this mode and plan a fresh identity.
Preconditions (all required):
1. The foreman requests --retain-specialist for one advisor, investigator or architect assignment
2. The worker's latest assignment has the same task, responsibility and engagement requirements
3. Live pane, native session and verified model tier match the preceding assignment
4. The prior report and delivery receipts match their saved report-contract assessment
5. The prior supervision enrollment is resolved with no pending observations
6. No correction count, correction plan or implementation work is carried through this mode
Every other consultation clears context under the normal retrospective and dispatch gates
Follow skills/herdr-foreman/references/specialists.md for profiles and assessment workflow

Judgment Routes

The foreman runs owner scripts, tracks the owner records and gates on the lines reports and scripts produce
Judgment on task content the foreman would otherwise exercise itself goes to a worker, through one of four routes
Report substance — assessing a report beyond its contract lines, classifier gates and judge rulings routes to a worker
A finding's scope class (skills/herdr-foreman/references/assignment-reasoning.md Assess a Finding's Scope) routes to an advisor consultation
A causal question — whether a diagnosis explains its evidence, whether successive findings share a cause — routes to the investigator
Non-mechanical brief — a bug or correction brief routes to an advisor only when accepted behavior, failing evidence, bounded scope, or the correction choice remains unsettled
A recorded accepted behavior, reproducible failure and bounded correction need no additional advisor before development
Triggered specialty work, causal uncertainty, changed scope and exhausted correction loops keep their existing consultation routes
That consultation's report is the brief's task framing: accepted behavior, evidence questions and correction scope
The handoff is the accepted report's path, never its text
The foreman passes the report path of that consultation's assess-specialist record, as an absolute path, in the role's SPECIALIST_CONTEXT value through compose-briefs
The receiving worker reads that report as a required input
The foreman never copies, excerpts or paraphrases it
Paths, identifiers, authority, review evidence and the other resolver or Step 3 values stay mechanical and stay with the foreman
Stalled round — a partial_work stall routes to the investigator, with the stall classification as its input
Every other stall class follows Stalled Workers unchanged
The re-dispatch-or-discard choice for that partial work belongs to the operator, through the stall's user-attention obligation, with the investigator's report attached by path
Disputed finding — resolving it routes to the judge under Judge Seat
A route consultation's brief names its question, the recorded accepted behavior and the source reports by path, and carries no analysis of its own
A route's consultation is planned, dispatched, observed and assessed like every consultation, and spends no developer fix round
Its report gates like every report under Reports: its contract lines, its classifier gates and any judge ruling
The foreman adds no substantive assessment of its own
A missing route report is re-dispatched or recorded as a gap, never replaced by the foreman's own reading

Judge Seat

The reserved judge seat runs on the most capable model available and holds no other responsibility
The foreman dispatches the judge in adjudication mode for one of four triggers: a contested reviewer or tester verdict, a report VERDICT: the classifier gate contradicts, a bot finding the team disagrees with, or a weighing nomination
The foreman dispatches the judge in diagnosis mode at an exhausted allowance with blocking work remaining, on the investigator's assessment
Every judge dispatch declares which mode it is for, at plan and at apply
An undeclared mode is refused, never defaulted
A diagnosis on an approach whose ladder reached stop is refused before the round runs, unless the operator authorized a plan or a different approach over that remedy
An adjudication is never refused on that ground
The judge rules on that assessment; it never investigates from scratch
The diagnosis cites in ASSESSMENT: the investigator report it ruled on, and the record binds that path
Diagnosis asks why the loop is not converging and what must change, never who is right
The diagnosis returns DIAGNOSIS:, REMEDY: continue | restructure | stop, BOUND:, ASSESSMENT:, EVIDENCE: and UNVERIFIED:
An APPROACH: and VERIFICATION: pair approves a materially different direction
BOUND then names that approach's own allowance, and the diagnosis records no correction plan
A stop remedy approves no direction
A continue or restructure remedy's BOUND supplies the attempt budget the operator formerly supplied
BOUND counts developer attempts and justifies the number against the evidence the diagnosis cites
A BOUND above the ceiling foreman diagnose enforces is refused, never silently honoured
A stop remedy ships what is clean and records the remainder as a tracked accepted defect
The operator overrides it with a plan over the remedy, or with a different approach
Either override is recordable, plannable and dispatchable without a further diagnosis
A stop remedy records a user-attention obligation the catch-up surfaces
That obligation gates no dispatch and waits on no answer
The judge's authority in diagnosis mode covers accepting a tracked defect into a release under a stop remedy
That acceptance follows rules/review-severity.md Judge-Accepted Defect Carve-Out; every other release gate holds
Record the diagnosis through foreman diagnose under the original task and base before acting on its remedy
A bound foreman cites the report supervision enrolled for the pinned judge, never another file
The operator overrides this exhaustion's recorded remedy
An approved budget never stands in for a diagnosis
An older remedy never authorizes new attempts
Re-enter diagnosis when a remedy's own bound exhausts with blocking work remaining
Re-enter before the bound is spent only for a changed scope or an operator override, naming the plan it supersedes and carrying the change it claims
A stop remedy ends implementation on its approach; no unspent allowance survives it
Each re-entry moves down the ladder continue → restructure → stop, or repeats one rung once
A repeat carries the diagnosis's PROGRESS: line naming what the prior remedy changed
A remedy that produced no progress is never reissued
The ladder never runs backwards
A rung already repeated is spent
The ladder belongs to the approach, never the task lifetime
An approved new direction starts its ladder at continue
stop is terminal and never repeats
An approach's diagnosis count is bounded by DIAGNOSIS_LADDER plus one reissue per rung (skills/herdr-foreman/foreman/recovery.py _remedy_options)
No exhausted allowance waits on an operator decision
The judge is read-only: it never edits a repository file, never runs a mutating git or gh command, never posts to GitHub, never dispatches a subagent — its only output is its report file
A weighing has no positions
The position, citation and ruling-grammar bullets below govern a dispute alone
Each dispute position cites its evidence: file and line, or command output, each at a named revision
Narrow exception for a position whose evidence an investigator supplied.
Preconditions (all required):
1. An investigator report is attached to the adjudication
2. The report cites the disputed facts at a named revision
3. The position's evidence value names that report
Every other position cites its own evidence
A position with no citations goes to an investigator before the judge is dispatched
In a dispute the judge reads both positions and the governing rule
It checks only the cited evidence against the tree
A dispute returns RULING: uphold A | uphold B | amend — <line> | insufficient — <facts needed> | blocked — <question> with numbered reasons, an ACTION: naming the minimal step, and an UNVERIFIED: line
In a dispute the judge never explores the tree beyond the cited evidence
insufficient names the disputed facts the cited evidence cannot settle
On an insufficient ruling the foreman dispatches an investigator to establish those facts with citations
The judge is re-dispatched on the same dispute with that investigator report
An investigator report attached to an adjudication is admissible evidence, whether it preceded the first dispatch or followed an insufficient ruling
In diagnosis mode it reads the round history and verifies against the tree what each round changed, and returns the six diagnosis lines with numbered reasons
A diagnosis repeating its predecessor's rung adds PROGRESS:
RULING: and ACTION: belong to adjudication alone; a diagnosis carries neither
A completed ruling (uphold A, uphold B or amend) binds the round
Only the operator overrides a completed ruling
insufficient binds nothing
No checkpoint cites an insufficient ruling
blocked is the judge declining to rule
A blocked ruling stops the round and sends the named question to the operator
blocked is for a question only the operator can answer
A fact the tree can settle is insufficient, never blocked
A weighing, its ruling file, coverage and floors follow rules/review-severity.md Judge-Weighed Finding Carve-Out
The foreman nominates findings for a weighing and never weighs one itself
foreman finding-churn placing a finding on lines the previous fix round added nominates it
A worker report marking a finding MARGINAL: with a cited reachability claim nominates it
No other signal nominates a finding
One weighing dispatch carries every nomination for one gate
The judge rules each nomination fix, defer or decline
A weighing returns RULING: weighed, insufficient or blocked, never uphold or amend
RULING: weighed is a completed ruling
insufficient and blocked keep their adjudication meaning in a weighing
fix returns the finding to the fix loop
defer and decline stop the finding blocking the round
defer and decline spend no fix round
A finding a ruling covers is never re-nominated
A fix finding that stays open follows the fix loop and its exhaustion route, never a second weighing
The judge is declared in config.json, measured, and planned like every other seat
The judge names a worker kind; its disposable probe and any other kind in the same window_group draw on one measured window
window_group names the usage window a worker kind shares with other kinds
A seat's cost reduces the projected headroom of every worker sharing its window_group
The judge block names the seat's worker_kind, and the model and effort its fresh worker is launched with
The planner creates a fresh judge assignment identity on that worker kind and echoes the tier in its plan
The model and effort are the worker's launch flags, applied by starting that worker before the dispatch
Prove the requested model and effort from returned launch argv or the live foreground process argv
A banner, transcript, or remembered ledger row alone never proves the live tier
Refuse the judge dispatch when its launch arguments do not prove the requested pair
The planner never ranks the judge seat
The pinned judge assignment identity never holds another seat; the worker kind may supply other fresh assignments
No exclusion bars the judge from a dispute involving its own model
A judge round the pinned worker's window cannot cover halts the round — no substitution, no fallback to another vendor's flagship, no degraded ruling
The most capable model is reserved for the judge
The foreman's tier is selected under Foreman Seat, never pinned

Round Tiers

A worker's tiers table maps round types to model, effort, and cost data
Judgment rounds use the pinned top model; no per-round override lowers it
Apply mechanical eligibility and risk escalation through skills/herdr-foreman/foreman/tiers.py
A round escalates on recorded evidence, never on its own round type or role name
Measured headroom resolves a seat's round, not only which worker fills it
Under measured scarcity a non-judgment round declines a discretionary escalation and records the round de-escalated
Configured-row routing never selects below that row; operator-opted minimum-adequate routing follows skills/herdr-foreman/references/model-tiers.md Minimum Adequate Routing
Minimum-adequate routing changes the pair, never the task's responsibility, authority, round or required qualification
Explicit operator pins, judgment floors and evidenced risk escalation remain overrides
Unmeasured headroom reads as neither scarcity nor capacity
The scarcity threshold is a script-owned constant, never a number the foreman picks per round
A tier switch requires a worker relaunch at a cleared-round boundary
Retained fixes never change model or raise effort; preserve a verified compatible higher effort
Before relaunch, verify the idle worker, empty composer, pane occupant, and foreground PID
An idle maintenance relaunch outside dispatch preserves the tier proved by the live configured argv, takes retrospective transition coverage, restarts with configured YOLO arguments, and proves the replacement process argv
Record model, effort, launch argv, verified pair, and evidence source in the assignment ledger
Unmeasured tier billing windows remain unknown; no model name establishes free capacity
Metering contracts are in skills/herdr-foreman/references/model-tiers.md

Fix Loops

Count fix rounds per task after its initial implementation
Bound corrections per approach, never per task lifetime
Default each approach's allowance to DEFAULT_FIX_LIMIT rounds (skills/herdr-foreman/foreman/recovery.py)
A task's original direction is its initial approach
Start a fresh allowance only for an evidenced change of approach
The investigator names the failed approach, its root cause and the discriminating experiment
The judge assesses that report and approves a materially different direction with its verification expectations
The operator approves a change of approach on their own recorded authorization
Record the transition before dispatching implementation
A new worker, a cleared context, a renamed task, a rewritten brief and a repeated remedy label are never a change of approach
Another attempt at the same approach spends that approach's existing allowance
A direction the task already recorded is refused
An authorization already spent on an earlier approach authorizes no further one
A prior approach's unspent correction plan is retired with the approach it was bought for
An approach reset grants a bounded correction opportunity alone
It approves no source, waives no defect, removes no contributor exclusion, and satisfies no test, independent review or release gate
Reserve the developer through initial and early-fix verification before assigning it another task or role
The planner derives reservations and busy workers from the owner records, never from the foreman's memory
Close a task through the owner utility when it merges or is abandoned
On legacy standing-worker installs, fix rounds in RETAIN_CONTEXT_ROUNDS (skills/herdr-foreman/foreman/assign.py) retain the same developer's context when the retention preconditions hold
Legacy standing-worker exception for retaining context on a same-role fix round. Assignment-scoped configs refuse this mode and plan a fresh identity.
Preconditions (all required):
1. The worker remains the developer for the same task
2. The assignment follows that worker's confirmed preceding developer round
3. Live native session identity matches the preceding assignment's recorded identity
4. The foreman uses --retain-context with the task identifier and fix-round number
Every other developer assignment clears context
--no-clear records a hand-cleared pane, never retained context
Fix rounds past RETAIN_CONTEXT_ROUNDS use a freshly cleared worker
Narrow exception for a recorded fresh early correction.
Preconditions (all required):
1. The owner ledger preserves the original task, base, preceding developer assignment, and actual next fix number
2. The recorded cause is a confirmed release clear, an explicit operator recovery decision for the preserved missing-session assignment, a verified historical import of a completed operator-authorized manual correction, or an owner-verified automatic clear into another authorized role
3. The next fix remains within the current approach's existing allowance and the task's scope
4. The foreman dispatches a fresh developer brief through the normal readiness, clear, and tier checks
5. For a historical import, the owner verifies original task/scope/budget authorization, archived transport and report bytes, and the actual VCS base, head and diff
6. For a historical import, the owner appends the actual count with null native-session proof
7. For a historical import, the owner preserves prior rows
8. For a historical import, the owner grants no future allowance or review approval
9. For a role clear, the owner binds the actual clearing assignment and archived dispatch evidence to the preceding developer
10. For a role clear, the owner preserves known native proof and all earlier rows
11. For a role clear, the owner reuses existing task and clear authorization or records the missing explicit decision
Every other early fix requires the retained-context preconditions
A required release clear or verified historical-import handoff needs no separate context-change permission
An authorized verified role clear needs no additional context-change permission within the existing correction scope and allowance
Never edit repository content while holding the release role
Each fresh-worker brief includes the task, prior report, and open findings
Frame the handoff as "a prior developer attempted this N times; you own it now"
At an exhausted approach allowance with remaining blocking work, stop the round, record the checkpoint, and consult the investigator before the judge's diagnosis
The investigator asks why the loop is not converging and returns a reproduction, a causal assessment and a discriminating experiment
It gathers evidence and decides nothing
Narrow exception for a judge-diagnosed bounded correction plan.
Preconditions (all required):
1. The task's latest developer attempt is confirmed applied with no dispatch outcome unknown
2. A checkpoint names the concrete remaining defect, previous changes, observed progress, and changed approach
3. An accepted investigator consultation for the task follows its latest developer attempt
4. The pinned judge returns a completed diagnosis whose remedy is continue or restructure, with its bound
5. The owner utility records the diagnosis and its derived plan under the original task and base
Every other exhausted loop takes its diagnosis first; never dispatch an unbounded further fix
Reuse that plan across attempts within its bounds
Re-enter diagnosis when the bound exhausts, scope changes, or the operator overrides the remedy
Record an explicit superseding decision without rewriting the prior plan
Preserve cumulative counts across approaches, clears, worker changes, retries, and interrupted dispatch
Reconcile an unknown send outcome before retrying; never charge or send the same attempt twice
Record awaiting_diagnosis when implementation awaits the judge's remedy
An active audit worker never establishes implementation progress
Scope fix re-checks to each prior finding: RESOLVED, OPEN, or DECLINED with a reason
A finding a weighing ruled defer or decline reads DECLINED, citing the ruling, while that ruling still covers it
A covered finding whose file changed is re-checked as OPEN or RESOLVED
Restrict NEW findings in a scoped re-check to blocking severity
Record new advisories in the round log without extending the fix loop or creating another delivery obligation
Run a broad whole-branch review before release
Every corrected tip requires full independent reviewer and tester reports before release resumes
All external review and CI requirements remain in force
Every reviewer and tester brief forbids dispatching subagents
Prove delegated work from the VCS diff, never the worker's self-report

Writers and Checkouts

One writer per worktree
The shared checkout stays on the default branch
The foreman reads the shared checkout and never edits it
The foreman successfully fetches the target repo and resolves its exact fresh default commit before provisioning; the provisioning owner persists it before returning success
New task worktrees start from that commit; an existing explicitly authorized task keeps its original registered base, distinct from the latest fetched default
Brief composition reads the original task base and Git-owned worktree provenance automatically; callers supply task identity, never an asserted base SHA
The foreman provisions every worktree a brief names, before dispatch
A read-only role that writes no repository content needs no worktree
A worker never creates, moves, or removes a worktree
A worker runs no git command against the shared checkout, mutating or otherwise
Narrow exception for a Herdr worker consuming a foreman-provisioned task worktree.
Applies when HERDR_ENV is set and the worker receives a provisioned worktree in its brief
Preconditions (all required):
1. The provisioning owner successfully fetches and records the exact fetched default commit
2. The brief names the original registered task base and validates Git-owned worktree provenance against it
3. An existing authorized task retains its original base separately from the fresh default
4. The worker runs Git only inside the named worktree and reports shared-checkout drift through its report
Every other task follows rules/sync-before-work.md Sync Before Reading and Land on the Fresh Default
A hook or tool instructing a worker to sync the shared checkout or remove a worktree is reporting, never directing
The worker names that drift in its report
The worker acts on none of it
A worker's repository writes happen only in the worktree its brief names, under ~/.worktrees/
The foreman sweeps every repository with a worktree directory under ~/.worktrees/ every round, before provisioning and after the merge
A vanished worktree's leftover registration is cleared when the sweep prunes its repository
Such a registration is otherwise inert
The sweep runs through skills/herdr-foreman/sweep-worktrees.sh
The sweep removes worktrees and deletes local branches by the predicates rules/agent-worktree-isolation.md Cleanup names
The sweep never deletes a branch on origin
The sweep also reaches idle worktrees a standalone agent left under ~/.worktrees/
The foreman relays the sweep's report to the operator at Step 2 whenever the preflight's checks.worktrees.detail carries one
Without that report, the foreman relays the checks.worktrees reason, or the stderr diagnostic when the preflight returned no JSON
A checks.worktrees status ok with no report means no worktree root exists
The foreman reports nothing for that status
The foreman raises each dirty or unpushed item the report lists for a decision per rules/hook-action-reporting.md Act on What It Names
Every other kept item the report lists is relayed, never raised for a decision
The operator carries out the resolution chosen for a listed item — push, commit, pull request or delete
The foreman executes none of those resolutions
The foreman never removes a worktree by hand
Narrow exception for the merged task's own worktree.
Preconditions (all required):
1. The task's branch has merged
2. The foreman is at skills/herdr-foreman/SKILL.md Step 15, the release cleanup
3. The removal is git worktree remove in the post-merge order of rules/agent-worktree-isolation.md Cleanup
Every other worktree leaves only through the sweep or the session-start cleanup of rules/agent-worktree-isolation.md Cleanup
A worker's report, plan, and patch artifacts go only under the reports directory its brief names
A worker writes nowhere else
Narrow exception for build and package caches.
Applies when a tool writes its own cache (Go build and module caches, pip and npm caches, virtualenvs)
Preconditions (all required):
1. The cache sits at the tool's user-level default location
2. The cache never lands under the reports directory
Every other write still follows the write limit above
The session-start hook hooks/check-report-caches.sh removes build and package caches from idle reports directories through skills/herdr-foreman/prune-report-caches.py
Its discovery, idleness and cache predicates live in that script's top-of-file docstring
It removes only a directory matching one enumerated cache kind by name, signature and top-level entries
It keeps every other file and directory
In a Herdr session, it runs nothing
Under tessl (portable mode), it reports from a dry run and deletes nothing
Under tessl, it skips a linked worktree
Narrow exception for a task-owned fixture root outside the reports directory
Applies when the tool under test resolves its configuration from filesystem ancestors, so a fixture placed under the reports directory initializes the operator's own project instead of the fixture's
Preconditions (all required):
1. The brief names the fixture root
2. The root is created by this assignment, under a name no other assignment uses
3. A root that already exists, or resolves through a symlink, is refused rather than reused
4. The root holds fixtures alone
5. The root resolves outside every ancestor that configures the tool
6. The worker proves the tool's effective root inside the fixture before any command that writes through it
7. The worker records a digest of each user-level file the rehearsal can reach, before and after, never a copy of a directory tree
8. An unexpected change stops the rehearsal and goes to the operator in the report, unrestored
9. A user-level file the rehearsal changed as expected is restored from a pre-run copy of that file alone
10. Reinstalling the operator's environment is never the automatic recovery
11. The worker removes the fixture root when the assignment ends
Every report, plan and patch artifact still goes under the reports directory its brief names
The worktree writes above and the restoration precondition 9 requires are unchanged
Every code-touching command carries its own cd <worktree> && prefix
See rules/agent-worktree-isolation.md

Reports

A worker's report is a file at the path its brief names
The final chat message's last line is exactly REPORT: <path>
Substantive output never travels through pane text
A worker never blocks on a question to the foreman
A worker decides the question itself
A worker records the decision in its report
A worker continues after recording it
A genuine block goes in a ## BLOCKED section, then the worker stops
The foreman reads every report body in full before gating the round
The foreman gates a report on its required lines, its classifier gates and the judge's rulings, and on nothing else
The foreman never accepts, rejects or rates a finding on its own reading
A reviewer or tester report carries exactly one VERDICT: line
A consultation report carries one ACCEPTANCE <k>/<N>: line per criterion its brief states
N is the count of CRITERION lines in the brief apply sent
A security, ux-product or documentation consultation also carries one VERDICT: line
A blocking consultation VERDICT: gates the round like a reviewer's
A reviewer or tester assignment is accepted with any valid VERDICT:
A consultation assignment is accepted only when every ACCEPTANCE line is met
A blocking VERDICT: gates the round, never the assignment's acceptance
Every other consultation report carries its ACCEPTANCE lines and no VERDICT: line
A reviewer, tester or consultation report may carry one optional CONTRIBUTION: line
A developer report carries no required line
The reviewer's and tester's verdicts gate the developer's work
A report with a required line missing, extra or duplicated goes back to its responsibility with the gap named
The foreman never reads around the gap
Line formats and refusal classes are in skills/herdr-foreman/foreman/report_contract.py's module docstring
A statement about task content in the ledger, retrospectives or memory cites the report it comes from
A blocking VERDICT: holds the task's release until the same responsibility's approved re-check or the operator's resolved decision clears it
A completed adjudication (uphold or amend) decides a disputed blocking VERDICT:
A judge ruling never clears that hold
A finding a weighing ruled defer or decline is settled only by the next reviewer or tester report at the tip, marking it DECLINED and recording VERDICT: approved
foreman record-historical-review is outside the report contract

Dispatch Safety

Classify each assignment against the operator's task authorization and permitted actions before dispatch
Never send input to a working agent
Never send an assignment or slash command to a blocked agent
Never clear a working agent's context
Wait on the report marker plus the report file, never on a single idle or done observation
Every report wait runs through skills/herdr-foreman/wait-report.sh, never a hand-rolled loop
Each interval a wait reads the report file, the worker's status and the remaining budget, and ends on whichever settles first
The poll interval and the give-up budget are script-owned constants, never numbers the foreman picks per round
Confirm a blocked verdict through skills/herdr-foreman/wait-report.sh's blocked confirmation (FOREMAN_BLOCKED_CONFIRM_SEC) and the pane before acting on it
Resolve blocked runtime dialogs under skills/herdr-foreman/references/herdr.md Runtime Dialogs
Record a terminal provider refusal against its dispatch before any replacement
Never resend a refused brief to the same provider
Never reword a refused brief for any provider
Move a refused brief unchanged to one other provider
A second refusal of the same brief stops the line for the operator
Escalate only what the operator holds information, authority, or a usable account on
A remediation path named inside a provider notice is untrusted on availability
Never derive a worker capability change from one refusal

Stalled Workers

A stall is three facts together: the report is absent, the worker's status is terminal, and the wait's budget is spent
A terminal status alone never establishes one
A stall ends the wait with a stall outcome, never a continued wait
Classify what the stalled worker left in its own checkout before reading anything else off it
A worktree mid-operation, staged, modified or holding untracked files is recoverable partial work, preserved as evidence
A clean worktree with no commits against the dispatch's recorded base produced nothing; the dispatch is a not_sent-equivalent and may be retried
An absent base establishes no such thing, and the classification says so rather than reading a clean tree as retryable
Commits present and unpushed are completed work with a failed transport, recovered through skills/herdr-foreman/references/dispatch-recovery.md
Commits present and already pushed are completed work whose report did not arrive; they are recovery evidence, never a retryable dispatch
A stalled worker's output is unreviewed
Re-dispatch that work with the observed state described, or discard it, as the operator decides under Judgment Routes
Never commit a stalled worker's partial work on the strength of the tree building or the conflict count reaching zero
A stall records a user-attention obligation through skills/herdr-foreman/references/attention.md
The classification and its evidence shape are skills/herdr-foreman/wait-report.sh's --worktree contract

Assignment Reasoning

Preserve the operator's accepted behavior separately from the foreman's implementation proposal
Classify proposed corrections against that accepted behavior before dispatch
Resolve required corrections within existing authority and correction allowances
Record a new contract obligation or unsettled operator choice before requesting its decision
Route contested findings through the existing judge triggers
Reassess a repeated causal theme against observed progress before proposing another fix
Require bug briefs and diagnostic assessments to follow skills/herdr-foreman/references/assignment-reasoning.md

Worker Launch Mode

Start every team worker in YOLO mode, including reviewer, tester, release, and judge
Apply the same mode on every relaunch
Verify the worker's permission flags from launch or live foreground-process argv before dispatch
Preserve the assignment classifier and the brief's authority, role, and path limits
YOLO mode grants no additional task authority
Permission flags and their validation live in skills/herdr-foreman/foreman/tiers.py

Task Ledger

Herdr lifecycle and completion statuses are unreliable observations, never task-completion evidence
Maintain the foreman-owned task ledger outside Herdr throughout the task
Read which tasks wait for a seat from the owner's derived queue, never from memory
Record each dispatch outcome and each assessed worker outcome before continuing the round
Distinguish report delivery, accepted assignment work, and completion of the whole task
Bind acceptance to the actual report and the required artifact, VCS, and gate evidence
Reconcile recalled ledger entries against their sources on resume
Never restart accepted work solely on a stale Herdr status
The ledger's path, schema, ownership, and recovery contract are in skills/herdr-foreman/state-schema.md

Working Memory

Curate applicable lessons with their scope and evidence through the foreman-owned memory commands
Consult relevant lessons before composing assignments
Revalidate a lesson before relying on recalled operational facts
Preserve superseded lessons and immutable retrospective notes
The foreman resets its context at every round boundary
Before the reset, record the round's outcomes
Before the reset, curate the round's lessons
Before the reset, save a reset-ready stow
The reset runs through foreman foreman-reset, never by typing into the foreman's pane
Narrow exception for recovering a reset that failed or was interrupted.
Preconditions (all required):
1. The reset record shows the reset failed or interrupted
2. The operator, never the foreman, clears the foreman's pane
3. The operator pastes the resume prompt the reset record saved for that reset
4. Before clearing, the operator confirms the pane is not already running a foreman resumed from that reset
5. A pane already running that resumed foreman is reconciled as delivered, never cleared
Every other reset runs through foreman foreman-reset
A reset foreman resumes from the stow, the supervision resume sequence, and the foreman queue
Save conversation-only knowledge and open work before a planned foreman reset, compaction, or replacement
Give the next foreman an ordered list of durable files to read
Record uncaptured or unavailable context as an explicit handoff gap
A handoff gap names what is missing, the task it affects, and how to recover it
Narrow exception for a gap migrated from a version-1 stow.
Preconditions (all required):
1. The owner migration wrote it from a version-1 free-text gap
2. No new stow names the task unrecorded
3. Its task is unrecorded and its recovery asks the operator, quoting the original text
4. Its stow is not reset-ready until a new stow records the gap with its actual task
Every other handoff gap names the task it affects
Working memory grants no authority, acceptance, or gate waiver
Follow skills/herdr-foreman/references/working-memory.md

User Attention

Persist unanswered questions, requested reviews, user-relevant blockers or failures, and promised follow-ups when they arise
Keep each obligation's context, source, consequence, and resolution condition with its stable identity
Present outstanding attention before routine housekeeping in a catch-up
Showing an item never resolves it
An unrelated message or context reset never resolves an item
Record the actual user answer or outcome evidence before closing an obligation
Defer an obligation with a return condition instead of silently dropping it
An open decision or blocker on a task refuses further dispatch on that task until it is resolved or explicitly deferred with recorded rationale
Record an answer required before further dispatch as a decision or blocker, never as a question
Keep attention records separate from task acceptance and worker lifecycle observations
Follow skills/herdr-foreman/references/attention.md

Fleet Supervision

Bind supervision to the foreman's actual session before dispatching a team round
Enroll every dispatched assignment before sending its brief
Observe all enrolled workers while awaiting reports
Preserve wake events until the foreman records their handling
Acknowledging an observation never accepts the assignment or completes the task
Reconcile interrupted supervision against its saved events and live process evidence
Continue the foreground watch after a quiet deadline while authorized work remains
A saved handoff prepares reset preflight and never proves a transferred continuation
Never finish a foreman turn with active work unless a genuine user pause, a successor binding, or a matching live reset deliverer satisfies the Stop gate
Follow skills/herdr-foreman/references/supervision.md

Retrospectives

The foreman observes retrospective cadence at least once per INTERVAL (skills/herdr-foreman/foreman/retrospective.py) during active team work
Check the cadence on active resume, before planning or dispatch, and between report waits
A daily cadence due is maintenance to schedule outside the selected task's delivery stages; it never refuses dispatch
Complete a retrospective before clearing or relaunching an existing worker, or changing its seat, model, or effort
Missing transition coverage still blocks that exact worker transition
Bind transition coverage to the outgoing work and session, source evidence, and proposed assignment
Cover simultaneous transitions in one retrospective
Reuse coverage only while the covered evidence and proposed transition remain unchanged
Narrow exception for a worker's first launch without outgoing work.
Preconditions (all required):
1. The owner has no preceding assignment for that worker
2. Live process evidence proves the target pane holds only its shell
3. No outgoing worker context or work needs a handoff
A closed no-brief transport retry also has no outgoing work, but is recorded as reconciled_not_sent, never as a first launch
The owner proves durable not_sent, unchanged task, role, frozen brief/common bytes, tier and judge mode, inactive old enrollment, old native agent and pane absent, no report or assignment input evidence, and an exact sole-shell new pane
The owner performs this proof and retry bookkeeping; executors need no manual reconciliation for pre-send refusal and no retro-check for a generated identity absent from static config
Unknown, possibly sent, live, changed or partially closed attempts preserve their work and fail closed
Every other worker transition requires retrospective coverage
Unknown worker history alone never proves a first launch
Collect observations from saved reports and read-only evidence
Never interrupt a working or blocked worker to collect retrospective input
Record verified outcomes, lessons, evidence gaps, and concrete improvements with owners and success criteria
Evaluate specialist selection, consultation timing, useful decisions, avoidable effort and lost handoff knowledge
Revisit prior improvement actions
A status snapshot or dispatch log alone never completes a retrospective
Persist completed notes outside task worktrees
Preserve completed notes during cleanup
Retrieve saved notes on request with their date, coverage, and path
Retrospectives grant no task authority, correction allowance, acceptance, or gate waiver
Execution, persistence, and retrieval contracts are in skills/herdr-foreman/references/retrospectives.md

Review Before PR

An implementation round runs two phases: pre-development planning, then mandatory post-push verification
Pre-development planning is optional for work that trips no Team Composition trigger
Work that trips one gates on its deliverable before implementation, or on the recorded staffing decision the four non-exhaustion triggers allow
An investigation-only round gates its knowledge deliverable under skills/herdr-foreman/references/assignment-reasoning.md
Pre-development output is a design note or a test plan, never a pass
The tester and the reviewer pass on the pushed branch before the PR opens
A round may split a reviewer's or a tester's surface across several seats against a declared partition
The partition is disjoint and exhaustive over the change
Every changed file belongs to exactly one slice
A partition leaving a changed file unowned is refused
A partition whose slices overlap is refused
skills/herdr-foreman/foreman/partition.py decides both refusals, through foreman validate-partition
A partition seats the reviewer or the tester responsibility alone
A responsibility holding a per-task counter is never sliced
A seat's role decides its bars, tiers, requirements, weight and history
foreman plan --partition seats one worker per slice under the existing capability, contribution-exclusion and headroom ordering
A seat carries its slice's identity
The responsibility a seat fills is its role
The ledger records that role, never the seat
Each slice's brief names its slice
Each slice's brief forbids roaming
An observation outside a seat's slice goes in a separate section of its report
An out-of-slice observation never forms part of that seat's verdict
A slice is saturated when its seat reports clean at the current tip
A partitioned responsibility has passed when every slice is saturated at one tip
A tester partition passes the tester gate, never the reviewer's
Severity classification, gating and independence are unchanged
A slice verdict is an ordinary verdict of its responsibility over a smaller surface
A partition never makes an unreviewable module feel reviewed
Slice boundaries that cannot be drawn without cutting through mutual dependencies are a structural finding for the architect trigger
The gate reads the post-push reports for the current branch tip
A pre-development report never satisfies the gate
Exclude every possible contributor from independent verification of that task
A dispatch classified a possible contribution before its worker ran makes that worker a possible contributor
A report declaring a design or implementation contribution makes its worker a possible contributor
A contribution only adds an exclusion
Nothing clears an exclusion a recorded classification or a declared contribution adds
A foreman --exclude narrows the current plan alone and is never contribution history
A worker's own CONTRIBUTION: none changes nothing
Every consultation worker stays excluded from verifying its own task
A role, model or session change never erases contribution history
A legacy reviewer responsibility reads as unknown
An unknown responsibility excludes its worker
Before a PR exists, the developer's own evidence is the branch CI its push triggered
On an open PR, the developer reads that evidence with skills/release/poll-pr-reviews.sh, never the pre-merge watch
The developer reports each reviewer lane's observed state, including whether a request is pending, whoever asked for it
Waiting on a review the role cannot request follows skills/release/references/release-contract.md Pre-Merge Watch Mechanics
The developer pushes the branch and stops
Advisory findings are recorded and do not create another push, verification round or target-task prerequisite
A shared GitHub account posts internal reviews as COMMENT reviews
The foreman enforces the blocking findings a COMMENT review carries
Severity classification follows rules/review-severity.md
The developer then runs the release skill for the PR, the merge, and the cleanup

Authority and Policy

The foreman verifies repo authority through a script before composing briefs
Ownership is namespace ownership; write permission is not ownership
A brief states the authority as a verified fact, never as a standing claim
A repo the operator does not own gets explicit per-repo, per-action permission recorded in the brief, or the round stays read-only
An unanswerable authority check is not permission
See rules/external-repo-contributions.md
Every worker runs the same plugin from the shared checkout
A runtime that does not auto-load the rules reads them from its brief
The brief names the rule index, this file, and the release-skill path in full