lararium

ESL lifecycle hop — the DISCOVER hop. When a scout mission's findings surface change-worthy signal (a defect, a spec/impl drift, or a genuine gap) in an ESL-enabled project (.spectra/ present), ATLAS proposes opening an ESL change at 'proposed' by framing the scout-report + its ECL envelope it already emits as the proposal artifact — it never calls mcp__tonberry__* itself and never implements (refusal boundary intact). SPECTRA's own esl-hop owns the actual right_size/propose/specify tonberry calls on receipt, over the existing atlas-to-spectra handoff edge. Absent .spectra/ or absent change-worthy findings → hand off the scout-report normally (ESL opt-in).

Phase S (Synthesize) — emit the scout-report.md artifact that downstream agents (SPECTRA, APIVR-Δ, human) consume. Hard cap 3000 tokens; every factual clause cited with FINDING-XXX; every recommended action carries a handoff label. Use after Phase A (Abstract) fold is validated and DECISION_TARGET has an answer or its gaps are recorded. Final phase of an ATLAS mission.

Receiver-side ECL integrity gate (blocking, symmetric). Refuses to process any upstream artefact whose sibling .envelope.json lacks a verify_pass trace event from the orchestrator. Use when reading any upstream artefact handed off to ATLAS that carries a sibling .envelope.json. Symmetric across all Eidolons — every Eidolon enforces it identically per ECL §6.2.2.

Governs the checker-handoff gate for FORGE verdicts that authorize an irreversible action. Use at the end of the Emit phase, after the verdict and recommended action are drafted, to check the recommended action against the five mechanically observable irreversibility trigger markers (deploy/release, destructive migration or data deletion, security-boundary change, external spend/commitment, public communication). On a match, set the emitted reasoning-report's requires_checker flag to true instead of letting the verdict flow straight to execution. Reversible verdicts (no marker match) are unaffected — do not fire this skill for them.

Governs N perspective-diverse, mutually-blind reasoning traces with structural-agreement judge-merge for gated high-stakes FORGE decisions (G2/TRANCE). Use instead of forge-deliberation when Deep depth AND a stakes flag both hold (Framing score 8–9 with irreversible/system-wide blast radius), or on explicit opt-in. Do NOT use for standard-tier decisions — self-consistency is never the default.

Governs logic verification, evidence coverage, confidence calibration, and the REFORGE protocol during the FORGE Gate phase. Use when the Reasoner enters Phase G to check logical soundness (fallacy scan), verify evidence coverage, assess decision completeness, calibrate the 4-factor confidence score, and decide pass/emit or trigger a single REFORGE revision pass.

Phase A (Attest) result emission — finalizes the TaskState audit record with evidence-anchored claims, emits the mission result via ECL PROPOSE, and PROPOSEs any typed handoff-request UPWARD (never dispatches). Use when Grind reaches a terminal stop_state; load at the end of a GILGAMESH cycle. Do NOT use during Gauge/Inventory/Lock/Grind.

ESL lifecycle hop — in an ESL-enabled project (tonberry MCP available), when a fallthrough mission is authored as an ESL change, Gilgamesh is the MAKER and drives proposed→in_progress→(ready-for-verify). Gilgamesh NEVER self-verifies — maker≠checker is mechanically enforced (C4), so a distinct checker owns the verified transition. Absent tonberry → run the normal GILGAMESH cycle (ESL opt-in); never hard-fail.

Phase G (Gauge) mission-intake gate — verifies the mission-contract, decides KEEP vs REFUSE at generalist scale (specialist-fit, over-authority, underspecified), and instantiates the six-row capability-authority table. Use once per mission at the start of every GILGAMESH cycle, after the inbound envelope is verified. Do NOT use during Inventory/Lock/Grind/Attest.

Phase Grind externally-verified work loop — governs sandbox-first mutation within authority, the named-oracle gate after every meaningful change, the loop budget (time/turns/tokens), and the mechanical stopping policy over exactly {continue, recover, escalate, terminate}. Use after Lock freezes the plan; load when Gilgamesh enters the work loop. Do NOT use during Gauge/Inventory/Lock/Attest.

Blocking ECL envelope integrity gate for inbound Gilgamesh missions; verifies SHA-256 and contract conformance before any payload is processed. Use when an upstream artefact arrives with a sibling .envelope.json; load automatically on every inbound ECL hand-off. Do NOT use for non-ECL artefacts (no .envelope.json sibling).

Governs how the Scribe transforms context into structured, grounded prose during the Draft phase. Use when starting any document composition, loading templates, applying structural markers, or writing section by section with topological ordering and envelope-aware intake.

ESL lifecycle hop — when the cortex routes a verified, drift-checked change to IDG in an ESL-enabled project (tonberry MCP available), the Scribe owns the archived hop: archive the change folder, chronicle the lifecycle outcome with provenance, and route the promotion-intent envelope to CRYSTALIUM. Absent tonberry → document normally (ESL opt-in).

Blocking symmetric receiver integrity gate for inbound ECL hand-offs to IDG. Use automatically when reading any upstream artefact with a sibling .envelope.json — verifies SHA-256 integrity via orchestrator trace, validates contract conformance, and refuses (does not process) on any failure. Do NOT use for non-ECL artefacts or when no envelope sidecar is present.

ESL lifecycle hop — when the cortex routes a verification to Kupo in an ESL-enabled project (tonberry MCP available), Kupo is the CHECKER (maker≠checker, mechanically enforced) and owns the verified transition. Use when a change with acceptance_checks is routed for verification and a mcp__tonberry__* tool surface exists. Absent tonberry → run your normal verify (ESL opt-in); never hard-fail.

Phase P+O sandbox patch loop with external verifier; governs edit emission, harness applier invocation, per-file loop detector, circuit-breaker, and pre-completion green-signal gate. Use when Kupo enters Phase P to emit a patch or Phase O to run verifiers; load after a KEEP decision. Do NOT use during Phase K or U.

The maker≠checker critique protocol for a plan at Test (T). Mandatory before Assemble at tier=full (self-approval is mechanically DENIED by ramza-gate), recommended at tier=lite. Mechanical debiasing: strip author identity, anchor findings on ramza-lint/ramza-ears-lint output plus the refine rubric, record identities via ramza-gate critic. Read-only; critiques, never edits.

Open-ended requirements & stakeholder/goal elicitation BEFORE CLARIFY. Use when the GOAL itself is underspecified (IDEA/STRATEGIC intent) — distinct from CLARIFY, which disambiguates an already-known goal. Read-only, bounded, mechanically countable coverage gate; produces an elicitation summary, never a plan.

ESL lifecycle hop — when the cortex routes a non-trivial change to RAMZA in an ESL-enabled project (tonberry MCP available), RAMZA owns the proposed→specify hop: right-size, propose the change folder, emit the spec into it. Absent tonberry → produce the spec normally (ESL opt-in).

Decision-ready, tamper-evident specifications via the RAMZA cycle. RS right-sizing runs first — every downstream gate (score, lint, freeze, drift, emit) is a bin/ramza-* tool call, never self-policed arithmetic. Use for any task needing a spec before implementation; ceremony scales with the RS tier (trivial/lite/full), never a fixed complexity threshold. Produces a plan .md + plan-state.json audit trail (+ YAML/JSON block, + ECL envelope when ECL_VERSION is present), never code.

TRANCE-only G3 evaluator-optimizer mode: fan out 2-4 perspective-diverse clean-context candidate specs, score with a bias-hardened evaluator anchored on ramza-score, judge-merge into ONE spec, terminate at confidence ≥85% or hard cap 3 iterations. Read-only; never the default — runs ONLY when the cortex authorizes TRANCE.

Load when reading any upstream artefact handed off to RAMZA that carries a sibling .envelope.json. BLOCKING per ECL §6.2.2: the orchestrator MUST have verified the envelope's SHA-256 (eidolons verify-envelope --block / eidolons run --verify) and recorded a verify_pass before dispatch. If no verify_pass exists for the message_id, or a verify_fail is present, REFUSE to process the payload and hand back to the orchestrator. Symmetric receiver gate — every Eidolon enforces it identically.

ESL lifecycle hop — in an ESL-enabled project (tonberry MCP available), VIGIL owns the FAILURE PATH: on a verify_fail or spec-vs-impl drift, transition the change back to the maker (in_progress) and emit an ESCALATE envelope carrying root-cause attribution. You are the failure-path checker, distinct from the maker (maker ≠ checker). Absent tonberry → run the normal V→I→G→I→L cycle (ESL opt-in).

Phase I (Intervene) — falsifies hypotheses via counterfactual replay. Designs minimal interventions for each root candidate; runs in sandbox; root cause is the candidate whose intervention flips failure→success. Hard cap 5 interventions. Use after `idg.md` identifies ≥1 ROOT_CANDIDATE, before emitting the root-cause report.

Phase L (Learn) — emits verified root-cause finding with evidence chain, walks the cause back to its originating decision, persists failure signature to semantic memory for future de-duplication, routes handoff to the correct downstream Eidolon. Use after `intervention-log.md` has a SURVIVOR to produce the primary deliverable.

Blocking, symmetric receiver-side integrity gate for inbound ECL hand-offs. Enforces ECL §6.2.2: REFUSES to process any upstream artefact whose SHA-256 envelope has not been verified and passed by the orchestrator; hands back to the orchestrator on failure. Use when reading any upstream artefact handed off to VIGIL that carries a sibling .envelope.json.

Phase V (Verify) — establishes a reproducible failure. Deterministic-first; on two failed deterministic attempts, switches to statistical replay with confidence bands. No attribution begins without this phase passing. Use when starting any VIGIL mission, on mission intake, before any isolation or intervention work.

Load at the start of the Vivi Analyze phase. Techniques for building a repo map, running progressive disclosure, and maximising context relevance for coding tasks. Use whenever you need to understand unfamiliar code before editing it, or when an existing Discovery Report feels under-grounded.

ESL lifecycle hop — when the cortex routes a non-trivial change to Vivi in an ESL-enabled project (tonberry MCP available), Vivi owns the in_progress (implement) hop as the MAKER: declare has_code, run the loop-native A→P→I→V→Δ/R cycle in an isolated worktree, hand off to the CHECKER (never self-verify). Absent tonberry → implement normally (ESL opt-in).

Load when the Vivi Verify phase produces failures — test fails, lint error, build break, or three consecutive unsuccessful attempts at the same category. Provides the failure classification taxonomy, bounded debugging protocol, and escalation thresholds. Use to avoid the 'random retries' anti-pattern.

Load in Vivi's V (Verify) phase. The core capability that distinguishes Vivi from its predecessor APIVR-Δ: drive the closed, autonomous, bounded edit-run-test loop (`eidolons sandbox loop`) as its `--fix-hook`, consuming localized feedback, retrying in fresh context, refusing to game the tests, and gating on pass^k. Use whenever the task has an executable test oracle and a loop-competent host.

Full Vivi cycle reference — A(nalyze) → P(lan) → I(mplement) → V(erify) → Δ(Delta)/R(eflect). Use when the task is a non-trivial feature implementation in a brownfield codebase and you need the complete methodology reference: complexity routing, evidence-grounded planning rules, test-anchoring requirements, and failure-escalation thresholds.

Load when reading any upstream artefact handed off to Vivi that carries a sibling .envelope.json. BLOCKING per ECL §6.2.2: the orchestrator MUST have verified the envelope's SHA-256 (eidolons verify-envelope --block / eidolons run --verify) and recorded a verify_pass before dispatch. If no verify_pass exists for the message_id, or a verify_fail is present, REFUSE to process the payload and hand back to the orchestrator. Symmetric receiver gate — every Eidolon enforces it identically.