Windows 1/5: foundation, durable runtime, and stack workflow

.agents/skills/quality/SKILL.md

@@ -39,26 +39,108 @@ synthesis step owns all edits so dedupe and severity-gating happen in one place.
   teammate per track, lead runs synthesis. Per the global git-worktrees policy,
   do **not** pass worktree isolation. Never *require* a team to run this skill.
 
-Each reviewer receives the same scoped context: `git diff main` plus the full
+Each reviewer receives the same scoped context: `git diff "$QUALITY_REVIEW_BASE"`
+plus the full
 contents of the changed files — **including new untracked files**, which
-`git diff main` omits — so it evaluates without guessing.
+the tracked diff omits — so it evaluates without guessing.
 
 ---
 
 ## Setup
 
+**Invocation:** `/quality [feature] [--base <ref>]`. `--base` is the explicit
+direct-parent binding for a stacked layer. Resolve the base in this order:
+
+1. a validated `--base <ref>` argument;
+2. an existing PR's `baseRefName`;
+3. the current entry's parent from non-interactive `gh stack view --json`;
+4. `ADE_REVIEW_BASE_REF` from a trusted ship state file;
+5. `main` for the unchanged ordinary workflow.
+
+Do not stop discovery after reading an existing PR. Still inspect `gh stack
+view --json`: a current branch present in that stack makes its PR base exact,
+including a bottom layer based on `main`. A PR with a non-default base is also
+an exact direct-parent binding. Only an ordinary unstacked PR targeting the
+repository default branch keeps `QUALITY_EXACT_BASE=false` and the historical
+merge-base behavior. When both PR and stack metadata exist, their parent names
+and SHAs must agree.
+
+Normalize `refs/heads/<name>`, `refs/remotes/origin/<name>`, `origin/<name>`, and
+plain `<name>` to one plain branch name. Reject another remote, symbolic refs,
+revision syntax (`..`, `~`, `^`, `:`), an empty value, or a name that fails
+`git check-ref-format --branch`; never concatenate an unvalidated ref into a
+command. Fetch the normalized name into its exact remote-tracking ref:
+
 ```bash
-git diff main --name-only          # tracked changes vs main
+# QUALITY_BASE_REF is the validated, normalized plain branch name selected
+# above. QUALITY_EXACT_BASE is true for --base, stack metadata, or trusted
+# stack ship state, a non-default PR base, or a PR confirmed in gh-stack;
+# ordinary unstacked /quality against the default branch keeps it false.
+git check-ref-format --branch "$QUALITY_BASE_REF"
+git fetch origin "refs/heads/$QUALITY_BASE_REF:refs/remotes/origin/$QUALITY_BASE_REF"
+QUALITY_BASE_SHA=$(git rev-parse "origin/$QUALITY_BASE_REF")
+if [ "$QUALITY_EXACT_BASE" = true ]; then
+  git merge-base --is-ancestor "$QUALITY_BASE_SHA" HEAD || {
+    echo "stack-coordinator-sync-required: direct parent is not an ancestor of HEAD"
+    exit 1
+  }
+  QUALITY_REVIEW_BASE="$QUALITY_BASE_SHA"
+else
+  QUALITY_REVIEW_BASE=$(git merge-base HEAD "$QUALITY_BASE_SHA")
+fi
+git diff "$QUALITY_REVIEW_BASE" --name-only
 git status --short                 # NEW (untracked) files — git diff omits these
-git diff main --stat | tail -20
-git log main..HEAD --oneline
+git diff "$QUALITY_REVIEW_BASE" --stat | tail -20
+git log "$QUALITY_REVIEW_BASE"..HEAD --oneline
 ```
 
+For stack metadata, also require its reported parent SHA to equal
+`QUALITY_BASE_SHA`; a name match alone is insufficient. The base must be the
+**direct parent** of the current stack entry, not `main`
+and not the root of the stack. Record the normalized parent branch, fetched
+parent SHA, merge-base, reviewed head SHA, and content-tree SHA. If the parent
+cannot be fetched or sources disagree, stop; silently widening or narrowing a
+stacked review is not valid evidence. A parent-head or branch change invalidates
+this result and every result above it in the stack.
+
+Run quality once per layer against its direct parent. For the fifth/top layer,
+also run both review tracks cumulatively against `origin/main`; the layer passes
+only when both the incremental and cumulative gates are empty. Record both
+bindings. A lower-parent change cascades invalidation through all higher-layer
+bindings, so the coordinator must sync/rebase the stack and rerun them in order.
+
 A new service or module added but not yet committed will not appear in
-`git diff main`. Fold the untracked files from `git status` into the review set
+the tracked diff. Fold the untracked files from `git status` into the review set
 and read their full contents — an unreviewed new file is the easiest place for a
 Blocker to hide.
 
+### Windows parity rules
+
+When the scoped diff touches filesystem paths, process launch, executable
+resolution, IPC, SQLite/native modules, startup services, or Computer Use:
+
+- Treat Windows as a first-class runtime. Verify drive letters, native and mixed
+  separators, UNC paths, quoting, `PATHEXT` and executable discovery. Audit
+  PowerShell, `cmd.exe`, and Git Bash invocation separately for argument loss,
+  shell injection, and environment drift. Require process-tree termination,
+  per-user/per-channel named-pipe ACL isolation, Stable/Beta identity isolation,
+  semantic runtime readiness (not merely a live supervisor PID), stale-PID
+  cleanup, bounded supervisor restart/backoff, and packaged native dependencies.
+- Trace installer, updater, signing, Windows Firewall, Relay, and capability-gate
+  effects. Verify IPC/preload/shared contracts, CLI/RPC, SQLite/CRR, mobile,
+  hosted web, and release-manifest compatibility rather than treating a native
+  host fix as isolated.
+- Require platform gates to state the capability, not infer the whole product
+  is unsupported. Native screenshot/video/OS GUI automation may be blocked on
+  Windows while App Control and proof-file ingestion remain available.
+- Trace the same change through macOS and Linux owners and tests. A Windows fix
+  that regresses launchd, Unix sockets, POSIX executable lookup, or graceful
+  Linux capability degradation is a correctness finding.
+- Separate code-backed evidence from external proof. Native Windows tests and
+  CI can prove contracts; installed Stable/Beta isolation, second-account pipe
+  denial, clean-host restart, and GUI evidence remain explicit blockers until
+  captured on the corresponding hosts.
+
 ---
 
 ## Phase 1: Thermo Dual-Review → Synthesize + Fix

.agents/skills/quality/references/ade-review-rules.md

@@ -125,6 +125,28 @@ rejected for non-linear history; the fallback is a local admin-bypass push. This
 isn't a code finding but flag any automation that assumes a plain merge will
 succeed.
 
+## 10. Windows foundation parity
+
+**Check:** When a lane touches path construction, process launch, executable
+lookup, local IPC, SQLite/native artifacts, service lifecycle, or Computer Use:
+
+- Windows service health means the channel runtime answers on the expected
+  per-user pipe with the recorded PID; a live supervisor alone is not health.
+  Verify bounded restart backoff, stale/reused PID diagnostics, and Stable/Beta
+  identity after packaged channel defaults are applied.
+- Named pipes must be scoped by canonical ADE home, channel/service, and current
+  user identity and retain intended-user listen restrictions. `.exe` resolution
+  and structured argv must not be replaced with shell-string parsing.
+- Native Windows CI must load the actual CR-SQLite DLL and exercise a CRR
+  mutation when packaging/native paths change. Preserve the macOS dylib, Linux
+  graceful-degrade, launchd/systemd, and Unix socket contracts.
+- Gate exact capabilities: Windows can block native screenshot/video/OS GUI
+  control while App Control and proof ingestion remain available. Do not widen
+  a native Computer Use limitation into a product-wide platform block.
+- Treat clean-host Stable/Beta coexistence, second-account pipe denial,
+  reboot/restart, installed updates, and GUI artifacts as external proof. Code
+  or mocked tests cannot close those gates.
+
 ---
 
 ## Output

.agents/skills/quality/references/correctness-security-review.md

@@ -14,14 +14,15 @@ and security/safety issues. Be rigorous — nothing should slip through.
 ## Scope
 
 - ONLY report issues in code being **added or modified** on this lane. Focus on
-  the diff against `main`.
+  the diff against the resolved `QUALITY_REVIEW_BASE` (`main` ordinarily; the
+  direct parent for a stacked PR).
 - Do NOT report pre-existing issues in untouched code.
 - Trace cross-module side effects of the changed code even into unchanged files,
   but the *finding* must trace back to something this lane changed.
 
 ```bash
-git diff main
-git diff main --name-only
+git diff "$QUALITY_REVIEW_BASE"
+git diff "$QUALITY_REVIEW_BASE" --name-only
 ```
 
 ---

.agents/skills/quality/references/thermo-nuclear-review.md

@@ -4,8 +4,9 @@ Seven structural standards. The primary question for every finding: does a
 "code judo" move exist — a smaller change that makes the code fundamentally
 simpler, not just cleaner?
 
-Tone: direct and demanding, not rude. Scope to the diff against `main` — do not
-restructure untouched code.
+Tone: direct and demanding, not rude. Scope to the diff against the resolved
+`QUALITY_REVIEW_BASE` (`main` ordinarily; the direct parent for a stacked PR) —
+do not restructure untouched code.
 
 ---
 

.agents/skills/ship/SKILL.md

@@ -7,7 +7,9 @@ description: >-
   only CI. Pure loop — it does not replace the baseline /quality or /test runs;
   run those first. It does revalidate quality after any ship-loop mutation so
   the final result is bound to the exact reviewed PR head and content tree.
-  Full phase logic lives
+  Opt-in --stack-ready runs the same loop for one layer of a coordinator-owned
+  stack: it fixes and pushes its own layer but stops at ready-stacked instead of
+  merging, rebasing, or running any gh stack command. Full phase logic lives
   in docs/playbooks/ship-lane.md.
 ---
 
@@ -25,7 +27,66 @@ Print a compact status line each iteration (no banner):
 ship · iter 2/5 · PR #184 · POLL → DECIDE → FIX → MERGE · FIXING CI (test-desktop 3) + 2 comments
 ```
 
-**Invocation:** `/ship` (auto-detect state) or `/ship <pr-number>`.
+Stack mode prints the layer and its terminal instead of `MERGE`:
+
+```
+ship · stack 12 layer 2/5 · iter 2/5 · PR #1007 · POLL → DECIDE → FIX → READY · FIXING CI (windows-foundation) + 1 comment
+```
+
+**Invocation:** `/ship` (auto-detect state), `/ship <pr-number>`, or the opt-in
+`/ship --stack-ready [<pr-number>] --base <direct-parent-branch>`.
+
+### Stack-ready mode (opt-in only)
+
+`--stack-ready` drives one layer of a coordinator-owned stack to *ready*, not to
+*merged*. It is the same loop — Phase 0 through Phase 5, the same poll/fix
+machinery, the same 5-iteration budget — with merging and every stack-wide
+operation removed. Resolve the direct parent from `--base`, an existing PR's
+`baseRefName`, then non-interactive `gh stack view --json`; normalize it with
+the `/quality` rules. Persist `mode: "stack"` plus the complete stack binding:
+stack number, size, position, expected parent branch, validated head SHA, base
+SHA, content-tree SHA, test-evidence SHA, required and deferred proof scenarios,
+proof links, and quality/test status.
+
+**The lane owns its layer; the coordinator owns the stack.** The lane commits
+and pushes its own layer branch, opens its PR against the resolved direct parent
+when none exists, polls CI and review bots, fixes red CI and verified findings on
+its own layer, reruns commit-bound quality revalidation against the exact
+resulting head, and repeats until the layer is genuinely clean. A red check on
+its own code is work to do, not a reason to stop.
+
+The lane never merges, never enables auto-merge, never deletes a branch, never
+rebases or restacks (`git rebase`, `gh stack sync --remote origin`, `gh stack
+rebase --upstack --remote origin`, `gh stack push --remote origin`, and `gh
+stack submit --auto --remote origin` are all coordinator-only), never retargets
+a PR base, never touches another layer's branch or files, and never enters
+force-finalize or any bypass-review path. Before any cap, force-finalize,
+rebase, merge, or branch-deletion decision, branch on `mode == "stack"`.
+
+Escalate only what the lane genuinely cannot do, with exact evidence:
+`stack-coordinator-sync-required` (a restack or base retarget is needed — the
+parent moved, a lower layer changed, or the PR base is not the direct parent),
+`stack-coordinator-fix-required` (the fix belongs to a lower layer, or the
+iteration budget is spent and the layer is still red),
+`stack-coordinator-pr-required` (the parent branch is missing on `origin`, or PR
+creation failed on auth or an unusable base ref), and
+`stack-coordinator-merged` (the coordinator already landed it). The playbook's
+**Stack escalation states** table is authoritative. None of them is a general
+stop at the first red check.
+
+Write `status: "ready-stacked"` only when the exact head is green,
+review-terminal, quality-clean, test-clean, and every mandatory proof scenario
+either has a current evidence link bound to the validated head or is recorded in
+`deferredProofScenarios` against a named higher layer that exists in this stack.
+The top layer defers nothing, and cumulative clean-host/cross-client/release
+scenarios never masquerade as lower-layer evidence. A known-missing mandatory
+scenario is `blocked` with the scenario ids listed — never `ready-stacked` with
+a caveat. Missing or ambiguous stack metadata is `blocked`, not a fallback to
+`main`.
+
+Without `--stack-ready`, every existing `/ship` default and merge behavior is
+unchanged: the base is `main`, green work proceeds through Phase 3c, and the
+terminal success state is `done-clean` only after merge confirmation.
 
 ---
 
@@ -35,7 +96,11 @@ ship · iter 2/5 · PR #184 · POLL → DECIDE → FIX → MERGE · FIXING CI (t
 commands, decision rules, and bot-ping rules live there. This skill is the
 runtime-neutral entrypoint and the ADE-specific deltas below. If re-invoked by a
 scheduled wake, read the state file first; if `status == running`, skip Phase 0
-and go to Phase 1.
+and go to Phase 1. If `status == ready-stacked`, revalidate the complete binding
+first: when it holds, print the persisted coordinator handoff and exit without
+scheduling or mutating anything; when it is stale, external movement exits
+`stack-coordinator-sync-required` and this lane's own newer head re-enters the
+loop at Phase 1.
 
 The playbook's Phase 0 is **checkpoint → commit-bound quality revalidation →
 push → open PR**. Baseline test generation and the local-CI gate are NOT part
@@ -60,7 +125,11 @@ change this branch was not asked to make. Both need the author.
 - If `/quality` was never run on this lane, or its final gate result is not
   available in the lane handoff, stop with `blocked`; unknown is not empty.
 - Any base movement, rebase, conflict resolution, Phase 3b edit, or
-  force-finalize edit clears all three quality binding fields. Run the
+  force-finalize edit clears all three quality binding fields. In stack mode,
+  this lane's own Phase 3b edit clears them and is rebound by revalidation on
+  the head it then pushes; external movement of the parent, base, or head
+  instead clears the complete stack binding and returns
+  `stack-coordinator-sync-required` without rebasing. Run the
   playbook's single canonical **Commit-bound
   quality revalidation** procedure before pushing that mutation.
 - Never enter Phase 3c with a missing or mismatched binding. Revalidate first;
@@ -98,10 +167,24 @@ only user-visible output is the per-iteration status line and the final summary.
   `gh pr checks` / the `ade-pr-workflows` skill — do not hardcode.
 - **PR creation:** prefer the `ade` CLI (registers the PR in ADE's tracking — lane
   ↔ PR link, check/comment inventory). `gh pr create --base main --head <branch>
-  --fill` is the fallback, not the default. See the playbook's discovery protocol.
+  --fill` is the ordinary fallback; stack mode substitutes the persisted direct
+  parent for `main`. See the playbook's discovery protocol.
 - **State file:** `.ade/shipLane/<branch-with-slashes-as-__>.json`. `status`:
-  `running` | `done-clean` | `done-max` | `blocked`. Rebase rebates the iteration
-  counter by 2 (floor 0).
+  `running` | `ready-stacked` | `done-clean` | `done-max` | `blocked`; it also
+  records `mode` and the complete stack binding. Rebase rebates the iteration counter by 2
+  (floor 0).
+
+**Windows proof gate.** For a Windows-relevant stack entry, require the native
+Windows foundation check to be terminal-green on the bound head. Require the
+packaged Windows check when packaging or native bundle contents changed.
+Computer Use evidence is capability-specific: native OS capture/control may be
+explicitly blocked while App Control and proof ingestion remain supported and
+tested. Clean-host Stable/Beta coexistence, second-account pipe denial,
+restart/reboot, installed-update, and GUI artifacts remain named external proof
+blockers until captured; never mark them proven from simulated tests. A stack
+entry cannot reach `ready-stacked` while any of them is required at its position
+and still uncaptured — record it as `blocked` with the scenario id, or defer it
+to a named higher layer in `deferredProofScenarios`.
 
 ---
 
@@ -135,11 +218,14 @@ terminal-neutral, and continue. Record it under `inactiveReviewBots`, never
 If branch protection requires an absent check, Phase 3c will surface that as a
 merge-policy block.
 
-**Rebase only on real conflicts or a stale quality base.** `behindMain` alone
+**Rebase only on real conflicts or a stale quality base.** `behindBase` alone
 does not normally trigger a rebase. The one safety exception is base movement
 after quality validation: the final tree is no longer the reviewed head tree,
-so rebase and rerun the canonical quality procedure even when GitHub reports a
-clean merge. Otherwise, skip needless rebases.
+so ordinary merge mode rebases and reruns the canonical quality procedure even
+when GitHub reports a clean merge. Stack mode instead invalidates the current
+and upstack bindings and returns `stack-coordinator-sync-required`; it never
+rebases and never pushes another layer, though it does push its own layer branch
+in Phase 0 and Phase 3b. Otherwise, skip needless rebases.
 
 **Bot pings by iteration.** Never ping GitHub Copilot and never treat Copilot as
 an expected review signal; quota exhaustion otherwise leaves the loop waiting
@@ -221,17 +307,22 @@ self-resume signal. Either:
   CI, never delete/skip tests or weaken lint/tsconfig, then merge on green.
 - **Phase 4/5:** post the iteration's `@codex review` ping after a fix push,
   update state, schedule the next wake (or stop per harness above).
+- **Stack mode:** the same phases run, minus 3a, 3c.1–3c.5, and 3d. Phase 2
+  routes remaining fix work to 3b and terminal-green to 3c.0
+  (`ready-stacked`); the spent iteration budget escalates via
+  `stack-coordinator-fix-required` instead of forcing.
 
 ---
 
 ## Exit states
 
 | Status | Meaning |
 |--------|---------|
+| `ready-stacked` | Opt-in stacked layer is green, review-terminal, quality/test-clean, and every mandatory proof scenario is linked to the validated head or validly deferred to a named higher layer. The lane fixed its own layer; the coordinator owns restacking, base retargeting, submission, and landing |
 | `done-clean` | PR merged on main |
 | `done-max` | 5 normal + 1 force-finalize exhausted, merge genuinely blocked |
-| `blocked` | Unrecoverable conflict, gate failure, API error, force-finalize CI failed, or a non-empty `/quality` gate awaiting an author decision |
+| `blocked` | Unrecoverable conflict, gate failure, API error, force-finalize CI failed, a non-empty `/quality` gate awaiting an author decision, a missing mandatory proof scenario, or a `stack-coordinator-*` escalation |
 
 Always print the final summary (PR, branch, iterations, status, reason,
 per-iteration log, unaddressed items) on exit. Do NOT schedule a wake when
-`status` is `done-clean` / `done-max` / `blocked`.
+`status` is `ready-stacked` / `done-clean` / `done-max` / `blocked`.