v12.0.0

Codex terra model family removed; its users move to sol at unchanged medium effort.

Migration (breaking)

• Custom agents declaring terra. Replace codex.model: "terra" (and any wraps_model: "terra") with "sol" in every .asd/agents/*.md you authored or kept as a local edit, then run node .asd/sync.js --apply <generated-view-path...> and node .asd/sync.js --check. Until then /asd-update's post-update check and sync --check exit 1 with unknown model family (family "terra", …); the already-generated view keeps running. There is no migration script — a release migration never rewrites custom agents.

Removed

• Codex model family terra (gpt-5.6-terra) from release-manifest.json model_families; the Codex model-ID check accepts only the remaining families.

Changed

• asd-dev and asd-tester (base, standard tier) and the asd-external-review wrapper resolve to sol / medium under Codex, up from terra / medium — expect higher Codex usage on these agents. Standard vs critical (sol / high) is now an effort split. Run /asd-update to regenerate the Codex agent views.

v11.1.0

Codex sol and luna model families move to GPT-6.

Changed

• Codex sol resolves to gpt-6-sol and luna to gpt-6-luna; terra stays gpt-5.6-terra. Run /asd-update to regenerate the Codex agent views and the External Review wrapper.
• Codex model-ID validation accepts any gpt-<N>[.<M>]-<family> ID, so a later family bump is a release-manifest.json edit alone, with no sync engine change.

v11.0.0

Remediates the Glings sprint 003 (subsystem-layout-migration) retrospective. Each reviewer now gets its own scoped file list and, in impl-review, its own .diff patch instead of a shared list and rendered diff text; concurrent dispatches are capped and large audits read in batches; scope collection drops the decision-prompt UI for free-form input and no longer clears context at phase boundaries; and a sprint may skip one enabled optional document for itself alone.

Migration

• No migration script. New manifest fields (--base/--head, pureRename rows, per-reviewer file lists) are optional to validate-ledger; a manifest emitted before the upgrade still validates, and state.json's schema is unchanged. An in-flight review iteration started before the upgrade: finish it as emitted, or discard and re-emit it fresh under the new per-reviewer contract — both are safe.

Added

• Per-reviewer scope. emit-manifest builds each reviewer's file list from one selector keyed by phase and reviewer (review-policy.md "Reviewer responsibility"). In impl-review, Testing narrows to the isTest files plus --test-plan <path...> (test-plan.md and its segments); Correctness, Efficiency and Documentation keep the full scope list.
• .diff patch files. emit-manifest --base <sha> --head <sha> (impl-review only) writes one patch per manifest or part (<reviewer>[.part-N].diff) beside it, and grants the compact pureRename row (NA_PREDICATES.pureRename) to every rename with identical content and mode — only a machine-proven rename qualifies, never a namespace/import-only edit. The reviewer payload carries the manifest and .diff paths, never rendered diff text, and no reviewer is ever told to run git.
• Dispatch ceiling. DISPATCH_CEILING (20) caps concurrent dispatches in one phase step; anything above it runs in sequential sub-waves (review parts, impl task waves), each judged separately for correlated interruption. surfaceCheck also returns the implied review-dispatch upper bound. A change-surface cap-override request states the dispatches count it implies.
• Batched audit reads. AUDIT_BATCH_THRESHOLD_FILES (200): when the touched areas exceed it, the architect payload carries a batched-read plan (grep first, then targeted section reads) instead of a flat file dump; asd-architect's maxTurns rises to 150 to match (the batched-read plan, not the turn cap, is the real control).
• Per-sprint document skip (sprint-lifecycle.md "Optional documents"): the user may flip an enabled prd, ux_spec, adr or c4 to false for the active sprint only, at the scope gate or the audit exit, before any draft of that document exists — a hard gate, narrow-only, logged as " skipped this sprint by user" distinct from config-disabled. audit itself is excluded.
• Free-form scope. Raw scope arrives as a plain chat message, not a decision prompt; before the scope gate the orchestrator asks about cleanup and quality criteria (legacy removal, warning budget, doc consolidation) unless the raw scope already covers them.
• BA/UX doc rename/delete now routes through the orchestrator at design-promote: the user approves, then the orchestrator runs git mv/git rm inline and re-dispatches the creator fresh to update content and inbound links.
• Design-review draft correctness. Correctness gains a design-review rubric entry: AC completeness against sprint.md, contract soundness, ADR decision soundness — covering every changed draft, not only UI drafts. From iteration 2 every design-review reviewer gets only the drafts changed since the previous iteration: runtime.js draft-snapshot persists each iteration's draft hashes in reviews/design/iter-NN/snapshot.json and lists what changed.

Changed

• Context hygiene (core.md): no instruction ever tells the orchestrator to clear context. A phase boundary continues the chain itself; context compaction is automatic and host-driven. The gate answer is written to disk before any further work, so a mid-gate compaction stays recoverable.
• Stub-resolution verification moves from the Testing reviewer's rubric to Documentation's, alongside persistent-doc actuality.

v10.0.0

Remediates the Glings sprint 002 retrospective. External Review can now return partial coverage from batched reviews instead of silently skipping, a failed dev/tester dispatch is reconstructed from git evidence before it is re-sent, plans declare a change surface capped at 100 files, and decisions-log.md / test-plan.md rotate into numbered segments so long sprints stay readable.

Migration (breaking)

• Merge duplicate ## Defects sections. node .asd/runtime.js defect-stalemate now fails closed when a test-plan.md holds more than one ## Defects heading (exact or suffixed), naming each heading line. Before resuming an active sprint, merge those sections into the single table. There is no migration script.
• External Review skip is narrowed. APPROVE (skipped: ...) now applies only to a non-ready preflight or an active negative cache; a failure after invocation is an interrupted dispatch, or APPROVE (partial: <n>/<m> files; <cause>) when at least one batch completed with no finding at or above floor (external-review.md "Outcome contract"). A partial satisfies only its iteration and never latches; unreviewed files carry into the next iteration.
• New hard gate change-surface cap override. A plan whose Change surface: <n> files exceeds SURFACE_CAP_FILES (100) blocks acceptance until split into sequential sprints or overridden with a bound; impl-review re-measures at first entry. Plans without the line are grandfathered.
• Commit trailer contract. Every commit a dispatched dev or tester makes carries one ASD-Task: <id> line per id it covers (git-strategy.md "Commits").

Added

• Failed-dispatch reconstruction (sprint-lifecycle.md "State recovery"): the routing line records dispatch HEAD <sha>; a dispatch returning no signal is rebuilt from ASD-Task trailers and uncommitted leftovers before re-dispatch. An impl-test trailer never marks its entry landed, and a D-N lands only once its Defects row reads fixed.
• External Review batching: scope above SPLIT_THRESHOLD_FILES is reviewed in sequential batches inside one dispatch; t_review-report.md gains Reviewed files and Unreviewed files.
• node .asd/runtime.js surface-check --files <path> [--bound <n>] and SURFACE_CAP_FILES.
• Standing n/a for Documentation Framework mode and Template adherence: emit-manifest --self-hosting and a templated-artefact classifier let split parts mark them n/a truthfully.
• Log rotation (artifact-layout.md "Decisions log", "Test plan"): decisions-log.NNN.md at a phase change, test-plan.entry-NN.md at impl-test re-entry; cross-span readers read segments in order.

Changed

• defect-stalemate table errors name the offending line (line <n>: ...) and validate the separator row.
• state.json carries only keys t_state.json defines; gate_decisions reason/evidence are short refs, narrative goes to the decisions log (artifact-layout.md "State file").
• Test coverage grew from 203 to 207 checks.

v9.0.0

The configuration surface shrinks from 28 settings to 20, and pull requests are always ASD-managed through gh. Three workflow guardrails replace an agent's word with deterministic evidence: a repeated impl⇄impl-test defect set escalates as a stalemate, a fail-first proof must carry raw runner evidence, and the retrospective deduplicates findings before drafting each survivor as a one-line guardrail with a named home. Audit now reads every relevant docs/ document and lets the canonical ASD document win a contradiction.

Migration (breaking)

• Run /asd-update. The new .asd/migrations/9.0.0.js rewrites .asd/project/config.yaml line by line, keeping your comments and line endings:
  • documents.c4: enabled keeps your project.diagram_tool (or sets likec4 when absent); documents.c4: disabled sets diagram_tool: none.
  • skip_design_phases: enabled disables documents.prd, ux_spec and adr and sets diagram_tool: none.
  • Legacy documents.audit: enabled/disabled become always/off.
  • documents.c4, skip_design_phases, git.gh_enabled, git.auto_pr, system.os, system.tools.likec4, system.tools.designmd and review.scoped_fan_out are removed.
  • A config shape it does not recognise (flow maps, duplicate keys, tabs, mixed line endings, out-of-range values) is left untouched with a warning naming the re-run command.
  • A sprint already active keeps working from its frozen state.json.
• gh is required. /asd-init stops unless gh --version and gh auth status succeed, and the pr phase opens and merges through gh only; a gh failure is FAILED naming gh auth login or the install step. There is no manual-PR fallback.
• Diff-scoped rubric n/a marking is always on. Projects that omitted review.scoped_fan_out previously got full per-section review; the standing n/a predicates now always apply.
• An unknown documents.audit value blocks scope instead of being normalised.
• A release migration is a sanctioned config writer. /asd-update may apply release-mandated key renames and removals, plus the value mappings, key insertions and shipped-comment rewrites that carry a renamed or removed key's or value's intent (core.md).

Added

• Stalemate breaker (sprint-lifecycle.md "Impl-test phase"): two consecutive impl-test entries routing the same code-defect set emit FAILED: stalemate and ask the user to continue with guidance, accept the defects as debt, or abort. Identity is file path, the runner's first failure line and the failing test name, compared by the new node .asd/runtime.js defect-stalemate. A logged answer covers only the next routing of that set. test-plan.md Defects gains an Entry column, and an interrupted impl-test entry is resumed rather than duplicated.
• Audit contradictions (sprint-lifecycle.md "Audit phase"): audit reads every docs/ document bearing on the touched areas; a canonical ASD document wins a contradiction without a gate, and a contradiction precedence cannot settle is a hard user decision. t_audit.md gains an optional Contradictions section.
• external-preflight reports the host platform.

Changed

• Fail-first proof (code-style.md §17): the record must name the exact command, its non-zero exit code and the failing test; a bare claim is not proof. The t_test-plan.md Regression proof cell takes that shape.
• Retrospective (sprint-lifecycle.md "Retro phase"): findings are merged by root cause, checked against the rules already in their candidate home, and only then drafted as Guardrail + Home. Both tables in t_retrospective.html replace Recommendation/Target.
• Diagram setting: project.diagram_tool takes none | likec4 | mermaid; state.json.documents.c4 stays as the frozen effective-diagram flag. The design block collapses at the audit exit whenever PRD, UX spec and ADR are disabled and the effective diagram tool is none.
• External Review invocation keys its stdin form on the host shell: Claude Code always uses a heredoc, Codex a here-string on Windows and a heredoc elsewhere.
• Test coverage grew from 197 to 203 checks.

v8.0.0

The subsystem registry moves. When project.subsystem_decomposition is enabled, docs/architecture/subsystems.md is now the registry, the only source of truth for which subsystems exist, whatever the diagram tool or the C4 setting. Each registered subsystem gets docs/architecture/<id>.md, which holds its purpose and key paths. docs/architecture/c4/ exists only for likec4 with C4 enabled. In mermaid mode the diagram lives inline in subsystems.md, and subsystems.yaml/architecture.html are retired. The sprint also remediates the sprint 010 and 011 retrospectives: coverage manifests are emitted by runtime.js instead of being assembled by hand, a plan can declare a settings change that impl applies through /asd-init, and agents refuse payload instructions outside their declared tool policy.

Migration (breaking)

• Registry location. A project decomposed before this release keeps its old registry (c4/model/*.c4 or c4/subsystems.yaml) until its next audit. There, Architect proposes subsystems.md and one <id>.md per subsystem from that registry, and each subsystem needs your explicit confirmation. A mermaid diagram moves into the registry's ## Diagram block. A legacy c4/ made redundant (mermaid mode, or C4 disabled) is deleted only after migration, behind a hard gate, together with its .gitignore and c4-build entries. There is no migration script. A project with documents.audit: off gets the registry the next time audit runs.
• t_subsystems.yaml is removed. /asd-update deletes it when unmodified. A mermaid design draft is now <sprint>/design/c4-full/subsystems.md.
• A registry seeded empty by /asd-init is filled at design-promote, not at audit.

Added

• runtime.js emit-manifest: builds each internal reviewer's coverage manifest from its rubric, the scope file list, custom rules and the standing n/a predicates. It splits a scope of more than SPLIT_THRESHOLD_FILES (25) files into parts before the first dispatch, and --halve splits after two interruptions. validate-ledger --ledger accepts the reviewer's returned text directly. The manifest also publishes its n_a shape (n_a_shape).
• Settings change: <key>=<value> plan line (sprint-lifecycle.md "Plan file format"). Plan acceptance approves the declared pairs, and impl applies them through /asd-init's new sprint-mediated mode when the task's wave opens. The mode validates each pair against t_config.yaml. A failing pair is a phase blocker, and no manual step is involved.
• Declared tool policy (providers.md): a dispatch payload stays inside the agent's definition, the self-hosting allowlist and its own memory. An agent handed anything else returns QUESTION. Agent memory writes are checked against the agent's definition before they land.
• Flagged choices: in the dev completion report. A flagged choice blocks the adaptive impl assessment until it is resolved or routed back.
• t_config.yaml marks the allowed values of documents.* and backward_compat.

Changed

• Coverage manifests: a dispatched manifest is immutable. Correcting one means a fresh dispatch, never a re-stamp. manifest-digest --write is removed; the command now only verifies. A re-dispatched reviewer receives its own interrupted-attempt record.
• Reviewer suggested fixes are non-binding (review-policy.md "Verify before applying").
• Code-style rules: a test or rule that names the members of a set derives the set from its source (code-style.md §17). A per-entry impl-test suite record measures the tree that entry analysed (sprint-lifecycle.md "Impacted test set").
• Agent-memory commits: a dispatched agent with a commit tool commits its own memory writes (git-strategy.md).
• Test coverage grew from 187 to 197 checks.

v7.3.0

A project can now skip the design block outright. skip_design_phases: enabled routes a sprint from audit straight to plan: design, design-review and design-promote are recorded as skipped and none of their skills or workflows is ever loaded. The existing skip when every design document is disabled stays unchanged; the new setting only makes it explicit and cheaper. Absent from an existing config.yaml means disabled, so nothing changes until a project opts in; update through /asd-update, no migration script.

Added

• skip_design_phases: enabled | disabled (t_config.yaml, sprint-lifecycle.md "Optional documents"): a top-level setting frozen into state.json at scope, like user_gates. When enabled, documents.prd/ux_spec/adr/c4 freeze false for the sprint whatever their configured values, and scope logs the documents it suppressed. documents.audit is untouched.
• The audit exit performs the skip (asd-phase-audit.md): one mechanical write, covering a skipped audit and the design block together, sets phase="design-promote" and returns NEXT: plan. The return contract is now NEXT: <design | plan>.
• /asd-init offers the setting in fresh mode, and re-init diff mode now lists every template field absent from the current config with its default, so a newly shipped field is editable.

Changed

• Resume and the plan precondition key on a frozen collapse test (sprint-lifecycle.md "Design/design-review/design-promote collapse", asd-sprint, asd-phase-plan.md, checkpoints.md): the design block counts as collapsed when skip_design_phases is true or every design document is disabled — never from the historical skipped_phases list, whose stale entry after a rollback could otherwise skip a real, interrupted promotion.
• The session-start hook reports plan as the next phase after audit when the setting is on.
• Test coverage grew from 184 to 187 checks.

v7.2.0

Agent-facing text becomes a governed cost surface. ASD now carries an iron rule for it, sited beside the single-source-of-truth rule and enforced through the Documentation reviewer's blocking coverage ledger: a line earns its place only by changing what a reading agent does, with a removal test that is necessary and controlling, and a preserve-list that protects contracts, exhaustive enumerations, case distinctions, stated failure modes, and standalone safety prohibitions. Roughly 18.7 KB of prose was cut from canon under it. The sprint also remediates every problem the sprint 009 retrospective identified. Nothing in consumer state changes shape; update through /asd-update, no migration script.

Added

• A documentation-economy iron rule (artifact-layout.md): what agent-facing text is cut on sight, the three tests that decide it — removal necessary and controlling, provenance and enforcement corroborating — and what is never cut whatever its length. It binds at authoring time, not only at review, so it reaches every creator that loads the file, including the two that never load code-style.md; and it reaches artifact templates, so consumer projects inherit it. The Documentation reviewer carries it as a rubric entry, which is the only path into the blocking coverage ledger.
• Rubric-ID derivation is stated (review-policy.md "Coverage ledger"): the manifest must enumerate every stable reviewer-rubric id and an omitted item invalidates a verdict, but nothing said where those ids come from. They are the rubric's own entry text, so a rubric edit moves the manifest in the same change.
• Manifest row_example (review-policy.md, runtime.js): one filled row travels beside the vocabulary, built from the vocabulary constant so it cannot publish a shape the validator rejects. validate-ledger rejects a manifest whose n_a is not an object or carries a key outside the row-type labels, instead of silently degrading it into "no predicate authorized" — a shape that accepted the malformed manifest while rejecting every truthful row.
• Dispatch waves in the plan format (sprint-lifecycle.md, t_plan.md, asd-phase-plan.md, asd-phase-impl.md): the plan's ## Dependencies section is now required and carries a wave table; a task changing the dispatch or commit contract is ordered ahead of everything dispatched under it, alone in its wave. The impl phase schedules from that table instead of deriving its own topological sort, with a fallback for a plan authored before the rule.
• Claude effort is validated at the emission site (sync.js): against the same vocabulary the Codex counterpart already used, reached whenever the field is emitted rather than when a sibling field happens to be present. An invalid value previously shipped into the generated view, where the host ignored it while canon, the tier matrix and the README all claimed otherwise.
• A corpus-wide citation sweep (tests/run.js): every canon citation of the form file plus heading or bold label must resolve — 185 pinned relations, up from 20. It immediately found two dangling pointers whose target headings were renamed in an earlier release, both now retargeted.

Changed

• Whole-tree git commands are named and banned for a dispatched agent (git-strategy.md, custom-coding-rules.md): git add -A/-u, git add --renormalize, commit -a and git stash, unconditionally — an agent cannot observe whether a sibling dispatch is in flight, so the conditional permission is the orchestrator's alone.
• Agent-memory commit ownership covers the co-author case (git-strategy.md, artifact-layout.md): the carve-out was justified by the author holding no commit tool, which is why it never reached a creator that does. Co-authorship is now defined where memory is — it can arise only between concurrent dispatches of the same agent, which share one directory.
• A fail-first mutation must be restored before the agent's next tool call (code-style.md §17), and a mutation left on disk is a defect regardless of what the suite reports.
• The impl completion gate reads the round's diff (asd-phase-impl.md): before committing or advancing, every path the round touched must be one its agents were authorised to touch. The ## Operations used block grants the git command that gate needs — the obligation previously existed at a site with no tool to perform it.
• The coverage-ledger enforcement splits its two cases (review-policy.md): an incomplete or unverifiable ledger rejects and re-dispatches, while one whose content resolves every row in the wrong shape is transcribed once by the phase workflow, re-validated, and recorded as a deviation. Distrusting a verdict is warranted by missing evidence, not by a wrong container.
• An External Review availability skip is a friction entry (external-review.md), so a recurrence is visible to the next retrospective rather than only to the iteration that paid for it.
• Six false single-source declarations were corrected across review-policy.md, both review workflows and several agent bodies: a "not restated here" or "sole statement" claim that is false converts a self-declared contract into a trap, because reviewers use these declarations as the premise of findings. Where the restatement earns its place at the acting site, the declaration was narrowed instead.
• Reviewer bodies, both review workflows and several rule docs lost restated text that a tool grant, a validator or another file already owned — including thoroughness exhortations the coverage ledger enforces deterministically. AGENTS.md's rule-doc list is a pointer at core.md "See also" rather than a second, already-drifted copy.
• Test coverage grew from 171 to 184 checks.

v7.1.0

Remediation of every problem the sprint 008 retrospective identified. The theme this time is one-sided obligations: a rule that told one party what to do while the party who had to act read a different file, or read nothing at all. Reviews gain an evidence path for a dispatch that returns after its replacement, a correlated-interruption branch so one session-wide failure is recorded once rather than N times, and an outcome contract that forbids External Review returning nothing. The coverage manifest now carries the row vocabulary a reviewer must satisfy, published from the same constant the validator enforces. Nothing in consumer state changes shape; update through /asd-update, no migration script.

Added

• Manifest vocabulary (review-policy.md "Coverage ledger", runtime.js): the allowed statuses per row type and the p/f placement rule now travel inside the manifest a reviewer is handed, instead of living only in prose it had to recall. Values come from one exported constant shared by the emitter and the validator, so published and enforced vocabulary cannot drift. Required in every manifest a phase workflow emits; optional to validate-ledger, which validates a manifest predating the field exactly as before and rejects one whose vocabulary diverges.
• An outcome contract for External Review (external-review.md "Outcome contract"): exactly two permitted returns — a verdict, or an availability skip naming its cause. Any inability to complete returns the skip, so the wrapper awaits the wrapped CLI inside its own dispatch and never backgrounds it; a return that is neither is not permitted and not a verdict, and its disposal is imported whole from the interrupted-dispatch rule. The agent's FAILED signal is gone, and ABORT is scoped to a precondition missing before any invocation.
• A late-returning dispatch may now be recorded (review-policy.md "Late duplicate return"): when a replaced dispatch delivers after its replacement's verdict was recorded, and carries an at-or-above-floor finding contradicting it, the phase workflow verifies that finding against source and records the more severe token. It holds for any replaced dispatch, External Review included. Previously the interrupted verdict never counted, which is right for bookkeeping and wrong for evidence.
• Correlated interruption (review-policy.md): one cause taking every dispatch in flight is recorded once as an iteration-level event, rather than arming the split trigger once per reviewer.
• Criterion cost surfacing (checkpoints.md): at the gates that already exist, a criterion's running cost is stated with the decision — iterations charged and fix rounds charged, both derived at read time from the review files and the decisions log, with no new state and no stored counter.
• A conditional Reachability: line in the plan format (sprint-lifecycle.md, t_plan.md): a task whose value depends on two phases agreeing names which two and on what, checked at plan approval. Absent means the task has no cross-phase dependency — deliberately not Material risk's fail-closed semantics, and never input to routing.
• Scope-time re-verification (sprint-lifecycle.md, asd-phase-scope.md): a retrospective-derived acceptance criterion is checked against current HEAD before it becomes an AC-N, and the verification is recorded in decisions-log.md. A retrospective is written against the HEAD of the sprint that produced it and carries no evidence that its rows are still unresolved when a later sprint picks them up.

Changed

• Staging and commit ownership is stated whole (git-strategy.md): a dispatched agent stages only the paths it authored and commits every path it authored before signalling completion. The rule previously stated only the negative half, and asd-dev was granted no git command at all — so the agent it governs could not follow it. That grant is now in the agent's tool policy, alongside the tester's.
• Fix rounds run as one ordered chain, dev chain before tester chain, never concurrently (asd-phase-impl.md): exactly one agent is in flight across a whole round. Parallel fix rounds each cost a review iteration in sprint 008 by introducing cross-file contradictions; initial-mode parallelism is unchanged.
• A reviewer's proposed fix is verified against source before it is applied (review-policy.md "Autofix vs escalation"). A prescription is a claim about source, not an instruction; an equivalent correct fix stays permitted, an unverified transcription does not.
• Agent memory is single-homed and in the review surface in both modes (artifact-layout.md "Agent memory"): the property was stated four times inside self-hosting carve-outs and nowhere for consumers. It is now stated once and cited, and the diff-reachability half names who commits a reviewer's memory writes so they reach a reviewed diff at all — a reviewer holds no commit tool.
• Line-ending guidance is platform-neutral and the pre-commit lint form is named (code-style.md §19): a scripted edit anchors on the file's actual EOL, a whole-file diff for a small edit is the symptom, and the check is git diff --cached --check — the bare form exits 0 once the damage is staged, so a stage-then-lint-then-commit sequence passed blind.
• coverageManifestDigest digests the manifest exactly as written; manifest-digest --write stamps the vocabulary into the file before digesting it. An earlier shape injected the vocabulary at digest time, which moved the identity of every manifest stamped before the field existed.
• Test coverage grew from 160 to 171 checks, and three existing assertions were re-pinned after going red on correct edits — a copy count became a single-owner-plus-citations property, an ordinal became a citation, and a header quotation became the delegation rule it was really about.

v7.0.0

Remediation of every problem the sprint 007 retrospective identified, plus the fixes that remediation itself turned out to need. Reviews gain a contract for what happens when a dispatch dies mid-flight; routing learns to tell a risky change from a routine edit to a risky file; the --apply command stops succeeding silently when it did nothing; and several always-loaded rule docs get shorter. Breaking: a bare node .asd/sync.js --apply with no target paths now fails instead of reporting success, and the reviewer read-only guarantee is restated in the narrower form that is actually true. Update through /asd-update; no migration script is needed, because nothing in consumer state changes shape.

Added

• Split and interrupted review dispatch (review-policy.md "Interrupted dispatch and split dispatch"): a contract for a read-only dispatch that dies before returning. The reviewer is re-dispatched fresh in the same iteration — never resumed, so "no dispatched reviewer is ever reused or resumed" stands unchanged — and the interrupted attempt is appended to decisions-log.md at the moment it happens, not at the verdict parse an interrupted dispatch never reaches. A reviewer interrupted twice on the same manifest digest is split into two fresh dispatches over disjoint files partitions, each carrying a complete digest-bearing manifest and the full rubric, with a union property checked before the two half-verdicts merge into one. An internal reviewer is never recorded as skipped and never satisfies DoD without a completed verdict; APPROVE (skipped: …) stays exclusive to an unavailable external provider.
• Typed material risk in routing. A plan task's Material risk: line now distinguishes risk to the change from risk to the artifact, and routeTask reads the distinction: a risky edit still routes to the most expensive tier, while a verifiable edit to a high-stakes file no longer does so by that fact alone. Both input shapes are accepted — a bare string keeps the previous force-critical semantics — so a consumer mid-upgrade is never blocked. Five class names (security, authentication, migration, public contract, workflow gate) are reserved: typing one of them artifact is rejected, so a fail-open path cannot be opened by mislabelling.
• A record of which agent frontmatter fields the host actually honours (providers.md), replacing a code comment that admitted one emitted field was undocumented.
• Test coverage for the new contracts and for content that had none: routing in both input shapes and at its reason-precedence boundaries, the --apply empty-target guard, the coverage-manifest partition property, and mirror checks over statements that must agree across files. The suite grew from 136 to 160 checks.

Changed

• BREAKING: node .asd/sync.js --apply with no target paths now returns ok: false and exits 1, before the apply loop and before the hash-ledger recompute. It previously reported success, wrote nothing, and still refreshed the ledger — so --check and the ledger tests stayed green over stale generated views. Any automation invoking --apply without arguments must now pass the generated view paths it intends to write.
• BREAKING: the reviewer read-only guarantee is corrected, not weakened. Reviewers write no review artifact, code or doc — that is what lets the phase workflow own the review file — while memory: project is a separate write channel they do use and the host serves. External Review is a named carve-out: it carries Bash because a command-runner is required to invoke the wrapped CLI at all, so its guarantee is enforced on the wrapped subprocess instead. Documentation that asserted an absolute host guarantee was asserting something untrue.
• The documented form of the --apply argument now names what the tool actually matches — generated provider-view paths, never .asd/ canon. The previous wording named the canonical path, so following the documentation produced a silent no-op.
• The external-review negative cache is consulted before the scope manifest is assembled, so a known-unavailable provider costs neither manifest assembly nor a dispatch.
• The over-engineering and structure/cohesion checklists bind at authoring time, not only at review, and the dev role loads them.
• The main orchestrator commits its own bookkeeping at phase exit, and a dispatched agent never commits orchestrator-owned files it did not author — previously unstated, and resolved defensively by agents at every phase boundary.
• Agent memory has a stated home at the provider-view root and never inside a sprint tree, and a sprint folder holds only what the path map names. The self-hosting review surface was narrowed from a blanket .claude/** exclusion to the generated subtrees, so hand-authored agent memory is reviewed like any other source.

Removed

• BREAKING: state.json.derived_handoff, added and retired within this release. It cached a phase's derived scope list, but the writer and reader computed different diff bases on every cycle re-entry, so the handoff it existed for could not occur. No consumer state carries the field and no migration is required.