feat(protocol): add universal agent session entrypoint

.agents/NOW.md

@@ -63,11 +63,11 @@ both gate models, reproduced 2–3x on an idle box. See the
    `parity-ledger.md` LINE anchors (re-anchor by ROW ID).
 
 **Operator/helper protocol**
-([spec](workflow.md)): roles DECLARED then MATERIALIZED
-into a lock or worktree+PR; operator merges PRs first and does features only via
-sub-agents; helpers use worktrees on `row/<ROW-ID>` and open a DRAFT PR at the
-START, which IS the claim. **W0-W5 LANDED**; role discipline ENFORCING,
-`--require-role` is the DEFAULT. Queue: 10 rows; backfill 79 rows, 30 anchored.
+([spec](workflow.md)): roles are a lock or worktree+PR; operator delegates,
+helpers claim `row/<ROW-ID>` with a start-time DRAFT PR. **W0-W5 LANDED**;
+role/entrypoint gates ENFORCE `agent-start.py` → claim → preflight. Review FAIL
+loops through fresh implementer, both gates, and fresh review until PASS; budgets
+cannot stop it. Queue: 10 rows; backfill 79 rows, 30 anchored.
 **Upstream inventory** ([spec](specs/upstream-derived-inventory-2026-08-05.md),
 drift-gated, arch parity BOTH ways): SM060/061/070 below vLLM's floor =
 OUT-OF-SCOPE; COMP-*/DISTRIBUTED-* are REAL unported work; **all 362 archs have

.agents/policy-cutover

@@ -1 +1 @@
-031410e8f01be61ab57aa228550156a365292351
+9432a7adff82a4a46c870a5d5f27e07efa2648e6

.agents/policy.csv

@@ -1,6 +1,7 @@
 rule_id,scope,trigger,requirement,enforcement,waiver_class,procedure
 POL-AUTH-REGISTRY,repository,any policy decision,Use policy.csv as the sole repository-policy authority.,scripts/check-policy.py,never,.agents/workflow.md
 POL-AUTH-PRECEDENCE,repository,repository instructions conflict,Apply AGENTS then the selected policy rule then its procedure then task evidence.,scripts/check-policy.py,never,.agents/workflow.md
+POL-BOOT-ENTRYPOINT,session,at session start,Run agent-start before role declaration preflight or task state.,scripts/check-protocol-consistency.py; scripts/check-policy.py,never,.agents/workflow.md
 POL-BOOT-ROLE,session,before task work,Resolve or declare the worktree role before reading task state or editing.,scripts/check-role-discipline.py; scripts/check-policy.py,never,.agents/workflow.md
 POL-BOOT-NOW,session,after role resolution,Read NOW.md before deeper task records.,scripts/check-now-current.py; scripts/check-policy.py,never,.agents/workflow.md
 POL-BOOT-TASK,session,after NOW,Read only the claimed task and its linked procedures and evidence.,scripts/check-policy.py,expiring,.agents/workflow.md
@@ -15,7 +16,7 @@ POL-REMOTE-UNKNOWN,remote gate,remote state cannot be queried,Report REMOTE_UNVE
 POL-OPERATOR-BOUNDARY,operator,feature work,Delegate implementation and keep main integration and GPU ownership in the operator role.,scripts/check-role-discipline.py; scripts/check-policy.py,expiring,.agents/workflow.md
 POL-OPERATOR-VERIFY,operator,implementation returns,Run the claimed gate instead of trusting an implementer report.,scripts/check-protocol-consistency.py; scripts/check-policy.py,never,.agents/workflow.md
 POL-REVIEW-FRESH,review,implementation is ready for review,Use a fresh reviewer that performs static review and targeted scratch mutation.,scripts/check-protocol-consistency.py; scripts/check-policy.py,never,.agents/workflow.md
-POL-REVIEW-NO-REPAIR,review,a finding is found,Return findings to a fresh implementer and do not repair them in the coordinating session.,scripts/check-protocol-consistency.py; scripts/check-policy.py,never,.agents/workflow.md
+POL-REVIEW-NO-REPAIR,review,a finding is found,Return actionable in-scope findings to a fresh implementer without repair in the coordinating session and repeat focused and full gates plus fresh scoped review until PASS; attempt budgets never terminate correctable findings and only explicit developer direction or a precise external authority or resource blocker may stop the loop.,scripts/check-protocol-consistency.py; scripts/check-policy.py,never,.agents/workflow.md
 POL-PR-DISPOSITION,operator,a PR is verified or obsolete,Merge a verified PR in-session or close an obsolete PR with the reason recorded.,scripts/check-policy.py,expiring,.agents/workflow.md
 POL-MIRROR-VLLM,feature port,vLLM defines behavior,Mirror every applicable vLLM mode instead of inventing product behavior.,scripts/check-agent-record.py; scripts/check-policy.py,never,.agents/porting.md
 POL-GROUND-CHAIN,parity investigation,comparing implementation,Ground conclusions in vLLM and the complete runtime dependency and generated-kernel chain.,scripts/check-policy.py,never,.agents/verification.md

.agents/prompts/operator.md

@@ -14,6 +14,7 @@ policy-rules: POL-PROMPT-ENVELOPE POL-PROMPT-BOUNDARIES POL-OPERATOR-BOUNDARY PO
 
 ## Method
 - `OP-DELEGATE` | required | Delegate implementation and repairs to fresh implementers.
+- `OP-CONTINUE` | required | For every actionable in-scope reviewer FAIL dispatch a fresh implementer, run focused and full gates, and dispatch a fresh scoped reviewer; repeat until PASS because attempt or retry budgets are scheduling controls and never terminal blockers.
 - `OP-VERIFY` | required | Run claimed verification on the returned commit without trusting the implementer report.
 - `OP-REVIEW` | required | Dispatch a fresh reviewer for independent static review and targeted scratch mutation.
 - `OP-DISPOSITION` | required | Merge a verified PR in-session or close an obsolete PR with its recorded reason.
@@ -28,6 +29,7 @@ policy-rules: POL-PROMPT-ENVELOPE POL-PROMPT-BOUNDARIES POL-OPERATOR-BOUNDARY PO
 - remaining_concern: EVIDENCE | NONE
 
 ## Stop conditions
-- `STOP-AUTHORITY` | BLOCKED | A required action exceeds Authority.
+- `STOP-AUTHORITY` | BLOCKED | A required external action exceeds Authority and the precise missing authority is named.
+- `STOP-RESOURCE` | BLOCKED | A required external resource is unavailable and the precise resource is named.
+- `STOP-DEVELOPER` | BLOCKED | The developer explicitly directs the review loop to stop before PASS.
 - `STOP-REMOTE` | REMOTE_UNVERIFIED | Required remote state cannot be queried.
-- `STOP-BLOCKER` | BLOCKED | Non-terminal work cannot name its blocker on the PR.

.agents/specs/review-failure-continuation.md

@@ -0,0 +1,87 @@
+# Review-failure continuation
+
+User-approved 2026-08-08. Governance task: strengthen the existing
+`POL-REVIEW-NO-REPAIR` contract so an actionable review failure cannot be
+converted into a terminal result by an orchestration retry budget.
+
+## Verified gap
+
+The policy registry and workflow already require reviewer findings to return
+to a fresh implementer, followed by focused and full gates and a fresh scoped
+reviewer. They do not state that this cycle continues until `PASS`, and the
+operator prompt still permits a generic `BLOCKED` result. A generic attempt or
+retry budget can therefore stop work while an actionable, in-scope finding is
+still correctable.
+
+The branch also inherits a cutover-record defect from the policy-history
+squash. `.agents/policy-cutover` names commit
+`00927ed611f4c5b720ceb158f6174be1e5470b03`, which exists locally but is not an
+ancestor of the current head. The fail-closed trailer checker correctly rejects
+that unreachable anchor. This spec commit is intentionally strict and becomes
+the replacement reachable cutover anchor; a following strict commit updates
+only the marker.
+
+## Binding design
+
+Strengthen `POL-REVIEW-NO-REPAIR` rather than introduce an overlapping rule.
+Every actionable, in-scope reviewer `FAIL` starts this cycle:
+
+1. send the bounded finding and evidence to a fresh implementer;
+2. rerun the focused and full gates on the resulting immutable head; and
+3. send that head to a fresh scoped reviewer.
+
+Repeat the cycle until the reviewer returns `PASS`. Attempt and retry budgets
+are scheduling controls, never terminal blockers for correctable findings.
+The cycle stops short of `PASS` only on explicit developer direction or a
+precise external authority or resource blocker. The coordinating/operator
+session continues to coordinate and independently verify; it does not repair
+the finding itself.
+
+## Affected surfaces
+
+- `.agents/policy.csv`: strengthen the authoritative
+  `POL-REVIEW-NO-REPAIR` requirement.
+- `.agents/workflow.md`: bind the exact continuation procedure.
+- `AGENTS.md`: refresh the generated compact T0 projection.
+- `.agents/prompts/operator.md`: close the operator output/stop grammar so a
+  correctable finding cannot be reported as terminal `BLOCKED`.
+- `scripts/check-protocol-consistency.py` and
+  `tests/scripts/test_check_protocol_consistency.py`: require and mutation-test
+  the continuation semantics.
+- `tests/scripts/test_policy_contract.py` and
+  `tests/scripts/test_check_prompt_contract.py`: cover the synchronized policy
+  projection and closed prompt contract where applicable.
+- `.agents/state.md`, `.agents/NOW.md`, `docs/STATUS.md`, and
+  `docs/BENCHMARKS.md`: record the governance checkpoint without changing a
+  feature/model/backend/quantization surface.
+- `.agents/policy-cutover`: replace the unreachable SHA with this spec commit's
+  full SHA in a separate strict commit, without weakening any checker.
+
+## Verification and evidence
+
+The cutover repair must prove the replacement anchor is reachable and all
+commits at or after it use strict Git-parsed trailers:
+
+```sh
+cutover=$(tr -d '\n' < .agents/policy-cutover)
+git merge-base --is-ancestor "$cutover" HEAD
+python3 scripts/check-commit-trailers.py \
+  --range origin/main..HEAD --cutover "$cutover"
+```
+
+The policy change uses red-before mutations for the continuation phrases and
+the operator prompt row, then runs:
+
+```sh
+python3 scripts/check-policy.py
+python3 scripts/check-prompt-contract.py
+python3 scripts/check-protocol-consistency.py
+python3 -m unittest \
+  tests.scripts.test_policy_contract \
+  tests.scripts.test_check_prompt_contract \
+  tests.scripts.test_check_protocol_consistency
+scripts/agent-preflight.sh
+```
+
+No checker is relaxed, no attempt budget can terminate an actionable review
+loop, and no remote operation is part of this task.

.agents/specs/session-onboarding.md

@@ -1,5 +1,13 @@
 # Session onboarding — ask, don't assume
 
+<!-- session-entrypoint:begin -->
+Every session first runs `scripts/agent-start.py`. Explicit work supplies
+`--intent operator|helper|read-only` and a known helper row, suppressing the
+first-time welcome. Follow the printed claim instruction, rerun the entrypoint
+from materialized state, and then run `scripts/agent-preflight.sh`. The router
+is non-interactive and owns no role, lock, worktree, environment value, or gate.
+<!-- session-entrypoint:end -->
+
 User-directed 2026-08-06. Status: **IMPLEMENTED 2026-08-06**, except the one
 piece § Enforcement marks DEFERRED (refusal on write paths other than
 `preflight --staged`). This document is the contract; § Work breakdown records

.agents/state.md

@@ -42614,6 +42614,25 @@ tier manifests, forced-tier mutation tests, and execution on feature-poor and
 feature-rich hosts/emulation are release gates. W1 is now the CUDA per-source
 gencode prerequisite; multi-SM AOT and CPU ISA audits precede bundle work.
 
+## 2026-08-08 — Universal, source-owned agent session entrypoint (`SESSION-ONBOARDING-UX`)
+<!-- state: 2026-08-08T00:00 -->
+
+`scripts/agent-start.py` is now the mandatory, non-interactive first command for
+every session. It consumes `agent-onboard.py`'s real probe and renders stable
+welcome/action blocks; only an undeclared session without explicit intent gets
+the compact ASCII welcome. Declared and explicit-intent routes suppress it,
+print exact non-mutating next actions, respect operator lock conflicts, helper
+row/queue state, declared mode, and environment status without values.
+
+The onboarding probe now projects `branch` and the real per-worktree git-dir
+identity from `agent-role.py`; real CLI/worktree tests prevent renderer fixtures
+from masking a missing projection. Preflight keeps all flags and role gates but
+points undeclared sessions to the canonical entrypoint. The post-cutover policy
+registry, generated bootstrap, procedure, and protocol-consistency mutations
+bind start-before-preflight without copying banner text into Markdown. This
+governance checkpoint changes no engine, kernel, model, correctness, or
+performance path; the benchmark disposition is NOT APPLICABLE.
+
 ## 2026-08-08 — ARCH-ONE-SURFACE ROW 2: MiniMax-H3 video+audio generation folded onto the ONE surface (PR #123)
 <!-- state: 2026-08-08T04:30 -->
 
@@ -42982,8 +43001,6 @@ removing only `; #129: SPIKE∅`; the compact clause consumes the existing
 279150-character ratchet exactly. `ENG-RELEASE-BINARIES` remains `SPIKE`: there
 is no archive, runtime, correctness or performance evidence.
 
-
-
 ## 2026-08-08 — Tensor-parallelism end-to-end spike lands at the current pin (task #287)
 <!-- state: 2026-08-08T21:00 -->
 
@@ -43053,7 +43070,6 @@ F79-4 remain open on the landed tree; the review's merge-and-fix map is the
 binding description. Pi concurrency, BF16 GEMM/speed closure (W6) stay open
 as the lane's own next steps.
 
-
 ## 2026-08-08 — ROCm approach-(b): unified memory true by construction on integrated APUs
 <!-- state: 2026-08-08T21:30 -->
 
@@ -43247,7 +43263,6 @@ Row moved INVENTORIED→READY (roadmap_v1 + feature-matrix §2). M1-M4 are the i
 rows this unblocks; M1/M2/M4-CPU are CPU-completable, M3 (profile run) is
 dgx-gated. Records-only spike (no code).
 
-
 ## 2026-08-08 — ROAD-V1-MEM M1+M2 LANDED: absolute --kv-cache-memory knob + group-aware bytes-per-block (CPU brick)
 <!-- state: 2026-08-08T23:30 -->
 
@@ -43319,4 +43334,22 @@ Gates: `check-device-leakage` RED→GREEN (`kcuda=0`, DSR 32 == baseline 32);
 -Werror CPU build. SEPARATE pre-existing main breakage recorded, not fixed here:
 `check-doc-checkpoint` is RED on `1a021b1b` itself (that policy commit touched
 70+ `.agents/` files without docs/BENCHMARKS.md + docs/FEATURES.md); it validates
-HEAD, so it self-heals as compliant commits land.
+HEAD, so it self-heals as compliant commits land.
+
+## 2026-08-09 — Review failures are an enforced until-PASS continuation loop
+<!-- state: 2026-08-09T00:10 -->
+
+Governance task `review-failure-continuation` closes the gap found by the fresh
+review of the universal session entrypoint. `POL-REVIEW-NO-REPAIR` now requires
+every actionable in-scope `FAIL` to return to a fresh implementer, run focused
+and full gates, and reach a fresh scoped reviewer; that cycle repeats until
+`PASS`. Attempt and retry budgets are scheduling controls, never terminal
+blockers for a correctable finding. Only explicit developer direction or a
+precise external authority/resource blocker may stop the cycle short of
+`PASS`, and the coordinating/operator session still never repairs findings.
+
+The closed operator grammar adds `OP-CONTINUE` and removes the generic
+`STOP-BLOCKER` escape in favor of exact authority, resource, developer, and
+remote-state stops. Policy, T0, workflow, prompt, prompt checker, protocol
+checker, and mutation suites move together; no product or benchmark code
+changes, so the public benchmark result remains NOT APPLICABLE.

.agents/workflow.md

@@ -11,8 +11,12 @@ Each controlled paragraph names exactly the rule it implements.
 
 [POL-AUTH-PRECEDENCE] Resolve conflicts in this order: repository `AGENTS.md`, the applicable registry row, that row's procedure, then task evidence. Report an unresolved contradiction before changing state.
 
+<!-- session-entrypoint:begin -->
+[POL-BOOT-ENTRYPOINT] Start every session with `scripts/agent-start.py`. Supply `--intent operator|helper|read-only` and a known helper `--row` when the opening request is explicit; otherwise relay its source-owned welcome verbatim and ask what work the contributor intends. Follow its printed claim action, rerun it from materialized state, and only then run `scripts/agent-preflight.sh`. The command is non-interactive and never claims, locks, creates a worktree, or mutates a gate.
+<!-- session-entrypoint:end -->
+
 <!-- role-interview:begin -->
-[POL-BOOT-ROLE] Begin with `scripts/agent-role.py show`. If no valid role exists, ask what work the developer intends and run `scripts/agent-role.py claim operator` for a multi-step integration campaign, `scripts/agent-role.py claim helper --row <ID>` for one scoped task, or `scripts/agent-role.py claim read-only` for inspection. Add `--headless` only when the developer explicitly declares an unattended run; never infer it.
+[POL-BOOT-ROLE] Use the entrypoint's reported worktree role. If none exists, ask what work the developer intends and run `scripts/agent-role.py claim operator` for a multi-step integration campaign, `scripts/agent-role.py claim helper --row <ID>` for one scoped task, or `scripts/agent-role.py claim read-only` for inspection. Add `--headless` only when the developer explicitly declares an unattended run; never infer it.
 <!-- role-interview:end -->
 
 [POL-BOOT-NOW] After role resolution, read `.agents/NOW.md` as the one-read live snapshot; consult the append-only state tail only when the task needs deeper history.
@@ -92,7 +96,7 @@ gates.
 <!-- orchestration-loop:begin -->
 [POL-REVIEW-FRESH] After focused and full gates pass on an immutable head from a fresh [implementer](prompts/implementer.md), dispatch a fresh [reviewer](prompts/reviewer.md), never the agent that wrote the code, to perform both static inspection and targeted scratch mutations of the claimed guarantees—mutate, not read. Review output identifies commands, mutations, findings, and the reviewed SHA.
 
-[POL-REVIEW-NO-REPAIR] A coordinating/operator session never repairs a reviewer finding: never fix findings yourself. Send the bounded finding and evidence to a fresh implementer, rerun focused and full gates, then use a fresh scoped reviewer.
+[POL-REVIEW-NO-REPAIR] Never fix findings yourself in a coordinating session. Each actionable in-scope reviewer FAIL and its evidence return to a fresh implementer for focused and full gates then a fresh scoped reviewer. Repeat this cycle until PASS. Attempt and retry budgets are scheduling controls and never terminal blockers for correctable findings. Stop only on explicit developer direction or a precise external authority or resource blocker.
 
 [POL-OPERATOR-VERIFY] The operator independently checks the immutable head: run the row's gate yourself. Implementer or reviewer summaries are evidence inputs, not gate results.