One run of /otter:orchestrate, end to end

You type /otter:orchestrate <task>. Plain chat never triggers the pipeline.

Classifies the request (review-only and test-only route to their own skills), picks an assurance level from observable signals and states it in one line. If goal, constraints, non-goals, acceptance criteria or scope are unclear it asks 1–3 questions and spawns nothing.

evidencethe assurance line, e.g. "assurance: light — explicit Owns, npm test present, no risk signals"

Writes or validates a canonical plan: goal, verified context, constraints, non-goals, stable AC IDs, approach, reuse, Scope In/Out, ordered slices with exact Owns paths plus per-slice Covers and Depends on, risks, verification. "The auth package" is not a path. Then the plan gate: you see the whole plan and approve, revise, or abort — run-state init refuses a missing or stale approval, so no writer starts without it.

evidenceplans/<slug>.md passing plan-contract validate

One run-state init call validates the plan against the contract, compares the implementer profile's model: with the recorded pin, then in a single locked write creates the manifest, closes planning, opens implementation and assigns the worker attempt — printing the run id, plugin root and attempt id the next commands need. A bad plan or drifted pin refuses before anything is written; a bad pin never reaches a spawn.

evidence.devin/otter/runs/<run-id>.json with phase implementation and attempt-implementer-1

Standard: only when the lead still has an open question after reading the owned files. Fan-out to 2–3 lanes only for genuinely independent questions, after showing the cost. Subagents have no web tools — the lead fetches sources into packs. No writer starts until every lane settles.

evidencemerged findings with paths/URLs, contradictions kept, union of "Not searched"

One writer per tree, Owns-bounded, test-first — slices with disjoint Owns fan out to parallel linked worktrees by default. On spawn the worker runs a one-command preflight.mjs self-check — its own pin against the recorded pin — as defence-in-depth under the dispatch-time gate. Edits outside Owns are made minimally and flagged under Outside Owns; the lead reviews them in the diff.

evidenceimpl.diff; the worker's Touched / Ran / Next footer

The lead re-runs the implementer's own green test command once and records the exit code as the test lane — it does not dispatch a tester to repeat it. A tester matrix runs on high assurance or when there is no test evidence.

evidencenpm-test.txt with exit=0; lane test: pass

The lead applies the reviewer contract to itself: reads the whole diff and the code around it, runs one probe per suspicion, writes P0–P3 findings with location, trigger, impact and evidence, validated by script. Open P0/P1 or request_changes is FAIL. Malformed after one retry is INCONCLUSIVE — never approval.

evidencereview.md passing evidence-contracts review; lane review with "lead review under reviewer contract"

Only a request_changes verdict, a failed test lane or an open P0/P1 starts a repair round. An approve with P2/P3 findings ends the run and lists them as follow-ups. One sequential implementer repairs; only affected lanes re-run; the loop never runs blind.

evidenceattempt-implementer-2; re-review

The lead reads the actual git diff, exit codes and artifacts — worker summaries are not proof. It ticks the acceptance criteria the evidence covers (plan-contract.mjs prove; an unticked AC at completion is FAIL unless you waive it), completes the run, appends an attest block (timestamp, profile names, requested pins, profile digests) to the plan, and replies in short sentences: assurance level, what was skipped, changed paths, verification, AC → evidence, run id, next command.

evidencemanifest status completed · outcome pass|fail|inconclusive