feat(resolve)!: split validation from fixing — Triager + Coder-as-fixer, blast-radius dispositions, verification gate

[dean0x]

Summary

• Retired the single-Resolver design that self-validated and self-fixed, replacing it with a strict separation: an opus Triager validates every issue via a blast-radius disposition matrix, Coder agents fix only pre-classified FIX_NOW items (with PUSH: false so parallel batches share one branch), and a haiku Validator gate runs build/typecheck/lint/test with up to 2 fix-retry cycles before recording an honest pass/fail in the summary.
• Addresses mined failure modes from 328 resolution reports: self-ratifying vacuous tests, positive-spin summaries, security findings dismissed on soft rationales, and verification documented in only 19% of runs.
• Resolves the "no agent grades its own homework" principle already established in dynamic-build, now applied to core /resolve.

Changes

New agent — shared/agents/triager.md (opus, validation-only):

• Blast-radius matrix: SECURITY GATE (overrides all) → FALSE_POSITIVE (requires cited evidence) → BY_DESIGN (requires ADR or code doc) → FIX_NOW (default, Standard/Careful risk tier) → FIX_SEPARATE (must become manage-debt ticket) → TECH_DEBT (last resort only)
• Applies ADR/PF decisions via devflow:apply-decisions (frontmatter-preloaded, avoids PF-002 re-entrancy)
• Reads DIFF_FILES from Git validate-branch to scope FIX_NOW vs FIX_SEPARATE

Retired — shared/agents/resolver.md (applies ADR-003: clean end-state, no tombstones)

Updated — shared/agents/coder.md:

• New inputs: OPERATION (implement | issue-fix | validation-fix | ci-fix), ISSUES, SCOPE, PUSH (default true)
• New Mode: issue-fix section: no re-litigation, regression-test rule (INCOMPLETE if no failing-then-passing test), Verification block in output
• Responsibility 6: PUSH: false commits only; orchestrator owns push/CI

Restructured — commands/resolve.mds (10-phase pipeline):

• Phase 2: Global Triager (single opus agent, cross-issue consistency)
• Phase 3: Batch FIX_NOW (same-file sequential, distinct-file parallel, max 5/batch)
• Phase 4: Coder × N (OPERATION: issue-fix, PUSH: false, CREATE_PR: false)
• Phase 5: Early summary write (compaction safety)
• Phase 7: Verification Gate (Validator haiku + 2-retry Coder loop)
• resolution-summary.md: adds ## Verification, ## By Design, ## Fix Separately, ## Escalations; Deferred = FIX_SEPARATE + TECH_DEBT (fp_ratio formula unchanged, byte-for-byte)

Updated — shared/agents/git.md: validate-branch adds ### Diff Scope output block; manage-debt ingests ## Fix Separately + ## Deferred to Tech Debt

Updated — shared/agents/reviewer.md: Cross-Cycle Awareness also parses ## By Design to avoid re-raising intentional code

Updated — registry: src/cli/plugins.ts, plugins/devflow-{resolve,ambient}/.claude-plugin/plugin.json, .gitignore

Updated — docs: CLAUDE.md, README.md, docs/commands.md, docs/reference/*, orchestrator-charter.md

Updated — tests: plugins.test.ts, resolve/decisions-citation.test.ts, decisions/command-adoption.test.ts

Breaking Changes

shared/agents/resolver.md is deleted. Any plugin that declared resolver in its agents array must switch to triager (+ coder for fix operations). The devflow-resolve and devflow-ambient plugins have been updated.

The resolution-summary.md schema gains new sections (## By Design, ## Fix Separately, ## Escalations, ## Verification). The ## Statistics table gains By Design and Escalated rows. Parser-coupled literals (Fixed, False Positive, Deferred, ## Fixed Issues, ## False Positives columns) are preserved verbatim for fp_ratio back-compat.

Reviewer Focus Areas

• triager.md blast-radius matrix: verify the 5-clause ordering is correct (SECURITY GATE first), evidence requirements for FALSE_POSITIVE/BY_DESIGN, and that PF-002 is honored (no Skill-tool invocation of preloaded skills)
• resolve.mds Phase 7 verification gate: push-before-validate sequence, 2-retry loop, honest failure recording
• Convergence back-compat: fp_ratio formula stays fp/(fp+fixed+deferred) — By Design and Escalated excluded from denominator; confirm deferred_count still maps correctly to the Deferred statistics row
• Test coverage: 1908 tests pass; new assertions cover triager.md structure, new template headings in resolve.md, devflow-resolve agent registry