Quick Ref: This is a thin memo. The implementation is the Go command
ao converge(cli/cmd/ao/converge.go). Do not reimplement the loop in shell — invoke the binary.
YOU MUST EXECUTE THE Go COMMAND. Do not describe or re-author the loop.
Constraints
- Invoke the compiled
ao convergecommand because its two-sided canary and quorum checks are the executable trust boundary. - Keep every judge leg non-mutating because a verdict must not silently rewrite the artifact it is judging.
- Stop at the command's bounded terminal state because bypassing
BLOCK, extending rounds implicitly, or substituting model agreement would defeat the acceptance boundary.
What it does
ao converge runs a bounded fix → re-run-judge-panel loop until the judges
agree or it blocks:
- Converged ⇔ ≥2 distinct non-author contexts PASS with zero FAIL. Each PASS must cite the slice's acceptance test (its Given/When/Then → a passing test), not just artifact agreement — model consensus on an artifact whose acceptance scenario never ran is not a converge (S5 binds to the slice's ATDD contract; see the narrow-waist micro-cycle).
- BLOCK after 3 consecutive failing rounds.
- NOT-CONVERGED when
--max-roundselapses with neither terminal condition. - KILLED when
<dir>/.agents/rpi/KILLappears at a round boundary.
The independence axis is fresh CONTEXT, not model family: the producing model
may judge its own work from a fresh context; only the author's context is
excluded. --require-cross-family is an optional strengthener (additionally
require ≥2 model families).
The one rule that makes it trustworthy
The command runs a two-sided canary entry gate before any judge dispatch: it proves the gate rejects a planted self-judge verdict and accepts a known-good one. An empty/PASS result is a lie until proven to bite — a failed canary aborts the run.
How to run it
ao converge --max-rounds 5 --min-contexts 2
ao converge --require-cross-family # add the cross-family strengthener
ao converge --help
The asymmetry you must honor
The FIX step is yours (the orchestrating agent). The dispatched judge leg is non-mutating — it emits a verdict + evidence, never edits the repo. Between rounds: read the judges' reasons, apply the fix yourself, then re-run.
On BLOCK / NOT-CONVERGED, emit the round's failing reasons as a next-loop finding (.agents/findings/registry.jsonl) so the escape ratchets forward (S6) — converge otherwise drops its by-products. See operating-loop.md → move 7.
Cross-vendor dispatch table (two legs, LAW 0)
| You are running in | Judge leg | How |
|---|---|---|
| Claude context | Claude → Codex judge | Go headless ao codex dispatch (Codex Pro sub), non-mutating |
| Codex context | Codex → Claude judge | Delegated to a pane — codex-approval skill / NTM Claude pane |
⛔ LAW 0: never a headless claude print-mode call, on either leg. The Codex→Claude
leg has no Go transport by design — it routes to an interactive pane.
Boundary
ao converge emits a CLAIM + evidence. It never writes a binding verdict —
MTO remains the sole writer of binding verdicts. No component here decides a merge.
Output Specification
- Path: command output on stdout plus any next-loop finding at
.agents/findings/registry.jsonlforBLOCKorNOT-CONVERGED. - Filename: the command owns runtime evidence names; this skill does not invent or rewrite them.
- Format: a converge claim containing the terminal status, completed rounds, distinct judge contexts, verdicts, and acceptance-test evidence.
- Exit code:
ao convergemust pass its entry canary; treat command failure, malformed evidence, or an unmet quorum as non-converged rather than success. - Downstream handoff: pass the claim and evidence to the verification membrane; only its binding verdict may authorize landing.
Quality Checklist
- The terminal status follows the configured round bound and three-consecutive-failure rule.
- Every counted PASS comes from a distinct non-author context and cites the slice's executed acceptance test.
- The handoff preserves failing reasons on
BLOCKorNOT-CONVERGEDand never presents the claim as a merge decision.
See also
cli/cmd/ao/converge.go— the loop, criterion, fail-tracker, transport resolver.cli/cmd/ao/converge_canary.go— the two-sided entry gate.cli/internal/liveness/quorum.go— the context-quorum floor (CheckSignificantActionDetailed).codex-approval— the Codex→Claude pane-delegation leg.