Pin read-only seats and restore judgment spawn rules

.github/workflows/ci.yml

@@ -272,7 +272,7 @@ jobs:
               .filter((f) => f.endsWith(".md"))
               .map(droidId)
               .sort();
-            const expectedDroidIds = expectedDroids.map(droidId);
+            const expectedDroidIds = expectedDroids.map(droidId).sort();
             if (JSON.stringify(cachedSkills) !== JSON.stringify(expectedSkills)) {
               fail(`Loaded skills mismatch: expected ${expectedSkills.length}, got ${cachedSkills.length}`);
             }

droids/poteto-agent-readonly.md

@@ -0,0 +1,11 @@
+---
+name: poteto-agent-readonly
+description: Read-only delegate subagent for code-writing and helper tasks spawned during a `/poteto-mode` run. Use for delegates, not as the runner for `/poteto-mode` itself. Spawn a fresh `poteto-agent-readonly` for each new task, and resume one only in the strict cases that poteto-mode's Subagents section names. Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index. Substituting `worker` skips that read and drifts.
+model: grok-4.7
+reasoningEffort: xhigh
+tools: read-only
+---
+
+# Poteto subagent
+
+You are operating as poteto-mode's full agent style. The chat that receives `/poteto-mode` owns the playbook, the todo list, and every Task spawn. You are one of its delegates. Read the `poteto-mode` skill's `SKILL.md` in full before doing any work, including its inline Principles index. Use the absolute path your parent gave you. With no path, before any other work, search the Droid plugin cache under `~/.factory/plugins/` for a file whose path ends in `skills/poteto-mode/SKILL.md`. If more than one file matches, use the copy whose `.factory-plugin/plugin.json` has the highest `version`. Your skill catalog hides this skill, so a missing catalog entry does not mean pstack is absent. If no such file exists, stop and tell your parent. Navigate to a leaf `principle-*` skill whenever you apply that principle.

droids/poteto-judgment-readonly.md

@@ -0,0 +1,11 @@
+---
+name: poteto-judgment-readonly
+description: Read-only judgment-seat delegate for the hardest changes, contested design, prose, review panels, and synthesis, spawned during a `/poteto-mode` run when the job needs the strongest judgment model rather than the code seat. Use for delegates, not as the runner for `/poteto-mode` itself. Spawn a fresh `poteto-judgment-readonly` for each new task, and resume one only in the strict cases that poteto-mode's Subagents section names. Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index. Substituting `worker` skips that read and drifts.
+model: claude-opus-5-5
+reasoningEffort: xhigh
+tools: read-only
+---
+
+# Poteto judgment subagent
+
+You are operating as poteto-mode's full agent style on the judgment seat. The chat that receives `/poteto-mode` owns the playbook, the todo list, and every Task spawn. You are one of its delegates. Read the `poteto-mode` skill's `SKILL.md` in full before doing any work, including its inline Principles index. Use the absolute path your parent gave you. With no path, before any other work, search the Droid plugin cache under `~/.factory/plugins/` for a file whose path ends in `skills/poteto-mode/SKILL.md`. If more than one file matches, use the copy whose `.factory-plugin/plugin.json` has the highest `version`. Your skill catalog hides this skill, so a missing catalog entry does not mean pstack is absent. If no such file exists, stop and tell your parent. Navigate to a leaf `principle-*` skill whenever you apply that principle.

droids/poteto-judgment.md

@@ -1,6 +1,6 @@
 ---
 name: poteto-judgment
-description: Judgment-seat delegate for the hardest changes, contested design, prose, review panels, and synthesis, spawned during a `/poteto-mode` run when the job needs the strongest judgment model rather than the code seat. Use for delegates and review seats, not as the runner for `/poteto-mode` itself. Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index.
+description: Judgment-seat delegate for the hardest changes, contested design, prose, review panels, and synthesis, spawned during a `/poteto-mode` run when the job needs the strongest judgment model rather than the code seat. Use for delegates, not as the runner for `/poteto-mode` itself. Spawn a fresh `poteto-judgment` for each new task, and resume one only in the strict cases that poteto-mode's Subagents section names. Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index. Substituting `worker` skips that read and drifts.
 model: claude-opus-5-5
 reasoningEffort: xhigh
 ---

skills/arena/SKILL.md

@@ -14,7 +14,7 @@ Every candidate gets the same prompt, so the prompt is the contract.
 
 1. State the artifact each candidate is producing.
 2. Derive the rubric, 3-6 concrete gradeable criteria for what success looks like on *this* task. It is the picker's tool in Phase D. Candidates only see the task.
-3. Pick the runners. Use the `arena runners` line in the pstack-models section of `~/.factory/AGENTS.md`. That section is always in context when present, so do not Read it; fall back to the defaults when it is absent. If the section or that line is missing, default to one each on the judgment seat (`claude-opus-5-5`, `subagent_type: "poteto-judgment"`) and the code seat (`grok-4.7`, `subagent_type: "poteto-agent"`). An `auto` or `inherit-parent` entry in this line or the cross-judge line means the parent model, so spawn the built-in `worker` for it. Droid model families go by ID prefix such as `claude-*` and `grok-*`. Spawn more runners when the arena covers multiple design directions. Use the same model N times when the work is generation-bound rather than judgment-sensitive. Pick each subagent's complexity for the job, per the Subagents section of the **poteto-mode** skill.
+3. Pick the runners. Use the `arena runners` line in the pstack-models section of `~/.factory/AGENTS.md`. That section is always in context when present, so do not Read it; fall back to the defaults when it is absent. If the section or that line is missing, default to one each on the judgment seat (`claude-opus-5-5`, `subagent_type: "poteto-judgment"`) and the code seat (`grok-4.7`, `subagent_type: "poteto-agent"`). An `auto` or `inherit-parent` entry on the runners line means the parent model, so spawn the built-in `worker` for it. On the cross-judge line, that entry spawns the built-in `explorer`. Droid model families go by ID prefix such as `claude-*` and `grok-*`. Spawn more runners when the arena covers multiple design directions. Use the same model N times when the work is generation-bound rather than judgment-sensitive. Pick each subagent's complexity for the job, per the Subagents section of the **poteto-mode** skill.
 4. Give each candidate its own output location (a git worktree where possible, otherwise `/tmp/arena-<slug>/candidate-<n>/`), per the **separate-before-serializing-shared-state** principle skill.
 
 ## Phase B: Fan out
@@ -25,7 +25,7 @@ If a candidate produces no output, proceed with N-1 and note the dropout.
 
 ## Phase C: Cross-judge
 
-After all Phase B candidates complete, choose one model from the `arena cross-judge pool` line in the pstack-models section of `~/.factory/AGENTS.md`. If the section or that line is missing, choose from `claude-opus-5-5` (judgment seat) and `grok-4.7` (code seat). Prefer a different model family from the parent's. Spawn one judge subagent on that model's seat, and tell it to work read-only in its brief. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with your reading in Phase D. Don't spawn it while candidates are still writing.
+After all Phase B candidates complete, choose one model from the `arena cross-judge pool` line in the pstack-models section of `~/.factory/AGENTS.md`. If the section or that line is missing, choose from `claude-opus-5-5` (judgment seat) and `grok-4.7` (code seat). Prefer a different model family from the parent's. Spawn one judge subagent on that model's read-only seat: `poteto-judgment-readonly` for `claude-opus-5-5`, `poteto-agent-readonly` for `grok-4.7`, and the built-in `explorer` for `auto` or `inherit-parent`. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with your reading in Phase D. Don't spawn it while candidates are still writing.
 
 ## Phase D: Pick a base
 

skills/how/SKILL.md

@@ -8,7 +8,7 @@ disable-model-invocation: true
 
 Explore the codebase to answer "how does X work?" questions. Produce architectural explanations at the level of a senior engineer onboarding onto a subsystem, enough to build a working mental model, not so much that it reads like annotated source code.
 
-Every spawn is a Task subagent. Explorers use the `how explorer` line in the pstack-models section of `~/.factory/AGENTS.md` (default `grok-4.7`, so spawn the code seat, `subagent_type: "poteto-agent"`), and every explainer uses the `how explainer` line (default `claude-opus-5-5`, so spawn the judgment seat, `subagent_type: "poteto-judgment"`). That section is always in context when present, so do not Read it; fall back to the defaults when it is absent. When a line's value is `auto` or `inherit-parent`, spawn the built-in `worker` instead. Explorers and explainers work read-only; say so in the brief. Pick each subagent's complexity for the job, per the Subagents section of the **poteto-mode** skill.
+Every spawn is a Task subagent. Explorers use the `how explorer` line in the pstack-models section of `~/.factory/AGENTS.md` (default `grok-4.7`, so spawn the read-only code seat, `subagent_type: "poteto-agent-readonly"`), and every explainer uses the `how explainer` line (default `claude-opus-5-5`, so spawn the read-only judgment seat, `subagent_type: "poteto-judgment-readonly"`). That section is always in context when present, so do not Read it; fall back to the defaults when it is absent. When a line's value is `auto` or `inherit-parent`, spawn the built-in `explorer` instead. Pick each subagent's complexity for the job, per the Subagents section of the **poteto-mode** skill.
 
 ## 1. Assess complexity
 

skills/interrogate/SKILL.md

@@ -28,10 +28,10 @@ Launch all reviewers in a single message with the Task tool, one per entry on th
 
 | Subagent | Default model | Seat |
 |----------|---------------|------|
-| Reviewer A | `claude-opus-5-5` | `poteto-judgment` |
-| Reviewer B | `grok-4.7` | `poteto-agent` |
+| Reviewer A | `claude-opus-5-5` | `poteto-judgment-readonly` |
+| Reviewer B | `grok-4.7` | `poteto-agent-readonly` |
 
-Each reviewer gets `subagent_type` for its entry's model: `claude-opus-5-5` means the judgment seat, `poteto-judgment`; `grok-4.7` means the code seat, `poteto-agent`. An `auto` or `inherit-parent` entry means the built-in `worker`, which runs on the parent model. Every reviewer works read-only; say so in the brief.
+Each reviewer gets `subagent_type` for its entry's model: `claude-opus-5-5` means the read-only judgment seat, `poteto-judgment-readonly`; `grok-4.7` means the read-only code seat, `poteto-agent-readonly`. An `auto` or `inherit-parent` entry means the built-in `explorer`, which runs on the parent model.
 
 Read `references/reviewer-prompt.md` and fill in the same template for every reviewer with the stated intent, the diff or file contents, the rubric from `references/rubric.md`, and the code-quality lens from `references/code-quality-review.md`. Pick each subagent's complexity for the job, per the Subagents section of the **poteto-mode** skill.
 

skills/setup-pstack/SKILL.md

@@ -65,7 +65,7 @@ interrogate reviewers: claude-opus-5-5, grok-4.7
 
 ### 6. Pin the seats
 
-Droid's `Task` call has no per-spawn model field, so a role's model takes effect through the seat droids. When a seat's chosen model or effort differs from the plugin default (`poteto-agent` at `grok-4.7` xhigh, `poteto-judgment` at `claude-opus-5-5` xhigh), write a personal droid at `~/.factory/droids/<seat>.md` pinning the chosen model and `reasoningEffort`, with the same name, description, and body as the plugin's droid. Personal droids override plugin droids of the same name. When a seat matches the plugin default, delete any stale personal override for it so the plugin's droid applies. New sessions pick the changes up.
+Droid's `Task` call has no per-spawn model field, so a role's model takes effect through the seat droids. When a seat's chosen model or effort differs from the plugin default (`poteto-agent` at `grok-4.7` xhigh, `poteto-judgment` at `claude-opus-5-5` xhigh), write a personal droid at `~/.factory/droids/<seat>.md` pinning the chosen model and `reasoningEffort`, with the same name, description, and body as the plugin's droid. Do the same for its read-only twin (`poteto-agent-readonly`, `poteto-judgment-readonly`): same model and `reasoningEffort`, `tools: read-only`, and the plugin twin's description and body. Personal droids override plugin droids of the same name. When a seat matches the plugin default, delete any stale personal override for it and for its read-only twin so the plugin's droid applies. New sessions pick the changes up.
 
 ### 7. Confirm