@brainervirus/workit-opencode 6.0.0 → 7.0.0

package/README.md

@@ -1,90 +1,35 @@
 # @brainervirus/workit-opencode
 
 [![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
-[![npm version](https://img.shields.io/npm/v/@brainervirus/workit-opencode.svg)](https://www.npmjs.com/package/@brainervirus/workit-opencode)
-[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](../../LICENSE)
+[![npm](https://img.shields.io/npm/v/@brainervirus/workit-opencode.svg)](https://www.npmjs.com/package/@brainervirus/workit-opencode)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/BrainerVirus/workit/blob/main/LICENSE)
 
-OpenCode plugin for Workit — optional coordination, policy, delegation, handoff, and read-only context. Native OpenCode tools execute Git, hosting, YouTrack and documentation effects.
+[Workit](https://github.com/BrainerVirus/workit) for OpenCode 2.0.18+: the seven task families,
+read-only `workit_context` and `workit_init_apply` as native tools, the
+eleven method skills with `/wk-*` commands, direct-child delegation, and
+context injection on session start and after compaction. Requires Node.js 24+.
 
-## Install
-
-```jsonc
-// opencode.json / opencode.jsonc
+```json
 {
   "$schema": "https://opencode.ai/config.json",
   "plugins": ["@brainervirus/workit-opencode"]
 }
 ```
 
-OpenCode 2.x reads `"plugins"` and still normalizes the older `"plugin"` key.
-
-Local dev variant (absolute path to this repo):
-
-```jsonc
-{
-  "$schema": "https://opencode.ai/config.json",
-  "plugins": ["file:///path/to/workit/packages/workit-opencode"]
-}
-```
-
-Requirements: OpenCode 2.0.18+, Node ≥ 24. The published plugin is a
-self-contained Node bundle whose default export is the V2 plugin definition
-(`{ id: "workit", setup }`). Workit 3.0 removed the OpenCode 1.x `server()`
-adapter; OpenCode 1.x hosts must stay on Workit 2.x by pinning
-`"plugin": ["@brainervirus/workit-opencode@2"]` (the V1 key) until they upgrade
-OpenCode.
-
-## What it provides
-
-- **Seven native operation tools** — `workit_task`, `workit_policy`, `workit_evidence`, `workit_finding`, `workit_decision`, `workit_worker`, and `workit_state`.
-- **Read-only context and init tools** — `workit_context` accepts `{ "kind": "git" }` and the existing PR/YouTrack/changelog/release/affected context fields; `workit_init_apply` keeps confirmed configuration initialization.
-- **Eleven policy-selected method skills** — shape, implement, review, debug, ship, continue, bdd, test-audit,
-  deslop, fanout, and verify-app.
-- **Native lifecycle hooks** — direct-child task workers and compact task bootstrap/restoration. Workit registers no question hooks.
+Local checkout: run `bun packages/workit-opencode/scripts/build.ts`, then pin
+`"file:///path/to/workit/packages/workit-opencode"`. OpenCode 1.x must stay on
+`"plugin": ["@brainervirus/workit-opencode@2"]`.
 
-## Host-native behavior
-
-- **Delegation** — native `task` workers are direct-child-only; nested or uncertain lineage is denied (`delegation_lineage_denied`).
-- **Continuity** — compact task context carries the newest decisions and bounded redacted choice summaries, injected once on session start and once after compaction; unobservable shell surfaces are labeled `agent_guided`.
-
-Workit does not register `workit_external_action` on OpenCode.
-Use native tools for mutations under the host permissions and target conventions;
-no Workit task or decision is needed merely to run an ordinary command. Decisions
-are durable records that satisfy decision requirements; they never authorize an
-effect. Delivery limits come from OpenCode permissions plus the workspace
-autonomy grants (`workit grant show`).
-Old action/decision history is preserved. Inspect and reconcile any uncertain
-effect before retrying; removal does not settle or migrate it.
-
-## Upgrade from Workit 1.x
-
-Workit 2.0 removes the managed external-action tool on both OpenCode versions.
-Use native host tools for mutations and `workit_context` for read-only context.
-Existing task and action history remains untouched; reconcile uncertain effects
-before retrying them.
-
-## Bundle / runtime model
-
-The build bundles the `@opencode/plugin` SDK surface used by the adapter into `dist/plugin.js`, so the published plugin has **no** runtime dependency on the SDK (it stays a development/build-only pin). The plugin loads through its real package entry `dist/plugin.js`; only the eleven method skills ship under `assets/`.
-
-The plugin registers nine tools (the seven families, `workit_context` and
-`workit_init_apply`) with `codemode: false`, the eleven
-skills and up to eleven `wk-*` commands. Existing user skills and commands
-are preserved; an alias is added only when its Workit skill is registered. It
-also provides direct-child subagent
-lineage with durable dispatch claims, and bootstrap/task/worker context plus
-compaction injection. Its shell
-permission hook adds branch-name policy denials for direct, unquoted literal
-branch-creation forms only. It leaves compliant branches, PR and worktree
-commands, and unsupported shell syntax to OpenCode's native permission rules.
-
-## Package scripts
+Effects (git, forge, files) run through OpenCode's native tools and the
+`workit` CLI under OpenCode permissions plus the workspace
+[grants](https://github.com/BrainerVirus/workit/blob/main/docs/guides/grants.md). The permission hook denies direct, unquoted
+branch-creation commands that break the naming policy, and edits or
+recognizable shell writes while the branch task has an open product choice or
+needs a plan ([before-write gate](https://github.com/BrainerVirus/workit/blob/main/docs/guides/verification.md)). Tools take flat
+fields. Details:
+[hosts guide](https://github.com/BrainerVirus/workit/blob/main/docs/guides/hosts.md#opencode).
 
 ```bash
-bun run build       # bundle dist/plugin.js + assets
-bun run typecheck   # tsc --noEmit
+bun run build       # bundle dist/plugin.js (self-contained, no runtime SDK dependency)
+bun run typecheck
 ```
-
-## Docs
-
-Full usage: https://github.com/BrainerVirus/workit#readme

package/assets/skills/workit-deslop/SKILL.md

@@ -22,7 +22,7 @@ behavior. A change that wants new behavior is its own change.
    validator that changes behavior is not deslop.
 5. **Re-run the checks** and report lines removed, not lines written. Nothing
    to clean is a valid result: say what you checked ("0 removals; ran knip and
-   read the diff"). When a tracked task lists a `pre-pr-cleanup` requirement,
+   read the diff"). When a tracked task lists a `pre-pr-cleanup` requirement (≤6.x tasks),
    record this result as its evidence.
 
 ## Example

package/assets/skills/workit-implement/SKILL.md

@@ -11,6 +11,9 @@ description: Build a requested change in small verified steps - follow local pat
    neighbour that already does something similar. Copy its patterns, names and
    error handling. Repo rules (AGENTS.md, CLAUDE.md, lint config) win.
 2. On the default branch? Branch first: `workit git branch --kind feature --slug <s>`.
+   Tracking it? Judge once: `workit policy assess --judge risk=normal
+   behavior=yes product-choice=no plan=no` (trivial and no for a mechanical
+   fix); Workit derives what close needs.
 3. Small steps that each leave the tree green. Behavior change: write the
    acceptance as Given/When/Then and see a test fail first (workit-bdd).
    Mechanical change: the existing checks are enough.
@@ -24,10 +27,12 @@ description: Build a requested change in small verified steps - follow local pat
    PR (`workit git push`, `workit pr create --fill`, then workit-ship) only when
    that was requested, or the request implies delivery and `workit grant show`
    reports `defaultEndpoint` `pr`; otherwise the endpoint is `commit`.
-7. Hand off verification. Never record a passing verdict on your own work.
-   Start a fresh verifier with its own session (`WORKIT_SESSION_ID=<yours>-v1`;
-   Claude Code: the `verifier` agent, which the hook gives one); it runs
-   verify-<app> and `workit ledger verdict`. Before saying done, reconcile
+7. Verify. Normal risk: after `workit check test` passes, record your own
+   `workit ledger verdict tests-verified --self --how "<what you ran>"`; it
+   reads self-reviewed, never verified. High risk, a workspace with
+   `verification: independent` (`workit grant show`) or a verified merge needs
+   a fresh verifier with its own session (`WORKIT_SESSION_ID=<yours>-v1`;
+   Claude Code: the `verifier` agent). Before saying done, reconcile
    every named deliverable against the target checkout and observe it (for a push:
    `workit verify-delivery push`).
 

package/assets/skills/workit-review/SKILL.md

@@ -8,6 +8,8 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent (Claude Code: the `reviewer` or `verifier` agent).
+An author's `--self` verdict reads self-reviewed and never counts as
+independent; `type-check-only` never proves a behavior change.
 
 1. Pin the candidate: `git rev-parse HEAD`, the base, `git diff <base>...HEAD`;
    for a PR, `workit pr status --json` (checks, unresolved threads).

package/assets/skills/workit-shape/SKILL.md

@@ -43,7 +43,7 @@ a choice that is hard to reverse, surprising and a real trade-off; a glossary
 entry for a term you had to resolve; `.out-of-scope/<concept>.md` for a rejected
 request that will come back. A one-file mechanical fix gets none. Formats and
 triggers: `references/knowledge.md`. Record each settled choice once:
-`workit ledger decision "<what>" --why "<why>"`.
+`workit ledger decision "<what>" --why "<why>"`; cite a plan: `workit policy assess --ref <path>`.
 
 ## 5. Slice as tracer bullets
 

package/assets/skills/workit-ship/SKILL.md

@@ -33,7 +33,7 @@ merge: Stop at PR-ready unless the user set merge as the endpoint.
    `workit ci rerun --failed --reason flake` (once per head). Real: reproduce
    with `workit check`, fix the root cause, batch fixes into one push.
 6. **Verified.** After the last push a non-author records a verdict
-   (workit-review). Land only when granted: `workit stack land` (the
+   (workit-review); `pr status` showing self-reviewed is not verified. Land only when granted: `workit stack land` (the
    contiguous verified run from the root) or `workit pr merge`.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`.