@ericrisco/rsc 3.0.8 → 3.0.10

package/README.md

@@ -98,8 +98,8 @@ rsc 3.0 fixes all four, by default, with no new commands to learn:
 
 **Commit, push and pull request without a prompt each time.** A harness installed from scratch lets
 the agent run `git commit`, `git push` and `gh pr create` without asking, because those are the steps
-that close every lane. A force-push still asks. The guards still decide: a commit on a closed `main` is
-refused whatever the permission says. It is a project decision, saved as `gitPermissions` in
+that close every lane. A force-push still asks. In Claude Code, rsc's guards still decide: a commit on a
+closed `main` is refused whatever the permission says. No other assistant runs those guards. It is a project decision, saved as `gitPermissions` in
 `.rsc.json`. A clone gets the same setting. A project adopted before this is left as it was until
 someone runs `rsc git-permissions on`.
 
@@ -108,16 +108,32 @@ someone runs `rsc git-permissions on`.
 | Claude Code | `.claude/settings.json` → `permissions.allow` (force-push under `ask`). Claude Code applies it once the folder is trusted. |
 | Codex | `.codex/rules/rsc-git.rules` (`prefix_rule`; force-push → `prompt`). Loaded when the project is trusted. |
 | Gemini | `.gemini/settings.json` → `tools.allowed` |
-| OpenCode | `opencode.json` → `permission.bash` (force-push → `ask`) |
+| OpenCode | `opencode.json`. With OpenCode 2 installed: the top-level `permissions` list (`shell` rules; force-push → `ask`). rsc's rules go before yours, so any rule of yours that matches later still wins; only a leading `"*"` allow/ask default stays in front. With OpenCode 1.x, or when `opencode --version` cannot be read: `permission.bash`, which both versions read. Moving to 2 moves rsc's entries over. An `opencode.jsonc` is read but never rewritten (its comments would be lost): rsc prints the rules to paste. |
 | Cursor | Not covered: its CLI matches only the first word, so allowing a push would allow every git command. |
 | DeepSeek Harness | Not covered: dsh has no per-command allow list. Its own Permissions selector (`/permission`) sets approval for every command at once. |
 
 ```bash
-rsc git-permissions status   # decided or not, and wired per assistant
-rsc git-permissions off      # ask again for commit, push and PR (saved in .rsc.json)
+rsc git-permissions status   # per assistant: wired or not, and in which format (--json for scripts)
+rsc git-permissions off      # remove rsc's rules (saved in .rsc.json)
 rsc git-permissions on       # turn it on, also for a project adopted before
 ```
 
+**What `off` turns off.** Only rsc's allow rules. Each command says, per assistant, what rsc controls
+there, what stops when it is off, and what is left to the assistant. `off` does not hand rsc's
+protections to the assistant. Claude Code keeps rsc's guards (branch-guard, danger-guard), because
+they do not depend on this switch. OpenCode, Codex and Gemini run no rsc guard. There, your own
+settings decide. With no rule matching, OpenCode 2 asks and OpenCode 1.x runs the command. To refuse a
+force-push in OpenCode 2, add this at the end of `permissions` (use `"ask"` to get a human approval):
+
+```json
+{ "action": "shell", "resource": "git push --force*", "effect": "deny" },
+{ "action": "shell", "resource": "git push -f*", "effect": "deny" },
+{ "action": "shell", "resource": "git push * --force*", "effect": "deny" },
+{ "action": "shell", "resource": "git push * -f*", "effect": "deny" }
+```
+
+In OpenCode 1.x the same patterns go at the end of `permission.bash` (`"git push --force*": "deny"`, …).
+
 **How does it know a project is "complex or in production"?** There are two layers. A hook counts
 what anyone can check: a CI setup, a deployment file (`Dockerfile`, `vercel.json`, `fly.toml`…) or
 at least two people in the last 50 commits. If any of those is there, a commit on the default branch
@@ -372,7 +388,11 @@ That verdict is not just about the receipt: it also requires the harness floor t
 `01-TOOLS/_TEMPLATE/`, `02-DOCS/wiki/harness/`, and the constitution when the plan selects SDD.
 If the floor is missing, the install applied but prints `RSC_ONBOARDING_INCOMPLETE` with each
 missing path and the action that creates it, because a plan that promised little used to be able to
-report success with three markdown files.
+report success with three markdown files. When the plan selects SDD, onboarding writes the
+constitution itself as a draft (`status: draft`, only the facts it knows, no principles), so a
+non-interactive install still ends `RSC_ONBOARDING_READY`; the draft is listed as pending — under
+READY and in `rsc doctor` — until the `constitution` phase completes it. An existing constitution is
+never overwritten.
 
 ---
 
@@ -399,6 +419,10 @@ rsc memory resume                    # print this branch/worktree continuation
 rsc memory learn --text "…" --evidence "…" --confidence 0.8 --approve
 rsc memory off                       # disable hooks, commands and injection project-wide
 rsc sync --target claude,codex       # refresh managed skills/hooks from the current package version
+rsc agent-model opencode openai/gpt-5   # pin the model the generated agents carry (saved in .rsc.json)
+rsc agent-model opencode inherit     # back to the session's model (OpenCode's default)
+rsc agents status                    # installed agents, and which ones you edited
+rsc agents reset developer           # take rsc's version of an agent you edited (yours is backed up first)
 rsc backups                          # list project-local snapshots
 rsc restore latest --dry-run         # preview restoring the newest snapshot
 rsc restore <snapshot-id>            # restore a project-local snapshot
@@ -406,6 +430,29 @@ rsc upgrade --dry-run                # show npm upgrade + sync commands
 rsc uninstall postgresdb --dry-run   # preview a removal
 ```
 
+### `rsc doctor`: harness health vs onboarding readiness
+
+`doctor` answers two different questions, and prints both first, on separate lines:
+
+```text
+Harness health: healthy
+Onboarding readiness: pending
+Pending: 02-DOCS/wiki/sdd/constitution.md (draft)
+Next: Complete 02-DOCS/wiki/sdd/constitution.md with the `constitution` phase …
+```
+
+- **Harness health** (`healthy` in `--json`) says whether what is installed works: skills, agents,
+  commands and hook scripts are on disk. It is the only thing the exit code follows (1 when
+  unhealthy), so CI and editor extensions can rely on it.
+- **Onboarding readiness** (`onboarding` in `--json`: `status`, `missing`, `pending`, `action`) says
+  whether onboarding is finished. It checks the accepted plan's floor, the same check that prints
+  `RSC_ONBOARDING_READY`, plus drafts. The status is `ready`; `pending` when a draft such as the
+  onboarding constitution still has to be completed; `incomplete` when part of the floor is missing,
+  for example a deleted constitution in an SDD plan, with the exact phase or command that fixes it;
+  or `not onboarded` when there is no onboarding record, as in a manual `rsc add` install. Readiness
+  never changes `healthy` or the exit code. `Missing:` and `Pending:` appear only when they have
+  entries.
+
 ---
 
 
@@ -842,6 +889,15 @@ selective specialists) and 53 command entries (20 fixed + 33 stack aliases).
 Unsupported means rsc writes nothing for that surface; it does not emulate a
 provider feature with an unverified file.
 
+**Generated agents follow your project, not rsc's defaults.** OpenCode agents carry no `model:`, so
+they use whatever model the session runs (a local one, OpenAI, Anthropic). To pin one for the whole
+team, run `rsc agent-model opencode <model>`: it is saved as `agentModels` in `.rsc.json` and works
+for any target with agents (`inherit` drops the pin). OpenCode agents never grant a tool either: a
+read-only reviewer only gets `edit`, `write`, `patch` and `bash` set to `false`, and an agent that may
+edit or run commands gets no `tools` block, so your project's permission policy decides. If you edit
+a generated agent, `rsc sync` keeps your file and says so. `rsc agents reset <name>` (or `--all`)
+takes rsc's version back after a backup in `.rsc/backups/`.
+
 ---
 
 ## Skill format

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.0.8",
+  "version": "3.0.10",
   "counts": {
     "skills": 270,
     "agents": 33,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "3.0.8",
+  "version": "3.0.10",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/doctor.js

@@ -17,9 +17,11 @@ import { countGaps, listSkills, listAgents } from './lib/capabilities.js';
 import { resolveCommands, commandPath, targetHasCommands } from '../targets/commands.js';
 import { inspectMemoryWiring } from '../targets/memory.js';
 import { metricsSummary } from '../targets/session-memory-core.mjs';
-import { agentPath } from '../targets/agents.js';
+import { agentPath, targetHasAgents, effectiveAgentModel } from '../targets/agents.js';
 import { projectOptOuts } from '../targets/opt-outs.js';
 import { versionReport } from './lib/versions.js';
+import { CONSTITUTION_PATH, constitutionIsDraft } from './lib/constitution-draft.js';
+import { onboardingReadiness } from './lib/onboarding-apply.js';
 
 // Gates the committed manifest says the team disarmed, still armed here. Read through the same
 // partition the installer uses, so a machine-only switch somebody's older rsc wrote into the
@@ -297,6 +299,11 @@ export function doctor({ target, home, cwd }) {
     memory,
     missingAgents,
     agentCollisions: state.agentCollisions || [],
+    // #298 — generated agents the user edited and sync kept as they are. Not unhealthy: theirs on
+    // purpose. Named with the way back, so a stale edit is one command from rsc's version.
+    agentsEditedByYou: (state.agentsKept || []).map((k) => ({ ...k, action: `\`npx @ericrisco/rsc agents reset ${k.name}\` takes rsc's version (yours is backed up first).` })),
+    // Which model the agents carry: the session's (inherit) or a project pin (`rsc agent-model`).
+    agentModel: targetHasAgents(target) ? (effectiveAgentModel(target, root) || 'inherit') : null,
     missingCommands,
     commandOrphans,
     commandCollisions: state.commandCollisions || [],
@@ -310,6 +317,19 @@ export function doctor({ target, home, cwd }) {
   for (const [id, e] of Object.entries(state.skills)) {
     for (const f of e.files) if (!existsSync(f)) report.missing.push({ id, path: f, action: 'Run `npx @ericrisco/rsc sync` to restore this managed skill.' });
   }
+  // Pending is not unhealthy: work the harness expects the user to finish, named with what does it.
+  // The draft constitution `rsc onboard` writes is the first entry; it never touches `healthy`.
+  report.pending = constitutionIsDraft(root)
+    ? [{ id: 'constitution-draft', path: CONSTITUTION_PATH, action: 'Complete it with the `constitution` phase before the first SDD feature; ratifying removes `status: draft`.' }]
+    : [];
+  // #298 — onboarding readiness is a SEPARATE question from health: is the accepted plan's floor
+  // on disk (the same check that prints RSC_ONBOARDING_READY), and is anything still a draft. It is
+  // reported, never folded into `healthy`: `healthy` and the exit code keep meaning "the installed
+  // harness works", which is what CI and editor extensions built on #277 read. Wrapped because a
+  // report must never fail for asking an extra question.
+  try { report.onboarding = onboardingReadiness(root); } catch (error) {
+    report.onboarding = { status: 'incomplete', missing: ['<onboarding readiness could not be read>'], pending: [], action: String(error?.message || error).slice(0, 200) };
+  }
   report.healthy = report.hookWired && !report.missing.length && !missingAgents.length && !missingCommands.length
     && !report.opencodePluginsOutdated.length;
   return report;

package/scripts/install-apply.js

@@ -7,7 +7,7 @@ import { planInstall } from './install-plan.js';
 import { targetPaths, writeSkill, wireHook, unwireHook, baseDir, TARGET_IDS } from '../targets/index.js';
 import { shadowTarget } from '../targets/agents-md-shadow.js';
 import {
-  targetHasAgents, reconcileAgents, agentPath, agentNames,
+  targetHasAgents, reconcileAgents, agentPath, agentNames, writeAgentsDetailed,
   resolveAgentNames, agentByName, allAgentNames, readDeveloperTier, writeDeveloperTier,
 } from '../targets/agents.js';
 import { projectOptOuts } from '../targets/opt-outs.js';
@@ -223,6 +223,7 @@ export function recordInManifest({ cwd, target, skillIds, agentIds = [], catalog
     optOuts: optOuts ?? projectOptOuts(prev.optOuts),
     memory: prev.memory,
     gitPermissions: gitPermissions ?? prev.gitPermissions,
+    agentModels: prev.agentModels,
     onboarding: onboarding ?? prev.onboarding,
   });
 }
@@ -306,13 +307,19 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
       ? explicit
       : resolveAgentNames(Object.keys(state.skills || {}), explicit);
   const previousAgents = state.agents || [];
+  let keptAgents = [];
   if (targetHasAgents(target)) {
     const agentResult = reconcileAgents(target, cwd, readDeveloperTier(cwd), previousAgents, desiredAgents);
     state.agents = agentResult.names;
     state.agentCollisions = agentResult.collisions;
+    // #298 — agents the user edited and rsc left alone. Recorded so `doctor` can say it on any run,
+    // and returned so the command that just ran says it now.
+    keptAgents = agentResult.kept;
+    state.agentsKept = keptAgents.map(({ name, path }) => ({ name, path }));
   } else {
     state.agents = [];
     state.agentCollisions = [];
+    state.agentsKept = [];
   }
   state.explicitAgents = explicit;
   const memoryResult = policy?.memory === false
@@ -381,7 +388,7 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
     if (existsSync(join(cwd, '.git'))) mergeHook = installMergeHook(cwd);
   } catch (err) { mergeHook = { installed: false, state: 'skipped', reason: err.message }; }
   ignoreLocalState(cwd, target);
-  return { ...state, backup, mergeHook };
+  return { ...state, backup, mergeHook, keptAgents };
 }
 
 // `.rsc/` holds local machine state — hook scripts, install markers, the sello's
@@ -551,9 +558,16 @@ export async function uninstall({ skillIds = [], agentIds = [], target, home, cw
     delete state.skills[id];
   }
   const agentResult = reconcileAgents(target, cwd, readDeveloperTier(cwd), state.agents || [], desiredAgents);
-  state.agents = agentResult.names;
+  // An edited agent no longer wanted stays on disk (#298) and stays recorded as rsc-managed, so a
+  // later reset or uninstall can still find it.
+  state.agents = [...new Set([...agentResult.names, ...agentResult.kept.map((k) => k.name)])];
   state.agentCollisions = agentResult.collisions;
+  state.agentsKept = agentResult.kept.map(({ name, path }) => ({ name, path }));
   state.explicitAgents = nextExplicit;
+  for (const k of agentResult.kept) {
+    const i = removed.indexOf(k.path);
+    if (i >= 0) removed.splice(i, 1);
+  }
   const desiredCommands = resolveCommands({
     target,
     skills: remainingSkillIds,
@@ -712,7 +726,30 @@ export async function syncInstalled({ target, home, cwd = process.cwd(), dryRun
   // question sat untracked, one `git add -A` from the team repo (team simulation D13). Sync is what a
   // clone runs, so it writes the same exclude. Lazy import: onboarding-apply imports this module.
   try { (await import('./lib/onboarding-apply.js')).excludePersonalProfile(cwd); } catch { /* not a repo → nothing */ }
-  return { synced: declared, syncedAgents: declaredAgents, backup: nextState.backup };
+  return { synced: declared, syncedAgents: declaredAgents, backup: nextState.backup, keptAgents: nextState.keptAgents || [] };
+}
+
+/**
+ * #298 — `rsc agents reset <name|--all>`: take rsc's version of agents the user edited. The user's
+ * file is snapshotted first (a backup under .rsc/backups/), and the answer says where, so taking rsc's
+ * version is never the loss the protection exists to prevent.
+ */
+export function resetAgents({ target, home, cwd = process.cwd(), names = [], all = false }) {
+  if (!targetHasAgents(target)) return { reset: [], backup: null, kept: [] };
+  const paths = targetPaths(target, home, cwd);
+  const state = readState(paths.stateFile);
+  const installed = state.agents || [];
+  const chosen = all ? installed : names;
+  const unknown = chosen.filter((name) => !installed.includes(name));
+  if (unknown.length) throw new Error(`${unknown.join(', ')}: not an agent rsc installed for ${target} (installed: ${installed.join(', ') || 'none'})`);
+  if (!chosen.length) return { reset: [], backup: null, kept: [] };
+  const files = chosen.map((name) => agentPath(target, cwd, name));
+  const backup = createBackup({ cwd, operation: 'agents-reset', target, paths: files.filter((f) => existsSync(f)), cliVersion: CLI_VERSION });
+  const { written } = writeAgentsDetailed(target, cwd, readDeveloperTier(cwd), chosen, { force: true });
+  state.agentsKept = (state.agentsKept || []).filter((k) => !chosen.includes(k.name));
+  writeState(paths.stateFile, state);
+  const rel = (p) => relative(cwd, p).split(sep).join('/');
+  return { reset: chosen, written, backup: backup ? rel(join(cwd, '.rsc', 'backups', backup.id)) : null };
 }
 
 // Remove EVERYTHING rsc put in this project: installed skills across all targets,

package/scripts/lib/constitution-draft.js

@@ -0,0 +1,156 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// La constitución como BORRADOR.
+//
+// El suelo del arnés exige `02-DOCS/wiki/sdd/constitution.md` cuando el plan elige SDD, y sólo una
+// fase agéntica la escribía. Así que una instalación no interactiva de software complejo —terminal,
+// CI, nadie con un agente delante— terminaba en RSC_ONBOARDING_INCOMPLETE: medio instalada. En la
+// prueba de campo una sesión entera ($3.59, 67 turnos) se gastó sólo en escribirla.
+//
+// Decisión del PO (2026-10-07): el onboarding escribe un BORRADOR y no falla. El borrador lleva
+// `status: draft`, los encabezados reales de la plantilla de la fase `constitution`, y sólo los
+// hechos que el onboarding conoce — objetivo, tipo, alcance, flujo, evidencia de stack. Ningún
+// principio: ratificar es de la fase `constitution`, con el usuario delante (P4). El suelo lo acepta
+// porque sólo mira existencia; la cadena SDD lo detecta por `status: draft` y lo completa antes del
+// primer spec; `doctor` lo lista como pendiente, nunca como fallo.
+
+export const CONSTITUTION_PATH = '02-DOCS/wiki/sdd/constitution.md';
+export const DRAFT_MARK = 'borrador — complétalo con la fase `constitution` antes del primer SDD';
+
+const WORKFLOW_FACT = {
+  branches: 'branches closed with a pull request; the default branch is closed to direct work',
+  main: 'straight on the default branch',
+};
+
+// El objetivo es texto del usuario y va a un documento que leerá un agente: una línea, acotada.
+const oneLine = (value, limit = 200) => String(value ?? '').replace(/[\u0000-\u001f\u007f]+/g, ' ')
+  .replace(/\s+/g, ' ').trim().slice(0, limit);
+
+/** Puro: el texto del borrador a partir del plan aceptado. Sin reloj ni disco, salvo lo que se le pase. */
+export function renderConstitutionDraft(plan, { project = 'Project', date = new Date() } = {}) {
+  const record = plan?.record || {};
+  const evidence = plan?.evidence || {};
+  const stacks = (evidence.stacks || []).map((s) => oneLine(s, 40)).filter(Boolean);
+  const manifests = (evidence.signals || []).filter((s) => String(s).startsWith('manifest:'))
+    .map((s) => oneLine(String(s).slice('manifest:'.length), 60));
+  const day = date.toISOString().slice(0, 10);
+  const name = oneLine(project, 80) || 'Project';
+  const stackLine = stacks.length
+    ? `Detected at install: ${stacks.join(', ')}${manifests.length ? ` (from ${manifests.join(', ')})` : ''}. Not ratified yet.`
+    : 'No stack evidence was detected at install. To be decided in the `constitution` phase.';
+  const workflow = WORKFLOW_FACT[record.workflow];
+  const pending = '_Pending — to be completed in the `constitution` phase._';
+  return `---
+type: constitution
+title: ${name} — Constitution
+description: Draft written by rsc onboard from the accepted plan; not ratified.
+tags: [sdd, constitution]
+timestamp: ${date.toISOString().replace(/\.\d{3}Z$/, 'Z')}
+topic: sdd
+status: draft
+version: draft
+---
+
+# ${name} — Constitution
+
+> **${DRAFT_MARK}.**
+> Draft: complete it with the \`constitution\` phase before the first SDD feature. It holds only what
+> onboarding knew; it ratifies no principle. Ratifying it removes \`status: draft\` and starts at v1.0.0.
+
+## Known facts (from onboarding)
+
+- Goal: ${oneLine(record.goal)}
+- Project kind: ${oneLine(record.projectKind, 40)}${record.softwareScope ? ` · software scope: ${oneLine(record.softwareScope, 40)}` : ''}
+${workflow ? `- How code changes land: ${workflow} (\`--workflow ${record.workflow}\`).\n` : ''}- Stack evidence: ${stackLine}
+
+## 1. Stack canon
+
+${stackLine}
+
+## 2. Quality bar
+
+${pending}
+
+## 3. Conventions
+
+${pending}
+
+## 4. Branching & shipping
+
+${workflow ? `Chosen at install: ${workflow}. ` : ''}${pending}
+
+## 5. Security & privacy floor
+
+${pending}
+
+## 6. UX / accessibility floor (if there is a UI)
+
+${pending}
+
+## 7. Performance budgets (where they matter)
+
+${pending}
+
+## 8. Knowledge & decisions
+
+${pending}
+
+## Definition of Done (the merge bar \`verify\` runs against)
+
+${pending}
+
+## Amendment log (append-only)
+
+| Date | Version | Change | Why |
+|------|---------|--------|-----|
+| ${day} | draft | Draft generated by \`rsc onboard\`. | The SDD floor needs a constitution; ratification is the \`constitution\` phase's. |
+`;
+}
+
+/** ¿La constitución existe y está en borrador? Sólo lee el frontmatter; ilegible ⇒ no es borrador. */
+export function constitutionIsDraft(cwd = process.cwd()) {
+  const path = join(cwd, CONSTITUTION_PATH);
+  try {
+    if (!existsSync(path) || !lstatSync(path).isFile()) return false;
+    const text = readFileSync(path, 'utf8').replace(/\r\n/g, '\n');
+    const block = /^---\n([\s\S]*?)\n---(\n|$)/.exec(text);
+    return Boolean(block && /^status:\s*["']?draft["']?\s*$/m.test(block[1]));
+  } catch {
+    return false;
+  }
+}
+
+const isLink = (path) => { try { return lstatSync(path).isSymbolicLink(); } catch { return false; } };
+
+/**
+ * Escribe el borrador si el plan exige la constitución y no hay ninguna. Nunca sobrescribe: ni una
+ * ratificada ni un borrador que el usuario ya empezó. Un enlace (aunque cuelgue) cuenta como
+ * existente, y `wx` cierra la carrera entre comprobar y escribir.
+ */
+export function ensureConstitutionDraft(cwd, plan, { now = new Date() } = {}) {
+  if (!(plan?.floorPaths || []).includes(CONSTITUTION_PATH)) return { created: false };
+  // Sin importar `onboarding-apply.js` (doctor lee este módulo y no debe arrastrar el instalador):
+  // un directorio intermedio que sea enlace podría sacar la escritura de la raíz, y git versiona los
+  // enlaces, así que el vector viaja en un clone. Más estricto que la guarda general: no se sigue.
+  let cursor = cwd;
+  for (const segment of ['02-DOCS', 'wiki', 'sdd']) {
+    cursor = join(cursor, segment);
+    if (existsSync(cursor) || isLink(cursor)) {
+      if (lstatSync(cursor).isSymbolicLink()) throw new Error(`RSC_ROOT_AMBIGUOUS: ${CONSTITUTION_PATH} would be written through a symlink`);
+    }
+  }
+  const target = join(cwd, CONSTITUTION_PATH);
+  let present = false;
+  try { lstatSync(target); present = true; } catch { /* ausente */ }
+  if (present) return { created: false };
+  mkdirSync(join(cwd, '02-DOCS', 'wiki', 'sdd'), { recursive: true });
+  try {
+    writeFileSync(target, renderConstitutionDraft(plan, { project: basename(cwd), date: now }), { flag: 'wx' });
+  } catch (error) {
+    if (error.code === 'EEXIST') return { created: false };
+    throw error;
+  }
+  return { created: true };
+}

package/scripts/lib/manifest-file.js

@@ -15,7 +15,7 @@ import { join } from 'node:path';
 export const MANIFEST = '.rsc.json';
 export const manifestPath = (cwd = process.cwd()) => join(cwd, MANIFEST);
 
-const KEYS = ['version', 'targets', 'skills', 'agents', 'ownSkills', 'catalogVersion', 'tier', 'optOuts', 'memory', 'gitPermissions', 'onboarding'];
+const KEYS = ['version', 'targets', 'skills', 'agents', 'ownSkills', 'catalogVersion', 'tier', 'optOuts', 'memory', 'gitPermissions', 'agentModels', 'onboarding'];
 
 export function readManifest(cwd = process.cwd()) {
   const file = manifestPath(cwd);
@@ -40,10 +40,19 @@ export function readManifest(cwd = process.cwd()) {
     memory: raw.memory ?? undefined,
     // true on a project installed from scratch since 3.0.3; absent on older ones; false once turned off.
     gitPermissions: typeof raw.gitPermissions === 'boolean' ? raw.gitPermissions : undefined,
+    // #298 — per-target agent model: { opencode: 'openai/gpt-5' | 'inherit' }. Only plain objects of
+    // strings survive the read; what each value may contain is checked where it is rendered.
+    agentModels: agentModelsFrom(raw.agentModels),
     onboarding: raw.onboarding ?? undefined,
   };
 }
 
+function agentModelsFrom(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value).filter(([, v]) => typeof v === 'string').sort(([a], [b]) => a.localeCompare(b));
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+
 // Stable output: fixed key order, arrays one entry per line, order as given. Rewriting an
 // unchanged manifest must produce identical bytes, or every install shows up as a diff.
 export function writeManifest(cwd, manifest) {

package/scripts/lib/onboarding-apply.js

@@ -10,6 +10,7 @@ import { readManifest, writeManifest } from './manifest-file.js';
 import { encodeGoal, identifyPlan } from './onboarding.js';
 import { createBackup, restoreBackup } from './backups.js';
 import { RETIRED_SKILLS, replaceRetired } from './retired-skills.js';
+import { CONSTITUTION_PATH, constitutionIsDraft } from './constitution-draft.js';
 import { LAYER_IGNORE, TEMPLATE_SOURCE, targetName, templateAssets } from './tools-skeleton.js';
 
 const sameSet = (a = [], b = []) => JSON.stringify([...a].sort()) === JSON.stringify([...b].sort());
@@ -370,7 +371,9 @@ export async function applyAcceptedOnboarding({ cwd = process.cwd(), plan, planI
 const TEMPLATE_FLOOR = '01-TOOLS/_TEMPLATE/';
 
 export const HARNESS_FLOOR_MINIMUM = [TEMPLATE_FLOOR, '02-DOCS/wiki/harness/'];
-export const HARNESS_FLOOR_CONSTITUTION = '02-DOCS/wiki/sdd/constitution.md';
+// El onboarding escribe ahora un BORRADOR (`constitution-draft.js`) y el suelo lo acepta: sólo
+// mira existencia, y completar el borrador es de la cadena SDD, no del instalador.
+export const HARNESS_FLOOR_CONSTITUTION = CONSTITUTION_PATH;
 
 // La plantilla, sus nombres con punto y el `.gitignore` de la capa viven en `tools-skeleton.js`:
 // lo que se copia aquí es exactamente lo que `purge` puede recuperar, y sólo si sigue intacto.
@@ -442,7 +445,10 @@ function floorSatisfied(cwd, path) {
 // conflictos de merge, y que un repo clonado puede traer preparado. Así que se valida la forma antes
 // de mirar el disco: un `..` daba el suelo por satisfecho MIRANDO FUERA de la raíz, y un `null` o una
 // cadena en lugar de un array tumbaban `rsc install` después de haber instalado.
-export function missingHarnessFloor(cwd = process.cwd(), plan = {}) {
+//
+// Devuelve los CAMINOS que faltan (como se muestran). `missingHarnessFloor` los redacta para el
+// instalador y `onboardingReadiness` los entrega tal cual a `doctor`: una comprobación, dos lectores.
+export function harnessFloorGaps(cwd = process.cwd(), plan = {}) {
   const declared = Array.isArray(plan?.floorPaths) ? plan.floorPaths : [];
   const missing = [];
   for (const path of declared) {
@@ -450,15 +456,19 @@ export function missingHarnessFloor(cwd = process.cwd(), plan = {}) {
     const usable = segments.length > 0 && !segments.includes('..') && !String(path).startsWith('/');
     // Un camino que no se puede usar se reporta como NO satisfecho, nunca como satisfecho, y sin
     // repetir su contenido: es dato ajeno y va a un canal que lee un agente.
-    if (!usable) { missing.push('missing harness floor <invalid declaration>'); continue; }
+    if (!usable) { missing.push('<invalid declaration>'); continue; }
     // La barra sólo si el camino declarado la traía: el suelo condicional es un FICHERO, y decir
     // `constitution.md/` invita a buscar un directorio que no existe.
     const shown = String(path).endsWith('/') ? `${floorKey(path)}/` : floorKey(path);
-    if (!floorSatisfied(cwd, path)) missing.push(`missing harness floor ${shown}`);
+    if (!floorSatisfied(cwd, path)) missing.push(shown);
   }
   return missing;
 }
 
+export function missingHarnessFloor(cwd = process.cwd(), plan = {}) {
+  return harnessFloorGaps(cwd, plan).map((shown) => `missing harness floor ${shown}`);
+}
+
 /**
  * Lo que el instalador puede afirmar honestamente, y qué hacer si no.
  *
@@ -476,3 +486,50 @@ export function harnessReadiness(cwd = process.cwd(), plan = {}) {
       : '',
   };
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Preparación del onboarding, como pregunta PROPIA (#298 punto 5).
+//
+// `doctor` respondía sólo «¿el arnés instalado funciona?» (`healthy`, y el exit code con él) y un
+// usuario leía ese `true` como «el onboarding está terminado» con la constitución sin escribir. Son
+// dos preguntas: ésta se calcula con el MISMO suelo que decide RSC_ONBOARDING_READY/INCOMPLETE
+// (`harnessFloorGaps`) más los borradores, y nunca toca `healthy`.
+//
+//   ready          suelo completo, nada en borrador
+//   pending        suelo completo, pero algo es un borrador que el usuario debe completar
+//   incomplete     falta parte del suelo del plan aceptado (o el recibo no cuadra con su id)
+//   not-onboarded  no hay recibo: instalación manual (`rsc add`) o anterior al onboarding
+//
+// Un recibo de una versión que no declaraba suelo queda exento por construcción (P3), igual que en
+// el instalador: aquí no se inventa un suelo que el plan aceptado no traía.
+const ONBOARD_ACTION = 'Run `npx @ericrisco/rsc@latest onboard` to record a plan for this harness (optional: what is installed keeps working).';
+const draftAction = (path) => `Complete ${path} with the \`constitution\` phase (tell your agent "constitution") before the first SDD feature; ratifying removes \`status: draft\`.`;
+
+export function onboardingReadiness(cwd = process.cwd(), manifest = readManifest(cwd)) {
+  const pending = constitutionIsDraft(cwd) ? [CONSTITUTION_PATH] : [];
+  const receipt = manifest?.onboarding;
+  if (!receipt?.plan) {
+    return { status: 'not-onboarded', missing: [], pending, action: ONBOARD_ACTION };
+  }
+  let identical = false;
+  try { identical = identifyPlan(receipt.plan) === receipt.acceptedPlanId; } catch { /* ilegible: no cuadra */ }
+  if (!identical) {
+    return {
+      status: 'incomplete', missing: ['<onboarding receipt does not match its accepted plan id>'], pending,
+      action: 'Do not trust the receipt. Re-run `npx @ericrisco/rsc@latest onboard` and accept a fresh plan.',
+    };
+  }
+  const missing = harnessFloorGaps(cwd, receipt.plan);
+  if (missing.length) {
+    const actions = [];
+    if (missing.includes(CONSTITUTION_PATH)) {
+      actions.push(`Write ${CONSTITUTION_PATH} with the \`constitution\` phase (tell your agent "constitution"); the SDD plan you accepted requires it.`);
+    }
+    if (missing.some((path) => path !== CONSTITUTION_PATH)) {
+      actions.push('Invoke the `harness` skill to scaffold 01-TOOLS/ + 02-DOCS/.');
+    }
+    return { status: 'incomplete', missing, pending, action: actions.join(' ') };
+  }
+  if (pending.length) return { status: 'pending', missing, pending, action: draftAction(CONSTITUTION_PATH) };
+  return { status: 'ready', missing, pending, action: '' };
+}

package/scripts/lib/onboarding.js

@@ -117,6 +117,13 @@ export function scanProject(root = process.cwd()) {
       // Codex stores the always-on layer in AGENTS.md. Ignore a file that contains
       // only our managed block, while retaining a user's surrounding instructions
       // as real project evidence across repair/re-onboarding.
+      // El `CLAUDE.md` raíz es el Knowledge map, y lo escriben las propias fases de rsc: la
+      // `constitution` añade su fila «create CLAUDE.md if absent», y el instalador puede dejar ahí
+      // la sombra de AGENTS.md. Contarlo como evidencia movía la identidad del plan justo después de
+      // completar el suelo, y el `--accept-plan` del mismo id moría con RSC_PLAN_CHANGED sin que
+      // nada se hubiera elegido distinto (reproducido con 3.0.8). La cuenta de markdown no decide
+      // nada del plan —sólo su identidad—, así que no se pierde ninguna decisión.
+      if (rel === 'CLAUDE.md') isSignal = false;
       if (entry.name === 'AGENTS.md') {
         const human = readFileSync(path, 'utf8')
           .replace(/\n*<!-- rsc-suggest:start -->[\s\S]*?<!-- rsc-suggest:end -->\n*/g, '')