@ericrisco/rsc 3.0.9 → 3.0.11

package/scripts/rsc.js

@@ -4,9 +4,12 @@ import { detectTarget, installedTargets, resolveTargets, TARGETS } from '../targ
 import { detectRepo } from './detect-repo.js';
 import { rank } from './consult.js';
 import { expandRecommends, toOutcomes, hasOutcome } from './lib/recommend.js';
-import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purgeReport, collisions, ownSkillPaths } from './install-apply.js';
+import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purgeReport, collisions, ownSkillPaths, resetAgents } from './install-apply.js';
 import { isAbsolute, relative, sep } from 'node:path';
-import { stackAgentNames } from '../targets/agents.js';
+import {
+  stackAgentNames, targetHasAgents, isValidAgentModel, agentModelSetting, targetInheritsByDefault,
+  effectiveAgentModel, writeAgentsDetailed, readDeveloperTier, AGENT_MODEL_INHERIT, AGENT_TARGET_IDS,
+} from '../targets/agents.js';
 import { doctor } from './doctor.js';
 import { ask, say, select, pickFrom, banner, confirm, isInteractive } from './lib/ui.js';
 import { refreshRegistry, registryStatus } from './lib/registry.js';
@@ -43,7 +46,7 @@ if (['--version', '-v', 'version'].includes(rawArgv[0])) {
   process.exit(0);
 }
 const GENERAL_HELP = [
-  'Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | memory <on|off|status|save|resume|learn|metrics> | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id...> | purge | help',
+  'Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | agent-model <target> <model|inherit|status> | agents [status|reset <name|--all>] | memory <on|off|status|save|resume|learn|metrics> | review consolidate [reports…] | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id...> | purge | help',
   'Any command takes --target <claude|codex|cursor|copilot|gemini|…> (comma-separate for several)',
   '   → without it, rsc uses the assistant already installed here; if two are, it asks instead of guessing.',
 ].join('\n');
@@ -74,7 +77,7 @@ const PURGE_HELP = [
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--workflow', '--accept-plan',
 ]);
-const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'git-permissions', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'sello', 'repair', 'uninstall', 'purge']);
+const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'knowledge-sync', 'git-permissions', 'agent-model', 'agents', 'main', 'isolation', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'review', 'sello', 'repair', 'uninstall', 'purge']);
 function positionalTokens(input) {
   const out = [];
   for (let i = 0; i < input.length; i++) {
@@ -416,7 +419,7 @@ function reportUnknown(ids) {
 // flag says which: `purge` sweeps every target by design, and the catalog/consult
 // side barely touches one, so blocking them would be a regression, not a safeguard.
 const NEEDS_TARGET = new Set([
-  'onboard', 'add', 'install', 'list', 'doctor', 'sync', 'uninstall', 'capabilities', 'catalog', 'registry',
+  'onboard', 'add', 'install', 'list', 'doctor', 'sync', 'uninstall', 'capabilities', 'catalog', 'registry', 'agents',
 ]);
 
 function flag(name) {
@@ -573,6 +576,11 @@ function printAgentHandoff() {
   }
   if (readiness.ready) {
     say('  3. Tell the user rsc is ready; they can start in their own words.');
+    // #298 — ready is not «nothing pending»: the onboarding draft is named here too, not only in
+    // RSC_ONBOARDING_READY, so an agent arriving through install/sync tells the user before an SDD feature.
+    let draft = false;
+    try { draft = constitutionIsDraft(process.cwd()); } catch { /* unreadable is not a draft */ }
+    if (draft) say(`     Tell them too: ${CONSTITUTION_PATH} is a draft — complete it with the \`constitution\` phase before the first SDD feature.`);
     say('     Do NOT auto-start a task — wait for the user.');
   } else {
     // El otro emisor. Decía «ready» desde el wizard y desde `install` sin mirar el suelo, así que
@@ -585,6 +593,19 @@ function printAgentHandoff() {
   say('════════════════════════════════════════════════');
 }
 
+// #298 — the two answers a person looks for first, before any figure or JSON: does the installed
+// harness work (`healthy`, the one the exit code follows) and is onboarding finished (the accepted
+// plan's floor plus drafts). Kept apart on purpose — readiness never changes health nor the exit code.
+const READINESS_LABEL = { ready: 'ready', pending: 'pending', incomplete: 'incomplete', 'not-onboarded': 'not onboarded' };
+function printDoctorHeadline(report) {
+  const o = report.onboarding || {};
+  say(`Harness health: ${report.healthy ? 'healthy' : 'unhealthy'}`);
+  say(`Onboarding readiness: ${READINESS_LABEL[o.status] || 'unknown'}`);
+  if (o.missing?.length) say(`Missing: ${safeLines(o.missing).join(', ')}`);
+  if (o.pending?.length) say(`Pending: ${safeLines(o.pending).map((p) => (p === CONSTITUTION_PATH ? `${p} (draft)` : p)).join(', ')}`);
+  if (o.action) say(`Next: ${o.action}`);
+}
+
 // What the harness costs in context before the user types anything. Printed ahead of the raw
 // health JSON because it is the part a human acts on: the figures say whether the harness is
 // paying its way, and the findings say what to do about it.
@@ -624,6 +645,7 @@ async function syncDeclared(targets, dry = false) {
     const result = await syncInstalled({ target: t, dryRun: dry });
     const verb = dry ? 'Would sync' : 'Synced';
     say(`${verb} ${t}: ${result.synced.length ? result.synced.join(', ') : '(nothing to sync)'}`);
+    for (const k of result.keptAgents || []) say(`  ${k.message}`);
     if (dry && result.paths?.length) {
       for (const p of result.paths) say(`  ${p}`);
     }
@@ -870,6 +892,7 @@ async function main() {
       // #277 — an automation on top of rsc reads the exit code, not the prose.
       if (!report.healthy) process.exitCode = 1;
       if (argv.includes('--json')) return void say(JSON.stringify(report, null, 2));
+      printDoctorHeadline(report);
       printContextBudget(report.contextBudget);
       return void say(JSON.stringify({ ...report, contextBudget: undefined }, null, 2));
     }
@@ -952,26 +975,28 @@ async function main() {
       const sub = argv[1] || 'status';
       const root = process.cwd();
       const { readManifest, writeManifest } = await import('./lib/manifest-file.js');
-      const { gitPermissionsWired, GIT_PERMISSION_TARGETS } = await import('../targets/git-permissions.js');
+      const { gitPermissionsState, explainGitPermissions, GIT_PERMISSION_TARGETS } = await import('../targets/git-permissions.js');
       if (sub === 'on' || sub === 'off') {
         const current = readManifest(root);
         if (!current) { say('No .rsc.json here: install the harness first (`npx @ericrisco/rsc onboard`).'); process.exitCode = 2; return; }
         writeManifest(root, { ...current, gitPermissions: sub === 'on' });
         for (const t of targets) await syncInstalled({ target: t, cwd: root });
-        say(sub === 'on'
-          ? 'rsc git-permissions on: the agent may git commit, git push and gh pr create without asking (a force-push still asks; Cursor is not covered). Commit .rsc.json so the team gets the same decision.'
-          : 'rsc git-permissions off: commit, push and PR ask again, as the assistant does by default. Commit .rsc.json so the team gets the same decision.');
-        return;
+        // What rsc controls, what stops when off, and what is the assistant's own job (#298).
+        return void say(explainGitPermissions({ targets, cwd: root, mode: sub }));
       }
       if (sub === 'status') {
         const declared = readManifest(root)?.gitPermissions;
+        if (!flag('json')) return void say(explainGitPermissions({ targets, cwd: root, mode: 'status', declared }));
+        const covered = targets.filter((t) => GIT_PERMISSION_TARGETS.includes(t));
+        const states = Object.fromEntries(covered.map((t) => [t, gitPermissionsState(t, root)]));
         return void say(JSON.stringify({
           declared: declared === undefined ? 'undecided' : declared,
-          wired: Object.fromEntries(targets.filter((t) => GIT_PERMISSION_TARGETS.includes(t)).map((t) => [t, gitPermissionsWired(t, root)])),
+          wired: Object.fromEntries(covered.map((t) => [t, states[t].wired])),
+          format: Object.fromEntries(covered.map((t) => [t, states[t].format])),
           notCovered: targets.filter((t) => !GIT_PERMISSION_TARGETS.includes(t)),
         }, null, 2));
       }
-      say('Use: npx @ericrisco/rsc git-permissions on|off|status');
+      say('Use: npx @ericrisco/rsc git-permissions on|off|status [--json]');
       process.exitCode = 2;
       return;
     }
@@ -1023,6 +1048,98 @@ async function main() {
       process.exitCode = 1;
       return;
     }
+    case 'agent-model': {
+      // #298 — which model the generated agents carry: the session's (`inherit`, OpenCode's default)
+      // or one the project pins. A PROJECT decision, saved as `agentModels` in .rsc.json, so a clone
+      // renders the same agents; the files of that target are re-rendered at once.
+      const root = process.cwd();
+      const t = argv[1];
+      const value = argv[2] || 'status';
+      const describe = (id) => {
+        const setting = agentModelSetting(root, id);
+        const effective = effectiveAgentModel(id, root);
+        return {
+          target: id,
+          declared: setting || (targetInheritsByDefault(id) ? 'default (inherit)' : 'default (tier model)'),
+          effective: effective || 'inherit — the agent uses the session model',
+        };
+      };
+      if (!t || t === 'status') {
+        return void say(JSON.stringify(targets.filter(targetHasAgents).map(describe), null, 2));
+      }
+      if (!targetHasAgents(t)) {
+        console.error(`rsc: ${t} has no file-based agents. Targets with agents: ${AGENT_TARGET_IDS.join(', ')}`);
+        process.exitCode = 2;
+        return;
+      }
+      if (value === 'status') return void say(JSON.stringify(describe(t), null, 2));
+      if (!isValidAgentModel(value)) {
+        console.error(`rsc: '${value}' is not a model id (letters, digits and . _ : / @ + - only), nor 'inherit'.\nUse: npx @ericrisco/rsc agent-model <target> <model|inherit|status>`);
+        process.exitCode = 2;
+        return;
+      }
+      const current = readManifest(root);
+      if (!current) { say('No .rsc.json here: install the harness first (`npx @ericrisco/rsc onboard`).'); process.exitCode = 2; return; }
+      const next = { ...(current.agentModels || {}) };
+      // `inherit` on a target whose default is inherit stores nothing: the manifest stays as small as the decision.
+      if (value === AGENT_MODEL_INHERIT && targetInheritsByDefault(t)) delete next[t];
+      else next[t] = value;
+      writeManifest(root, { ...current, agentModels: Object.keys(next).length ? next : undefined });
+      const { targetPaths: pathsOf } = await import('../targets/index.js');
+      const { readState } = await import('./lib/state.js');
+      const installedAgents = readState(pathsOf(t, undefined, root).stateFile).agents || [];
+      const { written, kept } = writeAgentsDetailed(t, root, readDeveloperTier(root), installedAgents);
+      say(value === AGENT_MODEL_INHERIT
+        ? `rsc agent-model ${t} inherit: the agents carry no model and use the session's.`
+        : `rsc agent-model ${t} ${value}: the agents are pinned to ${value}.`);
+      say(`  Re-rendered ${written.length} agent file(s). Commit .rsc.json so the team gets the same decision.`);
+      for (const k of kept) say(`  ${k.message}`);
+      return;
+    }
+    case 'agents': {
+      const sub = argv[1] || 'status';
+      const root = process.cwd();
+      if (sub === 'reset') {
+        const all = argv.includes('--all');
+        const names = requestedIds(2);
+        if (!all && !names.length) {
+          console.error('Use: npx @ericrisco/rsc agents reset <name...|--all> [--target <assistant>]');
+          process.exitCode = 2;
+          return;
+        }
+        const { targetPaths: pathsOf } = await import('../targets/index.js');
+        const { readState } = await import('./lib/state.js');
+        const withAgents = targets.filter(targetHasAgents);
+        let done = 0;
+        for (const t of withAgents) {
+          const installed = readState(pathsOf(t, undefined, root).stateFile).agents || [];
+          const mine = all ? [] : names.filter((n) => installed.includes(n));
+          if (!all && !mine.length) continue;
+          const out = resetAgents({ target: t, cwd: root, names: mine, all });
+          done += out.reset.length;
+          if (out.reset.length) {
+            say(`Reset ${t}: ${out.reset.join(', ')} — rsc's version is back.`);
+            if (out.backup) say(`  Your previous files are kept in ${out.backup}/files/ (\`rsc restore\` lists the snapshot).`);
+          }
+        }
+        if (!all && !done) {
+          console.error(`rsc: ${names.join(', ')}: not an agent rsc installed here (${withAgents.join(', ') || 'no target with agents'}).`);
+          process.exitCode = 1;
+        }
+        return;
+      }
+      if (sub === 'status') {
+        const { targetPaths: pathsOf } = await import('../targets/index.js');
+        const { readState } = await import('./lib/state.js');
+        return void say(JSON.stringify(targets.filter(targetHasAgents).map((t) => {
+          const state = readState(pathsOf(t, undefined, root).stateFile);
+          return { target: t, agents: state.agents || [], editedByYou: (state.agentsKept || []).map((k) => k.name) };
+        }), null, 2));
+      }
+      say('Use: npx @ericrisco/rsc agents status | agents reset <name...|--all>');
+      process.exitCode = 2;
+      return;
+    }
     case 'sync':
       return syncDeclared(targets, argv.includes('--dry-run'));
     case 'backups': {
@@ -1064,6 +1181,37 @@ async function main() {
       say('Use: npx @ericrisco/rsc registry refresh | registry status');
       return;
     }
+    case 'review': {
+      // `review consolidate` — the deterministic half of the refuter panel (P1): the three lenses
+      // often report one defect three ways, so grouping happens here, by location and evidence, and
+      // only the unique serious findings go on to `finding-verifier`, which is judgement.
+      const USE = 'Use: npx @ericrisco/rsc review consolidate [report.md|findings.json ...] [--json] [--window <lines>]\n  Without files it reads stdin. Each lens report carries its findings in ```json findings blocks.';
+      if (argv[1] !== 'consolidate') { say(USE); if (argv[1]) process.exitCode = 1; return; }
+      const { readFileSync } = await import('node:fs');
+      const R = await import('./lib/review-findings.js');
+      const w = flag('window');
+      const window = w === undefined ? R.DEFAULT_WINDOW : Number(w);
+      if (!Number.isInteger(window) || window < 0) { say(`rsc: --window takes a whole number of lines, got '${w}'.\n${USE}`); process.exitCode = 1; return; }
+      const rest = argv.slice(2);
+      const files = rest.filter((a, i) => !a.startsWith('--') && rest[i - 1] !== '--window');
+      const sources = [];
+      try {
+        if (files.length) for (const f of files) sources.push([readFileSync(f, 'utf8'), f]);
+        else if (!process.stdin.isTTY) sources.push([readFileSync(0, 'utf8'), 'stdin']);
+      } catch (e) { say(`rsc: cannot read ${e.path || 'stdin'} (${e.code || e.message}).`); process.exitCode = 1; return; }
+      if (!sources.length) { say(USE); process.exitCode = 1; return; }
+      const all = []; const errors = [];
+      for (const [raw, src] of sources) {
+        const parsed = R.parseFindings(raw, src);
+        all.push(...parsed.findings); errors.push(...parsed.errors);
+      }
+      const result = R.consolidate(all, { window });
+      if (argv.includes('--json')) say(JSON.stringify({ ...result, errors }, null, 2));
+      else say(R.renderConsolidation(result, errors));
+      // An unreadable block is a finding that may have been lost: say it with the exit code too.
+      if (errors.length) process.exitCode = 1;
+      return;
+    }
     case 'worktrees': {
       // The deterministic half of "the cleanup is the default". `ship` and the `worktrees` skill call
       // this instead of judging by eye, which is what turns a rule that was only ever written down

package/skills/code-review/SKILL.md

@@ -93,6 +93,8 @@ Read the surrounding code, trace the *value*, confirm the path is reachable.
 
 If you cannot trace it to a concrete value and a reachable sink, you do not yet have a finding.
 
+When several reviewers looked at the same diff, merge before reporting. Have each one end with a ` ```json findings ` block, run `npx @ericrisco/rsc review consolidate <reports…>`, and send each blocker it marks `verify` to the `finding-verifier` agent. That is the `review` skill's step, and it applies here unchanged.
+
 ## The verdict
 
 End every review with exactly one, plainly — no mushy middle:

package/skills/review/SKILL.md

@@ -128,7 +128,8 @@ gap deliberately with `--accept-partial-lenses` (it is recorded). Every approval
 
 **Lenses by risk tier** — tier 0 never reaches you (the gate passes docs/copy silently);
 tier 1 → run the single most relevant pass from the table above yourself; tier 2 → dispatch
-**three parallel fresh-context subagents** (correctness · security · tests-as-evidence), each told
+**three parallel fresh-context subagents** (`refuter-correctness` · `refuter-security` ·
+`refuter-tests`), each told
 to *refute* readiness, not confirm it. Fresh context is the point: a reviewer who inherits the
 implementer's context inherits its blind spots.
 
@@ -164,6 +165,26 @@ Two extra finding classes the four inputs unlock, neither reachable from a diff:
 - **Mapping, both directions** — an acceptance criterion with no test that can be made to fail, and
   a test pinning behaviour no criterion asked for.
 
+**Consolidate, then verify — before anything reaches the author.** Three lenses on one diff often
+report one defect three ways, and a lens hunting for something can overstate what it found. Two
+steps, in this order:
+
+1. **Group (deterministic).** Each lens ends its report with a ` ```json findings ` block. Save the
+   three reports and run `npx @ericrisco/rsc review consolidate <reports…>`. It merges findings on
+   the same file within 3 lines, or quoting the same evidence; keeps the highest severity and every
+   lens that saw it; and downgrades a blocker or should-fix with no `file:line` or failure scenario to
+   a question. Several lenses on one finding is a reason to look first, never a reason to raise its
+   severity.
+2. **Verify (judgement).** For each finding it marks `verify`, dispatch the **`finding-verifier`**
+   agent with that one finding plus the same four inputs, in parallel. It starts from "this is false"
+   and returns **CONFIRMED** (reproduced or traced, with the proof), **REFUTED** (cites the guard that
+   makes it impossible), or **UNPROVEN** (becomes a question). It never gets the lens's reasoning.
+
+Report the consolidated count honestly ("11 reported → 4 unique → 2 confirmed"), and list what was
+refuted and why: a refuted finding hidden from the author is a review nobody can audit. At tier 1
+(one pass, run by you) there is nothing to group, but a blocker still goes to `finding-verifier`
+before it blocks.
+
 **A finding blocks only if it survives all three filters** — no exceptions, and eagerness to
 find something is not evidence:
 
@@ -171,8 +192,8 @@ find something is not evidence:
    `--note "<finding>"` (they land in `.rsc/sello-findings.md`, surfaced by `doctor`) and
    suggest an issue; they never block this delivery.
 2. **Severity** — only `blocker` blocks. `should-fix`/`nit` → `--note`.
-3. **Evidence** — a `repro` or a concrete failure scenario. A suspicion without one is a
-   `[question]`, and questions don't block.
+3. **Evidence** — `finding-verifier` returned **CONFIRMED** with its proof. REFUTED is dropped (with
+   its reason in the report); UNPROVEN is a `[question]`, and questions don't block.
 
 **Fixing a blocker is budgeted, one attempt.** Before touching anything: estimate the fix and
 declare it — `npx @ericrisco/rsc sello budget --lines <N>`. After the fix:

package/targets/agents.js

@@ -9,7 +9,9 @@
 // elsewhere. The chosen tier (balanced default, or heavy) lives in `.rsc/developer.json`,
 // written by `init` at onboarding and read here so re-syncs honor it.
 import { readFileSync, writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { join, dirname, relative, sep } from 'node:path';
+import { createHash } from 'node:crypto';
+import { readManifest } from '../scripts/lib/manifest-file.js';
 import {
   stackAgents, stackAgentNames, stackAgentByName,
   resolveStackAgentNames, validateAgentCatalog,
@@ -32,7 +34,12 @@ const AGENT_TARGETS = {
   claude: { dir: '.claude/agents', ext: '.md', format: 'md', model: (t) => (t === 'heavy' ? 'opus' : 'sonnet') },
   junie: { dir: '.junie/agents', ext: '.md', format: 'md', model: (t) => (t === 'heavy' ? 'opus' : 'sonnet') },
   cursor: { dir: '.cursor/agents', ext: '.md', format: 'md', model: (t) => TIER_MODEL.anthropic[t] },
-  opencode: { dir: '.opencode/agents', ext: '.md', format: 'md', mode: 'subagent', toolsFormat: 'map', model: (t) => `anthropic/${TIER_MODEL.anthropic[t]}` },
+  // #298 — OpenCode is the one tool people point at a local model or another provider per session, so
+  // its agents INHERIT the session model by default (`model: null` → no `model:` line) and only carry
+  // one when the project pins it (`agentModels.opencode` in .rsc.json). And its `tools` map is
+  // restrict-only: rsc never grants a tool there, it can only take away what a role never declared,
+  // so a stricter project permission policy is never loosened by an rsc agent.
+  opencode: { dir: '.opencode/agents', ext: '.md', format: 'md', mode: 'subagent', toolsFormat: 'restrict', model: () => null, legacyModel: (t) => `anthropic/${TIER_MODEL.anthropic[t]}` },
   gemini: { dir: '.gemini/agents', ext: '.md', format: 'md', model: (t) => TIER_MODEL.google[t] },
   copilot: { dir: '.github/agents', ext: '.agent.md', format: 'md', model: (t) => TIER_MODEL.anthropic[t] },
   kiro: { dir: '.kiro/agents', ext: '.json', format: 'json', model: (t) => (t === 'heavy' ? 'claude-opus-4' : 'claude-sonnet-4') },
@@ -68,7 +75,15 @@ ${REFUTER_FOUR_INPUTS}
 3. Did you inspect the relevant **caller, import, and relevant test**?
 4. Can the severity survive the **existing guards** you verified?
 
-If an answer is no, lower the severity or omit the finding. Every **HIGH or CRITICAL** needs the line and failure mode in the report. **Zero findings with an attack list is valid.**
+If an answer is no, lower the severity or omit the finding. Every **blocker or should-fix** needs the line and failure mode in the report. **Zero findings with an attack list is valid.**
+
+**Report findings in one shape, so the panel can be consolidated** — a fenced ${'`json findings`'} block holding an array (empty when you found nothing):
+
+${'```'}json findings
+[{ "lens": "<your lens>", "severity": "blocker|should-fix|nit|question", "file": "path/from/repo/root", "line": 42, "claim": "one sentence: what is wrong", "failure_scenario": "concrete input + state -> wrong result", "evidence": "the exact changed line, quoted" }]
+${'```'}
+
+${'`rsc review consolidate`'} merges what several lenses reported about the same place and sends each unique blocker or should-fix to ${'`finding-verifier`'}, whose job is to prove it false. A blocker or should-fix with no ${'`file`'}, ${'`line`'} or ${'`failure_scenario`'} is downgraded to a question there, mechanically.
 
 **Common false positives to reject:** an equivalent mutant with no diverging input; a documented dummy value that never reaches a sink; a deliberate boundary already enforced by a caller; generated/vendor code outside the change; style preference presented as correctness; and a theoretical race with no shared state or overlapping lifetime.
 
@@ -126,8 +141,36 @@ ${REFUTER_CONTRACT}
 
 **Check the mapping both ways:** every acceptance criterion needs a falsification procedure that can be made to fail, and every test should trace to something someone asked for.`,
   },
+  // The second half of ECC's orch-review, adapted: after `rsc review consolidate` collapses the panel's
+  // duplicates, every unique blocker/should-fix gets ONE more fresh context whose default is that the
+  // finding is false. A refuter attacks the diff; the verifier attacks the finding. Same asymmetry,
+  // pointed the other way — which is what stops an exaggerated lens from reaching the author as a blocker.
+  {
+    name: 'finding-verifier',
+    desc: 'Adversarial verifier of review findings: takes ONE consolidated finding and tries to prove it false against the code. Default stance: the finding is false; only a reproduced or traced failure is CONFIRMED. Fresh context, edits nothing.',
+    body: `You are the **finding verifier** for this project. ${'`review`'} hands you **one** finding that survived ${'`rsc review consolidate`'} — a blocker or should-fix some refuter lens reported against a diff. Your job is to **prove it false**. Your starting position is that it is false; the finding has to beat you.
+
+**Your inputs:** the finding (location, claim, failure scenario, evidence) plus the same four the lenses had —
+
+${REFUTER_FOUR_INPUTS}
+
+**You do NOT get** the refuter's reasoning or the builder's defence. Judge the claim against the code, not against either story.
+
+**How to try to kill it:**
+1. Read the cited line **and** its callers, guards and tests — the check that makes it impossible often lives two functions up, or in a caller that never passes that input.
+2. Try the failure scenario for real when you can: run the test, execute the command, or write a throwaway check in a temp directory outside the repo. An observed failure outranks any argument.
+3. Ask whether the change **caused** it. A defect that was already there is real but does not block this delivery.
+
+**Verdict — exactly one, with its proof:**
+- **CONFIRMED** — you reproduced it, or traced a reachable path from a concrete input to the wrong result. Quote the output or the path. Only this verdict may block.
+- **REFUTED** — you found what makes it impossible (the guard, the caller, the type, the test). Cite it with file and line.
+- **UNPROVEN** — neither: it becomes a question for the human, and questions never block.
+
+Also state whether the severity holds. A CONFIRMED finding whose blast radius is narrow is a should-fix, not a blocker — say so. You fix nothing and edit no file: your output is the verdict, the proof, and the commands you ran.`,
+  },
 ];
 
+
 export const BASE_AGENT_NAMES = Object.freeze(AGENTS.map((agent) => agent.name));
 export { stackAgents, stackAgentNames, validateAgentCatalog };
 export const allAgentNames = () => [...BASE_AGENT_NAMES, ...stackAgentNames()];
@@ -157,11 +200,26 @@ export function writeDeveloperTier(cwd, tier) {
   return t;
 }
 
-function renderMd(spec, model, agent) {
-  const fm = ['---', `name: ${agent.name}`, `description: "${agent.desc}"`, `model: ${model}`];
+// OpenCode V1 tool names a declared capability maps to. `read`/`search` need nothing: what the agent
+// may read is the project's policy to decide, and saying `read: true` would be a grant.
+const RESTRICT_TOOLS = { edit: ['edit', 'write', 'patch'], shell: ['bash'] };
+function restrictedTools(tools) {
+  if (!tools) return [];
+  return Object.entries(RESTRICT_TOOLS).filter(([cap]) => !tools.includes(cap)).flatMap(([, names]) => names);
+}
+
+function renderMd(spec, model, agent, toolsFormat = spec.toolsFormat) {
+  const fm = ['---', `name: ${agent.name}`, `description: "${agent.desc}"`];
+  if (model) fm.push(`model: ${model}`);
   if (spec.mode) fm.push(`mode: ${spec.mode}`);
   if (agent.tools) {
-    if (spec.toolsFormat === 'map') {
+    if (toolsFormat === 'restrict') {
+      const denied = restrictedTools(agent.tools);
+      if (denied.length) {
+        fm.push('tools:');
+        for (const tool of denied) fm.push(`  ${tool}: false`);
+      }
+    } else if (toolsFormat === 'map') {
       fm.push('tools:');
       for (const tool of agent.tools) fm.push(`  ${tool}: true`);
     } else {
@@ -171,44 +229,146 @@ function renderMd(spec, model, agent) {
   fm.push('---', '');
   return `${fm.join('\n')}${agent.body}\n`;
 }
-const renderJson = (model, agent) => `${JSON.stringify({ name: agent.name, description: agent.desc, model, ...(agent.tools ? { tools: agent.tools } : {}), prompt: agent.body }, null, 2)}\n`;
+const renderJson = (model, agent) => `${JSON.stringify({ name: agent.name, description: agent.desc, ...(model ? { model } : {}), ...(agent.tools ? { tools: agent.tools } : {}), prompt: agent.body }, null, 2)}\n`;
 function renderToml(model, agent) {
   const esc = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
   // body as a TOML multiline LITERAL string ('''…''') — no escape processing.
   const tools = agent.tools ? `tools = [${agent.tools.map((tool) => `"${tool}"`).join(', ')}]\n` : '';
-  return `name = "${agent.name}"\ndescription = "${esc(agent.desc)}"\nmodel = "${model}"\n${tools}developer_instructions = '''\n${agent.body}\n'''\n`;
+  return `name = "${agent.name}"\ndescription = "${esc(agent.desc)}"\n${model ? `model = "${model}"\n` : ''}${tools}developer_instructions = '''\n${agent.body}\n'''\n`;
+}
+
+// ── #298: the model, decided by the project. `agentModels` in .rsc.json maps a target to a model id
+// or to `inherit`. Absent → the target's default (inherit on OpenCode, the tier model elsewhere). The
+// value lands verbatim in YAML/TOML/JSON from a COMMITTED file, so anything outside a plain model-id
+// alphabet is ignored rather than written: a pulled .rsc.json must not be able to inject frontmatter.
+export const AGENT_MODEL_INHERIT = 'inherit';
+export const isValidAgentModel = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,127}$/.test(value);
+export function agentModelSetting(cwd, target) {
+  let value;
+  try { value = readManifest(cwd)?.agentModels?.[target]; } catch { value = undefined; }
+  return isValidAgentModel(value) ? value : null;
+}
+export const targetInheritsByDefault = (target) => AGENT_TARGETS[target]?.model('balanced') === null;
+function resolveModel(target, cwd, tier) {
+  const setting = agentModelSetting(cwd, target);
+  if (setting === AGENT_MODEL_INHERIT) return null;
+  if (setting) return setting;
+  return AGENT_TARGETS[target].model(tier);
+}
+
+export const effectiveAgentModel = (target, cwd, tier = readDeveloperTier(cwd)) => (AGENT_TARGETS[target] ? resolveModel(target, cwd, tier) : null);
+
+function renderAgent(target, spec, model, agent, toolsFormat) {
+  return spec.format === 'json' ? renderJson(model, agent)
+    : spec.format === 'toml' ? renderToml(model, agent)
+      : renderMd(spec, model, agent, toolsFormat);
+}
+
+// ── #298: what rsc wrote, per file, so a user edit is told apart from rsc's own file. Machine-local
+// (.rsc/ is gitignored): a digest says "this machine's rsc wrote these bytes", which is not a team fact.
+const sha = (text) => createHash('sha256').update(text).digest('hex');
+const digestFile = (cwd) => join(cwd, '.rsc', 'agent-digests.json');
+const relKey = (cwd, path) => relative(cwd, path).split(sep).join('/');
+function readDigests(cwd) {
+  try { const d = JSON.parse(readFileSync(digestFile(cwd), 'utf8')); return d && typeof d === 'object' ? d : {}; } catch { return {}; }
+}
+function writeDigests(cwd, digests) {
+  mkdirSync(dirname(digestFile(cwd)), { recursive: true });
+  const ordered = Object.fromEntries(Object.keys(digests).sort().map((k) => [k, digests[k]]));
+  writeFileSync(digestFile(cwd), `${JSON.stringify(ordered, null, 2)}\n`);
+}
+
+// Every rendering rsc could have produced for this agent on this target: either tier, the current
+// model setting, and — for OpenCode — the pre-#298 shape (pinned Anthropic model, `tool: true` map).
+// A file with no digest that matches one of these is rsc's and may be replaced; anything else is the
+// user's. Bodies from older releases are not reconstructed: such a file is kept and reported, the safe
+// direction, and `rsc agents reset` is one command away.
+function knownRenderings(target, cwd, agent) {
+  const spec = AGENT_TARGETS[target];
+  const out = new Set();
+  for (const tier of ['balanced', 'heavy']) {
+    out.add(renderAgent(target, spec, resolveModel(target, cwd, tier), agent));
+    out.add(renderAgent(target, spec, spec.model(tier), agent));
+    if (spec.legacyModel) out.add(renderAgent(target, spec, spec.legacyModel(tier), agent, 'map'));
+  }
+  return out;
+}
+
+// 'rsc' when the file on disk is rsc's to overwrite or remove, 'user' when it carries the user's edit.
+function ownership(target, cwd, agent, path, digests) {
+  if (!existsSync(path)) return 'absent';
+  const current = readFileSync(path, 'utf8');
+  const key = relKey(cwd, path);
+  if (digests[key]) return digests[key] === sha(current) ? 'rsc' : 'user';
+  return knownRenderings(target, cwd, agent).has(current) ? 'rsc' : 'user';
 }
 
+const keptNotice = (name, path, cwd) => ({
+  name,
+  path,
+  message: `kept your edited agent ${name} (${relKey(cwd, path)}; rsc's version differs; \`rsc agents reset ${name}\` to take it)`,
+});
+
 export function agentPath(target, cwd, name = 'developer') {
   const spec = AGENT_TARGETS[target];
   return spec ? join(cwd, ...spec.dir.split('/'), `${name}${spec.ext}`) : null;
 }
 
-export function writeAgents(target, cwd, tier = readDeveloperTier(cwd), names = agentNames()) {
+/**
+ * Write the agents, keeping any the user edited. Returns { written, kept }: `kept` names each agent
+ * left as the user has it, with the message to show. `force` takes rsc's version regardless — only
+ * `rsc agents reset` passes it, after backing the user's file up.
+ */
+export function writeAgentsDetailed(target, cwd, tier = readDeveloperTier(cwd), names = agentNames(), { force = false } = {}) {
   const spec = AGENT_TARGETS[target];
-  if (!spec) return [];
+  if (!spec) return { written: [], kept: [] };
+  const digests = readDigests(cwd);
   const written = [];
+  const kept = [];
   for (const name of names) {
     const agent = byName(name);
     if (!agent) continue;
     const effectiveTier = agent.tier === 'heavy' ? 'heavy' : tier;
-    const model = spec.model(effectiveTier);
-    const content = spec.format === 'json' ? renderJson(model, agent)
-      : spec.format === 'toml' ? renderToml(model, agent)
-        : renderMd(spec, model, agent);
+    const content = renderAgent(target, spec, resolveModel(target, cwd, effectiveTier), agent);
     const path = agentPath(target, cwd, agent.name);
+    if (!force && ownership(target, cwd, agent, path, digests) === 'user') {
+      // Unless it already IS what rsc would write — then there is nothing to protect, only to record.
+      if (readFileSync(path, 'utf8') !== content) { kept.push(keptNotice(agent.name, path, cwd)); continue; }
+    }
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, content);
+    digests[relKey(cwd, path)] = sha(content);
     written.push(path);
   }
-  return written;
+  writeDigests(cwd, digests);
+  return { written, kept };
+}
+
+export function writeAgents(target, cwd, tier = readDeveloperTier(cwd), names = agentNames(), options) {
+  return writeAgentsDetailed(target, cwd, tier, names, options).written;
 }
 
 export function reconcileAgents(target, cwd, tier, previousNames = [], desiredNames = []) {
-  if (!targetHasAgents(target)) return { written: [], removed: [], collisions: [], names: [] };
+  if (!targetHasAgents(target)) return { written: [], removed: [], collisions: [], names: [], kept: [] };
   const previous = new Set(previousNames);
   const desired = new Set(desiredNames);
-  const removed = removeAgents(target, cwd, [...previous].filter((name) => !desired.has(name)));
+  const kept = [];
+  // An agent no longer wanted is removed only while it is still rsc's file. One the user edited is
+  // theirs now: deleting it on an uninstall or a stack change is the same loss sync must not cause.
+  const digests = readDigests(cwd);
+  const stale = [];
+  for (const name of [...previous].filter((n) => !desired.has(n))) {
+    const agent = byName(name);
+    const path = agentPath(target, cwd, name);
+    if (agent && ownership(target, cwd, agent, path, digests) === 'user') {
+      kept.push({ name, path, message: `kept your edited agent ${name} (${relKey(cwd, path)}); rsc no longer installs it, delete it yourself if you do not want it` });
+    } else stale.push(name);
+  }
+  const removed = removeAgents(target, cwd, stale);
+  if (removed.length) {
+    for (const path of removed) delete digests[relKey(cwd, path)];
+    writeDigests(cwd, digests);
+  }
   const written = [];
   const collisions = [];
   const names = [];
@@ -218,10 +378,12 @@ export function reconcileAgents(target, cwd, tier, previousNames = [], desiredNa
       collisions.push(path);
       continue;
     }
-    written.push(...writeAgents(target, cwd, tier, [name]));
+    const result = writeAgentsDetailed(target, cwd, tier, [name]);
+    written.push(...result.written);
+    kept.push(...result.kept);
     if (existsSync(path)) names.push(name);
   }
-  return { written, removed, collisions, names };
+  return { written, removed, collisions, names, kept };
 }
 
 /**