@frankzhang2026/opencode-android-orchestrator 0.1.0 → 0.3.0

package/docs/SECURITY.md

@@ -0,0 +1,219 @@
+# Security model
+
+This document describes the security properties of
+`@frankzhang2026/opencode-android-orchestrator@0.3.0`. The lifecycle foundation
+completed the real OpenCode `1.14.22` and `1.15.13` release matrix in `0.2.0`;
+`0.3.0` retains that compatibility boundary.
+
+## Security goals and non-goals
+
+The orchestrator is designed to reduce accidental or model-initiated scope
+expansion in a local Android repository. It aims to:
+
+- keep human proposal, contract, and final-result approval explicit;
+- constrain Coder edits to contract-approved Android source/test paths;
+- keep Reviewer read-only;
+- authenticate packaged and installed orchestration resources;
+- preserve original files and recover complete installer transactions;
+- block silent overwrites, unsafe symlinks, stale plans, branch drift, pushes,
+  unbounded retries, and Scheduler/launchd registration;
+- create one local product-and-planning commit only after sealed verification.
+
+It is not a privilege boundary against a malicious local user, a compromised
+OpenCode binary/provider, a compromised npm/Git dependency, or another process
+running as the same operating-system account. It does not sandbox Gradle,
+OpenCode, Java, Git hooks, or project tests. A hostile build script or test can
+perform actions outside the orchestrator's intended scope.
+
+## Trust boundaries
+
+| Boundary | Trusted input | Untrusted or separately verified input |
+| --- | --- | --- |
+| Package installation | The exact reviewed npm tarball and its pinned version | Existing project files, paths, modes, symlinks, and concurrent edits |
+| OpenCode interaction | A fresh single-choice result handled by the scheduled planner | Ordinary chat text, command arguments, and model-generated approval phrases |
+| Product implementation | The sealed task contract, baseline HEAD, allowed paths, and deterministic scripts | Coder summaries and any unsealed worktree change |
+| Review | The approved contract and independently recomputed diff/evidence | Coder claims and stale report content |
+| Integration | Task ID, repository lease, sealed diff SHA, approved review, original branch/ref, and fresh acceptance | Branch drift, manual commits, changed worktrees, or a reused acceptance package |
+| Recovery | Manifest, markers, hashes, modes, original backups, snapshots, and Git refs | Guessed cleanup steps or copied state from another repository |
+
+## Human approval boundary
+
+The normal workflow has three fresh OpenCode `question` selections: proposal,
+sealed contract, and final result. Direct chat prose, silence, a dismissed
+question, or a copied option label is not a normal-path approval. Exceptional
+abort has its own fresh status display and confirmation flow.
+
+Approval phrases stored in `automation/config.json` are validation tokens, not
+secrets or cryptographic proof. Security depends on the scheduled planner
+showing the current review material, the user acting at that boundary, and the
+fixed Shell script independently verifying state, hashes, refs, scope, and
+leases. Anyone with direct shell and repository write access can invoke or
+modify local files; this package does not claim to protect against that actor.
+
+OpenCode permission prompts are also not semantic workflow approval. They can
+be accepted for the remainder of a session and may be auto-approved. For that
+reason `0.3.0` exposes only `android_orchestrator_status` and
+`android_orchestrator_doctor` as custom tools. State-changing wrappers remain a
+NO-GO until a one-use, non-model-forgeable receipt can bind the approval kind,
+task, session/message, sealed SHA or branch, time, and nonce.
+
+## Agent and tool permissions
+
+All three installed agents start with `"*": deny` and add exact permissions.
+The planner can write only new planning artifacts and invoke the small set of
+orchestration scripts. The Coder can edit detected production/test source sets
+but not Gradle, OpenCode, automation, or control files. Reviewer edit access is
+denied. Subagents, Scheduler/job tools, external directories, web access, push,
+merge/rebase, destructive Git commands, shell composition, and launchd are
+denied where applicable.
+
+Permissions are defense in depth, not a substitute for script checks. The
+source preflight resolves each agent and verifies its effective high-risk
+permissions and custom-tool discovery.
+
+The read-only status tool additionally:
+
+- validates `TASK-[A-Z0-9-]+` at Schema and execution time;
+- binds execution to the worktree that loaded the plugin;
+- authenticates the installation manifest, managed resources, and executable
+  modes before running anything;
+- invokes only the fixed `scripts/automation/status.sh` path with separate
+  shell expressions;
+- rejects a failed command, malformed/mismatched JSON, or output above 1 MiB.
+
+Doctor invokes read-only project, dependency, SDK, and installation checks and
+returns their failures instead of repairing the project.
+
+## Filesystem and configuration safety
+
+The installer never follows a symbolic link at a managed file or required
+ancestor. Paths must be relative, normalized, unique, within the detected Git
+root, and regular files where required. Existing content, size, and effective
+mode are captured during planning and rechecked before the first write. A stale
+or tampered plan fails closed.
+
+Installation strategies are deliberately distinct:
+
+- `copy` and `generate` accept a missing target or an exact content/mode match;
+  any differing existing file is a conflict;
+- `merge` accepts only output produced by the structure-aware OpenCode JSON/JSONC
+  or bounded AGENTS merge planner;
+- no lifecycle command has a force-overwrite flag.
+
+OpenCode JSON/JSONC merging preserves unrelated fields, comments, order, and
+plugin options. It rejects malformed/ambiguous files, duplicate identities,
+different managed-plugin versions, and symlinks. AGENTS merging owns only one
+marked block and rejects partial, duplicate, or modified markers.
+
+New installations generate task examples in `all` module scope: every detected
+Android module's `src/main`, `src/test`, and `src/androidTest` path is eligible,
+while Gradle settings/build files and orchestration resources remain protected.
+`primary` scope narrows the generated paths to one module. Upgrade treats a
+legacy configuration with no scope field as `primary`, preventing an implicit
+permission expansion.
+
+The installed manifest is `0600`. Installer control, backup, recovery, and
+history directories are created with private `0700` defaults; backup files
+preserve the original file mode where recovery requires it. Shell resources
+must be exact packaged bytes with `0755`; other copied templates are
+non-executable.
+
+## Transaction and recovery safety
+
+`init` writes original-file backups before publishing a prepared manifest. It
+then applies validated files, runs the 38-case transaction suite and a shadow
+run, verifies final hashes/modes, and only then marks the manifest installed.
+Failure before completion restores originals and removes safely unchanged new
+files.
+
+`upgrade` requires a healthy installed manifest and original backups. It saves
+the exact old manifest and immediate pre-upgrade snapshots, reconstructs merge
+targets from first-install originals, writes the new version, and replaces the
+manifest only after verification. Failure attempts a whole-version rollback.
+
+`uninstall` restores an original or removes a plugin-created path only when the
+current path still matches a safe known state. Content, permission, deletion,
+or existence drift is retained and reported. Before changes it saves the
+active manifest and every affected installed file. Failure before commit
+attempts to restore the installed state.
+
+An `*_ROLLBACK_FAILED` result is a hard stop. Do not delete markers or recovery
+data and do not guess at partial cleanup. Preserve the repository and inspect
+the recorded before/after hashes and Git refs.
+
+## Git and orchestration invariants
+
+- The source repository must have an identifiable original branch and baseline
+  HEAD. Original-branch drift blocks integration.
+- The persistent repository lease prevents concurrent orchestrated tasks from
+  sharing a mutable repository workspace.
+- Planning artifacts remain uncommitted until the verified product change is
+  ready. Successful integration creates exactly one combined local commit.
+- Scope gates inspect tracked and untracked changes, reject protected paths and
+  obvious test weakening, and bind the accepted result to a diff SHA.
+- Integration reruns verification before a fast-forward. It never pushes.
+- A successfully integrated task branch is deleted only after the original
+  branch reaches the verified commit. Failure preserves the branch for
+  recovery.
+- Abort rejects out-of-contract/protected paths, archives the diff, and avoids
+  changing the original branch ref.
+
+Git hooks and Git configuration remain part of the host repository's trust
+surface. Review them before running a workflow in an untrusted project.
+
+## Dependencies and network behavior
+
+Use fixed package references. The installer adds the exact orchestrator
+version and the configured pinned Superpowers Git tag; it does not use
+`latest`. The package is compiled against `@opencode-ai/plugin@1.14.22` and
+declares the bounded peer range `>=1.14.22 <1.16.0`.
+
+The orchestrator does not contain a telemetry uploader and the deterministic
+Shell flow forbids Git push. Network activity can still occur outside that
+code when npm/npx downloads a package, OpenCode resolves a pinned plugin,
+OpenCode contacts the configured model provider, or project build/test tooling
+uses the network. Apply the host organization's normal npm, Git, OpenCode,
+provider, proxy, certificate, and dependency-review policy.
+
+## Secrets and retained evidence
+
+Installed agents deny reads of `.env`, `.env.*`, `local.properties`, `*.jks`,
+and `*.keystore`. Do not put secrets in task descriptions, plans, source code,
+test output, commit messages, model prompts, or approval summaries.
+
+The following may contain sensitive source, paths, branch names, test logs,
+diffs, or review findings:
+
+- `.git/automation-runtime/evidence/`;
+- `.git/automation-runtime/workspaces/` and state/transition records;
+- `.automation-plugin/backups/`, `upgrades/`, `uninstalls/`, and `history/`;
+- generated acceptance, abort, integration, and rollback evidence.
+
+These paths are excluded from package templates but remain local audit data.
+Keep repository and filesystem access appropriately restricted. Redact user
+names, absolute paths, proprietary source/diffs, provider details, tokens, SDK
+paths, and signing information before sharing a diagnostic bundle. Do not
+commit installer recovery data unless an explicit internal policy requires it.
+
+## Residual risks
+
+- Hashes prove byte identity against the running package; they do not prove the
+  package itself is trustworthy. Review the tarball and its provenance.
+- A same-user process can race filesystem or Git state around checks. The
+  implementation rechecks critical snapshots and locks cooperative workflows,
+  but it is not an operating-system sandbox.
+- Gradle tests, Git hooks, OpenCode, model providers, and third-party plugins
+  execute outside this package's file planner and may have broader behavior.
+- `inPlaceExclusive` intentionally switches the current worktree to a task
+  branch. Use the explicitly configured isolated-worktree strategy only after
+  validating its storage and cleanup policy.
+- Recovery evidence improves auditability but increases local sensitive-data
+  retention.
+- Real dual-version end-to-end acceptance and a clean install from the final
+  tarball remain mandatory release gates.
+
+When reporting a suspected security problem, preserve exact versions, error
+codes, hashes, and redacted evidence. Do not publish credentials, proprietary
+diffs, recovery archives, or exploit details that would expose another
+project. See [Troubleshooting](TROUBLESHOOTING.md) for safe first-response
+commands.

package/docs/TROUBLESHOOTING.md

@@ -0,0 +1,171 @@
+# Troubleshooting
+
+Use this guide for
+`@frankzhang2026/opencode-android-orchestrator@0.3.0`.
+
+## Start with read-only evidence
+
+From the repository root, capture:
+
+```sh
+git status --short --branch
+git rev-parse HEAD
+opencode --version
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 doctor . --json
+```
+
+If installation never completed, doctor will correctly report a missing or
+invalid installed manifest. Preserve the complete error code and details from
+the command that failed. Do not rerun a write command repeatedly while the
+working tree or installer control state is changing.
+
+The CLI uses these exit codes:
+
+| Exit code | Meaning |
+| ---: | --- |
+| `0` | Command completed, or doctor found no failed check. Doctor warnings are allowed. |
+| `1` | A lifecycle operation failed, or doctor found at least one failed check. |
+| `2` | Unknown command or invalid CLI arguments. |
+
+`doctor --json` always emits a structured report. The `--json` option on
+`init`, `upgrade`, and `uninstall` structures successful results; thrown errors
+remain human-readable on stderr with a stable code such as `[FILE_CONFLICT]`.
+
+## Prerequisite and discovery failures
+
+| Symptom | Likely cause | Safe response |
+| --- | --- | --- |
+| `DOCTOR_FAILED` before any write | One or more required project/tool checks failed. | Read each failed doctor check; fix only the named prerequisite, then rerun doctor or init. |
+| OpenCode version failure | Installed version is below `1.14.22`, at or above `1.16.0`, or cannot be parsed/executed. | Install a certified version (`1.14.22` or `1.15.13`) for release validation. Do not bypass the version gate. |
+| Git root or Android project not detected | The target is outside a Git repository, settings are missing, or no supported Android module was found. | Run from the intended repository/module and inspect `settings.gradle` or `settings.gradle.kts`. Nested Gradle roots are intentionally unsupported. |
+| Gradle Wrapper failure | `gradlew` or `gradle/wrapper/gradle-wrapper.properties` is missing, or `gradlew` is not executable. | Restore the project's reviewed Wrapper files. Do not let the installer generate or replace build configuration. |
+| `MODULE_SCOPE_INVALID` or an invalid `--module-scope` argument | The value is not `all` or `primary`. | Use `all` for the default all-module contract or `primary` for an intentional single-module restriction. |
+| `PRIMARY_MODULE_AMBIGUOUS` | Restrictive `primary` scope has multiple possible Android modules. | Supply an exact Gradle path, for example `--module-scope primary --primary-module :mobile`, or use the default `all` scope. |
+| `PRIMARY_MODULE_NOT_FOUND` | The selected Gradle path was not detected. | Use a module path reported by doctor/project detection; do not pass a filesystem directory. |
+| Android SDK failure | No valid explicit SDK, `ANDROID_HOME`, `ANDROID_SDK_ROOT`, or `local.properties` `sdk.dir` was found. | Configure one real SDK root containing `platforms/` and `build-tools/`. Do not publish `local.properties`. |
+| Missing `git`, `jq`, `rg`, `shasum`, or Java | Required deterministic command is unavailable on `PATH`. | Install or restore the missing command, record its version, and rerun the read-only checks. |
+
+After installation, inspect OpenCode discovery separately:
+
+```sh
+opencode debug config
+opencode debug skill
+opencode debug agent scheduled-planner
+opencode debug agent scheduled-coder
+opencode debug agent scheduled-reviewer
+```
+
+Then run `./scripts/automation/preflight.sh --source`. It validates pinned
+plugins, required skills, agent permissions, and both read-only custom tools.
+If it fails, preserve its exact output. Do not broaden an agent's default-deny
+permissions to make discovery pass.
+
+## Installation conflicts
+
+Common fail-closed codes include:
+
+| Code | Meaning | Response |
+| --- | --- | --- |
+| `FILE_CONFLICT` | Existing content or mode differs from a `copy`/`generate` target. | Compare the named path with the packaged template. Preserve local policy elsewhere or restore the audited file deliberately; there is no force flag. |
+| `AMBIGUOUS_CONFIG` | Both `opencode.json` and `opencode.jsonc` exist. | Select and consolidate the user-owned configuration in a separate reviewed change. |
+| `PLUGIN_VERSION_CONFLICT` | The same managed package identity has another reference/version. | Review and remove or migrate only the obsolete entry; never let init silently replace it. |
+| `DUPLICATE_PLUGIN` or `DUPLICATE_PROPERTY` | Configuration identity is ambiguous. | Correct the JSON/JSONC structure without discarding unrelated fields or comments. |
+| `INVALID_JSONC` or `ROOT_NOT_OBJECT` | OpenCode configuration cannot be merged safely. | Repair the user-owned file and validate it before retrying. |
+| `AGENTS_BLOCK_CONFLICT` or `AGENTS_MARKERS_INVALID` | The bounded managed block is modified, partial, or duplicated. | Restore one exact managed block; keep project-specific instructions outside its markers. |
+| `FILE_SYMLINK`, `TARGET_SYMLINK`, or `CONFIG_SYMLINK` | A managed target or ancestor is a symbolic link. | Replace it only after understanding ownership and destination. The installer intentionally does not follow it. |
+| `PLAN_STALE` or `TARGET_MODIFIED` | A file changed between planning and application. | Stop concurrent edits, inspect the diff, and rerun from a stable state. |
+
+An init verification failure reports `POST_INSTALL_VERIFICATION_FAILED` and
+automatically rolls back the prepared installation. Confirm the original files
+and inspect `.automation-plugin/history/`; do not assume a failed init left a
+usable installation.
+
+## Manifest, upgrade, and uninstall failures
+
+Run doctor before deciding on recovery. Its installation section distinguishes
+manifest identity, content drift, permission drift, backups, and semantic
+configuration.
+
+| Code or check | Meaning | Response |
+| --- | --- | --- |
+| `MANIFEST_MISSING`, `MANIFEST_INVALID`, or `MANIFEST_STATE` | No trustworthy installed manifest is available. | Do not invent a manifest or copy one from another project. Determine whether this is an uninstalled/manual setup or an interrupted transaction. |
+| `EXISTING_INSTALLATION_DIFFERENT` | `init` found another installed inventory/version. | Use `upgrade` for a healthy older manifest. |
+| `EXISTING_INSTALLATION_INVALID` or `INSTALLATION_INVALID` | Manifest, installed files, or required backups failed validation. | Preserve the project and `.automation-plugin/`; inspect doctor details and recovery history. |
+| `INSTALLED_FILES_MODIFIED` | Upgrade found content, existence, mode, or backup drift. | Move intentional customization out of managed paths or choose manual recovery. Upgrade will not overwrite it. |
+| `VERSION_DOWNGRADE_REFUSED` | Target package is older than the installed manifest. | Use a newer fixed package version; never edit the manifest version. |
+| `UPGRADE_IN_PROGRESS` or `UNINSTALL_IN_PROGRESS` | `.automation-plugin/upgrade.json` or `uninstall.json` records an unfinished transaction. | Inspect the marker and matching recovery directory. Do not delete the marker merely to retry. |
+| `POST_UPGRADE_VERIFICATION_FAILED` | New resources failed verification. | The implementation attempts a complete old-version rollback; verify the old manifest and inspect upgrade evidence. |
+| `UNINSTALL_CONFLICT` | Uninstall planning/application detected unsafe state. | Keep all files and inspect the listed paths. Drift is retained by design. |
+| `POST_UNINSTALL_VERIFICATION_FAILED` | Final restored/removed paths did not verify. | The implementation attempts to restore the installed state; inspect uninstall recovery evidence before another command. |
+| Any `*_ROLLBACK_FAILED` | Automatic recovery could not prove completion. | Stop all automation. Preserve Git refs, the manifest, marker, backups, recovery snapshots, and logs for manual analysis. |
+
+Installer control paths are:
+
+- active manifest: `.automation-plugin/manifest.json` (`0600`);
+- first-install/original backups: `.automation-plugin/backups/<id>/`;
+- upgrade marker and snapshots: `.automation-plugin/upgrade.json` and
+  `.automation-plugin/upgrades/<id>/`;
+- uninstall marker and snapshots: `.automation-plugin/uninstall.json` and
+  `.automation-plugin/uninstalls/<id>/`;
+- completed/rolled-back records: `.automation-plugin/history/`.
+
+These files are evidence, not cache.
+
+## Read-only custom tool failures
+
+`android_orchestrator_status` accepts exactly one `TASK-[A-Z0-9-]+` ID. It
+authenticates the installation before invoking the fixed status script.
+
+| Code | Meaning |
+| --- | --- |
+| `INVALID_TASK_ID` | The ID contains invalid characters, extra text, or an unsupported format. |
+| `WORKSPACE_MISMATCH` | The tool context differs from the worktree that loaded the plugin. |
+| `UNTRUSTED_INSTALLATION` | Manifest, packaged resource, or executable-mode checks could not authenticate the installed status script. |
+| `STATUS_RUNNER_UNAVAILABLE` | OpenCode did not supply the compatible shell adapter. |
+| `STATUS_COMMAND_FAILED` | The authenticated status script returned a nonzero exit. Its details usually identify a missing contract or invalid runtime layout. |
+| `INVALID_STATUS_OUTPUT` | Output was not valid JSON or identified another task. |
+| `STATUS_OUTPUT_TOO_LARGE` | Output exceeded the 1 MiB safety bound. |
+| `TOOL_ABORTED` | The OpenCode call was cancelled before execution. |
+
+Do not bypass `UNTRUSTED_INSTALLATION` by calling a different script path. Run
+doctor, restore the exact managed installation, or perform a reviewed recovery.
+
+## Automation task recovery
+
+Use `./scripts/automation/status.sh <TASK-ID>` or the read-only status tool to
+identify the state, workspace, original branch, sealed diff, and evidence.
+
+- `AWAITING_HUMAN`: use `/acceptance <TASK-ID>` to regenerate the verified
+  review card and fresh result question.
+- `BLOCKED` after a Reviewer exited without submitting a decision: use
+  `/resume-review <TASK-ID>`. The script accepts only the bounded reviewer-only
+  recovery and proves the sealed diff has not changed.
+- A supported stopped state that should be abandoned: use
+  `/abort-task <TASK-ID>`, inspect the status card, and complete its explicit
+  confirmation. It archives contract-scoped work before restoring the original
+  branch.
+- `INTEGRATION_BLOCKED`: preserve the task branch, original branch, lease, and
+  integration evidence. Do not reset, cherry-pick, merge, or rerun the
+  integrator until the recorded refs and failure are understood.
+- `TEST_FAILED` or `NEEDS_HUMAN`: inspect the contract and evidence. Do not
+  broaden scope or silently queue the same task again.
+
+## Actions to avoid
+
+Never use a troubleshooting shortcut that destroys the evidence needed to
+prove recovery:
+
+- do not run `git reset --hard`, `git clean`, an improvised merge/rebase, or a
+  manual branch deletion;
+- do not edit manifest hashes, state JSON, approvals, or sealed evidence;
+- do not recursively delete `.automation-plugin/` or
+  `.git/automation-runtime/`;
+- do not chmod all managed files to silence permission drift;
+- do not replace a pinned package reference with `latest`;
+- do not expose `.env`, signing keys, keystores, `local.properties`, npm tokens,
+  model-provider credentials, or recovery diffs in public reports.
+
+For escalation, provide the command, exit code, stable error code, redacted
+details, OpenCode version, package version, current branch/HEAD, and the list of
+affected paths. Share file contents only after applying the guidance in
+[Security](SECURITY.md).

package/package.json

@@ -1,13 +1,26 @@
 {
   "name": "@frankzhang2026/opencode-android-orchestrator",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Reusable OpenCode orchestration for Android projects",
   "license": "MIT",
+  "author": "frankzhang2026",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/frankzhangtx/npm-orchestrator-plugin.git"
+  },
+  "homepage": "https://github.com/frankzhangtx/npm-orchestrator-plugin#readme",
+  "bugs": {
+    "url": "https://github.com/frankzhangtx/npm-orchestrator-plugin/issues"
+  },
   "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/opencode-plugin.js",
+  "types": "./dist/opencode-plugin.d.ts",
   "exports": {
     ".": {
+      "types": "./dist/opencode-plugin.d.ts",
+      "import": "./dist/opencode-plugin.js"
+    },
+    "./api": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     }
@@ -17,9 +30,12 @@
   },
   "files": [
     "dist/",
+    "docs/",
     "templates/",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "publishConfig": {
     "access": "public",
@@ -38,7 +54,6 @@
     "automation",
     "orchestration"
   ],
-  "author": "",
   "peerDependencies": {
     "@opencode-ai/plugin": ">=1.14.22 <1.16.0"
   },
@@ -46,5 +61,8 @@
     "@opencode-ai/plugin": "1.14.22",
     "@types/node": "22.13.9",
     "typescript": "5.8.2"
+  },
+  "dependencies": {
+    "jsonc-parser": "3.3.1"
   }
 }

package/templates/.opencode/agents/scheduled-coder.md

@@ -0,0 +1,115 @@
+---
+description: Implements or repairs exactly one orchestrated task with TDD and deterministic quality gates
+mode: primary
+temperature: 0.1
+steps: 32
+permission:
+  "*": deny
+  android_orchestrator_status: allow
+  android_orchestrator_doctor: allow
+  read:
+    "*": allow
+    ".env": deny
+    ".env.*": deny
+    "local.properties": deny
+    "**/*.jks": deny
+    "**/*.keystore": deny
+  edit:
+    "*": deny
+    "src/main/**": allow
+    "src/test/**": allow
+    "src/androidTest/**": allow
+    "**/src/main/**": allow
+    "**/src/test/**": allow
+    "**/src/androidTest/**": allow
+    ".opencode/**": deny
+    ".opencode/skills/**": deny
+    "automation/**": deny
+    "scripts/automation/**": deny
+    "opencode.json": deny
+    "AGENTS.md": deny
+    "gradle/**": deny
+    "gradlew": deny
+    "gradlew.bat": deny
+    "settings.gradle": deny
+    "settings.gradle.kts": deny
+    "build.gradle": deny
+    "build.gradle.kts": deny
+    "**/build.gradle": deny
+    "**/build.gradle.kts": deny
+  bash:
+    "*": deny
+    "git status": allow
+    "git status --short": allow
+    "git diff": allow
+    "git diff --stat": allow
+    "git diff --name-only": allow
+    "git rev-parse HEAD": allow
+    "git rev-parse --show-toplevel": allow
+    "git ls-files": allow
+    "./gradlew testDebugUnitTest": allow
+    "./gradlew assembleDebug": allow
+    "./gradlew lint": allow
+    "./gradlew connectedDebugAndroidTest": allow
+    "./scripts/automation/status.sh *": allow
+    "./scripts/automation/select-task.sh PENDING": allow
+    "./scripts/automation/claim-task.sh *": allow
+    "./scripts/automation/block-task.sh *": allow
+    "./scripts/automation/record-red.sh *": allow
+    "./scripts/automation/quality-gate.sh *": allow
+    "git push*": deny
+    "git merge*": deny
+    "git rebase*": deny
+    "git worktree*": deny
+    "git clean*": deny
+    "git reset*": deny
+    "rm *": deny
+    "*>*": deny
+    "*<*": deny
+    "*|*": deny
+    "*;*": deny
+    "*&&*": deny
+    "*||*": deny
+    "*$(*": deny
+    "*`*": deny
+  glob: allow
+  grep: allow
+  list: allow
+  skill:
+    "*": deny
+    "using-superpowers": allow
+    "scheduled-quality-coder": allow
+    "test-driven-development": allow
+    "systematic-debugging": allow
+    "verification-before-completion": allow
+  schedule_job: deny
+  list_jobs: deny
+  get_version: deny
+  get_skill: deny
+  install_skill: deny
+  get_job: deny
+  update_job: deny
+  delete_job: deny
+  cleanup_global: deny
+  run_job: deny
+  job_logs: deny
+  task: deny
+  question: deny
+  external_directory: deny
+  webfetch: deny
+  websearch: deny
+  doom_loop: deny
+---
+
+You are the write-capable half of an orchestrated coding quality gate.
+
+The orchestrator message must contain exactly one task ID or the compatibility
+selector token `NEXT_PENDING`. Load
+`scheduled-quality-coder` before taking any repository action and follow it
+literally. Do not infer missing requirements and do not ask questions during a
+non-interactive run. If anything is ambiguous or blocked, stop and report the exact
+reason; the deterministic scripts own state transitions.
+
+You may edit only paths allowed both by this agent and by the task contract.
+Passing tests never grants permission to push, merge, create worktrees, alter
+automation rules, or declare the task ready for review yourself.