@frankzhang2026/opencode-android-orchestrator 0.6.1 → 0.8.0

package/dist/plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAMlD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAGnC,eAAO,MAAM,0BAA0B,4CACI,CAAC;AAC5C,eAAO,MAAM,yBAAyB,2CACI,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAuBpC,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,EAAE,MACyB,CAAC;AAElE,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAMlD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAGnC,eAAO,MAAM,0BAA0B,4CACI,CAAC;AAC5C,eAAO,MAAM,yBAAyB,2CACI,CAAC;AAC3C,eAAO,MAAM,wBAAwB,QAKpC,CAAC;AACF,eAAO,MAAM,iBAAiB,2OAMpB,CAAC;AAwBX;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAgCpC,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,EAAE,MACyB,CAAC;AAElE,eAAe,yBAAyB,CAAC"}

package/dist/plugin/index.js

@@ -1,18 +1,50 @@
+import { lstatSync } from "node:fs";
 import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { applyLongCommandTimeout, readLongCommandTimeoutMs, } from "../config/long-command-timeout.js";
 import { defineCompatibleHooks, toCompatiblePluginInput, } from "../compatibility/hooks.js";
 import { createReadOnlyTools } from "../tools/index.js";
 export const ORCHESTRATOR_DIRECTORY_ENV = "OPENCODE_ANDROID_ORCHESTRATOR_DIRECTORY";
 export const ORCHESTRATOR_WORKTREE_ENV = "OPENCODE_ANDROID_ORCHESTRATOR_WORKTREE";
+export const BUNDLED_SKILLS_DIRECTORY = fileURLToPath(new URL("../../resources/third-party/superpowers-v6.2.0/skills/", import.meta.url));
+export const BUNDLED_SKILL_IDS = [
+    "android-orchestrator-brainstorming",
+    "android-orchestrator-writing-plans",
+    "android-orchestrator-test-driven-development",
+    "android-orchestrator-systematic-debugging",
+    "android-orchestrator-verification-before-completion",
+];
+function assertBundledSkillsAvailable() {
+    for (const skillId of BUNDLED_SKILL_IDS) {
+        const entrypoint = resolve(BUNDLED_SKILLS_DIRECTORY, skillId, "SKILL.md");
+        try {
+            if (!lstatSync(entrypoint).isFile()) {
+                throw new Error("entrypoint is not a regular file");
+            }
+        }
+        catch (error) {
+            throw new Error(`Bundled Orchestrator skill is unavailable: ${skillId}. Reinstall the exact Orchestrator package.`, { cause: error });
+        }
+    }
+}
 /**
  * Runtime implementation deliberately receives only fields shared by the two
  * certified OpenCode versions.
  */
 export const createCompatiblePlugin = async ({ directory, worktree, $, }) => {
+    assertBundledSkillsAvailable();
     const projectDirectory = resolve(directory);
     const projectWorktree = resolve(worktree);
     const longCommandTimeoutMs = readLongCommandTimeoutMs(projectWorktree);
     return defineCompatibleHooks({
+        config: async (config) => {
+            const compatibleConfig = config;
+            compatibleConfig.skills = compatibleConfig.skills ?? {};
+            compatibleConfig.skills.paths = compatibleConfig.skills.paths ?? [];
+            if (!compatibleConfig.skills.paths.includes(BUNDLED_SKILLS_DIRECTORY)) {
+                compatibleConfig.skills.paths.push(BUNDLED_SKILLS_DIRECTORY);
+            }
+        },
         tool: createReadOnlyTools({
             directory: projectDirectory,
             worktree: projectWorktree,

package/dist/plugin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,0BAA0B,GACrC,yCAAyC,CAAC;AAC5C,MAAM,CAAC,MAAM,yBAAyB,GACpC,wCAAwC,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAqB,KAAK,EAAE,EAC7D,SAAS,EACT,QAAQ,EACR,CAAC,GACF,EAAE,EAAE;IACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAEvE,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,mBAAmB,CAAC;YACxB,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,CAAC;SACT,CAAC;QACF,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,gBAAgB,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,eAAe,CAAC;QAC1D,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7C,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAW,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACxE,sBAAsB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAElE,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,0BAA0B,GACrC,yCAAyC,CAAC;AAC5C,MAAM,CAAC,MAAM,yBAAyB,GACpC,wCAAwC,CAAC;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CACnD,IAAI,GAAG,CACL,wDAAwD,EACxD,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CACF,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,oCAAoC;IACpC,oCAAoC;IACpC,8CAA8C;IAC9C,2CAA2C;IAC3C,qDAAqD;CAC7C,CAAC;AAQX,SAAS,4BAA4B;IACnC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8CAA8C,OAAO,6CAA6C,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAqB,KAAK,EAAE,EAC7D,SAAS,EACT,QAAQ,EACR,CAAC,GACF,EAAE,EAAE;IACH,4BAA4B,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAEvE,OAAO,qBAAqB,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,gBAAgB,GAAG,MAA8C,CAAC;YACxE,gBAAgB,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,IAAI,EAAE,CAAC;YACxD,gBAAgB,CAAC,MAAM,CAAC,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBACtE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,EAAE,mBAAmB,CAAC;YACxB,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,CAAC;SACT,CAAC;QACF,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,gBAAgB,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,eAAe,CAAC;QAC1D,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7C,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAW,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACxE,sBAAsB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAElE,eAAe,yBAAyB,CAAC"}

package/docs/MIGRATION.md

@@ -1,7 +1,7 @@
 # Migration guide
 
 This guide covers migration to
-`@frankzhang2026/opencode-android-orchestrator@0.6.1`. Pin the exact version and
+`@frankzhang2026/opencode-android-orchestrator@0.8.0`. Pin the exact version and
 prove the migration in a disposable clone before changing a long-lived
 repository.
 
@@ -9,9 +9,9 @@ repository.
 
 | Current state | Correct command after release | Important distinction |
 | --- | --- | --- |
-| No orchestrator files or manifest | `npx @frankzhang2026/opencode-android-orchestrator@0.6.1 init .` | Normal new installation; all detected Android modules and registered debug verification tasks are discovered automatically. |
+| No orchestrator files or manifest | `npx @frankzhang2026/opencode-android-orchestrator@0.8.0 init .` | Normal new installation; all detected Android modules and registered debug verification tasks are discovered automatically. |
 | Published `0.1.0` scaffold only | Remove any project-local `@0.1.0` plugin reference after review, then run `init`. | `0.1.0` did not create a usable managed installation and cannot be upgraded. |
-| Healthy `0.2.0` through `0.6.0` manifest-managed installation | Run the fixed `0.6.1` doctor, then `upgrade`. | Existing module scope and verification tasks are preserved. Pre-`0.6.1` configurations receive the 30-minute long-command timeout default. |
+| Healthy `0.2.0` through `0.7.0` manifest-managed installation | Run the fixed `0.8.0` doctor, then `upgrade`. | Existing module scope, verification tasks, and policy values are preserved. The old managed Superpowers plugin reference is replaced by bundled skills. Pre-`0.6.1` configurations receive the 30-minute long-command timeout default. |
 | Manually copied V3 files, no `.automation-plugin/manifest.json` | Finish active tasks, preserve historical evidence separately, then run `init`. | Exact files can be reused; differing managed files fail as conflicts. |
 | Healthy older manifest-managed installation | Run `doctor`, then the fixed target version's `upgrade`. | `upgrade` requires a valid installed manifest and intact original backups. |
 | Healthy current-version manifest | Run `doctor`; repeated `init` or same-version `upgrade` is verification-only and byte-idempotent. | Do not reinstall or delete the manifest. |
@@ -36,7 +36,7 @@ removes unchanged plugin-created files, and retains drift for manual review.
 5. If a managed manifest already exists, run:
 
    ```sh
-   npx @frankzhang2026/opencode-android-orchestrator@0.6.1 doctor . --json
+   npx @frankzhang2026/opencode-android-orchestrator@0.8.0 doctor . --json
    ```
 
    Do not proceed with `upgrade` unless the installation checks pass.
@@ -52,14 +52,14 @@ scaffold, not as an older managed installation.
 If the project OpenCode configuration contains an exact
 `@frankzhang2026/opencode-android-orchestrator@0.1.0` entry, save the file and
 remove only that obsolete entry in a reviewed Git change before running
-`0.6.1 init`. The merger deliberately rejects a different version of the same
+`0.8.0 init`. The merger deliberately rejects a different version of the same
 managed package; it will not silently replace the reference. A global npm
 installation of `0.1.0` alone does not require project-file cleanup.
 
 After release, initialize with the fixed version:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.6.1 init .
+npx @frankzhang2026/opencode-android-orchestrator@0.8.0 init .
 ```
 
 New installations default to all-module scope, so multiple application modules
@@ -105,8 +105,8 @@ installer to guess which customization should survive.
 Use the lifecycle command selected by the active manifest:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.6.1 doctor . --json
-npx @frankzhang2026/opencode-android-orchestrator@0.6.1 upgrade . --json
+   npx @frankzhang2026/opencode-android-orchestrator@0.8.0 doctor . --json
+npx @frankzhang2026/opencode-android-orchestrator@0.8.0 upgrade . --json
 ```
 
 `upgrade` verifies the installed manifest, every managed file, and every
@@ -127,6 +127,21 @@ To choose another value during migration, pass
 `--long-command-timeout-ms <milliseconds>`; the accepted range is `120000`
 through `7200000`.
 
+Unit-test and Android lint verification are repository policies in
+`automation/config.json`. Existing boolean values are preserved. Older
+configurations receive `unitTestsEnabled: true` and `lintEnabled: false`.
+After migration, change only those two values in place and commit the
+configuration; there are no `init` or `upgrade` flags for these policies.
+
+Upgrading a healthy `0.7.0` installation removes the exact managed Superpowers
+v6.2.0 plugin reference that the older Orchestrator added. Upgrade rebuilds the
+OpenCode merge from the verified original pre-install file, so ownership stays
+bounded: if that exact reference was already present before Orchestrator was
+installed, it remains user-owned and is preserved. Other Superpowers versions,
+plugin entries, options, comments, and configuration fields are not silently
+removed. Version `0.8.0` instead registers its five package-local,
+`android-orchestrator-*` workflow skills through the OpenCode `config` hook.
+
 The command refuses:
 
 - a downgrade or malformed semantic version;
@@ -144,8 +159,9 @@ the source of drift and use the recorded recovery data.
 Run all checks from the detected Git root:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.6.1 doctor .
+npx @frankzhang2026/opencode-android-orchestrator@0.8.0 doctor .
 opencode debug config
+opencode debug skill
 opencode debug agent scheduled-planner
 opencode debug agent scheduled-coder
 opencode debug agent scheduled-reviewer
@@ -157,7 +173,8 @@ opencode debug agent scheduled-reviewer
 Verify all of the following before switching normal work to the plugin:
 
 - doctor has no failed check;
-- all three agents, five commands, and required skills are discoverable;
+- all three agents, five commands, three scheduled-quality skills, and five
+  `android-orchestrator-*` workflow skills are discoverable;
 - both read-only custom tools resolve for the scheduled agents;
 - the Shell suite ends with `1..44`;
 - shadow output contains `"mutationPerformed": false`;

package/docs/SECURITY.md

@@ -1,9 +1,9 @@
 # Security model
 
 This document describes the security properties of
-`@frankzhang2026/opencode-android-orchestrator@0.6.1`. The lifecycle foundation
+`@frankzhang2026/opencode-android-orchestrator@0.8.0`. The lifecycle foundation
 completed the real OpenCode `1.14.22` and `1.15.13` release matrix in `0.2.0`;
-`0.6.1` retains that compatibility boundary.
+`0.8.0` retains that compatibility boundary.
 
 ## Security goals and non-goals
 
@@ -53,7 +53,7 @@ modify local files; this package does not claim to protect against that actor.
 
 OpenCode permission prompts are also not semantic workflow approval. They can
 be accepted for the remainder of a session and may be auto-approved. For that
-reason `0.6.1` exposes only `android_orchestrator_status` and
+reason `0.8.0` exposes only `android_orchestrator_status` and
 `android_orchestrator_doctor` as custom tools. State-changing wrappers remain a
 NO-GO until a one-use, non-model-forgeable receipt can bind the approval kind,
 task, session/message, sealed SHA or branch, time, and nonce.
@@ -91,6 +91,13 @@ value is an integer from `120000` through `7200000` milliseconds, defaults to
 `1800000`, never shortens a larger caller timeout, and does not rewrite the
 command or authorize a state change.
 
+The five namespaced bundled workflow skills are loaded from a fixed directory
+inside the installed npm package. The compatible `config` hook only appends
+that directory to `skills.paths`, and plugin startup verifies that every
+expected `SKILL.md` is a regular file. The package omits the upstream
+`using-superpowers` bootstrap, localhost/browser companion, remote branding,
+telemetry, and unrelated skills.
+
 ## Filesystem and configuration safety
 
 The installer never follows a symbolic link at a managed file or required
@@ -119,6 +126,14 @@ while Gradle settings/build files and orchestration resources remain protected.
 legacy configuration with no scope field as `primary`, preventing an implicit
 permission expansion.
 
+`unitTestsEnabled` and `lintEnabled` are the only operator-editable fields in
+the otherwise manifest-managed `automation/config.json`. Upgrade authenticates
+the remaining generated content before preserving those values, and doctor
+validates the resulting adaptive configuration. Task agents still cannot edit
+the protected file. Unit tests default on and lint defaults off; disabling unit
+verification does not remove the mandatory RED evidence step. Assemble, scope,
+evidence, and required device-test gates are unaffected.
+
 The optional repository-root `.automation-worktree-allowlist` is controlled by
 the local human operator, not by task agents. It accepts at most 256 exact,
 normalized repository-relative file paths in a regular file no larger than 64
@@ -188,14 +203,16 @@ surface. Review them before running a workflow in an untrusted project.
 
 ## Dependencies and network behavior
 
-Use fixed package references. The installer adds the exact orchestrator
-version and the configured pinned Superpowers Git tag; it does not use
-`latest`. The package is compiled against `@opencode-ai/plugin@1.14.22` and
+Use fixed package references. The installer adds only the exact Orchestrator
+version; it does not use `latest` or install a GitHub-backed Superpowers
+plugin. The five required Superpowers-derived skills and their supporting
+files are part of the reviewed npm tarball with the upstream MIT license and
+provenance. The package is compiled against `@opencode-ai/plugin@1.14.22` and
 declares the bounded peer range `>=1.14.22 <1.16.0`.
 
 The orchestrator does not contain a telemetry uploader and the deterministic
 Shell flow forbids Git push. Network activity can still occur outside that
-code when npm/npx downloads a package, OpenCode resolves a pinned plugin,
+code when npm/npx downloads a package, OpenCode resolves another configured plugin,
 OpenCode contacts the configured model provider, or project build/test tooling
 uses the network. Apply the host organization's normal npm, Git, OpenCode,
 provider, proxy, certificate, and dependency-review policy.

package/docs/TROUBLESHOOTING.md

@@ -1,7 +1,7 @@
 # Troubleshooting
 
 Use this guide for
-`@frankzhang2026/opencode-android-orchestrator@0.6.1`.
+`@frankzhang2026/opencode-android-orchestrator@0.8.0`.
 
 ## Start with read-only evidence
 
@@ -11,7 +11,7 @@ From the repository root, capture:
 git status --short --branch
 git rev-parse HEAD
 opencode --version
-npx @frankzhang2026/opencode-android-orchestrator@0.6.1 doctor . --json
+npx @frankzhang2026/opencode-android-orchestrator@0.8.0 doctor . --json
 ```
 
 If installation never completed, doctor will correctly report a missing or
@@ -43,9 +43,15 @@ remain human-readable on stderr with a stable code such as `[FILE_CONFLICT]`.
 | `PRIMARY_MODULE_AMBIGUOUS` | Restrictive `primary` scope has multiple possible Android modules. | Supply an exact Gradle path, for example `--module-scope primary --primary-module :mobile`, or use the default `all` scope. |
 | `PRIMARY_MODULE_NOT_FOUND` | The selected Gradle path was not detected. | Use a module path reported by doctor/project detection; do not pass a filesystem directory. |
 | `GRADLE_DISCOVERY_FAILED` | The temporary read-only Gradle configuration failed, or registered tasks could not form every required verification group. | Run `./gradlew help --no-configuration-cache --console=plain` and fix the reported project/JDK/dependency issue. Use `--gradle-verification-config` only for an intentional nonstandard task policy, and keep that file inside the target repository. |
+| Unit tests did not run | `unitTestsEnabled` is false. | Set it to `true` in `automation/config.json`, commit the change, and rerun the gate. |
+| Unit tests run but should be skipped | `unitTestsEnabled` is true, which is the default. | Set it to `false` in `automation/config.json`; RED evidence remains mandatory. |
+| Lint did not run | `lintEnabled` is false, which is the default. | Set it to `true` in `automation/config.json`, commit the change, and rerun the gate. |
+| Lint runs but should be skipped | `lintEnabled` is true. | Set it to `false` in `automation/config.json` and commit the change. |
 | Invalid `--long-command-timeout-ms` | The value is not an integer from `120000` through `7200000`. | Use the `1800000` ms default or pass an intentional bounded value to `init`/`upgrade`; do not edit the generated config directly. |
 | Android SDK failure | No valid explicit SDK, `ANDROID_HOME`, `ANDROID_SDK_ROOT`, or `local.properties` `sdk.dir` was found. | Configure one real SDK root containing `platforms/` and `build-tools/`. Do not publish `local.properties`. |
 | Missing `git`, `jq`, `rg`, `shasum`, or Java | Required deterministic command is unavailable on `PATH`. | Install or restore the missing command, record its version, and rerun the read-only checks. |
+| `Bundled Orchestrator skill is unavailable` | The installed `0.8.0` package is incomplete, damaged, or loaded from an unsupported partial copy. | Reinstall the exact package, inspect its `resources/third-party/superpowers-v6.2.0/skills/` entries, restart OpenCode, and rerun `opencode debug skill`. Do not add an external Superpowers plugin as a fallback. |
+| The exact Superpowers v6.2.0 plugin remains after upgrade | That entry existed in the verified pre-install OpenCode file and is therefore user-owned. | Leave it in place or remove it as a separate reviewed configuration change. Upgrade only removes the old Orchestrator-managed entry. |
 
 Version `0.6.0` always passes `--no-configuration-cache` to its temporary
 Gradle task-discovery invocation. This overrides a repository-level
@@ -53,12 +59,12 @@ Gradle task-discovery invocation. This overrides a repository-level
 the project's files or normal build behavior. Deleting the project's
 Configuration Cache is therefore neither required nor a durable repair.
 
-Version `0.6.1` raises direct managed long-running lifecycle commands to at
+Version `0.7.0` raises direct managed long-running lifecycle commands to at
 least `1800000` milliseconds. A higher timeout already supplied by the caller
 is preserved; unrelated Bash commands are unchanged. To configure one hour,
 run `upgrade . --long-command-timeout-ms 3600000` on a healthy installation.
 If a command still reports `120000 ms`, confirm that the project manifest and
-OpenCode plugin reference are both `0.6.1`, restart the OpenCode session so the
+OpenCode plugin reference are both `0.8.0`, restart the OpenCode session so the
 plugin reloads, and rerun doctor before attempting recovery.
 
 After installation, inspect OpenCode discovery separately:
@@ -71,8 +77,9 @@ opencode debug agent scheduled-coder
 opencode debug agent scheduled-reviewer
 ```
 
-Then run `./scripts/automation/preflight.sh --source`. It validates pinned
-plugins, required skills, agent permissions, and both read-only custom tools.
+Then run `./scripts/automation/preflight.sh --source`. It validates resolved
+configuration, required bundled and project skills, agent permissions, and
+both read-only custom tools.
 If it fails, preserve its exact output. Do not broaden an agent's default-deny
 permissions to make discovery pass.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frankzhang2026/opencode-android-orchestrator",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Reusable OpenCode orchestration for Android projects",
   "license": "MIT",
   "author": "frankzhang2026",
@@ -31,6 +31,7 @@
   "files": [
     "dist/",
     "docs/",
+    "resources/",
     "templates/",
     "README.md",
     "CHANGELOG.md",
@@ -45,6 +46,7 @@
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "npm run build && node --test tests/*.test.mjs",
+    "test:offline-discovery": "npm run build && node --test tests/offline-skill-discovery.integration.mjs",
     "pack:check": "npm pack --dry-run",
     "prepack": "npm run build"
   },

package/resources/third-party/superpowers-v6.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jesse Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/resources/third-party/superpowers-v6.2.0/PROVENANCE.md

@@ -0,0 +1,21 @@
+# Bundled Superpowers-derived resources
+
+- Upstream: https://github.com/obra/superpowers
+- Upstream version: v6.2.0
+- Upstream copyright: Copyright (c) 2025 Jesse Vincent
+- License: MIT; see `LICENSE` in this directory.
+
+This directory contains a curated, Orchestrator-specific derivative of five
+upstream workflow skills. Names are prefixed with `android-orchestrator-` to
+avoid collisions with independently installed skills.
+
+Intentional changes:
+
+- removed the `using-superpowers` bootstrap dependency;
+- removed brainstorming's visual companion, localhost server, browser launch,
+  remote branding, and telemetry resources;
+- replaced Superpowers plan execution handoffs with the sealed Android
+  Orchestrator contract/Coder/Reviewer workflow;
+- moved optional supporting documents under `references/` and scripts under
+  `scripts/`;
+- rewrote cross-skill references to the bundled namespaced skill IDs.

package/resources/third-party/superpowers-v6.2.0/skills/android-orchestrator-brainstorming/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: android-orchestrator-brainstorming
+description: Refine one Android Orchestrator coding request into a bounded observable behavior proposal before plan and contract creation
+license: MIT
+compatibility: opencode
+metadata:
+  upstream: obra/superpowers@v6.2.0
+  workflow: scheduled-coding
+---
+
+# Android Orchestrator brainstorming
+
+Turn a rough request into one small, testable behavior change. This is an
+interactive planning aid; it never edits product code, creates planning files,
+starts execution, or grants approval.
+
+## Workflow
+
+1. Inspect the relevant repository code, tests, and project instructions.
+2. Summarize current observable behavior and the requested behavior.
+3. Identify ambiguity in scope, acceptance behavior, edge cases, or test
+   strategy. Ask one focused question at a time only when the answer changes
+   the proposal.
+4. Consider two or three approaches when a meaningful tradeoff exists. Lead
+   with the recommended approach and explain the material tradeoff.
+5. Converge on exactly one bounded behavior change with:
+   - observable acceptance criteria;
+   - important edge cases;
+   - exact allowed implementation and test paths;
+   - maximum changed-file count;
+   - focused test filter and device-test policy;
+   - protected paths and explicit non-goals.
+6. Hand the proposal back to `scheduled-quality-orchestrator` for its formal
+   `方案确认` boundary.
+
+## Boundaries
+
+- Never treat discussion or agreement in prose as approval.
+- Never broaden a request merely to make the implementation cleaner.
+- Never propose dependency, build-system, automation-rule, push, merge, or
+  worktree changes unless the user explicitly put them in scope.
+- Use text-only interaction. This bundled skill contains no localhost server,
+  browser launcher, remote image, or telemetry path.