@frankzhang2026/opencode-android-orchestrator 1.0.4 → 1.1.0

package/templates/.opencode/agents/scheduled-planner.md

@@ -62,13 +62,69 @@ approval. After approval, assemble a complete plan and contract in memory and
 call `android_orchestrator_intake` with action `draft`; do not create files in the
 product checkout. Preserve the snapshot's target branch and planningHead.
 
+Use schema V4 with verification version 2 unless the proposal explicitly includes
+bounded baseline recovery; use schema V5 only with that newly approved policy. Declare only task behavior cases;
+the executor captures existing focused tests before Coder edits and adds them
+as regression coverage. Explicitly approve inventory mode `focusedBaseline`,
+existing skips (`reject` or `preserve`) and empty baseline (`reject` or `allow`).
+Default both policies to `reject`; use `allow` only for an intentionally empty
+scope such as a new test class. Use fully qualified configured Test task paths,
+and include each parameter instance in the exact behavior identity. Discovered
+test/resource directories do not expand `allowedPaths` or agent permissions.
+Give every verification case a stable ID,
+its one-based acceptance-criterion reference, its source, and its exact test
+identity. Classify preserved behavior as `before: pass`, changed behavior as
+`before: fail`, and an uncertain old boundary as `before: observe`. Do not infer
+exact serializer, parser, locale, date or framework output from declarations or
+memory. For preserved behavior, use an existing trusted test or explicitly mark
+the value for baseline capture. Plan examples are implementation guidance and
+must not add requirements beyond the contract. Check acceptance criteria,
+non-goals and verification expectations for contradictions before drafting.
+
+For V5/V6/V7/V8, present all recovery fields before contract approval: `version: 1`,
+`scope: baseline`, `maxEnvironmentRetries`, `maxManualRetries`,
+`maxSameFailureRetries` (each 0..3), `maxElapsedMs` (1000..86400000), and
+`initialDelayMs`/`maxDelayMs` (1000..600000, maximum at least initial).
+Explain that classified temporary network/rate-limit failures may retry only
+in deterministic baseline capture. Unknown failures require a fresh resume
+approval within the separate manual budget. Historical test failures, changed
+inputs and corrupted evidence cannot use this route. The elapsed limit stops
+new attempts; it does not terminate a hung process. Recovery does not authorize
+model retries, changed tests, wider scope, or automatic local integration.
+Keep existing V4 contracts unchanged; do not silently add V5 authority.
+
+Use schema V6, V7 or V8 only when the proposal also explicitly approves Worker
+termination. Present `execution: { version: 1, maxRunMs, maxStageMs,
+terminationGraceMs }`: run/stage limits are 1000..86400000 ms, stage at most
+run, and TERM grace is 1000..60000 ms. These wall-clock limits apply to each
+reserved execution, including baseline recovery, review, integration and
+abort. An independent supervisor may TERM owned processes and then KILL
+survivors after grace. Deadlines include sleep time and survive scheduler or
+supervisor restart. Log silence is never a reason to kill. Show the actual
+limits before contract approval; do not infer this authority for old tasks.
+Unknown ownership retains the slot. A stopped candidate is not accepted; a
+visible commit keeps its existing transaction for idempotent recovery.
+
+Use V7/V8 only with separately approved `stageRecovery`: `version: 1`,
+`maxEnvironmentRetries`, `maxSameFailureRetries` (0..3), `maxElapsedMs`
+(1000..86400000), `initialDelayMs` and `maxDelayMs` (1000..600000,
+maximum at least initial). Each of RED, GREEN and independent Review has its
+own cumulative environment budget and recovery window. Only deterministic
+verification is retried; no model call or commit is replayed. Attempts and
+backoff are durable; changed inputs, ambiguous processes and altered evidence
+stop recovery. Exhausted or unknown verification failures preserve the task
+without spending implementation or Review correction cycles. This does not
+authorize a task-wide model-cost budget, provider retries or evidence revision.
+V1..V6 contracts gain none of this authority through an upgrade.
+
 When the draft does not specify a workspace or commit policy, use the values in
 `automation/config.json`; new installations configure `inPlaceExclusive` and
 `humanApproval`. A user may explicitly override the commit policy to
-`autoCommit` only for `inPlaceExclusive`. Explain the effective policy before
+`autoCommit` for `inPlaceExclusive`, or for `isolatedWorktree` with a new V8
+contract explicitly setting `continuity.isolatedAutoIntegration: true`. Explain the effective policy before
 sealing: quality gates still include build, fresh full unit tests and independent
 Review; automatic mode authorizes local commit and integration, never remote
-push. `isolatedWorktree` supports human acceptance only. Never infer a policy
+push. Older isolated contracts retain human acceptance. Never infer a policy
 from an old approval or successful tests.
 
 Present the returned sealed contract, plan, digest, version, schedule,
@@ -107,3 +163,18 @@ respective recovery jobs. Commit-transaction recovery uses `recover`; it may
 reuse only already sealed authorization and verified local commit metadata.
 Failures preserve the workspace. Do not reset, clean, force-update refs, delete
 user changes, commit directly or push.
+
+
+For V8, retain V7 recovery/execution policies and present `continuity` with
+`version: 1`, `isolatedAutoIntegration`, `planningRefresh` (`reject` or
+`completedQueueTasks`) and 1..128 unique repository-relative `planningInputs`.
+Declare all code, interfaces, tests and resources used to reason about the task,
+including dependencies outside allowed edit paths. Exact files or path selectors
+are fingerprinted at the immutable planning HEAD, including absent matches.
+If semantic dependencies are unclear, select `reject` rather than claiming that
+nonconflicting files establish independence. The sealed draft and question must
+show the input selectors/digest and refresh policy. Completed-queue refresh may
+only advance before execution over recorded integrations with unchanged inputs
+and configuration; changed requirements or tests require a revised contract.
+This policy does not authorize automatic candidate rebasing, weakening tests,
+retry-budget resets, new requirements, remote pushes or publication.

package/templates/.opencode/skills/scheduled-quality-coder/SKILL.md

@@ -50,9 +50,30 @@ it with `./scripts/automation/block-task.sh <TASK-ID> <reason>` before stopping.
    - For `CODING` after an interrupted initial run, inspect existing evidence
      and continue from the first incomplete mandatory action.
 
-4. On the initial coding cycle, add or change the smallest behavior test
+4. For V4/V5/V6/V7, confirm successful claim recorded `baselineInventory` in status
+   before editing any test. Discovery classifies evidence inputs only; all
+   edits still need contract and agent permission. On the initial coding cycle,
+   add or change the smallest behavior test
    permitted by `allowedPaths`.
-5. If RED evidence does not already exist, capture a genuine RED result with:
+5. If RED evidence does not already exist, capture a genuine RED result. For a
+   schema V3/V4/V5/V6/V7 contract use:
+
+   `./scripts/automation/record-red.sh <TASK-ID>`
+
+   It checks every declared preserved, changed and observed case against fresh
+   structured output. V4/V5/V6/V7 also checks every captured existing regression case;
+   RED and GREEN share that manifest. After RED, test sources and resources are
+   frozen. For V4, if baseline inventory capture fails after `baseline.json` is written,
+   stop: baseline-only resume cannot retry it. Preserve evidence and request
+   approved abort/archive followed by a newly approved task; do not delete
+   baseline files or keep retrying the original task.
+   For V5/V6/V7, the queue completes deterministic baseline capture before launching
+   Coder. Inspect `baselineRecovery` and require a complete sealed baseline.
+   If capture is blocked, stop; only the queue may schedule approved recovery.
+   Never invoke recovery.cjs directly, change its ledger or retry a claim.
+   Read `inventoryStatus` for the exact reason and next action on
+   failure; never regenerate a baseline or overwrite sealed RED to bypass it.
+   For a legacy schema V1/V2 contract use:
 
    `./scripts/automation/record-red.sh <TASK-ID> <expected-failure-text> -- <test-filter>`
 
@@ -97,3 +118,14 @@ Do not invoke `android-orchestrator-brainstorming`,
 `finishing-a-development-branch`, `requesting-code-review`, parallel agents, or
 subagent-driven development. Planning and approval happen before this session;
 review happens in a separate fresh read-only session.
+
+## Approved V7 verification recovery
+
+For V7, record-red.sh, quality-gate.sh and submit-review.sh handle explicitly
+approved transient verification retries with separate RED/GREEN/Review budgets.
+Do not retry these commands to reset an exhausted environment budget. Status
+`stageRecovery` shows attempt history, failure classification and persistent
+backoff. An environment/unknown stop is not a request to change production code
+or weaken tests; preserve the candidate and stop. Provider/model failures still
+follow the existing approved recovery route. Never edit the recovery ledger,
+locks or earlier logs. V1..V6 keep their original retry semantics.

package/templates/.opencode/skills/scheduled-quality-orchestrator/SKILL.md

@@ -26,9 +26,10 @@ description: Plan stable committed code, approve independent inbox contracts, an
    from `automation/config.json`; new installations configure
    `inPlaceExclusive` + `humanApproval`. If the user explicitly wants a
    different policy, show the effective choice in the proposal and seal it.
-   `autoCommit` is supported only with `inPlaceExclusive`; the unsupported
-   `isolatedWorktree` + `autoCommit` combination must fail. Older approvals
-   retain their sealed policies.
+   `autoCommit` supports `inPlaceExclusive`, or `isolatedWorktree` with a new
+   V8 contract explicitly granting `continuity.isolatedAutoIntegration: true`.
+   Older approvals retain their sealed policies and cannot acquire this
+   authority from repository defaults.
 5. Display the returned full plan, contract and review card: task ID/version,
    digest, target local branch/planningHead, allowed paths/file count, tests,
    acceptance/non-goals, dependencies/notBefore, workspace and commit policies.
@@ -53,7 +54,7 @@ contract authorization. Never create a final human approval for autoCommit.
 `/acceptance <TASK-ID>` reads the current item and acceptance report. Present
 the candidate/diff hash, target branch, baseline, build, actual full-test results,
 independent Review, scope and commit policy. If the local target has advanced
-for an isolated candidate, request `revalidate`. That job waits for the same
+for a human-approval isolated candidate, request `revalidate`. That job waits for the same
 execution slot, runs fresh verification/Review and invalidates old acceptance.
 After a fresh candidate exists, call queue `review` with
 `operation: integrate` and the task key. Present its evidence, then call
@@ -80,3 +81,63 @@ independent tasks run. Dependencies complete only after local integration.
 
 After completion, show the true authorization source, local commit SHA and
 “未推送”. No workflow, failure or recovery grants remote push rights.
+
+## Approved V5 baseline recovery
+
+V5 contracts explicitly seal a bounded baseline-only recovery policy. Queue
+status exposes the failure category, retained attempts, deadline and next run.
+A scheduled environment retry uses the existing execution slot without another
+model call or question. Do not submit a duplicate manual recovery while it is
+waiting. `/resume-task` remains a fresh approval for an unknown failure and
+uses the separate manual budget. Neither route can replace a successful
+baseline, accept changed inputs, or weaken V4/V5 RED/GREEN checks. No recovery
+policy is inferred for V4 contracts. Preserve incomplete RUNNING attempts after
+an ambiguous process exit for ownership diagnosis; do not reset their budgets.
+
+## Approved V6 Worker supervision
+
+V6 adds explicit per-execution run/stage deadlines and TERM grace to the V5
+contract. The independent supervisor applies that sealed policy without a new
+question for each timeout. Queue and task status expose `workerSupervision`;
+inspect the stop reason and durable signal/exit evidence. Never issue broad
+process-name kills, clear ownership faults to force scheduling, or delete
+leases. A known stopped isolated candidate is sealed before independent work
+continues; its dependents still wait. An interrupted local commit stays
+`INTEGRATION_BLOCKED`; use the existing transaction recovery route, never make
+a replacement commit. `queue stop` stops the scheduler and leaves supervision
+active. On restart the scheduler reattaches a missing supervisor without
+relaunching a live Worker or resetting its deadlines/grace.
+
+## Approved V7 verification recovery
+
+For V7, record-red.sh, quality-gate.sh and submit-review.sh handle explicitly
+approved transient verification retries with separate RED/GREEN/Review budgets.
+Do not retry these commands to reset an exhausted environment budget. Status
+`stageRecovery` shows attempt history, failure classification and persistent
+backoff. An environment/unknown stop is not a request to change production code
+or weaken tests; preserve the candidate and stop. Provider/model failures still
+follow the existing approved recovery route. Never edit the recovery ledger,
+locks or earlier logs. V1..V6 keep their original retry semantics.
+
+## Approved V8 isolated integration and planning refresh
+
+V8 retains the V7 recovery and execution policies. Present all `continuity`
+fields before approval: `version: 1`, `isolatedAutoIntegration`, `planningRefresh`
+and `planningInputs`. Isolated automatic integration requires both sealed
+`isolatedWorktree` and `autoCommit` policies. Use the complete returned approval
+question, including its continuity authority; never synthesize a shorter label.
+
+Declare every repository input used to reason about the requirement, interfaces,
+design and tests in `planningInputs`, including dependencies and relevant
+resources. Selectors do not grant edit permission. If this dependency declaration
+is uncertain, use `planningRefresh: "reject"`. `completedQueueTasks` permits a
+fresh execution baseline only before execution, with unchanged declared inputs
+and configuration and a verified linear history of completed queue integrations.
+It cannot reset recovery budgets or replace an existing task's RED/Review.
+
+For BASELINE_REVIEW, inspect `planning-baseline` evidence and propose a revised
+contract when required. Preserve the original planning HEAD and approval. Target
+drift during automatic integration does not authorize rebase or automatic
+revalidation. Preserve the candidate; an existing commit transaction requires
+explicit `recover`, while a revised plan requires a new approval. Report the
+actual local commit and automatic authorization source after completion.

package/templates/.opencode/skills/scheduled-quality-reviewer/SKILL.md

@@ -38,6 +38,17 @@ you review.
 5. Check each acceptance criterion against observable behavior. Inspect for
    regression risk, missing edge cases, out-of-scope changes, test deletion,
    ignored tests, relaxed assertions, and implementation-shaped tests.
+   For schema V3/V4/V5/V6/V7, also verify every structured case source and identity, that
+   preserved cases passed before implementation, that changed cases failed only
+   for their declared reason, and that RED contains no undeclared failure. Treat
+   the Planner and Coder summaries as claims; use the bound preflight evidence.
+   For V4/V5/V6/V7 inspect `baselineInventory`, `testManifest`, `greenInventory` and
+   `inventoryStatus` from status. Check complete regression coverage, explicit
+   existing-skip/empty-baseline policy and frozen test/resource inputs. The
+   collector records type/message mechanically; independently assess the
+   declared failure origin and assertion meaning from the tests and evidence.
+   `processExitCode` is Gradle's actual exit; a RED `exitCode` of 1 represents
+   approved case failure, not a failed Gradle build.
 6. Decide independently:
 
    - approve only when the diff is correct and evidence is sufficient;
@@ -70,3 +81,14 @@ you review.
   `AWAITING_HUMAN`.
 - If verification cannot run, submit `CHANGES_REQUESTED` with the environmental
   blocker. Do not manufacture approval.
+
+## Approved V7 verification recovery
+
+For V7, record-red.sh, quality-gate.sh and submit-review.sh handle explicitly
+approved transient verification retries with separate RED/GREEN/Review budgets.
+Do not retry these commands to reset an exhausted environment budget. Status
+`stageRecovery` shows attempt history, failure classification and persistent
+backoff. An environment/unknown stop is not a request to change production code
+or weaken tests; preserve the candidate and stop. Provider/model failures still
+follow the existing approved recovery route. Never edit the recovery ledger,
+locks or earlier logs. V1..V6 keep their original retry semantics.

package/templates/AGENTS.md.fragment

@@ -3,10 +3,16 @@
 
 Run orchestration commands from the Git repository root.
 
-For automated local unit-test verification, run `./gradlew testDebugUnitTest`
-as a standalone command. Do not prepend environment assignments or wrap it in
-another script; this keeps the invocation aligned with the installed OpenCode
-command allowlist.
+For automated local unit-test verification, use the task paths in
+`automation/config.json` under `gradleVerification.fullUnitTestTasks`.
+For manual runs, execute `./gradlew` followed by those configured tasks from
+`androidProject.capabilities.buildRoot` relative to the Git root (default `.`).
+Use a standalone command without environment assignments or shell chaining.
+For nested builds, unattended agents must use the managed verification scripts
+from the Git root; direct Gradle commands are rejected by the executor guard.
+Task execution uses the controlled verification scripts, which read the same
+configuration. Empty lint/device task lists mean the capability is unavailable;
+they never count as a passed check when that capability is required.
 
 Treat `.opencode/`, `automation/`, `scripts/automation/`, `opencode.json`,
 and this managed block as orchestration infrastructure. Product tasks must not

package/templates/README.md

@@ -12,7 +12,9 @@ Migrated template roots:
 - `.opencode/commands`: `change`, `acceptance`, `resume-task`, `resume-review`,
   and `abort-task`
 - `.opencode/skills`: the three `scheduled-quality-*` skills
-- `scripts/automation`: all 29 deterministic V3 Bash transactions and their
+- `automation/verification`: the shared V4/V5 contract validator, bounded V5 baseline recovery, inventory evaluator
+  and Gradle collector. Discovered tests are evidence inputs, not edit permission.
+- `scripts/automation`: all 29 deterministic Bash transactions and their
   test runner, preserved as executable files
 - `automation`: the portable V5 configuration render source, both JSON Schemas,
   and the task contract example

package/templates/automation/config.schema.json

@@ -22,6 +22,13 @@
       "minLength": 1,
       "pattern": "^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$"
     },
+    "optionalGradleTaskList": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/gradleTask"
+      }
+    },
     "gradleTaskList": {
       "type": "array",
       "minItems": 1,
@@ -184,10 +191,10 @@
           "$ref": "#/$defs/gradleTaskList"
         },
         "lintTasks": {
-          "$ref": "#/$defs/gradleTaskList"
+          "$ref": "#/$defs/optionalGradleTaskList"
         },
         "deviceTestTasks": {
-          "$ref": "#/$defs/gradleTaskList"
+          "$ref": "#/$defs/optionalGradleTaskList"
         }
       }
     },
@@ -266,7 +273,8 @@
                   "library",
                   "dynamic-feature",
                   "test",
-                  "asset-pack"
+                  "asset-pack",
+                  "jvm-library"
                 ]
               },
               "namespace": {
@@ -283,14 +291,7 @@
           "minItems": 1,
           "uniqueItems": true,
           "items": {
-            "allOf": [
-              {
-                "$ref": "#/$defs/repositoryPath"
-              },
-              {
-                "pattern": "(^|/)src/main/\\*\\*$"
-              }
-            ]
+            "$ref": "#/$defs/repositoryPath"
           }
         },
         "testPaths": {
@@ -298,17 +299,202 @@
           "minItems": 1,
           "uniqueItems": true,
           "items": {
-            "allOf": [
-              {
-                "$ref": "#/$defs/repositoryPath"
+            "$ref": "#/$defs/repositoryPath"
+          }
+        },
+        "capabilities": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "version",
+            "buildRoot",
+            "modules"
+          ],
+          "properties": {
+            "version": {
+              "const": 1
+            },
+            "buildRoot": {
+              "$ref": "#/$defs/repositoryPath"
+            },
+            "modules": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "gradlePath",
+                  "directory",
+                  "buildFile",
+                  "type",
+                  "namespace",
+                  "applicationId",
+                  "dependencies",
+                  "sources",
+                  "tasks"
+                ],
+                "properties": {
+                  "gradlePath": {
+                    "type": "string",
+                    "pattern": "^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$"
+                  },
+                  "directory": {
+                    "$ref": "#/$defs/repositoryPath"
+                  },
+                  "buildFile": {
+                    "$ref": "#/$defs/repositoryPath"
+                  },
+                  "type": {
+                    "enum": [
+                      "application",
+                      "library",
+                      "dynamic-feature",
+                      "test",
+                      "asset-pack",
+                      "jvm-library"
+                    ]
+                  },
+                  "namespace": {
+                    "$ref": "#/$defs/nullableIdentifier"
+                  },
+                  "applicationId": {
+                    "$ref": "#/$defs/nullableIdentifier"
+                  },
+                  "dependencies": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "pattern": "^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$"
+                    },
+                    "uniqueItems": true
+                  },
+                  "sources": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": [
+                        "name",
+                        "kind",
+                        "paths"
+                      ],
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "pattern": "^[A-Za-z0-9_.-]+$"
+                        },
+                        "kind": {
+                          "enum": [
+                            "production",
+                            "test"
+                          ]
+                        },
+                        "paths": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/$defs/repositoryPath"
+                          },
+                          "uniqueItems": true
+                        }
+                      }
+                    },
+                    "uniqueItems": true
+                  },
+                  "tasks": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": [
+                        "path",
+                        "kind",
+                        "variant"
+                      ],
+                      "properties": {
+                        "path": {
+                          "type": "string",
+                          "pattern": "^:(?:[A-Za-z0-9_.-]+:)*[A-Za-z][A-Za-z0-9_.-]*$"
+                        },
+                        "kind": {
+                          "enum": [
+                            "unit",
+                            "assemble",
+                            "lint",
+                            "device"
+                          ]
+                        },
+                        "variant": {
+                          "type": [
+                            "string",
+                            "null"
+                          ],
+                          "pattern": "^[A-Za-z0-9]+$"
+                        }
+                      }
+                    },
+                    "uniqueItems": true
+                  }
+                }
               },
-              {
-                "pattern": "(^|/)src/(?:test|androidTest)/\\*\\*$"
-              }
+              "uniqueItems": true,
+              "minItems": 1
+            }
+          }
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "required": [
+              "capabilities"
             ]
+          },
+          "then": {},
+          "else": {
+            "properties": {
+              "productionPaths": {
+                "items": {
+                  "allOf": [
+                    {
+                      "$ref": "#/$defs/repositoryPath"
+                    },
+                    {
+                      "pattern": "(^|/)src/main/\\*\\*$"
+                    }
+                  ]
+                }
+              },
+              "testPaths": {
+                "items": {
+                  "allOf": [
+                    {
+                      "$ref": "#/$defs/repositoryPath"
+                    },
+                    {
+                      "pattern": "(^|/)src/(?:test|androidTest)/\\*\\*$"
+                    }
+                  ]
+                }
+              },
+              "modules": {
+                "items": {
+                  "properties": {
+                    "type": {
+                      "enum": [
+                        "application",
+                        "library",
+                        "dynamic-feature",
+                        "test",
+                        "asset-pack"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
           }
         }
-      }
+      ]
     },
     "protectedPaths": {
       "type": "array",
@@ -356,15 +542,19 @@
     {
       "if": {
         "properties": {
-          "workspaceStrategy": {
-            "const": "isolatedWorktree"
+          "lintEnabled": {
+            "const": true
           }
         }
       },
       "then": {
         "properties": {
-          "commitPolicy": {
-            "const": "humanApproval"
+          "gradleVerification": {
+            "properties": {
+              "lintTasks": {
+                "minItems": 1
+              }
+            }
           }
         }
       }