@ionivetech/mugiwara 0.6.4 → 0.6.5

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "mugiwara",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
   "contextFileName": "GEMINI.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionivetech/mugiwara",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, self-healing. Installs into Claude Code, opencode, Copilot, Gemini, Codex, Cursor, Kimi, pi, Windsurf, Cline, Kilo, Antigravity.",
   "homepage": "https://github.com/ionivetech/mugiwara#readme",
   "repository": {
@@ -59,7 +59,7 @@
     "retrieval-eval": "bun scripts/retrieval-eval.ts",
     "verify-install": "bun scripts/verify-install.ts",
     "sync-version": "bun scripts/sync-version.ts",
-    "gate": "bun run typecheck && bun run test && bun run build && bun scripts/validate-content.ts --check-manifest --check-docs --check-doc-integrity && bun scripts/lane-base.ts && bun run verify-pack && bun scripts/run-evals.ts && bun scripts/retrieval-eval.ts && bun scripts/verify-install.ts",
+    "gate": "bun run typecheck && bun run test && bun run build && bun scripts/validate-content.ts --check-manifest --check-docs --check-doc-integrity && bun scripts/lane-base.ts && bun run verify-pack && bun scripts/run-evals.ts && bun scripts/retrieval-eval.ts && bun scripts/verify-install.ts && bun scripts/conformance.ts",
     "verify-pack": "npm pack --dry-run 2>&1 | node -e \"let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{if(!s.includes('ionivetech-mugiwara')){console.error('npm pack failed');process.exit(1)};console.log('npm package clean')})\"",
     "prepack": "bun run build && bun run sync-version"
   },

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mugiwara",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "author": {
     "name": "ionivetech"
   },

package/references/wave-banners.md

@@ -5,16 +5,19 @@ plugin and the opencode-target generator derive agent UI colors from the table
 below — change a color HERE, never in code. This file is machine-parsed:
 keep the table format exact (one row per agent, pipes, no extra columns).
 
-## Terminal format (ANSI truecolor)
+## Banner format (one form)
 
 Every wave opens with the banner line in the owning agent's color, and closes
-with a handoff line. Wrap the whole line in the ANSI truecolor of the agent:
+with a handoff line:
 
 ```
-\x1b[38;2;R;G;Bm==================== WAVE 3 — ZORO (EXECUTION) ====================\x1b[0m
+===== ⚔️ WAVE 3 — ZORO (EXECUTION) =====
 → Wave 4 — Chopper (Checkpoint)
 ```
 
+- Terminal: wrap the whole line in ANSI truecolor `\x1b[38;2;R;G;Bm` ... `\x1b[0m`.
+- Markdown UI: emit the plain equals line, no ANSI (UIs strip or garble escapes).
+- The crew emoji leads the line, before the `WAVE N` text.
 - RGB values come from the `hex` column below; R/G/B are the hex channels in
   decimal (truecolor `38;2;R;G;B`). If the terminal lacks truecolor, use the
   `ansi-256` index: `\x1b[38;5;Nm`.
@@ -22,20 +25,8 @@ with a handoff line. Wrap the whole line in the ANSI truecolor of the agent:
 - The literal `WAVE N —` text must stay exact: `scripts/savepoint.sh` counts
   heal cycles by grepping `wave 8` (case-insensitive) in the trace. A banner
   that drops the literal silently resets the heal loop.
-- Never convey the wave by color alone — the crew name and emoji always
-  accompany the color.
-
-## UI format (markdown UIs)
-
-Rich UIs (Claude Code UI, VSCode, Codex) strip or garble ANSI escapes. Emit
-the emoji-heading form instead — no ANSI, no equals line:
-
-```
-## ⚔️ WAVE 3 — ZORO (EXECUTION)
-→ Wave 4 — Chopper (Checkpoint)
-```
-
-Same literal `WAVE N —` rule applies.
+- Never convey the wave by color alone — the crew name always accompanies
+  the color.
 
 ## Crew colors
 
@@ -65,8 +56,7 @@ wizard agents — their banners appear only when a wave or worker names them.
 1. Banner before EVERY wave; handoff after it. No wave starts without its
    banner (orchestration red flag).
 2. The color comes from this table only — never invent a hex mid-mission.
-3. Terminal variant when the session looks like a terminal; UI variant for
-   markdown-rendering UIs. When unsure, the UI variant is safe everywhere.
+3. One form everywhere: equals line `===== <emoji> WAVE N — <CREW> (ROLE) =====` — five `=` per side, the crew emoji from the table leading the line, ANSI-wrapped in terminals, plain in markdown-rendering UIs. When unsure, the plain form is safe everywhere.
 4. Only the crew table's colors and the two SGR forms above (truecolor,
    256-index) may appear in a banner — never other escape families (OSC,
    title, cursor, other SGR codes). The banner is a fixed template, not a

package/scripts/conformance.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+// scripts/conformance.ts — C1: cross-platform conformance suite.
+// Every installable target: materialize the standard-feature fixture repo,
+// install the target, run the four core scripts, and compare a normalized
+// snapshot (state fields, report sections, evidence header, gitignore block,
+// file count) against test/golden/<target>.json. Exit 1 on any difference
+// with a diff; --update-golden regenerates. The snapshots are normalized:
+// timestamps, hashes, and random filenames are excluded so a golden is stable
+// across runs.
+
+import { execSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { installTo, ensureProjectGitignore } from '../src/installer.ts';
+import { targets, TARGET_IDS } from '../src/targets/index.ts';
+
+const root = join(import.meta.dirname, '..');
+const goldenDir = join(root, 'test', 'golden');
+const UPDATE = process.argv.includes('--update-golden');
+
+// tier mapping per docs/reference/harness-matrix.md (target defs carry tier only
+// on some; the matrix is the source of truth for the rest)
+const TIER_OF: Record<string, number> = {
+  claude: 1, opencode: 1,
+  gemini: 2, codex: 2, copilot: 2,
+  windsurf: 3, cline: 3, kilo: 3, antigravity: 3,
+};
+
+const TARGETS = TARGET_IDS.map(id => ({ id, tier: TIER_OF[id] ?? 2 }));
+
+// marketplace-plugin platforms: installed from the repo itself via the host's
+// plugin system (no rules-dir install). Conformance = the manifest an
+// operator's marketplace will consume: it parses, its version matches the
+// package, its pointers resolve, and its metadata set-equals content/.
+const MARKETPLACE = [
+  { id: 'cursor', manifest: '.cursor-plugin/plugin.json' },
+  { id: 'kimi', manifest: '.kimi-plugin/plugin.json' },
+  { id: 'pi', manifest: null, piField: true },
+];
+
+function marketplaceSnapshot(id: string, manifestRel: string | null, piField: boolean): Record<string, unknown> {
+  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const skillDirs = readdirSync(join(root, 'content', 'skills'), { withFileTypes: true })
+    .filter(e => e.isDirectory()).map(e => e.name).sort();
+  const agentFiles = readdirSync(join(root, 'content', 'agents'))
+    .filter(f => f.endsWith('.md')).map(f => f.replace(/\.md$/, '')).sort();
+
+  const base = {
+    target: id,
+    kind: 'marketplace-plugin',
+    version_matches_package: false,
+    skills_pointer_resolves: false,
+    skills_count: 0,
+    agents_metadata_set_equal: false,
+  };
+
+  if (piField) {
+    const pi = packageJson.pi;
+    const list = pi?.skills;
+    const pointers = Array.isArray(list) ? list : [];
+    base.skills_pointer_resolves = pointers.every(p => existsSync(join(root, p)));
+    base.skills_count = existsSync(join(root, 'content', 'skills')) ? skillDirs.length : 0;
+    base.version_matches_package = true; // package.json is the package itself
+    base.agents_metadata_set_equal = true; // pi loads skills only; agents ship in the same tree
+    return base;
+  }
+
+  const m = JSON.parse(readFileSync(join(root, manifestRel!), 'utf8'));
+  const skillsPtr = m.skills;
+  const skillsDir = typeof skillsPtr === 'string' ? join(root, skillsPtr) : null;
+  const actual = skillsDir && existsSync(skillsDir)
+    ? readdirSync(skillsDir, { withFileTypes: true }).filter(e => e.isDirectory()).map(e => e.name).sort()
+    : [];
+  const mSkills = Array.isArray(m.metadata?.skills) ? [...m.metadata.skills].sort() : [];
+  const mAgents = Array.isArray(m.metadata?.agents) ? [...m.metadata.agents].sort() : [];
+
+  return {
+    ...base,
+    version_matches_package: m.version === packageJson.version,
+    skills_pointer_resolves: skillsDir !== null && existsSync(skillsDir) && actual.length === skillDirs.length,
+    skills_count: actual.length,
+    agents_metadata_set_equal: JSON.stringify(mAgents) === JSON.stringify(agentFiles),
+  };
+}
+
+const MISSION = 'conform';
+
+function sh(cmd: string, cwd: string) {
+  execSync(cmd, { cwd, stdio: 'pipe', env: { ...process.env, MUGIWARA_DIR: join(cwd, '.mugiwara') } });
+}
+
+function snapshot(targetId: string): Record<string, unknown> {
+  const dir = mkdtempSync(join(tmpdir(), `mugi-conform-${targetId}-`));
+  try {
+    // 1. materialize the standard-feature fixture repo (trunk + feat branch)
+    sh(`bun scripts/setup-fixtures.ts standard-feature "${dir}"`, root);
+
+    // 2. install the target into the project
+    const target = targets[targetId];
+    if (!target) throw new Error(`unknown target ${targetId}`);
+    installTo(target, { scope: 'project', projectDir: dir, force: true, dryRun: false });
+
+    // 3. run the four core scripts + the gitignore write the CLI does post-install
+    sh(`bash "${root}/scripts/lane.sh" main --json`, dir);
+    sh(`bash "${root}/scripts/savepoint.sh" ${MISSION} "" 1 auto`, dir);
+    sh(`bash "${root}/scripts/evidence.sh" ${MISSION} lint -- printf 'ok\\n'`, dir);
+    sh(`bash "${root}/scripts/mission-report.sh" ${MISSION}`, dir);
+    ensureProjectGitignore(dir, { dryRun: false });
+
+    // 4. normalize + collect
+    const state = JSON.parse(readFileSync(join(dir, '.mugiwara', 'state', MISSION, 'state.json'), 'utf8'));
+    const reportFile = readdirSync(join(dir, '.mugiwara', 'reports')).find(f => f.endsWith(`-${MISSION}.md`));
+    const report = reportFile ? readFileSync(join(dir, '.mugiwara', 'reports', reportFile), 'utf8') : '';
+    const evFile = readdirSync(join(dir, '.mugiwara', 'results', MISSION)).find(f => f.includes('lint-'));
+    const ev = evFile ? readFileSync(join(dir, '.mugiwara', 'results', MISSION, evFile), 'utf8') : '';
+    const gitignore = existsSync(join(dir, '.gitignore')) ? readFileSync(join(dir, '.gitignore'), 'utf8') : '';
+
+    const countFiles = (p: string): number => {
+      if (!existsSync(p)) return 0;
+      return readdirSync(p, { recursive: true, withFileTypes: true }).filter(e => e.isFile()).length;
+    };
+
+    return {
+      target: targetId,
+      tier: TIER_OF[targetId] ?? 2,
+      state: {
+        mission: state.mission,
+        member: state.member,
+        lane: state.lane,
+        lane_reason: state.lane_reason,
+        files_touched: state.files_touched,
+        loc_delta: state.loc_delta,
+        loc_ins: state.loc_ins,
+        loc_del: state.loc_del,
+        loc_churn: state.loc_churn,
+        mode: state.mode,
+        verbosity: state.verbosity,
+        tasks_done: state.tasks?.done,
+        tasks_total: state.tasks?.total,
+        blockers_open: state.blockers_open,
+        heal_cycle: state.heal_cycle,
+        tokens_source: state.tokens_source,
+        budget_status: state.budget_status,
+        sensitive_paths: state.sensitive_paths,
+      },
+      report_sections: [...report.matchAll(/^#{2,3} .*$/gm)].map(m => m[0]),
+      evidence: {
+        header: ev.split('\n').filter(l => l.startsWith('# ') && !l.startsWith('# At:') && !/^# (Exit|Verdict):/.test(l)),
+        trailer: ev.split('\n').filter(l => /^# (Exit|Verdict):/.test(l)),
+      },
+      gitignore_block: gitignore.split('\n').filter(l => l.includes('mugiwara') || l.includes('# ---')),
+      file_count: {
+        skills: countFiles(target.paths({ scope: 'project', projectDir: dir, home: '' }).skillsDir),
+        agents: countFiles(target.paths({ scope: 'project', projectDir: dir, home: '' }).agentsDir),
+        state: countFiles(join(dir, '.mugiwara', 'state')),
+        evidence: countFiles(join(dir, '.mugiwara', 'results', MISSION)),
+      },
+    };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function diff(a: unknown, b: unknown, path = ''): string[] {
+  const out: string[] = [];
+  if (JSON.stringify(a) === JSON.stringify(b)) return out;
+  if (typeof a !== typeof b || a === null || b === null || typeof a !== 'object') {
+    out.push(`${path}: ${JSON.stringify(a)} ≠ ${JSON.stringify(b)}`);
+    return out;
+  }
+  for (const k of new Set([...Object.keys(a as object), ...Object.keys(b as object)])) {
+    out.push(...diff((a as Record<string, unknown>)[k], (b as Record<string, unknown>)[k], `${path}.${k}`));
+  }
+  return out;
+}
+
+let failed = false;
+mkdirSync(goldenDir, { recursive: true });
+
+const ALL = [
+  ...TARGETS.map(t => ({ id: t.id, label: `tier ${t.tier}`, snap: () => snapshot(t.id) })),
+  ...MARKETPLACE.map(m => ({ id: m.id, label: 'marketplace', snap: () => marketplaceSnapshot(m.id, m.manifest, m.piField === true) })),
+];
+
+for (const t of ALL) {
+  const snap = t.snap();
+  const goldenFile = join(goldenDir, `${t.id}.json`);
+  if (UPDATE) {
+    writeFileSync(goldenFile, JSON.stringify(snap, null, 2) + '\n');
+    console.log(`✓ golden updated: test/golden/${t.id}.json`);
+    continue;
+  }
+  if (!existsSync(goldenFile)) {
+    console.log(`✗ ${t.id}: golden missing — run with --update-golden first`);
+    failed = true;
+    continue;
+  }
+  const golden = JSON.parse(readFileSync(goldenFile, 'utf8'));
+  const diffs = diff(snap, golden);
+  if (diffs.length > 0) {
+    failed = true;
+    console.log(`✗ ${t.id} (${t.label}) differs:`);
+    for (const d of diffs) console.log(`    ${d}`);
+  } else {
+    console.log(`✓ ${t.id} (${t.label}) conforms`);
+  }
+}
+
+if (UPDATE) {
+  console.log('goldens regenerated — review the diff before committing');
+  process.exit(0);
+}
+if (failed) process.exit(1);
+console.log(`✓ ${ALL.length} platforms pass conformance`);

package/scripts/evidence.sh

@@ -40,20 +40,33 @@ TIMESTAMP=$(date +%Y%m%d-%H%M%S)
 HASH=$(echo "${LABEL}-${TIMESTAMP}-$$-${RANDOM}" | (sha256sum 2>/dev/null || shasum -a 256 2>/dev/null || openssl sha256) | cut -c1-12 2>/dev/null || echo "${TIMESTAMP}")
 EVIDENCE_FILE="$RESULTS_DIR/${LABEL}-${HASH}.log"
 
+# Neutralize forged verdict/exit header lines in captured output. The agent
+# trusts the real trailer only (# Exit:/# Verdict: appended after the block);
+# attacker output may try to impersonate it under any spelling — leading
+# whitespace, ANSI prefix, no space, CRLF. Idempotent: already-neutralized
+# #-Verdict: / #-Exit: lines pass through unchanged.
+SANITIZE='s/^[[:space:]]*(\x1b\[[0-9;]*m)*#[[:space:]]*(Verdict|Exit):/#-\2:/'
+
+# command line echoed in the header — collapse embedded newlines so an arg
+# cannot forge a header line inside "# Command:" (the header block is written
+# verbatim, outside the sanitizer).
+COMMAND_LINE=$(printf '%s ' "$@" 2>/dev/null | tr '\n\r' '  ' | sed 's/  *$//')
+
 {
   echo "# Evidence: $LABEL"
   echo "# At: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  echo "# Command: ${*:-<stdin pipeline>}"
+  echo "# Command: ${COMMAND_LINE:-<stdin pipeline>}"
   echo "# ---"
   echo
 
   if [ $# -gt 0 ]; then
-    "$@" 2>&1
+    "$@" 2>&1 | sed -E "$SANITIZE"
+    EXIT_CODE=${PIPESTATUS[0]}
   else
-    cat
+    sed -E "$SANITIZE"
+    EXIT_CODE=0
   fi
 } > "$EVIDENCE_FILE"
-EXIT_CODE=$?
 
 # trailer: exit code + verdict (D6). The verdict is PASS/FAIL derived from the
 # exit code — the check's own outcome, not the harness's opinion.

package/scripts/gate-selftest.ts

@@ -68,6 +68,20 @@ if (!existsSync(join(root, 'scripts', 'validate-content.ts'))) {
   }
 }
 
+// --- G5: conditional-assertion guard — prove expect-in-conditional goes red ---
+console.log('\nG5 — conditional-assertion guard');
+{
+  const testFile = join(root, 'test', 'targets.test.ts');
+  const original = readFileSync(testFile, 'utf8');
+  try {
+    writeFileSync(testFile, `${original}\nif (x) { expect(1).toBe(1); }\n`);
+    assert('expect() in non-invariant conditional → exit 1', false, () => run('G5', 'bun scripts/validate-content.ts'));
+  } finally {
+    writeFileSync(testFile, original);
+    assert('restored → exit 0', true, () => run('G5', 'bun scripts/validate-content.ts'));
+  }
+}
+
 // --- G3: savepoint fixtures — prove test fails when a field is broken ---
 console.log('\nG3 — savepoint fixtures');
 if (!existsSync(join(root, 'test', 'savepoint.test.ts'))) {

package/scripts/initiative.ts

@@ -55,40 +55,47 @@ function assertPlanContent(content: string, planFile: string): void {
   }
 }
 
-function parseSubMissions(content: string): SubMission[] {
+function parseSubMissions(content: string): { subs: SubMission[]; hasSection: boolean } {
   const lines = content.split('\n');
   let inTable = false;
   let inSubSection = false;
+  let hasSection = false;
   const subs: SubMission[] = [];
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
-    if (line.startsWith('## Sub-missions')) {
+    if (line.trim().toLowerCase().startsWith('## sub-missions')) {
       inSubSection = true;
+      hasSection = true;
       continue;
     }
-    if (inSubSection && line.startsWith('## ') && !line.startsWith('## Sub-missions')) {
+    if (inSubSection && line.startsWith('## ') && !line.trim().toLowerCase().startsWith('## sub-missions')) {
       break;
     }
     if (!inSubSection) continue;
 
     const trimmed = line.trim();
-    if (trimmed.startsWith('| ID ') && trimmed.includes('| Name ')) {
+    const lower = trimmed.toLowerCase();
+    if (lower.startsWith('| id ') && lower.includes('| name ')) {
       inTable = true;
       continue;
     }
     if (inTable && trimmed.startsWith('|---')) continue;
     if (inTable && trimmed.startsWith('|')) {
-      const cols = trimmed.split('|').map(c => c.trim()).filter(Boolean);
+      // Keep interior empty cells (e.g. empty "depends on"): filter(Boolean)
+      // would shift columns and drop the touched-files tail.
+      const cols = trimmed.split('|').map(c => c.trim());
+      while (cols.length && cols[0] === '') cols.shift();
+      while (cols.length && cols[cols.length - 1] === '') cols.pop();
       if (cols.length >= 6) {
         subs.push({
           id: cols[0],
           name: cols[1],
           assignee: cols[2],
           branch: cols[3],
-          status: cols[4],
+          status: cols[4].replace('[X]', '[x]'),
           dependsOn: cols[5],
-          touchedFiles: cols.slice(6).join(' ').split(/\s+/).filter(Boolean),
+          touchedFiles: cols.slice(6).join(' ').split(/[,\s]+/).map(s => s.trim()).filter(Boolean),
         });
       }
     }
@@ -97,13 +104,23 @@ function parseSubMissions(content: string): SubMission[] {
     }
   }
 
-  return subs;
+  return { subs, hasSection };
+}
+
+function assertRowsParsed(planFile: string, content: string): { subs: SubMission[]; hasSection: boolean } {
+  const { subs, hasSection } = parseSubMissions(content);
+  if (hasSection && subs.length === 0) {
+    console.error('initiative: "## Sub-missions" section found but no rows parsed.');
+    console.error('  Expected header: | ID | Name | Assignee | Branch | Status | Depends On | Touched Files |');
+    process.exit(1);
+  }
+  return { subs, hasSection };
 }
 
 function cmdStatus(planFile: string): void {
   const content = readFileSync(planFile, 'utf8');
   assertPlanContent(content, planFile);
-  const subs = parseSubMissions(content);
+  const { subs } = assertRowsParsed(planFile, content);
 
   if (subs.length === 0) {
     console.log('No sub-missions found — solo mission.');
@@ -117,14 +134,24 @@ function cmdStatus(planFile: string): void {
   const filled = Math.round((doneCount / total) * barLen);
   const bar = '█'.repeat(filled) + '░'.repeat(barLen - filled);
 
+  // dependency blocking: a sub whose dependency is not done is blocked
+  const statusById = new Map(subs.map(s => [s.id, s.status]));
+  const blockedBy = new Map<string, string>();
+  for (const s of subs) {
+    if (s.dependsOn && statusById.has(s.dependsOn) && statusById.get(s.dependsOn) !== '[x]') {
+      blockedBy.set(s.id, s.dependsOn);
+    }
+  }
+
   console.log(`\n${doneCount}/${total} done [${bar}] ${pct}%\n`);
   console.log(`${'ID'.padEnd(8)} ${'Name'.padEnd(20)} ${'Assignee'.padEnd(12)} ${'Branch'.padEnd(28)} ${'Status'.padEnd(8)} ${'Depends'.padEnd(10)} ${'Files'}`);
   console.log('─'.repeat(120));
 
   for (const s of subs) {
     const icon = { '[ ]': '◻', '[~]': '◉', '[x]': '✓', '[!]': '✗' }[s.status] || '?';
+    const blocked = blockedBy.has(s.id) ? ` ⛔ blocked-by ${blockedBy.get(s.id)}` : '';
     console.log(
-      `${s.id.padEnd(8)} ${s.name.padEnd(20)} ${s.assignee.padEnd(12)} ${s.branch.padEnd(28)} ${icon} ${s.status.padEnd(3)} ${s.dependsOn.padEnd(10)} ${s.touchedFiles.join(', ')}`
+      `${s.id.padEnd(8)} ${s.name.padEnd(20)} ${s.assignee.padEnd(12)} ${s.branch.padEnd(28)} ${icon} ${s.status.padEnd(3)} ${s.dependsOn.padEnd(10)} ${s.touchedFiles.join(', ')}${blocked}`
     );
   }
   console.log();
@@ -133,7 +160,7 @@ function cmdStatus(planFile: string): void {
 function cmdConflictCheck(planFile: string): void {
   const content = readFileSync(planFile, 'utf8');
   assertPlanContent(content, planFile);
-  const subs = parseSubMissions(content);
+  const { subs } = assertRowsParsed(planFile, content);
 
   if (subs.length === 0) {
     console.log('No sub-missions — no conflicts possible.');
@@ -168,6 +195,7 @@ function cmdConflictCheck(planFile: string): void {
     console.log(`\n${conflicts.length} file conflict(s) detected:\n`);
     console.log(conflicts.join('\n'));
     console.log();
+    process.exit(1);
   }
 }
 
@@ -187,28 +215,34 @@ function cmdSetStatus(planFile: string, id: string, status: string): void {
 
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
-    if (line.startsWith('## Sub-missions')) {
+    if (line.trim().toLowerCase().startsWith('## sub-missions')) {
       inSubSection = true;
       continue;
     }
-    if (inSubSection && line.startsWith('## ') && !line.startsWith('## Sub-missions')) {
+    if (inSubSection && line.startsWith('## ') && !line.trim().toLowerCase().startsWith('## sub-missions')) {
       break;
     }
     if (!inSubSection) continue;
 
     const trimmed = line.trim();
-    if (trimmed.startsWith('| ID ')) { inTable = true; continue; }
+    if (trimmed.toLowerCase().startsWith('| id ')) { inTable = true; continue; }
     if (!inTable || !trimmed.startsWith('|')) continue;
     if (trimmed.startsWith('|---')) continue;
 
-    const cols = trimmed.split('|').map(c => c.trim()).filter(Boolean);
+    // same cell handling as parseSubMissions: interior empty cells preserved
+    const cols = trimmed.split('|').map(c => c.trim());
+    while (cols.length && cols[0] === '') cols.shift();
+    while (cols.length && cols[cols.length - 1] === '') cols.pop();
     if (cols[0] === id) {
-      const oldMarker = cols[4];
+      let oldMarker = cols[4];
+      if (oldMarker === '[X]') oldMarker = '[x]';
       if (!Object.values(STATUS_MARKERS).includes(oldMarker)) {
         console.error(`Row ${id}: status column "${oldMarker}" is not a recognized marker`);
         process.exit(1);
       }
-      lines[i] = lines[i].replace(oldMarker, newMarker);
+      // rewrite only the status cell — a marker string elsewhere in the row
+      // (name, touched files) must not be clobbered by a row-wide replace
+      lines[i] = `| ${cols.slice(0, 4).join(' | ')} | ${newMarker} | ${cols.slice(5).join(' | ')} |`;
       found = true;
       break;
     }

package/scripts/savepoint.sh

@@ -42,6 +42,16 @@ MISSION="${1:-${STATE_MISSION:-}}"
 MEMBER="${2:-${STATE_MEMBER:-}}"
 WAVE="${3:-${STATE_WAVE:-1}}"
 MODE="${4:-${STATE_MODE:-guided}}"
+# verbosity from config (project .mugiwara/config), default normal; env override
+VERBOSITY="${STATE_VERBOSITY:-normal}"
+if [ -f "$MUGIWARA_DIR/config" ]; then
+  CFG_VERBOSITY=$(grep -E '^verbosity=' "$MUGIWARA_DIR/config" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '[:space:]')
+  [ -n "$CFG_VERBOSITY" ] && VERBOSITY="$CFG_VERBOSITY"
+fi
+case "$VERBOSITY" in
+  normal|full) ;;
+  *) VERBOSITY="normal" ;;
+esac
 ACTOR="${STATE_ACTOR:-${GIT_AUTHOR_NAME:-${GIT_ID:-${USER:-}}}}"
 BRANCH="$(git branch --show-current 2>/dev/null || echo 'unknown')"
 
@@ -296,6 +306,7 @@ const data = {
   lane_rose: process.argv[25] === 'true',
   wave: parseInt(process.argv[6], 10),
   mode: process.argv[7],
+  verbosity: process.argv[32] || 'normal',
   base_sha: process.argv[8],
   head_sha: process.argv[9],
   files_touched: parseInt(process.argv[10], 10),
@@ -324,7 +335,7 @@ require('fs').writeFileSync(process.argv[23], JSON.stringify(data, null, 2) + '\
   "$STATUS" "$SKILL_VERSION" "$EVIDENCE" \
   "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
   "$STATE_FILE" "$LANE_PREV" "$LANE_ROSE" "$TOKENS_SOURCE" "$LANE_PEAK" \
-  "$LOC_INS" "$LOC_DEL" "$LOC_CHURN" "$MEMBER"
+  "$LOC_INS" "$LOC_DEL" "$LOC_CHURN" "$MEMBER" "$VERBOSITY"
 
 if [ "$LANE_ROSE" = true ]; then
   echo "⚠ LANE ROSE: $LANE_PREV → $LANE ($LANE_REASON) — escalate per check-in protocol"

package/scripts/validate-content.ts

@@ -207,10 +207,15 @@ for (const f of [...agentFiles, ...skillDirs.map(d => join(root, 'skills', d, 'S
   }
 }
 
-// --- manifest-sync check: .claude-plugin/plugin.json must set-equal content/ ---
+// --- manifest-sync check: every marketplace plugin.json set-equal content/ ---
 const manifestArg = process.argv.indexOf('--check-manifest');
 if (manifestArg !== -1) {
-  const manifests = ['.claude-plugin/plugin.json'];
+  const manifests = [
+    '.claude-plugin/plugin.json',
+    '.codex-plugin/plugin.json',
+    '.cursor-plugin/plugin.json',
+    '.kimi-plugin/plugin.json',
+  ];
   let manifestErrors = 0;
 
   for (const mp of manifests) {
@@ -380,5 +385,20 @@ if (integrityArg !== -1) {
   }
 }
 
+// Conditional-assertion guard: an expect() reachable only inside a truthiness
+// check silently passes when the value is absent. This class produced 9 defects.
+// Allowed: checks keyed on a declared invariant (tier, fixture keys).
+const ALLOWED_COND = /if \((?:t\.tier === 3|keys\.length|label === 'exact'|fx\.expect\.(?:lane|sensitive_paths_(?:min|max)))/;
+const repoRoot = join(import.meta.dirname, '..');
+for (const f of readdirSync(join(repoRoot, 'test')).filter(x => x.endsWith('.test.ts'))) {
+  const src = readFileSync(join(repoRoot, 'test', f), 'utf8');
+  // matches both braced and brace-less conditionals whose body reaches an expect()
+  for (const m of src.matchAll(/if \([^)]+\)(?:\s*\{[^}]{0,400}?)?expect\(/gs)) {
+    if (!ALLOWED_COND.test(m[0])) {
+      errors.push(`test/${f}: expect() inside a conditional — assert presence explicitly instead:\n    ${m[0].slice(0, 80)}`);
+    }
+  }
+}
+
 if (errors.length) { console.error(errors.map(e => `✗ ${e}`).join('\n')); process.exit(1); }
 console.log(`✓ content valid: ${skillDirs.length} skills, ${agentFiles.length} agents`);

package/src/targets/opencode.ts

@@ -33,6 +33,7 @@ const CREW: Record<string, CrewConfig> = {
   'eval-runner': { color: '#14b8a6', temperature: 0.2, steps: 15 },
   'resume-coordinator': { color: '#d97706', temperature: 0.2, steps: 10 },
   'memory-keeper': { color: '#d946ef', temperature: 0.2, steps: 8 },
+  'onboarding-guide': { color: '#0ea5e9', temperature: 0.3, steps: 15 },
 };
 
 // Crew colors from the wave-banners table (single source of truth). Returns