@ionivetech/mugiwara 0.6.6 → 0.7.0

package/src/policy.ts

@@ -0,0 +1,156 @@
+// src/policy.ts
+// mugiwara.policy.yml — org rules that override crew judgement.
+//
+// One optional file at the repo root; absent means today's
+// behavior everywhere. Policy only ever pushes UP (more scrutiny), never down:
+// lanes forced to full, coverage thresholds raised, paths flagged for human
+// approval.
+//
+// The parser is a deliberate YAML subset — nested maps, string arrays,
+// scalars — enough for the documented schema and nothing more. No dependency:
+// a governance file that needs an npm install to read would not be read.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export type MugiwaraPolicy = {
+  lanes?: { force_full?: string[] };
+  gates?: {
+    coverage?: { new?: number; modified?: number };
+    require_human_approval?: string[];
+  };
+  evidence?: { required?: string[] };
+};
+
+const POLICY_FILES = ['mugiwara.policy.yml', 'mugiwara.policy.yaml'];
+const KNOWN_ROOTS = ['lanes', 'gates', 'evidence'];
+
+/**
+ * Minimal YAML subset: maps, `- item` string lists, scalars.
+ *
+ * A `key:` with no value stays pending on its scope until a deeper line turns
+ * it into a map (first mapping child) or a list (first `- ` child). Scopes are
+ * keyed by the indent of their own key line; any line at indent <= a scope's
+ * key indent leaves that scope. Enough for the documented schema, nothing more.
+ */
+export function parsePolicyYaml(text: string): Record<string, unknown> {
+  const root: Record<string, unknown> = {};
+  type Scope = { keyIndent: number; obj: Record<string, unknown>; pending?: { key: string; indent: number } };
+  const stack: Scope[] = [{ keyIndent: -1, obj: root }];
+  const lines = text.split(/\r?\n/);
+
+  const process = (i: number): void => {
+    if (i >= lines.length) return;
+    const noComment = lines[i].replace(/(^|\s)#.*$/, '');
+    if (!noComment.trim()) return process(i + 1);
+    const indent = noComment.length - noComment.trimStart().length;
+    const line = noComment.trim();
+
+    while (stack.length > 1 && indent <= stack[stack.length - 1].keyIndent) stack.pop();
+    const top = stack[stack.length - 1];
+
+    // A pending `parent:` whose first child this line is → become a map scope,
+    // then dispatch this same line into the new scope. A `- ` child instead
+    // turns the pending key into a LIST below — it must not materialize a map.
+    if (top.pending && !line.startsWith('- ') && indent > top.pending.indent && !Array.isArray(top.obj[top.pending.key])) {
+      const { key, indent: pIndent } = top.pending;
+      delete top.pending;
+      const created: Record<string, unknown> = {};
+      top.obj[key] = created;
+      stack.push({ keyIndent: pIndent, obj: created });
+      return process(i);
+    }
+
+    if (line.startsWith('- ')) {
+      if (top.pending) {
+        const existing = top.obj[top.pending.key];
+        const arr: unknown[] = Array.isArray(existing) ? existing : [];
+        arr.push(scalar(line.slice(2)));
+        top.obj[top.pending.key] = arr;
+      }
+      // stray items outside a pending key are ignored in this subset
+      return process(i + 1);
+    }
+
+    const colon = line.indexOf(':');
+    if (colon === -1) return process(i + 1); // not a mapping line in this subset
+    const key = line.slice(0, colon).trim();
+    const rest = line.slice(colon + 1).trim();
+    if (rest === '') {
+      top.pending = { key, indent };
+    } else {
+      top.obj[key] = scalar(rest);
+      delete top.pending;
+    }
+    process(i + 1);
+  };
+
+  process(0);
+  return root;
+}
+
+function scalar(v: string): unknown {
+  const t = v.trim().replace(/^["']|["']$/g, '');
+  if (/^-?\d+(\.\d+)?$/.test(t)) return Number(t);
+  if (t === 'true') return true;
+  if (t === 'false') return false;
+  return t;
+}
+
+export function loadPolicy(projectDir: string): MugiwaraPolicy | null {
+  for (const name of POLICY_FILES) {
+    const file = join(projectDir, name);
+    if (!existsSync(file)) continue;
+    return normalize(parsePolicyYaml(readFileSync(file, 'utf8')));
+  }
+  return null;
+}
+
+function normalize(raw: Record<string, unknown>): MugiwaraPolicy {
+  // A typo'd root key would otherwise silently disable the rule it carried.
+  for (const k of Object.keys(raw)) {
+    if (!KNOWN_ROOTS.includes(k)) throw new Error(`unknown policy key "${k}" (known: ${KNOWN_ROOTS.join(', ')})`);
+  }
+  const out: MugiwaraPolicy = {};
+  const lanes = raw.lanes as Record<string, unknown> | undefined;
+  if (lanes && Array.isArray(lanes.force_full)) out.lanes = { force_full: strings(lanes.force_full) };
+  const gates = raw.gates as Record<string, unknown> | undefined;
+  if (gates) {
+    out.gates = {};
+    const cov = gates.coverage as Record<string, unknown> | undefined;
+    if (cov) {
+      out.gates.coverage = {};
+      if (typeof cov.new === 'number') out.gates.coverage.new = cov.new;
+      if (typeof cov.modified === 'number') out.gates.coverage.modified = cov.modified;
+    }
+    if (Array.isArray(gates.require_human_approval))
+      out.gates.require_human_approval = strings(gates.require_human_approval);
+  }
+  const evidence = raw.evidence as Record<string, unknown> | undefined;
+  if (evidence && Array.isArray(evidence.required)) out.evidence = { required: strings(evidence.required) };
+  return out;
+}
+
+function strings(a: unknown[]): string[] {
+  return a.filter((x): x is string => typeof x === 'string' && x.length > 0);
+}
+
+/** Glob → RegExp: `**` crosses separators, `*` stays within one. */
+export function globToRegExp(glob: string): RegExp {
+  const esc = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  const src = esc.replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\u0000/g, '.*');
+  return new RegExp(`^${src}$`);
+}
+
+/** Any changed path matching any policy glob? Returns the matching globs. */
+export function matchedGlobs(paths: string[], globs: string[]): string[] {
+  return globs.filter((g) => paths.some((p) => globToRegExp(g).test(p)));
+}
+
+/**
+ * Coverage thresholds: the max of the .mugiwara/config value (or its
+ * fallback) and any policy raise. Policy pushes up, never down.
+ */
+export function effectiveThreshold(configured: number, policyValue: number | undefined): number {
+  return Math.max(configured, policyValue ?? 0);
+}

package/src/provenance.ts

@@ -0,0 +1,116 @@
+// src/provenance.ts
+// Provenance ledger: line-of-sight from a commit to the
+// mission that produced it — which agent persona, which lane, verified by
+// what evidence. Distributed in two layers:
+//   1. a git note on refs/notes/mugiwara attached to the branch head
+//      (local precision archive; survives rebase via notes.rewriteRef)
+//   2. provenance.md in the mission dir, ready to paste as a PR comment
+//      (the layer every hosting UI can show)
+import { execFileSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const NOTES_REF = 'refs/notes/mugiwara';
+
+/** Structural subset any mission state satisfies — keeps this import-free. */
+export type NoteSource = {
+  mission: string;
+  actor: string;
+  lane: string;
+  mode: string;
+  branch: string;
+  tasks_done: number;
+  tasks_total: number;
+  evidence: string[];
+  models?: string[];
+};
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+}
+
+export function modelLabel(): string {
+  return process.env.MUGIWARA_MODEL?.trim()
+    || process.env.ANTHROPIC_MODEL?.trim()
+    || 'model-unrecorded (set MUGIWARA_MODEL to attribute)';
+}
+
+/** The provenance block — identical wording in the note and the md file. */
+export function buildNote(s: {
+  mission: string; actor: string; lane: string; mode: string; branch: string;
+  tasks_done: number; tasks_total: number; evidence: string[]; model?: string; models?: string[];
+}): string {
+  const gates = s.evidence.length ? s.evidence.join(' · ') : 'no evidence recorded';
+  // Per-stage attribution (A4): when flow history recorded models, render the
+  // unique set — a mid-mission switch must not collapse to the last env value.
+  // With nothing recorded, keep the env-fallback label wording.
+  const uniqModels = [...new Set((s.models ?? []).filter(Boolean))];
+  const modelPart = uniqModels.length ? `model(s): ${uniqModels.join(', ')}` : (s.model ?? modelLabel());
+  return [
+    `mission: ${s.mission}`,
+    `agent: ${s.actor || 'unknown'} · ${modelPart} · lane ${s.lane} · mode ${s.mode}`,
+    `tasks: ${s.tasks_done}/${s.tasks_total}`,
+    `gates/evidence: ${gates}`,
+    `branch: ${s.branch}`,
+    'human review: pending (PR review is the terminal gate)',
+  ].join('\n');
+}
+
+/** PR-paste-ready markdown wrapper around the same facts. */
+export function renderProvenanceMd(note: string, sha: string | null): string {
+  const lines = [
+    '# Provenance',
+    '',
+    '<!-- paste below into the PR description or a PR comment -->',
+    '',
+    '```',
+    note,
+    '```',
+    '',
+    sha ? `Commit: ${sha}` : 'Commit: not recorded (no git head resolved at closure)',
+    '',
+    'Query locally after pushing notes:',
+    '`git fetch origin refs/notes/mugiwara:refs/notes/mugiwara` then `mugiwara blame <path>`.',
+  ];
+  return lines.join('\n') + '\n';
+}
+
+export function attachGitNote(projectDir: string, branch: string, note: string): { sha: string } | null {
+  try {
+    let sha: string;
+    try {
+      sha = git(projectDir, ['rev-parse', '--verify', branch]);
+    } catch {
+      sha = git(projectDir, ['rev-parse', 'HEAD']);
+    }
+    git(projectDir, ['notes', '--ref=mugiwara', 'add', '-f', '-m', note, sha]);
+    return { sha };
+  } catch {
+    // not a repo, detached oddities, or notes disabled — degrade honestly
+    return null;
+  }
+}
+
+/** `mugiwara blame <path>` — last commit that touched the path + its note. */
+export function blamePath(projectDir: string, path: string): string {
+  let sha: string;
+  try {
+    sha = git(projectDir, ['log', '-1', '--format=%H', '--', path]);
+  } catch {
+    return `blame: not a git repository (${projectDir})`;
+  }
+  if (!sha) return `blame: no commit touches "${path}"`;
+  try {
+    const note = git(projectDir, ['notes', '--ref=mugiwara', 'show', sha]);
+    return `${path} @ ${sha.slice(0, 7)}\n${note}`;
+  } catch {
+    return `${path} @ ${sha.slice(0, 7)}\n(no mugiwara provenance note on this commit)`;
+  }
+}
+
+/** Closure hook: write provenance.md + attach the git note. */
+export function writeProvenance(projectDir: string, missionDir: string, state: NoteSource): void {
+  const note = buildNote(state);
+  const attached = attachGitNote(projectDir, state.branch, note);
+  writeFileSync(join(missionDir, 'provenance.md'), renderProvenanceMd(note, attached ? attached.sha : null));
+}

package/src/rollback.ts

@@ -0,0 +1,95 @@
+// src/rollback.ts
+// Executable rollback map: recovery you can run, not prose.
+// Generated from git + state at closure; the human runs it, mugiwara never does.
+import { execFileSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export type RollbackInput = {
+  mission: string;
+  branch: string;
+  baseSha: string;
+};
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+}
+
+/**
+ * Build the rollback script body. Pure given the inputs — the shas are read
+ * from the repo by the caller so this stays unit-testable without git.
+ */
+export function buildRollback(input: RollbackInput, commitsNewestFirst: string[], filesTouched: string[]): string {
+  const lines = [
+    '#!/usr/bin/env bash',
+    `# Rollback map for mission "${input.mission}" — generated at closure.`,
+    '# Human-executed. Review before running; mugiwara never runs this.',
+    `# Branch: ${input.branch}`,
+    `# Base:   ${input.baseSha}`,
+    '',
+    'set -euo pipefail',
+    '',
+  ];
+  if (!commitsNewestFirst.length && !filesTouched.length) {
+    lines.push('# No commits between base and HEAD on this branch — nothing to revert.', '');
+    return lines.join('\n');
+  }
+  if (!commitsNewestFirst.length) {
+    // Squash-merge workflows: the branch's changes reached the base ref as one
+    // squashed commit, so `rev-list base..branch` can come back empty while
+    // `git diff base branch` is not. "Nothing to revert" would be a lie — the
+    // changes are live. Emit loud, human-executable guidance and exit 1 so a
+    // careless run fails instead of silently doing nothing.
+    lines.push(
+      '# UNRESOLVED: squash-merged state detected.',
+      `# git rev-list ${input.baseSha}..${input.branch} is empty, but the diff`,
+      `# ${input.baseSha}..${input.branch} touches ${filesTouched.length} file(s):`,
+      '# the mission\'s changes were collapsed into commit(s) already on the base',
+      '# ref. No per-commit revert list can be derived automatically.',
+      '# Locate the squash commit, review it, then revert it:',
+      `#   git log --oneline ${input.baseSha}..HEAD --grep="${input.mission}"`,
+      '#   git revert <squash-commit>',
+      '# Files carrying the squashed changes (verify each after reverting):',
+      ...filesTouched.map((f) => `#   ${f}`),
+      '',
+      'echo "ROLLBACK INCOMPLETE: squash-merged state — locate and revert the squash commit manually" >&2',
+      'exit 1',
+      '',
+    );
+    return lines.join('\n');
+  }
+  lines.push(
+    '# Revert newest-first so earlier reverts never conflict with later ones.',
+    'git revert --no-edit \\',
+    commitsNewestFirst.map((c) => `  ${c}`).join(' \\\n'),
+    '',
+  );
+  if (filesTouched.length) {
+    lines.push(
+      '# Files this mission touched (verify the working tree is clean afterwards):',
+      ...filesTouched.map((f) => `#   ${f}`),
+      '',
+    );
+  }
+  return lines.join('\n');
+}
+
+/** Read the repo for everything the script needs, then write rollback.sh. */
+export function generateRollback(projectDir: string, missionDir: string, input: RollbackInput): { file: string; commits: number } | null {
+  try {
+    const range = `${input.baseSha}..${input.branch}`;
+    const revList = git(projectDir, ['rev-list', '--reverse', range]).split(/\r?\n/).filter(Boolean);
+    const commitsNewestFirst = [...revList].reverse();
+    const filesTouched = input.baseSha === 'unknown'
+      ? []
+      : git(projectDir, ['diff', '--name-only', input.baseSha, input.branch]).split(/\r?\n/).filter(Boolean);
+    const body = buildRollback(input, commitsNewestFirst, filesTouched);
+    const file = join(missionDir, 'rollback.sh');
+    writeFileSync(file, body, { mode: 0o755 });
+    return { file: 'rollback.sh', commits: commitsNewestFirst.length };
+  } catch {
+    // No git, unknown base, or an empty branch — a rollback map cannot be
+    // derived. Absent file beats a wrong one.
+    return null;
+  }
+}

package/src/routing.ts

@@ -0,0 +1,69 @@
+// src/routing.ts
+// Review routing: tell the reviewer where to look. A ranked
+// reading order computed from what the mission touched — not a flat diff.
+// Heuristic and labeled as such: the ranking decides reading ORDER, never
+// whether a line is correct.
+
+export type RankedFile = { path: string; score: number; reasons: string[] };
+
+const DOC_PAT = /\.(md|txt|rst)$|^docs\/|^(CHANGELOG|LICENSE|README)/;
+const TEST_PAT = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)(tests?|__tests__|specs?)\//;
+
+export type RoutingSource = { evidence: string[]; sensitive_paths?: string[] };
+
+/**
+ * Score one path. Sensitive paths dominate; production code next; tests and
+ * docs sink. Files the evidence trail never mentions get a bump — absence of
+ * evidence is exactly where review attention pays.
+ */
+export function scorePath(path: string, sensitivePaths: string[], evidenceJoined: string): { score: number; reasons: string[] } {
+  const reasons: string[] = [];
+  let score = 0;
+  const sensitiveHit = sensitivePaths.some((s) => s && (path === s || path.startsWith(s.replace(/\/?$/, '/')) || new RegExp(s.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '.*').replace(/\*/g, '[^/]*')).test(path)));
+  if (sensitiveHit) {
+    score += 100;
+    reasons.push('sensitive path');
+  }
+  if (!DOC_PAT.test(path) && !TEST_PAT.test(path)) {
+    score += 50;
+    reasons.push('production code');
+  } else if (TEST_PAT.test(path)) {
+    score += 10;
+    reasons.push('test scaffolding — skim unless behavior changed');
+  } else {
+    score += 5;
+    reasons.push('docs/config');
+  }
+  if (!evidenceJoined.includes(path)) {
+    score += 20;
+    reasons.push('not covered by recorded evidence');
+  }
+  return { score, reasons };
+}
+
+export function rankFiles(paths: string[], state: RoutingSource): RankedFile[] {
+  const sensitive = state.sensitive_paths ?? [];
+  const ev = state.evidence.join(' ');
+  return paths
+    .map((path) => {
+      const { score, reasons } = scorePath(path, sensitive, ev);
+      return { path, score, reasons };
+    })
+    .sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
+}
+
+export function renderRouting(ranked: RankedFile[], mission: string): string {
+  if (!ranked.length) return '';
+  const lines = [
+    '',
+    '## Review routing',
+    '',
+    `Ranked reading order for \`${mission}\` (heuristic ordering — it decides where to look first, never correctness):`,
+    '',
+  ];
+  ranked.forEach((r, i) => {
+    lines.push(`${i + 1}. \`${r.path}\` — ${r.reasons.join('; ')}`);
+  });
+  lines.push('');
+  return lines.join('\n');
+}

package/src/run.ts

@@ -5,7 +5,7 @@
 // Why this exists: the skills tell the crew to run `scripts/savepoint.sh`, but
 // the installer only ever copied `content/` and `references/` into a project.
 // That path resolved against the project's cwd, where the file does not exist,
-// so every savepoint / lane / evidence / mission-report call silently did
+// so every savepoint / lane call silently did
 // nothing. Resolving from the package root fixes it for every install target at
 // once.
 import { existsSync, readdirSync } from 'node:fs';
@@ -18,7 +18,7 @@ const here = dirname(fileURLToPath(import.meta.url));
 export const SCRIPTS_DIR = join(here, '..', 'scripts');
 
 /** Scripts a project is meant to call. Anything else stays internal tooling. */
-export const RUNNABLE = ['savepoint.sh', 'lane.sh', 'evidence.sh', 'mission-report.sh'] as const;
+export const RUNNABLE = ['savepoint.sh', 'lane.sh'] as const;
 
 /**
  * Locate a POSIX shell. Windows has none natively, but Git for Windows ships

package/src/sign.ts

@@ -0,0 +1,61 @@
+// src/sign.ts
+// Signed attestation: evidence that cannot be fabricated
+// after the fact — optional, user-keyed, never a hard dependency.
+//
+// Uses minisign when it is installed and the user supplies keys. No minisign,
+// no keys → today's behavior, stated plainly in the output. Detached
+// signature lives beside the report (`report.md.minisig`).
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export function signArgs(reportPath: string, secretKey: string): string[] {
+  return ['-Sm', reportPath, '-s', secretKey];
+}
+
+export function verifyArgs(reportPath: string, pubKey: string | null): string[] {
+  return pubKey ? ['-Vm', reportPath, '-p', pubKey] : ['-Vm', reportPath];
+}
+
+export function hasMinisign(): boolean {
+  try {
+    execFileSync('minisign', ['-v'], { stdio: ['ignore', 'pipe', 'ignore'] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function defaultKey(flag: 'secret' | 'public'): string {
+  return join(homedir(), '.mugiwara', flag === 'secret' ? 'minisign.key' : 'minisign.pub');
+}
+
+export function signReport(projectDir: string, missionDir: string): { ok: boolean; message: string } {
+  const report = join(missionDir, 'report.md');
+  if (!existsSync(report)) return { ok: false, message: 'no report.md to sign — archive first' };
+  if (!hasMinisign()) {
+    return { ok: false, message: 'minisign not installed — signing skipped (install minisign to enable attestation)' };
+  }
+  const secretKey = process.env.MUGIWARA_SIGN_KEY?.trim() || defaultKey('secret');
+  try {
+    execFileSync('minisign', signArgs(report, secretKey), { cwd: projectDir, stdio: 'pipe', input: process.env.MUGIWARA_SIGN_PASSWORD ?? '' });
+    return { ok: true, message: `signed ${report}.minisig (key: ${secretKey})` };
+  } catch (e) {
+    return { ok: false, message: `signing failed: ${(e as Error).message}` };
+  }
+}
+
+export function verifyReport(projectDir: string, missionDir: string): { ok: boolean; message: string } {
+  const report = join(missionDir, 'report.md');
+  const sig = `${report}.minisig`;
+  if (!existsSync(sig)) return { ok: false, message: 'not signed (no .minisig beside report.md)' };
+  if (!hasMinisign()) return { ok: false, message: 'minisign not installed — cannot verify' };
+  const pubKey = existsSync(defaultKey('public')) ? defaultKey('public') : null;
+  try {
+    execFileSync('minisign', verifyArgs(report, pubKey), { cwd: projectDir, stdio: 'pipe' });
+    return { ok: true, message: 'signature verifies against report.md' };
+  } catch {
+    return { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing' };
+  }
+}

package/src/targets/claude.ts

@@ -40,8 +40,8 @@ function copyScripts(dstDir: string): string[] {
     if (!existsSync(src)) return;
     for (const f of readdirSync(src)) {
       // install.sh is the npx bootstrap, not a harness script — never shipped
-      // into a project. initiative.ts ships too: `mugiwara initiative` runs it.
-      if ((!f.endsWith('.sh') && f !== 'initiative.ts') || f === 'install.sh') continue;
+      // into a project.
+      if (!f.endsWith('.sh') || f === 'install.sh') continue;
       const to = join(dst, f);
       mkdirSync(dst, { recursive: true });
       copyFileSync(join(src, f), to);

package/.opencode/commands/mugiwara-execute.md

@@ -1,13 +0,0 @@
----
-description: Execute an approved mugiwara plan as Zoro (execution stage)
----
-Execute the approved plan as Zoro, inline in the main conversation:
-
-1. **Entry protocol first** — read the mission state (`.mugiwara/state/<mission>/[member].json`). No active mission → run Flow 0 triage before anything else. Foreign mission → stop, report owner. Base drift → stop, ask. Non-git → degrade to standard, say so once.
-2. Load the skill: `mugiwara-execution`.
-3. Read the existing plan from `.mugiwara/plans/` — that file is the bridge, never re-plan.
-4. Open a todo list, run tasks sequentially inline; dispatch [PARALLEL] batches to worker subagents only.
-5. Commit per logical task and verify every acceptance criterion with evidence in `.mugiwara/results/`.
-6. **Return the result to Luffy — do not choose the next wave.**
-
-See skills/mugiwara-execution for the wave-structured protocol.

package/.opencode/commands/mugiwara-heal.md

@@ -1,13 +0,0 @@
----
-description: Heal earlier-wave failures as Brook (healing stage, after review/security findings)
----
-Heal failures as Brook, inline in the main conversation:
-
-1. **Entry protocol first** — read the mission state (`.mugiwara/state/<mission>/[member].json`). No active mission → run Flow 0 triage before anything else. Foreign mission → stop, report owner. Base drift → stop, ask. Non-git → degrade to standard, say so once. Read `heal_halt` (savepoint computes it as `heal_cycle ≥ heal_max_cycles`, config default 3) — when `true`, STOP and escalate to the user.
-2. Load the skill: `mugiwara-healing`.
-3. Read the `.mugiwara/issues` ledger first — stop-the-line triage per failure, never fix blind.
-4. Prove-it before fixing: reproduce or verify the failure from `.mugiwara/results/` evidence.
-5. Apply minimal root-cause fixes, update the ledger with evidence.
-6. **Return the result to Luffy — do not choose the next wave.**
-
-See skills/mugiwara-healing for the triage protocol.

package/.opencode/commands/mugiwara-onboard.md

@@ -1,14 +0,0 @@
----
-description: Run the Mugiwara onboarding wizard — zero-LLM terminal wizard via `mugiwara onboard`, writes .mugiwara/config.
----
-Mugiwara onboard: $ARGUMENTS
-
-Run the onboarding wizard. One path only — the zero-LLM terminal wizard:
-
-1. Tell the user to run `mugiwara onboard` in their terminal (or `bunx @ionivetech/mugiwara onboard`).
-2. Do NOT ask the questions yourself. Do NOT write .mugiwara/config. The wizard is a plain
-   script — no LLM, no network, works on every platform.
-3. After the user finishes, verify `.mugiwara/config` exists and summarize the values.
-
-The wizard never writes .mugiwara/onboard.json. All 14 crew agents are always active —
-no agent-selection step.

package/.opencode/commands/mugiwara-plan.md

@@ -1,17 +0,0 @@
----
-description: Plan a mugiwara mission as Nami (planning stage)
----
-Plan the mission as Nami, inline in the main conversation:
-
-1. **Entry protocol first** — read the mission state (`.mugiwara/state/<mission>/[member].json`). No active mission → run Flow 0 triage before anything else. Foreign mission → stop, report owner. Base drift → stop, ask. Non-git → degrade to standard, say so once.
-2. Load the skill: `mugiwara-planning`.
-3. Classify mission size, interview first, scan full context, write the scaled Quick/Standard/Full plan.
-4. Embody the Nami crew role inline — never Task-dispatch.
-5. Persist the plan to `.mugiwara/plans/`; later stages read it from there as the bridge.
-6. **Return the plan to Luffy — do not choose the next wave.**
-
-Spec input: read `.mugiwara/spec/YYYY-MM-DD-<mission>.md`. If it is empty or
-missing, write the spec bridge from the user's request first (goal, acceptance
-criteria, constraints) before planning — never plan from an empty spec.
-
-See skills/mugiwara-planning for the full template and wave structure.

package/.opencode/commands/mugiwara-ship.md

@@ -1,13 +0,0 @@
----
-description: Close the mission as Luffy (closure + ship stage, at mission end)
----
-Close the mission as Luffy, inline in the main conversation:
-
-1. **Entry protocol first** — read the mission state (`.mugiwara/state/<mission>/[member].json`). No active mission → run Flow 0 triage before anything else. Foreign mission → stop, report owner. Base drift → stop, ask. Non-git → degrade to standard, say so once.
-2. Load the skills: `mugiwara-orchestration` + `mugiwara-ship`.
-3. Run the ship gate: pre-launch checklist, feature flags, staged rollout, mandatory rollback plan — binary GO/NO-GO with evidence.
-4. Bridge on `.mugiwara/plans/` (promise) vs `.mugiwara/results/` (evidence) for the Definition-of-Done verdict.
-5. Close the mission: lessons ledger update, then the terminal step — save-point commit, push the branch, write the PR verdict, hand to the user.
-6. **The crew never creates a PR, never merges, never deploys — hand the branch + verdict to the user.**
-
-See skills/mugiwara-ship for the gate and skills/mugiwara-orchestration for closure.

package/.opencode/commands/using-mugiwara.md

@@ -1,20 +0,0 @@
----
-description: Mugiwara crew reference — how it works, crew overview, pipeline summary. Documentation only.
----
-Mugiwara Reference: $ARGUMENTS
-
-`mugiwara-orchestration` auto-loads as gatekeeper for every task — no need to call this command.
-
-## How it works
-
-- 11 agents: Luffy (triage), Usopp (brainstorm), Nami (plan), Zoro (execute), Chopper (audit), Sanji (quality), Franky (gates), Robin (review), Jinbe (security), Brook (heal), Resume (+3 internal: Skeptic, Eval Runner, Memory)
-- 26 skills — one per crew role + domain skills (frontend, backend, git, security)
-- 9-wave pipeline runs inline in the main conversation
-- Evidence over claims at every wave
-- Autonomy modes: guided, semi, auto
-
-## When to use this command
-
-Use `/using-mugiwara` when you want the crew overview or pipeline summary. For task routing and classification, `mugiwara-orchestration` auto-loads as gatekeeper — you do not need to call this first.
-
-See skills/mugiwara-workflow for the full pipeline.