@kaydash9999/banker-plugins 0.22.0 → 0.23.2

package/skills/3d-intro-setup/references/video-pool.mjs

@@ -28,7 +28,9 @@
  *
  * Pool state lives in ~/.config/banker/3d-intro/video-pool-state.json (0600). It holds
  * FINGERPRINTS (sha256 of endpoint+key+model), never a key, so a rotated key or a changed model
- * starts with a clean record. State is advisory: a failed write is reported, never fatal.
+ * starts with a clean record. A Sora deployment that answered 410 (retired) is recorded under the
+ * fingerprint of its endpoint origin and deployment name, and Sora is skipped for 24 h.
+ * State is advisory: a failed write is reported, never fatal.
  * Concurrent processes share the file last-write-wins; the per-key in-flight limit is per process.
  *
  * Runtime: Node >=18 builtins only. globalThis.fetch and cp.spawnSync are read at call time so
@@ -40,7 +42,7 @@ import os from 'node:os';
 import crypto from 'node:crypto';
 import cp from 'node:child_process';
 import {
-  createVideo, pollVideo, downloadVideo, resolveFfmpeg, redact, fetchGuarded, safeForKey, keyHeldBack,
+  createVideo, pollVideo, downloadVideo, resolveFfmpeg, redact, fetchGuarded, safeForKey, keyHeldBack, probeSoraDeployment,
   API_TIMEOUT_MS, DOWNLOAD_TIMEOUT_MS, HELD_KEY, errnoOf, timeLeft,
 } from './azure-adapter.mjs';
 
@@ -213,13 +215,17 @@ function updateEntry(file, entry, fn, emit) {
   }
 }
 
-/** Clear recorded state for all entries, or only for the given labels (e.g. ['WAN_2']). */
+/**
+ * Clear recorded state for all entries, or only for the given labels (e.g. ['WAN_2']). 'AZURE_SORA'
+ * clears the Sora retirement record (every Sora deployment's, so creds are not needed for it).
+ */
 export function resetPoolState({ statePath = defaultStatePath(), creds, labels } = {}) {
   const state = loadPoolState(statePath);
   if (!labels) state.entries = {};
   else {
     const fps = new Set(loadWanPool(creds).filter((e) => labels.includes(e.label)).map((e) => e.fp));
-    for (const fp of Object.keys(state.entries)) if (fps.has(fp)) delete state.entries[fp];
+    const sora = labels.includes(SORA_LABEL);
+    for (const [fp, st] of Object.entries(state.entries)) if (fps.has(fp) || (sora && st?.label === SORA_LABEL)) delete state.entries[fp];
   }
   return savePoolState(state, statePath);
 }
@@ -235,14 +241,62 @@ function entryStatus(st, t) {
   return { status: 'ok' };
 }
 
-/** Per-entry availability for reporting. Never includes a key, nor a malformed endpoint or model. */
+/**
+ * Per-entry availability for reporting: one row per WAN entry (provider 'wan'), then one Sora row
+ * (label AZURE_SORA, provider 'sora', status ok | retired | unset | malformed). Never includes a key,
+ * nor a malformed endpoint or model.
+ */
 export function poolSummary({ creds = {}, statePath = defaultStatePath(), now = Date.now() } = {}) {
   const state = loadPoolState(statePath);
-  return loadWanPool(creds).map((e) => {
+  const wan = loadWanPool(creds).map((e) => {
     const st = state.entries[e.fp];
     const field = malformedField(e);
-    return { ...shownEntry(e), okCount: st?.okCount || 0, ...(field ? { status: 'malformed', reason: field } : entryStatus(st, now)) };
+    return { ...shownEntry(e), provider: 'wan', okCount: st?.okCount || 0, ...(field ? { status: 'malformed', reason: field } : entryStatus(st, now)) };
   });
+  return [...wan, soraSummary(creds, state, now)];
+}
+
+// The Sora row of poolSummary.
+function soraSummary(creds, state, t) {
+  const conn = soraConn(creds);
+  const base = { label: SORA_LABEL, provider: 'sora', model: isModelId(conn.model) ? conn.model : '(invalid model)' };
+  if (!conn.endpoint || !conn.key) return { ...base, host: null, status: 'unset' };
+  if (!originOf(conn.endpoint)) return { ...base, host: '(invalid endpoint)', status: 'malformed', reason: 'endpoint' };
+  const rec = retiredIn(state, conn, t);
+  const status = rec ? { status: 'retired', reason: rec.reason, retiredAt: rec.retiredAt, until: rec.retiredAt + SORA_RETIRED_TTL_MS } : { status: 'ok' };
+  return { ...base, host: hostOf(originOf(conn.endpoint)), ...status };
+}
+
+/**
+ * The CLIP_MODE a run starts with (FREE, nothing is sent): dive without exits on any provider (the user
+ * found it the most natural of the three on the sora-2 comparison page). Returns { mode, exit, provider,
+ * measured, reason }: provider is the first one generateClip would really use (VIDEO_PROVIDER_ORDER), and
+ * measured is false on WAN (dive on WAN is not measured; say so when the user picks). mode is null when
+ * no leg could be made: every WAN entry refused (generateClip stops there and does not use Sora), a Sora
+ * endpoint that is not https, or nothing set up (no WAN entry, Sora unset or recorded retired).
+ */
+export function defaultClipMode(creds = {}, { statePath = defaultStatePath(), now = Date.now() } = {}) {
+  for (const p of parseProviderOrder(creds.VIDEO_PROVIDER_ORDER)) {
+    const r = p === 'wan' ? wanMode(creds) : soraMode(creds, loadPoolState(statePath), now);
+    if (r) return r;
+  }
+  return { mode: null, provider: null, reason: 'no video provider: no WAN entry, and Sora is unset or recorded retired' };
+}
+
+function wanMode(creds) {
+  const pool = loadWanPool(creds);
+  if (!pool.length) return null;
+  if (pool.every((e) => entryRefusal(e))) return { mode: null, provider: 'wan', reason: 'every WAN entry is malformed or held back: generateClip stops there and does not use Sora' };
+  return { mode: 'dive', exit: false, provider: 'wan', measured: false, reason: 'the video runs on WAN: dive without exits (dive on WAN is not measured)' };
+}
+
+function soraMode(creds, state, t) {
+  const conn = soraConn(creds);
+  if (!conn.endpoint || !conn.key) return null;
+  const origin = originOf(conn.endpoint);
+  if (!origin || proxyHolds(origin)) return { mode: null, provider: 'sora', reason: 'AZURE_SORA_ENDPOINT is not an https URL (or the env proxy holds the key back): the leg stops before sending' };
+  if (retiredIn(state, conn, t)) return null;
+  return { mode: 'dive', exit: false, provider: 'sora', measured: true, reason: 'the video runs on Sora: dive without exits (measured on sora-2 2025-12-08)' };
 }
 
 // In-process in-flight counter per fingerprint (the documented limit is per key).
@@ -728,6 +782,60 @@ function soraConn(creds) {
   };
 }
 
+// ---------------------------------------------------------------------------
+// Sora retirement (HTTP 410). A 410 on the submit is the model's retirement at once. A 410 on a poll
+// or a download may also be a job that expired, so it counts only when the free deployment probe says
+// retired. The record keeps Sora from being sent the next legs for 24 h.
+// ---------------------------------------------------------------------------
+
+const SORA_LABEL = 'AZURE_SORA';
+const SORA_RETIRED_TTL_MS = 24 * 3_600_000;
+// The Sora record's name in the state file: endpoint origin and deployment, never the key.
+const soraFp = (conn) => `sora:${crypto.createHash('sha256').update(`${originOf(conn.endpoint)}\n${conn.model}`).digest('hex').slice(0, 16)}`;
+
+function retiredIn(state, conn, t) {
+  const st = state.entries[soraFp(conn)];
+  return st?.status === 'retired' && t - st.retiredAt < SORA_RETIRED_TTL_MS ? st : null;
+}
+
+function recordSoraRetired(ctx, conn, stage) {
+  const t = ctx.now();
+  updateEntry(ctx.statePath, { fp: soraFp(conn), label: SORA_LABEL }, (st) => ({ ...st, status: 'retired', retiredAt: t, reason: `HTTP 410 (${stage})` }), ctx.emit);
+  ctx.emit({ type: 'fail', provider: 'sora', label: SORA_LABEL, kind: 'retired', status: 410, stage });
+}
+
+const soraWhere = (conn) => `Sora deployment ${isModelId(conn.model) ? conn.model : '(invalid model)'} on ${hostOf(originOf(conn.endpoint))}`;
+const SORA_RETIRED_NEXT = "add a WAN key (3d-intro-setup), or deploy a newer Sora model and clear the record with resetPoolState({ labels: ['AZURE_SORA'] })";
+
+function soraRetiredStop(conn, stage, taskId) {
+  const job = taskId ? `job ${taskId} may have billed` : 'no job was made';
+  return stopError('retired', `${soraWhere(conn)} is retired (HTTP 410 on the ${stage}); ${job}; Sora is skipped for 24 h — ${SORA_RETIRED_NEXT}`, { provider: 'sora', label: SORA_LABEL, status: 410, ...(taskId ? { taskId } : {}) });
+}
+
+// Sora was skipped for its record, and no other provider took the leg.
+function soraSkippedStop(conn, rec) {
+  return stopError('retired', `${soraWhere(conn)} was recorded retired (${rec.reason}) at ${new Date(rec.retiredAt).toISOString()}, and no WAN key could take the leg; nothing was sent — ${SORA_RETIRED_NEXT}`, { provider: 'sora', label: SORA_LABEL, retiredAt: rec.retiredAt });
+}
+
+// One free probe per process and deployment.
+const soraProbes = new Map();
+function probeSoraOnce(conn, now) {
+  const fp = soraFp(conn);
+  if (!soraProbes.has(fp)) {
+    soraProbes.set(fp, probeSoraDeployment({ endpoint: conn.endpoint, key: conn.key, deployment: conn.model, now }).catch(() => ({ state: 'unknown', status: null })));
+  }
+  return soraProbes.get(fp);
+}
+
+// The retired stop for a 410 on a poll or a download when the probe confirms it, else null.
+async function confirmRetired(ctx, conn, stage, jobId) {
+  const p = await probeSoraOnce(conn, ctx.now);
+  ctx.emit({ type: 'probe', provider: 'sora', label: SORA_LABEL, stage, state: p.state, status: p.status ?? null });
+  if (p.state !== 'retired') return null;
+  recordSoraRetired(ctx, conn, stage);
+  return soraRetiredStop(conn, stage, jobId);
+}
+
 // Poll an accepted Sora job to a downloaded clip; same stop rules as finishWanTask.
 async function finishSoraJob(ctx, jobId, secs) {
   const conn = soraConn(ctx.creds);
@@ -737,13 +845,14 @@ async function finishSoraJob(ctx, jobId, secs) {
   if (!st || !SORA_DONE.has(st.status)) {
     throw stopError('timeout', `Sora job ${jobId} still ${st?.status ?? 'unknown'} after polling for ${ctx.now() - t0} ms; resume with resumeClip`, { provider: 'sora', taskId: jobId, label: 'AZURE_SORA', seconds: secs });
   }
-  const mp4 = await downloadSoraClip(conn, jobId, secs);
+  const mp4 = await downloadSoraClip(ctx, conn, jobId, secs);
   ctx.emit({ type: 'done', provider: 'sora', label: 'AZURE_SORA', taskId: jobId });
   return { mp4, provider: 'sora', label: 'AZURE_SORA', model: conn.model, seconds: secs, taskId: jobId, usage: null };
 }
 
 // pollVideo throws on a 4xx other than 408/429 (the job is gone, or the key is refused): such a job
-// never turns terminal, so the leg ends at once as task_lost instead of polling to the deadline.
+// never turns terminal, so the leg ends at once as task_lost instead of polling to the deadline. A 410
+// the deployment probe calls retired ends it as retired.
 async function pollSoraJob(ctx, conn, jobId) {
   const interval = Math.max(0, ctx.pollIntervalMs);
   try {
@@ -754,6 +863,8 @@ async function pollSoraJob(ctx, conn, jobId) {
     });
   } catch (e) {
     if (!e.status) throw e;
+    const retired = e.status === 410 && await confirmRetired(ctx, conn, 'poll', jobId);
+    if (retired) throw retired;
     throw stopError('task_lost', `Sora poll for job ${jobId} failed: HTTP ${e.status}${e.code ? ` ${e.code}` : ''}; check the job in Azure before resubmitting`, { provider: 'sora', taskId: jobId, label: 'AZURE_SORA', status: e.status, code: e.code });
   }
 }
@@ -764,10 +875,12 @@ function soraFailure(st, jobId) {
   return stopError('failed', `Sora job ${jobId} ended ${st.status}: ${JSON.stringify(st.error || '')}`, { provider: 'sora', taskId: jobId, code });
 }
 
-async function downloadSoraClip(conn, jobId, secs) {
+async function downloadSoraClip(ctx, conn, jobId, secs) {
   try {
     return await downloadVideo({ endpoint: conn.endpoint, key: conn.key, id: jobId, apiVersion: conn.apiVersion });
   } catch (err) {
+    const retired = err.status === 410 && await confirmRetired(ctx, conn, 'download', jobId);
+    if (retired) throw retired;
     throw stopError('download', `${err.message} for Sora job ${jobId}; resume with resumeClip`, { provider: 'sora', taskId: jobId, label: 'AZURE_SORA', seconds: secs });
   }
 }
@@ -784,7 +897,8 @@ const SORA_SUBMIT_TRIES = 5;
 
 // A 429 is a refusal, so retrying it cannot double-bill; a lost connection or a bare 5xx can. Each
 // wait is the server's Retry-After, else 30 s doubling, from 1 s to 10 min. A Retry-After longer
-// than maxRateWaitMs is not waited out: the leg stops as `rate` at once, as WAN's waits do.
+// than maxRateWaitMs is not waited out: the leg stops as `rate` at once, as WAN's waits do. A 410 is
+// the deployment's retirement: recorded, and the leg stops as `retired`.
 async function submitSora(ctx, conn, secs) {
   for (let i = 0; ; i++) {
     try {
@@ -793,6 +907,7 @@ async function submitSora(ctx, conn, secs) {
         endpoint: conn.endpoint, key: conn.key, model: conn.model, prompt: ctx.prompt, size: ctx.size, seconds: secs, inputReferencePng: ctx.firstFramePng, apiVersion: conn.apiVersion,
       });
     } catch (e) {
+      if (e.status === 410) { recordSoraRetired(ctx, conn, 'submit'); throw soraRetiredStop(conn, 'submit'); }
       if (e.status !== 429 || i >= SORA_SUBMIT_TRIES - 1) throw soraSubmitError(e);
       const want = e.retryAfterMs ?? RATE_BASE_MS * 2 ** i;
       if (want > ctx.maxRateWaitMs) throw soraRateStop(want, ctx.maxRateWaitMs, e.retryAfterMs != null);
@@ -815,6 +930,10 @@ function soraSubmitError(e) {
   if (e.status === 429) {
     return stopError('rate', `Sora still answered HTTP 429 after ${SORA_SUBMIT_TRIES} tries; no job was made — wait, then generate the leg again`, { provider: 'sora', status: 429 });
   }
+  if (e.status === 404) {
+    // only the status and the code field are read: a message is no contract
+    return stopError('invalid_request', `${e.message}; the deployment name may be wrong, or the deployment was removed after its model retired — check AZURE_SORA_DEPLOYMENT (3d-intro-setup §4 checks it for free)`, { provider: 'sora', status: 404, code: e.code || null });
+  }
   if (soraMayHaveJob(e)) {
     const answer = e.status === 0 ? e.errno || 'network' : `HTTP ${e.status}`;
     return stopError('submit_unknown', `Sora submit got no usable answer (${answer}); the job may exist — check Azure before resubmitting`, { provider: 'sora', status: e.status });
@@ -851,6 +970,10 @@ const DEFAULTS = { size: '720x1280', seconds: 5, pollIntervalMs: 15_000, pollTim
  *   kind 'unreachable'                  Sora host refused the connection (nothing was sent)
  *   kind 'rate'                         Sora kept answering 429, or asked (Retry-After, err.retryAfterMs) for a
  *                                       wait past maxRateWaitMs (no job was made); wait, then call again
+ *   kind 'retired'                      the Sora deployment answered 410 (on the submit, or on a poll or a
+ *                                       download the free deployment probe confirmed), or was recorded so in
+ *                                       the last 24 h and no WAN key could take the leg; add a WAN key, or
+ *                                       deploy a newer model and resetPoolState({ labels: ['AZURE_SORA'] })
  * @returns {Promise<{mp4:Buffer, provider:'wan'|'sora', label:string, model:string, seconds:number, taskId:string, usage:object|null}>}
  */
 export async function generateClip(opts = {}) {
@@ -867,17 +990,24 @@ export async function generateClip(opts = {}) {
     const clip = await tryProvider(ctx, p, tried);
     if (clip) return clip;
   }
+  if (ctx.soraRetired) throw soraSkippedStop(soraConn(o.creds), ctx.soraRetired);
   throw new Error(`generateClip: no video provider available (tried: ${tried.join(', ') || 'none'})`);
 }
 
 // One provider's go at the leg: the clip, or null to go on to the next. Sora, once it runs, ends the
-// leg (with a clip or a throw).
+// leg (with a clip or a throw). A Sora deployment recorded retired is skipped before anything is sent.
 async function tryProvider(ctx, p, tried) {
   if (p === 'wan') {
     tried.push('wan');
     return runWan(ctx);
   }
   if (p !== 'sora' || !soraReady(ctx)) return null;
+  const rec = retiredIn(loadPoolState(ctx.statePath), soraConn(ctx.creds), ctx.now());
+  if (rec) {
+    ctx.emit({ type: 'skip', provider: 'sora', label: SORA_LABEL, reason: 'retired', retiredAt: rec.retiredAt });
+    ctx.soraRetired = rec;
+    return null;
+  }
   tried.push('sora');
   ctx.emit({ type: 'fallback', provider: 'sora', from: tried.slice(0, -1) });
   return runSora(ctx);

package/skills/all-in-one/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: all-in-one
-description: "코딩 작업을 한 명령으로 계획부터 QA 통과까지 엄격하게 진행. `ralplan` 으로 합의 계획, `ralph` 로 검증 구현을 하고 독립 QA 게이트(Claude Code 는 `verify` 순환, Codex 는 `ultraqa`)로 마무리. 'all-in-one'/'all in one' 시 사용. 한 줄 수정은 이 스킬 대신 `ralph`, 아이디어 확장은 `autopilot`."
-argument-hint: "[--short] [--checkpoint] [--critic=critic|architect|codex] [--qa=tests|build|lint|typecheck] [--no-deslop] <task description>"
+description: "코딩 작업을 한 명령으로 계획부터 QA 통과까지 엄격하게 진행. `ralplan` 으로 합의 계획, `ralph` 로 검증 구현을 하고, 두 런타임 모두 `ralph-qa` 의 독립 검토자 3명 이상과 실행기가 돌린 게이트 증거로 마무리. 'all-in-one'/'all in one' 시 사용. 한 줄 수정은 이 스킬 대신 `ralph`, 아이디어 확장은 `autopilot`."
+argument-hint: "[--short] [--checkpoint] [--critic=critic|architect|codex] [--qa=tests,build,lint,typecheck,scenarios] [--codex[=<model>]] [--gemini[=<model>]] [--opencode[=<provider/model>]] [--no-deslop] <task description>"
 level: 4
 ---
 
@@ -11,8 +11,8 @@ level: 4
 
 ## 0. Prerequisite: OMC 5 with a matching `omc` CLI (check first)
 
-This skill orchestrates OMC's `ralplan` → `ralph`, then a QA gate built on OMC's
-`verify` workflow. **Check the dependency before Stage 1**; if it is missing or
+This skill orchestrates OMC's `ralplan` → `ralph`, then banker's own `ralph-qa`
+as the QA gate. **Check the dependency before Stage 1**; if it is missing or
 stale, **guide installation first** rather than failing mid-pipeline. The `omc`
 check below is for Claude Code; on Codex check OMX instead (`omx --version`), whose
 `ralph` does not use the `omc` CLI.
@@ -33,11 +33,15 @@ check below is for Claude Code; on Codex check OMX instead (`omx --version`), wh
   → oh-my-claudecode, the `setup-omc` skill, or
   `npm install -g oh-my-claude-sisyphus@latest`), then resume. Do not start a
   pipeline whose Stage 2 will stop.
-- **`ultraqa` does not exist in OMC 5** (removed in 5.0.0, no alias), so a call
-  to `oh-my-claudecode:ultraqa` fails. Stage 3 below runs in its place.
+- **Stage 3 is banker's `ralph-qa` on both runtimes.** It ships with banker, so
+  the gate needs no OMC or OMX skill; OMC and OMX serve Stages 1 and 2 only.
 - On Codex the equivalent framework is OMX (`omx setup`).
 
-**런타임 매핑 (Claude Code ↔ Codex).** Stage 1·2 의 `ralplan`·`ralph` 는 Claude Code에선 OMC 스킬이고 **Codex에선 oh-my-codex(OMX)가 제공하는 동명 스킬**이다. Stage 3 은 런타임마다 다르다: Claude Code(OMC 5)는 `ultraqa` 가 없어 아래 verify 순환을 직접 돌리고, **Codex는 OMX 가 아직 제공하는 `ultraqa`** 를 쓴다. 아래 `Skill("oh-my-claudecode:<name>")`·`Task(subagent_type="oh-my-claudecode:<name>")` 표기는 Claude Code 기준이다.
+**런타임 매핑 (Claude Code ↔ Codex).** Stage 1·2 의 `ralplan`·`ralph` 는 Claude Code에선 OMC 스킬이고 **Codex에선 oh-my-codex(OMX)가 제공하는 동명 스킬**이다. Stage 3 은 두 런타임 모두 banker `ralph-qa` 다: Claude Code `Skill("banker:ralph-qa")`, Codex npm 길 `$banker-ralph-qa`, 플러그인 길 `$banker:ralph-qa`. Codex 에는 Skill 도구가 없으니 그 `SKILL.md` 를 읽고 그대로 따른다(npm 길 `<S>/../banker-ralph-qa/SKILL.md`, 플러그인 길 `<S>/../ralph-qa/SKILL.md`, `<S>` 는 이 스킬 폴더). `<RQ>` 는 ralph-qa 의 `references` 폴더다(Claude Code 와 Codex 플러그인 길 `<S>/../ralph-qa/references`, Codex npm 길 `<S>/../banker-ralph-qa/references`). 아래 `Skill("oh-my-claudecode:<name>")` 표기는 Claude Code 기준이다.
+
+**Codex 의 tmux 밖 실행.** OMX 의 런타임 워크플로(`ralph`, `team` 등)는 OMX tmux 런타임을 요구한다. OMX 의 `AGENTS.md` 는 tmux 밖(Codex App, 일반 `codex`, `codex exec`)이면 그 사실을 알리고 가장 가까운 대체 경로로 계속하라고 정한다(oh-my-codex 0.20.2 `templates/AGENTS.md`). 그래서 tmux 밖이라는 사실만으로는 멈추지 않는다. 그 단계는 이 세션이 그 스킬의 `SKILL.md` 절차를 네이티브 하위 에이전트로 그대로 따르고, 보고에 `<단계>: tmux 밖 대체 실행(OMX 런타임 없음)` 한 줄을 적는다. 종결 낱말은 다른 멈춤 조건과 마지막 ralph-qa 판정으로만 정한다. 대체 실행도 할 수 없으면(하위 에이전트 기능이 꺼짐 등) `STOPPED(omx-runtime-unavailable)` 로 멈추고 tmux 안의 OMX 에서 다시 실행하라고 안내한다.
+
+**Codex 의 계획과 상태 경로.** 이 문서의 `.omc/plans/`, `.omc/state/` 는 Claude Code(OMC) 경로다. Codex 에서는 OMX 경로를 쓴다: 계획은 `.omx/plans/`(ralplan 이 쓰는 `prd-*.md`, `test-spec-*.md`), ralph 의 진행 기록은 `.omx/state/<scope>/ralph-progress.json`. Codex 에서 `.omc/` 아래에 계획을 쓰지 않는다.
 
 ## Purpose
 
@@ -51,18 +55,17 @@ Stage 1  /ralplan --deliberate     consensus plan (Planner → Architect → Cri
 Stage 2  /ralph --critic=critic    PRD-driven persistent build, critic-verified
    │     → implementation + deslop + regression, then ralph self-cancels
    ▼
-Stage 3  QA gate (--qa=tests)      fresh verifier → diagnose → fix, bounded cycle
-         → PASS, or honest STOPPED-with-diagnosis   (Codex: OMX /ultraqa)
+Stage 3  ralph-qa --gates=<--qa>    3+ independent reviewers on runner-run gate evidence
+         → ALL-IN-ONE COMPLETE, or honest STOPPED   (both runtimes)
 ```
 
 This skill is a **thin sequential orchestrator**. It does not implement, plan,
-or test directly, and it does **not** create its own state file. Stages 1 and 2
-hand every loop, retry, and verification to the sub-skill they invoke. The one
-loop all-in-one owns is Stage 3's bounded verify → fix cycle: OMC 5 removed
-`ultraqa`, which used to own it, and its replacement `verify` gathers evidence
-but does not fix. Beyond that, its only job is to run the stages in order,
-bridge their handoffs, gate each stage on the previous one's success, and
-report honestly.
+or test directly, and it does **not** create its own state file. Each stage
+hands every loop, retry, and verification to the skill it invokes: `ralplan`,
+`ralph`, and banker's `ralph-qa`, whose judge → fix loop runs until its quorum
+says `APPROVE` or its `--max` ends it. Beyond that, its only job is to record the
+pre-change gate baseline, run the stages in order, bridge their handoffs, gate
+each stage on the previous one's success, and report honestly.
 
 ## Why three stages (and not just ralph)
 
@@ -75,17 +78,20 @@ modes, and each stage's reviewer is independent of the previous stage's author
 2. **A partial or unverified build declared "done"** → Stage 2's PRD
    story-by-story persistence + critic verification catch this.
 3. **Integration / regression breakage slipping past the builder's own checks**
-   → Stage 3's fresh, test-focused, fix-cycling gate catches this.
+   → Stage 3's independent quorum over gate evidence the runner, not a model,
+   recorded catches this.
 
 **On the apparent redundancy of Stage 3:** ralph (Stage 2) already runs its own
 Step-7 reviewer verification and Step-7.6 regression re-run (`omc ralph verify`
 against the baseline it recorded). Stage 3 is still worth running because it is
-*independent* (a fresh verifier agent, not the context that built the change),
-*test-suite-focused*, and *actively fixes* in a bounded cycle. If ralph's
-regression already ran the suite green, the gate usually passes in cycle 1
-(cheap); its value rises when the suite is broad, when changes touched many
-files, or when integration/flaky issues hide behind unit-level checks. Keeping
-it explicit gives a clean, separate PASS signal.
+*independent* (3+ reviewers in contexts that did not build the change),
+*evidence-bound* (each `--qa` goal's real command is run by ralph-qa's
+`gate-evidence.mjs` and kept as an `observed` record; a model's word about a
+command does not count), and *actively fixes* inside ralph-qa's bounded loop.
+If ralph's regression already ran the suite green, the gate usually approves in
+its first iteration (cheap); its value rises when the suite is broad, when
+changes touched many files, or when integration/flaky issues hide behind
+unit-level checks. Keeping it explicit gives a clean, separate PASS signal.
 
 ## When to use
 
@@ -115,7 +121,8 @@ it explicit gives a clean, separate PASS signal.
 | `--short` | Stage 1 runs ralplan **without** `--deliberate` (skips pre-mortem + expanded test plan) for lower-risk work | off → deliberate |
 | `--checkpoint` | Insert an `AskUserQuestion` approval gate between Stage 1 (plan) and Stage 2 (implement) | off → auto-proceed |
 | `--critic=critic\|architect\|codex` | Reviewer passed to ralph's verification | `critic` |
-| `--qa=tests\|build\|lint\|typecheck` | What the Stage 3 gate checks (Codex: the goal passed to ultraqa) | `tests` |
+| `--qa=<goals>` | The Stage 3 gates, comma-separated: `tests`, `build`, `lint`, `typecheck`, `scenarios` (adversarial scenario rows). Passed to ralph-qa as `--gates` on both runtimes | `tests` |
+| `--codex[=<model>]`, `--gemini[=<model>]`, `--opencode[=<provider/model>]` | Passed through to ralph-qa as external seats. Without them only its backbone of 3+ session-model reviewers sits | none |
 | `--no-deslop` | Passed through to ralph (skip the post-review deslop pass) | off |
 
 Everything before the flags / after them that isn't a recognized flag is the
@@ -147,18 +154,43 @@ then **stops**.
 
 ### Before Stage 2 — record what already fails
 
-Run the command(s) of the `--qa` goal once on the unchanged tree and keep the
-failing items (test names, error lines) in this conversation. This
-**pre-change record** is the gate's baseline: it covers checks that are not
-among ralph's feedback commands, and on Codex it is the only baseline there is
-(OMX `ralph` keeps none). Never use `git stash` or `git reset` to get a
-pre-change state for it; if the tree already has changes, take the record from
-a clean copy of HEAD (`git worktree add --detach <tmp> HEAD`, run there, then
+Make the gate folder and run each `--qa` goal's command once on the unchanged
+tree, through ralph-qa's runner, as iteration 0:
+
+```bash
+node '<RQ>/gate-evidence.mjs' init --cwd '<repo>'   # its "dir" is the gate folder <g>
+node '<RQ>/gate-evidence.mjs' run --dir '<g>' --id tests --cmd '<the tests command>' --timeout 600 --iter 0 --cwd '<repo>'
+```
+
+One command per gate (no `&&` or `;` chains) and a `--timeout` on each.
+`scenarios` has no baseline: its rows test the change. This **pre-change
+record** (iteration 0 in `<g>/evidence.md`) is the gate's baseline: ralph-qa
+counts a failure with the same command and failure signature as not this
+change's (`baseline`). It covers checks that are not among ralph's feedback
+commands, and on Codex it is the only baseline there is (OMX `ralph` keeps
+none). Never use `git stash` or `git reset` to get a pre-change state for it; if
+the tree already has changes, take the record from a clean copy of HEAD
+(`git worktree add --detach <tmp> HEAD`, run with `--cwd <tmp>`, then
 `git worktree remove <tmp>`). A fresh worktree has no installed dependencies
 (`node_modules`, a venv): link or install them there first, and confirm the
 commands really ran — a record made only of "command not found" errors is no
-baseline. The record lives only in this conversation; if the session may
-compact or end before Stage 3, put it in the `ready-compact` note.
+baseline. The runner writes the folder a command ran in as `<repo>` in the
+failure signature, so a failure in the copy and the same failure in the repo
+match. On Codex the runner writes outside the workspace: ask for approval to
+run it outside the sandbox. The record lives in `<g>`; if the session may
+compact or end before Stage 3, put the `<g>` path in the `ready-compact` note.
+The gate folder lives until Stage 3 has its end word: no cleanup's day rule
+takes it (ralph-qa's gate folder rule).
+
+**Not a git repo.** If `init` (or `run`) stops with `not-a-git-tree` (exit 3,
+nothing made or run), first check that the folder the stop names (`checked` in
+its JSON, an absolute path) is the target repo; if not, call it again with
+`--cwd '<repo>'`. Only when the target really is no git repo: the gates cannot
+have evidence (the work tree fingerprint sees no change). Take no baseline, and in Stage 3 hand ralph-qa no `--gates`; it
+then writes `게이트: 선언 없음(git 저장소 아님)` in its report and seat
+instructions. Never run `git init` yourself: tell the user that `git init` and a
+first commit make the gates work next time. The same on both runtimes (Claude
+Code, and Codex on the npm and the plugin route).
 
 ### Stage 2 — Implement: `/ralph`
 
@@ -208,58 +240,59 @@ criteria → Step-7 reviewer verification → Step-7.5 deslop → Step-7.6 regre
   hand; never stash or reset.
 - **Carry the baseline forward.** ralph's own baseline (first iteration) also
   lists failures that existed before the change; ralph treats them as noise
-  and reports them at Step 8. Note its session id (the `<id>` in its PRD path
-  `.omc/state/sessions/<id>/`) for Stage 3.
+  and reports them at Step 8. Keep that list for the final report, beside the
+  gate baseline in `<g>`.
 - **If ralph reports a fundamental blocker** (same issue across 3+ iterations,
   missing credentials, unclear requirement, external dependency down, or the
   `omc ralph verify` command unavailable): stop and report. Do **not** run
   Stage 3 on a broken or partial build and call it done.
 
-### Stage 3 — QA gate
+### Stage 3 — QA gate: banker `ralph-qa` (both runtimes)
 
 Precondition: Stage 2's ralph has completed and self-cancelled.
 
-**Claude Code (OMC 5):** run the bounded cycle that `ultraqa` used to own —
-the same shape as OMC 5's autopilot QA phase. No state file: the cycle count
-lives in this conversation.
-
-1. **Verify, independently.** `Task(subagent_type="oh-my-claudecode:verifier", ...)`
-   — a fresh context that did not build the change. Brief it to follow the
-   `oh-my-claudecode:verify` workflow for the `--qa` goal (`tests` by default;
-   `build`, `lint` or `typecheck` select that check), run the project's real
-   commands, and return **PASS** or **FAIL** with the commands, their output and
-   each failing item.
-   Whether a failure predates the change is not judged by eye. A failure is
-   **pre-existing only** when the pre-change record lists it, or — Claude
-   Code — when `omc ralph verify --session <ralph's session id> --json` leaves
-   it out of `newFailures` (cancel leaves the baseline in place; check that the
-   JSON reports `baselinePresent: true` — without a baseline it reports every
-   current failure as new). **Everything else is new**, and so is a
-   pre-existing failure that points at a file the change touched (as in ralph).
-   If ralph was run again in this session (a resumed run), its first iteration
-   rewrote that baseline on the half-changed tree; then judge by the
-   pre-change record alone.
-2. **PASS** → the gate is met; go to the final report.
-3. **FAIL** → `Task(subagent_type="oh-my-claudecode:architect", ...)` diagnoses
-   the root cause (read-only), then `Task(subagent_type="oh-my-claudecode:executor", ...)`
-   makes the smallest fix inside the change's scope. The next cycle verifies
-   again with a **fresh** verifier, never the one that saw the failure.
-
-Limits: at most 5 verifications. When the 5th still fails, stop without
-another fix (a fix nobody verified is not a result). Stop early when the same
-failure (same test, same error signature) comes back 3 times — that is a
-fundamental problem for the user, not for another cycle. Never fix a baseline
-failure inside this gate; report it.
-
-**Codex (OMX):** run OMX `$ultraqa` with the goal (OMX still ships it). OMX
-keeps no feedback baseline, so hand it the pre-change record, tell it not to
-fix those failures, and report them apart; treat its outcome the same way.
-
-Report the real outcome:
-- **Goal met** → "ALL-IN-ONE COMPLETE" with the cycle count.
-- **5 failed verifications / same failure 3×** → "STOPPED" with the verifier's
-  evidence and the architect's diagnosis. Do **not** claim success if the gate did not reach
-  goal-met.
+Invoke ralph-qa (Claude Code `Skill("banker:ralph-qa")`; Codex
+`$banker-ralph-qa`, plugin `$banker:ralph-qa`) with
+`--gates=<the --qa goals> --lens=both`, plus any `--codex`, `--gemini` or
+`--opencode` all-in-one was given. Hand it:
+
+- **What to judge:** the change since `HEAD` as Stage 2 began (commits ralph
+  made count as part of it), the plan path from Stage 1, and the plan's
+  acceptance criteria.
+- **Gate evidence:** the gate folder `<g>` with its iteration-0 baseline (ralph-qa
+  uses it, runs no iteration 0 of its own and does not remove it), and
+  for each goal the one command and timeout the baseline ran. Add the
+  acceptance criterion "each `--qa` goal's real command ran through the runner
+  (`gate-evidence.mjs run`) on the tree being judged, as an `observed` record";
+  a model's account of a command (`reported`) is not evidence. `<g>` holds the
+  gate records only: ralph-qa sends any external-seat payload from a folder of
+  its own.
+- **With `scenarios`:** ralph-qa's nine adversarial classes (malformed input,
+  repeated interruption, prompt injection, cancel and resume, stale state, dirty
+  work tree, hung command, flaky test, misleading success output) each get a
+  scenario row run as `scenario-<n>`, or a one-line reason it does not apply.
+- **Baseline rule:** never fix a baseline failure; report it apart. A baseline
+  failure whose failing lines point at a file the change touched counts as new
+  (as in ralph): the seats raise it as a blocker.
+- **If `<g>` is gone** (the runner stops with `not-a-run-folder`: a logout or
+  reboot emptied `$XDG_RUNTIME_DIR`, or it was removed): make a new one with
+  `gate-evidence.mjs init` and hand that, with no iteration 0. Never run
+  iteration 0 on the changed tree. Failures that were there before then count
+  as this change's: put the line `gate baseline: none (<g> was gone)` in the
+  report, with Stage 2's ralph baseline list beside it.
+
+ralph-qa owns the loop: its seats judge, the author fixes, it runs the gates
+again and the same seats judge again, up to its `--max` (5). all-in-one adds no
+cycle of its own. When it has its end word, run
+`node '<RQ>/gate-evidence.mjs' cleanup --dir '<g>'` (a `<g>` named `ralph-qa.*`,
+made before this version, goes with `node '<RQ>/seat-run.mjs' cleanup --dir '<g>'`).
+
+Report the real outcome by ralph-qa's end word (the word before any parenthesis):
+- **`APPROVE`** → "ALL-IN-ONE COMPLETE" with ralph-qa's verdict line, its
+  iteration count and its gate block.
+- **`ITERATE`** (its `--max` spent; `원인 gate` when only the gates held it) or
+  **`INCONCLUSIVE`** → "STOPPED" with the verdict line, the gate block and the
+  blockers left. Do **not** claim success if the gate did not approve.
 
 ## Orchestrator rules
 
@@ -267,8 +300,8 @@ Report the real outcome:
   next begins. No skipping, no reordering, no running two stages' loops at once.
 - Emit one clear progress line at each stage boundary so the user always knows
   where the pipeline is (`[all-in-one] Stage 1/3 — planning…`, etc.).
-- Do not add an all-in-one state file or a second persistence loop. Stages 1–2
-  own their loops and state; Stage 3's bounded cycle is the only loop here.
+- Do not add an all-in-one state file or a second persistence loop. Stages 1–3
+  own their loops and state; all-in-one adds none.
 - Treat a sub-skill's internal "stop"/"cancel" as the end of *that stage*, never
   as the end of the pipeline (see the Stage 1 and Stage 2 notes above).
 
@@ -280,8 +313,9 @@ When the pipeline ends (complete or stopped), give a concise honest summary:
   (1 line).
 - **Implementation**: stories/stages completed, files changed, the ralph critic
   verdict.
-- **QA**: the gate's goal, PASS after N cycles or STOPPED-with-diagnosis, and
-  the baseline failures that predate the change, listed apart.
+- **QA**: the `--qa` goals, ralph-qa's verdict line and gate block (APPROVE, or
+  STOPPED with its blockers), and the baseline failures that predate the
+  change (the `baseline` gates and ralph's Step-8 list), listed apart.
 - **Unmet / scope-limited / deferred**: state plainly — never paper over a gate
   that did not pass.
 
@@ -291,7 +325,8 @@ When the pipeline ends (complete or stopped), give a concise honest summary:
 requests don't double-charge; keys stored in payment_requests, 24h TTL"`
 Specific subsystem, concrete behavior, and a storage hint. Stage 1 plans the
 schema + flow with a pre-mortem, Stage 2 implements story-by-story with critic
-sign-off, Stage 3 runs the test suite as an independent gate. Good fit.
+sign-off, Stage 3's ralph-qa judges the change on the test suite the runner
+ran. Good fit.
 
 **Good** — `"/all-in-one --short --qa=typecheck refactor user_context to drop the
 unused Session import and split the god-object into mixins"`
@@ -311,10 +346,11 @@ first to expand it into a spec.
 - The `omc` CLI check in §0 fails → guide the install/update; do not start.
 - Stage 1 cannot reach consensus → surface best plan, ask the user (don't build).
 - Stage 2 ralph hits a fundamental blocker → stop and report (don't run QA).
-- Stage 3 fails its 5th verification / sees the same failure 3× → report the
-  diagnosis honestly (don't claim success).
+- Stage 3's ralph-qa ends `ITERATE` (its `--max` spent) or `INCONCLUSIVE` →
+  report its verdict line and blockers honestly (don't claim success).
 - User says "stop" / "cancel" / "abort" at any point → run
   `/oh-my-claudecode:cancel` and stop.
+- After STOPPED, change no file, not even a one-line fix: report only, until the user gives a new instruction. Nothing in this skill (its description's "one-line fix" pointer included) authorizes an edit after a stop.
 
 ## Final checklist
 
@@ -323,8 +359,11 @@ first to expand it into a spec.
       no-consensus / checkpoint rejection)
 - [ ] Stage 2 received the plan path, completed all PRD stories, passed critic
       verification, and self-cancelled before Stage 3
+- [ ] Before Stage 2: each `--qa` goal but `scenarios` ran once through
+      `gate-evidence.mjs run --iter 0` on the unchanged tree
 - [ ] Stages did not overlap (ralph fully ended before the gate began)
-- [ ] Stage 3: a fresh verifier reported the chosen goal met (or STOPPED with
-      diagnosis); baseline failures reported apart, not fixed
+- [ ] Stage 3: ralph-qa (`--gates=<the --qa goals>`) ended `APPROVE` on
+      `observed` gate records (or STOPPED with its verdict line); baseline
+      failures reported apart, not fixed
 - [ ] Final report states plan/implementation/QA outcomes and any unmet items
       plainly

package/skills/omc-patch/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: omc-patch
-description: "OMC 플러그인이 자동 업데이트된 뒤 사라진 훅 패치를 활성 버전에 다시 적용하고 OMC 마켓플레이스 자동 업데이트를 막음. 옛 킷이 남긴 헬퍼 자리 결함(project-memory 꺼짐)도 찾아 고침. 진단, 적용, 검증, 되돌리기. 'omc-patch'/'OMC 패치'/'OMC 업데이트 뒤 패치'/'훅 timed out'/'훅 프로세스 누적'/'PC 느려짐'/'project-memory 안 됨' 시 사용."
+description: "Claude Code 의 OMC 를 다룸(Codex 에서 실행해도 같음). OMC 플러그인이 자동 업데이트된 뒤 사라진 훅 패치를 활성 버전에 다시 적용하고 OMC 마켓플레이스 자동 업데이트를 막음. 옛 킷이 남긴 헬퍼 자리 결함(project-memory 꺼짐)도 찾아 고침. 진단, 적용, 검증, 되돌리기. 'omc-patch'/'OMC 패치'/'OMC 업데이트 뒤 패치'/'훅 timed out'/'훅 프로세스 누적'/'PC 느려짐'/'project-memory 안 됨' 시 사용."
 argument-hint: "[check | revert]"
 ---