@kody-ade/kody-engine 0.4.206 → 0.4.207-next.1

package/README.md

@@ -8,8 +8,8 @@
 **An autonomous development engine that runs in your GitHub Actions.**
 
 Comment `@kody` on an issue and it implements the change, commits, and opens a
-PR — all inside CI, no bot server to host. Comment on a PR to apply review
-feedback, fix failing CI, resolve merge conflicts, or run a UI/QA pass. It's a
+PR — all inside CI, no bot server to host. Comment on a PR with explicit
+commands such as `@kody resolve` or `@kody sync` for PR maintenance. It's a
 single-session Claude Code agent behind a generic executor and declarative JSON
 profiles.
 
@@ -26,8 +26,8 @@ kody:  reads the issue → writes the code → runs your tests → opens a PR
 
 - **No infrastructure.** Runs on the GitHub Actions you already have. One ~20-line
   workflow file, installed via `npx`. Nothing to deploy or keep online.
-- **Whole PR lifecycle, not just authoring.** `run`, `fix`, `fix-ci`, `resolve`,
-  `review`, `ui-review`, `qa-engineer`, scheduled jobs — one agent, many verbs.
+- **Whole PR lifecycle, not just authoring.** `run`, `resolve`, `sync`, `merge`,
+  `revert`, previews, releases, and scheduled duties — one executor, many verbs.
 - **Declarative & extensible.** Every command is a folder of `profile.json` +
   `prompt.md` + shell. Add a command by dropping a folder — no engine changes.
 - **Bring your own model.** Anthropic native, or any provider via the built-in
@@ -68,7 +68,7 @@ See [SECURITY.md](SECURITY.md) to report a vulnerability.
 
 ```
 ┌─────────────────────────────────────────────┐
-│ Consumer repo workflow (.github/kody.yml)  │  @kody comments · schedule · release PR merge
+│ Consumer repo workflow (.github/kody.yml)  │  @kody comments · schedule · manual dispatch
 └─────────────────────────────────────────────┘
                     ↓
 ┌─────────────────────────────────────────────┐
@@ -96,181 +96,58 @@ npx -y -p @kody-ade/kody-engine@latest kody init
 
 Required repo secrets: at least one model provider key (e.g. `MINIMAX_API_KEY`, `ANTHROPIC_API_KEY`). Recommended: `KODY_TOKEN` PAT so kody's commits trigger downstream CI and can modify `.github/workflows/*`.
 
-The consumer workflow listens on three triggers: `issue_comment` (for `@kody …` dispatch), `workflow_dispatch` (manual runs, chat mode, job wake), and `pull_request: [closed]` (auto-finalizes a merged `release/vX.Y.Z` PR).
+The consumer workflow listens on `issue_comment` for `@kody ...` dispatch and `workflow_dispatch` for manual runs, chat mode, and scheduled wakeups.
 
 ## Commands
 
 ```
-# agent, writes code
-kody run       --issue <N>                             # implement an issue end-to-end
-kody fix       --pr    <N> [--feedback ...]            # apply PR review feedback
-kody fix-ci    --pr    <N> [--run-id <ID>]             # fix failing CI
-kody resolve   --pr    <N> [--prefer ours|theirs]      # merge default branch, resolve conflicts
-
-# agent, read-only
-kody plan      --issue <N>                             # research + implementation plan
-kody research  --issue <N>                             # map repo context, surface gaps
-kody review    --pr    <N>                             # structured diff review
-kody ui-review --pr    <N> [--preview-url <URL>]       # UI review — browses preview via Playwright MCP
-kody qa-engineer [--url <URL>] [--scope ...]           # free-form QA — browses, opens findings as goal task issues
-               [--goal <id>] [--issue <N>]
-               [--auth-profile <storageState.json>]
-kody classify  --issue <N>                             # pick a flow type (feature/bug/spec/chore)
-
-# flow orchestrators (no agent of their own — transition tables)
-kody feature   --issue <N>                             # research → plan → run → review (→ fix)
-kody bug       --issue <N>                             # plan → run → review (→ fix)
-kody spec      --issue <N>                             # research → plan (no code, terminates at plan)
-kody chore     --issue <N>                             # run → review (→ fix)
-
-# jobs & watches (scheduled, coordinate work via issue state)
-kody job-scheduler                                 # fans out to per-issue job-tick
-kody job-tick      --issue <N>                     # one tick of a kody:job issue
-kody watch-stale-prs                                   # weekly stale-PR report
-kody memorize                                          # daily vault wiki update from recent PRs
-
-# deterministic (no agent)
-kody sync      --pr    <N>                             # merge default into PR branch
-kody release   --mode  prepare|finalize [--bump patch|minor|major] [--dry-run]
-kody init      [--force]                               # scaffold consumer repo
-
-# engine entrypoints
-kody ci                                                # auto-dispatches from the GHA event
-kody chat      [--session <id>]                        # dashboard-driven chat session
-```
-
-### Flow orchestrators
-
-Each flow (`feature`, `bug`, `spec`, `chore`) is a declarative transition table: postflight entries dispatch the next executable based on `data.taskState.core.lastOutcome.type` via `runWhen`. No engine changes to add a new flow — drop a new `src/executables/<flow-name>/` with a different table. `classify` picks the flow for an unlabeled issue.
-
-### Jobs
-
-A **job** is a stateful, bounded goal expressed as a labeled GitHub issue (`kody:job`). A **watch** is a stateless repeating loop. A **manager** is a job whose job happens to be overseeing other jobs. All three run on the same scheduled-executable substrate.
-
-`job-scheduler` wakes on cron (default `*/5 * * * *`) or empty `workflow_dispatch`, finds every open `kody:job` issue, and calls `job-tick` once per issue. The tick agent reads the issue body (human-owned prose) and a dedicated state comment (bot-owned JSON), decides the next step, and emits a fenced `kody-job-next-state` block the postflight persists. Children are spawned via `gh workflow run kody.yml` (not `@kody` comments — the default `GITHUB_TOKEN` can dispatch workflows but can't post auto-triggering comments).
-
-**Locked-toolbox jobs** (v0.4.175). A job file can add `tools: [...]` to its frontmatter to run the tick in a *locked toolbox*: the agent gets only those named tools (as `mcp__kody-duty__<name>`) plus `submit_state` — `Bash` and `Read` are revoked entirely. This removes the escape hatch where a job posted a raw `@kody <verb>` comment that the webhook silently drops for bot authors, so the job looked done while its verb never ran. The in-process kody-duty MCP server exposes high-level intents instead — `list_prs_to_repair`, `sync_pr` / `fix_ci_pr` / `resolve_pr` (each dispatches the matching `workflow_dispatch`, never a comment), `recommend_to_operator`, and `read_ledger`. Jobs without `tools:` keep the full Bash/gh toolbox unchanged.
-
-### `ui-review`
-
-PR-bound UI review. Drives the running preview deployment via the Playwright MCP server alongside the usual diff review, posts one structured review comment.
-
-- Preview URL: `--preview-url` → `$PREVIEW_URL` → `http://localhost:3000`. Unreachable → falls back to diff-only.
-- Credentials: dashboard-managed, per-repo — login username from the `LOGIN_USER` variable (`.kody/variables.json`), password from the `LOGIN_PASSWORD` vault secret (`.kody/secrets.enc`). Hand-written scenarios/notes come from the company profile (`.kody/profile/*.md`).
-- Auto-discovery: routes, roles, login/admin paths, Payload CMS collections, API routes, env vars — fed to the agent as context.
-
-For free-form QA passes (no diff, no PR), see [`qa-engineer`](#qa-engineer) below.
+# The published bin is `kody-engine` (renamed from `kody` in v0.4.77 to avoid
+# shadowing a consumer repo's own `kody` bin). Install globally or via `npx`.
 
-### `qa-engineer`
+# issue authoring
+kody-engine run               --issue <N>                     # implement an issue end-to-end
 
-Free-form QA pass. Browses a running site with Playwright MCP, exercises UI states (happy / empty / error / loading / mobile / a11y), and turns findings into a kody goal whose tasks are individually triageable, severity-labelled bug issues. Read-only on the repo (no commits except the goal's own `state.json`).
+# PR operations
+kody-engine resolve           --pr <N> [--prefer ours|theirs] # merge default branch, resolve conflicts
+kody-engine sync              --pr <N>                         # merge default into a PR branch
+kody-engine merge             --pr <N>                         # merge a green PR
+kody-engine revert            --pr <N> --shas <sha...>         # mechanically revert PR commits
+kody-engine preview-build     --pr <N>                         # build and publish a PR preview
 
-```bash
-# broad smoke against the project's QA_URL variable
-kody qa-engineer
-
-# focused pass; opens a new qa-<scope>-<date> goal + N task issues
-kody qa-engineer --scope "checkout flow"
-
-# attach findings to an existing goal (resolves URL from goal-<id>'s Vercel deployment)
-kody qa-engineer --goal admin-chat-memory-recall-ui
+# release operations
+kody-engine release           --issue <N> [--bump patch|minor|major] [--dry-run]
+kody-engine release-prepare   --issue <N> [--bump patch|minor|major] [--dry-run]
+kody-engine release-publish   --issue <N> [--dry-run]
+kody-engine release-deploy    --issue <N> [--dry-run]
 
-# explicit URL overrides everything; useful for testing a deployed PR preview
-kody qa-engineer --url https://my-feature-branch.vercel.app --scope "search UX"
+# scheduled duties and goals
+kody-engine job-scheduler                                     # fan out due .kody/duties/*.md files
+kody-engine job-tick          --job <slug> [--force]          # one agent tick for one duty
+kody-engine job-tick-scripted --job <slug> [--force]          # one deterministic tickScript duty tick
+kody-engine goal-scheduler                                    # fan out active .kody/goals/* state files
+kody-engine goal-tick         --goal <id>                     # advance one stacked-PR goal
 
-# pre-authenticated session via committed Playwright storageState
-kody qa-engineer --scope "admin" --auth-profile .kody/qa-storage-state.json
-
-# PASS verdicts (no findings) skip goal creation; --issue routes the report to a comment
-kody qa-engineer --scope "smoke" --issue 1234
+# setup, servers, and utilities
+kody-engine init              [--force]                       # scaffold consumer repo
+kody-engine ci                                                # auto-dispatch from the GitHub Actions event
+kody-engine chat              [--session <id>]                # dashboard-driven chat session
+kody-engine serve                                             # LiteLLM/editor helper
+kody-engine brain-serve                                       # Brain SSE server
+kody-engine pool-serve                                        # warm-pool owner
+kody-engine runner-serve                                      # warm-pool one-shot runner
+kody-engine worker-ask        --worker <slug> --message "..." # ad-hoc staff persona run
+kody-engine stats                                             # inspect run/event history
 ```
 
-**URL resolution chain.** `resolveQaUrl` walks the chain in order; first non-empty source wins:
-
-1. `--url <URL>` — explicit
-2. `--goal <id>` → latest successful Vercel deployment for the `goal-<id>` branch (via `repos/.../deployments?ref=goal-<id>` + statuses)
-3. `$PREVIEW_URL` env var
-4. `QA_URL` variable in `.kody/variables.json` (per-repo, dashboard-managed)
-5. error — no localhost defaults; CI has no localhost to fall back to.
-
-Configure the per-repo default via the dashboard's variables store (`.kody/variables.json`), key `QA_URL` — e.g. `https://dev.example.com`.
+### Duties
 
-**Output modes.**
+A **duty** is a markdown file at `.kody/duties/<slug>.md` with frontmatter such as `every:` and `staff:` plus human-owned prose. `job-scheduler` wakes on cron, finds due duties, and dispatches either `job-tick` for an agent tick or `job-tick-scripted` for a deterministic `tickScript:` duty. `kody init` copies built-in starter duties and scaffolds `.kody/staff/kody.md`.
 
-| Trigger | What happens |
-|---|---|
-| Findings + no `--goal` | Appends a new `qa-<scope>-<date>` entry to the `kody:goals-manifest` issue (description = full report markdown). Opens N task issues, each labelled `goal:<id>` + `severity:Px` + `kody:qa-finding`. Writes `.kody/goals/<id>/state.json` (state: `active`) and pushes — `goal-scheduler` picks it up next tick. |
-| Findings + `--goal <id>` | Skips manifest body mutation (the existing goal owns its description). Posts the report markdown as a comment on the manifest issue. Opens N task issues with `goal:<id>` labels. |
-| Zero findings + `--issue <N>` | Posts the report as a comment on issue N. No goal touched. |
-| Zero findings + no `--issue` | Opens a single `kody:qa-finding`-labelled record issue with the full report body. |
-
-**Agent-emitted JSON contract.** The prompt requires the agent's final message to end with a machine-readable block:
-
-```
-<!-- KODY_QA_REPORT_JSON
-```json
-{
-  "findings": [
-    {
-      "severity": "P0|P1|P2|P3",
-      "title": "Short imperative — becomes the issue title",
-      "route": "/admin/...",
-      "steps": "1. ...\n2. ...",
-      "expected": "...",
-      "actual": "...",
-      "evidence": ".kody/qa-reports/<scope>/<finding>.png"
-    }
-  ]
-}
-```
--->
-```
-
-If the block is missing or malformed, the postflight falls back to single-issue mode and logs a warning. Severity rubric: P0 blocks core flow / data loss / security → verdict FAIL; P1 broken non-critical feature → typically FAIL; P2 degraded UX → typically CONCERNS; P3 polish → doesn't affect verdict.
-
-**GHA usage.** Trigger from any issue comment (auto-dispatched by the existing kody.yml workflow):
-
-```
-@kody qa-engineer --goal add-per-user-chat-memory-recall-ui --scope "memory recall UI"
-```
-
-…or via `workflow_dispatch`:
-
-```bash
-gh workflow run kody.yml -F executable=qa-engineer \
-  -F args="--goal admin-chat-memory-recall-ui --scope 'admin chat'"
-```
-
-**Auto-discovery & credentials.** Same as `ui-review`: `discoverQaContext` scans the repo for routes/roles/admin path/Payload collections/env vars; `loadQaContext` reads the dashboard-managed login username (`LOGIN_USER` variable), password (`LOGIN_PASSWORD` vault secret), and hand-written scenarios/notes (`.kody/profile/*.md`). The agent only logs in if a route under test requires it.
-
-**Artifacts.** Screenshots and DOM snapshots go to `.kody/qa-reports/<scope-slug>/`; the Playwright MCP also writes to `.playwright-mcp/`. Both should be in `.gitignore` and `.prettierignore` — `kody init` doesn't yet scaffold these, add them manually:
-
-```gitignore
-.kody/qa-reports/
-.playwright-mcp/
-```
-
-```
-.kody/**
-.playwright-mcp/**
-```
-
-### `memorize` — vault wiki
-
-A scheduled watch (cron `0 3 * * *`) that synthesizes recently merged PRs into a markdown knowledge base at `.kody/vault/` and opens a PR with the changes. Pages are entity-centric (`architecture/`, `conventions/`, `decisions/`, `components/`), not per-PR logs. Future kody runs see the relevant pages via the `loadVaultContext` preflight, which is wired into `run` / `fix` / `resolve` and exposes them as `{{vaultContext}}` in the prompt.
-
-To enable in a consumer repo: ensure `.gitignore` un-ignores the vault if `.kody/*` is otherwise ignored:
-
-```gitignore
-.kody/*
-!.kody/vault/
-!.kody/vault/**
-```
+Locked-toolbox duties can declare `tools: [...]` to run with only the named high-level MCP intents plus `submit_state`; duties without `tools:` keep the legacy Bash/gh toolbox.
 
 ### `release`
 
-- `--mode prepare` — bumps `package.json`, updates `CHANGELOG.md`, opens a `release/vX.Y.Z` PR. `--bump patch|minor|major` (default `patch`).
-- `--mode finalize` — tags, pushes, runs `prepublishOnly` + `npm publish`, creates a GH release. Runs **automatically** when a `release/vX.Y.Z` PR is merged (via `pull_request: [closed]` in the consumer workflow); manual trigger still works.
+`release` is a single deterministic flow: bump version files, update `CHANGELOG.md`, open or reuse a release PR, wait for CI, merge, publish, deploy, and notify. `release-prepare`, `release-publish`, and `release-deploy` remain available as explicit stage commands.
 
 ## Profiles
 

package/dist/bin/kody.js

@@ -1486,7 +1486,7 @@ var init_loadCoverageRules = __esm({
 // package.json
 var package_default = {
   name: "@kody-ade/kody-engine",
-  version: "0.4.206",
+  version: "0.4.207-next.1",
   description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   license: "MIT",
   type: "module",
@@ -1717,10 +1717,10 @@ function loadConfig(projectDir = process.cwd()) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`kody.config.json is invalid JSON: ${msg}`);
   }
-  const quality = raw.quality ?? {};
-  const git5 = raw.git ?? {};
-  const github = raw.github ?? {};
-  const agent = raw.agent ?? {};
+  const quality = recordValue(raw.quality) ?? {};
+  const git5 = recordValue(raw.git) ?? {};
+  const github = recordValue(raw.github) ?? {};
+  const agent = recordValue(raw.agent) ?? {};
   if (!agent.model || typeof agent.model !== "string") {
     throw new Error(`kody.config.json: agent.model is required (e.g. "minimax/MiniMax-M2.7-highspeed")`);
   }
@@ -1748,7 +1748,7 @@ function loadConfig(projectDir = process.cwd()) {
     issueContext: parseIssueContext(raw.issueContext),
     testRequirements: parseTestRequirements(raw.testRequirements),
     defaultExecutable: typeof raw.defaultExecutable === "string" && raw.defaultExecutable.length > 0 ? raw.defaultExecutable : "run",
-    defaultPrExecutable: typeof raw.defaultPrExecutable === "string" && raw.defaultPrExecutable.length > 0 ? raw.defaultPrExecutable : "fix",
+    defaultPrExecutable: typeof raw.defaultPrExecutable === "string" && raw.defaultPrExecutable.length > 0 ? raw.defaultPrExecutable : void 0,
     onPullRequest: typeof raw.onPullRequest === "string" && raw.onPullRequest.length > 0 ? raw.onPullRequest : void 0,
     aliases: mergeAliases(raw.aliases),
     classify: parseClassifyConfig(raw.classify),
@@ -1811,10 +1811,11 @@ function parseJobsConfig(raw) {
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function recordValue(raw) {
+  return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : void 0;
+}
 var BUILTIN_ALIASES = {
-  build: "run",
-  orchestrate: "bug",
-  orchestrator: "bug"
+  build: "run"
 };
 function mergeAliases(raw) {
   const out = { ...BUILTIN_ALIASES };
@@ -3500,10 +3501,11 @@ function autoDispatch(opts) {
     return null;
   }
   if (eventName === "workflow_dispatch") {
-    const n = parseInt(String(event.inputs?.issue_number ?? ""), 10);
+    const inputs2 = objectValue(event.inputs);
+    const n = parseInt(String(inputs2?.issue_number ?? ""), 10);
     if (!Number.isNaN(n) && n > 0) {
-      const exe = String(event.inputs?.executable ?? "").trim() || "run";
-      const base = String(event.inputs?.base ?? "").trim();
+      const exe = String(inputs2?.executable ?? "").trim() || "run";
+      const base = String(inputs2?.base ?? "").trim();
       const targetKey = primaryNumericInputName(exe) ?? "issue";
       const cliArgs = { [targetKey]: n };
       if (base) cliArgs.base = base;
@@ -3516,7 +3518,8 @@ function autoDispatch(opts) {
     const exe = opts?.config?.onPullRequest?.trim();
     const action = String(event.action ?? "");
     if (exe && (action === "opened" || action === "synchronize" || action === "reopened")) {
-      const prNum = Number(event.pull_request?.number ?? event.number ?? 0);
+      const pullRequest = objectValue(event.pull_request);
+      const prNum = Number(pullRequest?.number ?? event.number ?? 0);
       if (prNum > 0) {
         const targetKey = primaryNumericInputName(exe) ?? "pr";
         return { executable: exe, cliArgs: { [targetKey]: prNum }, target: prNum };
@@ -3525,15 +3528,18 @@ function autoDispatch(opts) {
     return null;
   }
   if (eventName !== "issue_comment") return null;
-  const rawBody = String(event.comment?.body ?? "");
-  const authorLogin = String(event.comment?.user?.login ?? "");
-  const authorType = String(event.comment?.user?.type ?? "");
+  const comment = objectValue(event.comment);
+  const issue = objectValue(event.issue);
+  const user = objectValue(comment?.user);
+  const rawBody = String(comment?.body ?? "");
+  const authorLogin = String(user?.login ?? "");
+  const authorType = String(user?.type ?? "");
   if (!hasKodyMention(rawBody)) return null;
   const isBotAuthor = authorLogin === "kody-bot" || authorType === "Bot";
   if (!associationAllowed(event, opts?.config)) return null;
   const body = rawBody.toLowerCase();
-  const targetNum = Number(event.issue?.number ?? 0);
-  const isPr = !!event.issue?.pull_request;
+  const targetNum = Number(issue?.number ?? 0);
+  const isPr = !!issue?.pull_request;
   if (!targetNum) return null;
   const afterTag = extractAfterTag(body);
   const firstTokenRaw = extractSubcommand(afterTag);
@@ -3554,7 +3560,7 @@ function autoDispatch(opts) {
     }
   }
   if (!executable && !firstToken) {
-    executable = isPr ? opts?.config?.defaultPrExecutable ?? "fix" : opts?.config?.defaultExecutable ?? null;
+    executable = isPr ? opts?.config?.defaultPrExecutable ?? null : opts?.config?.defaultExecutable ?? null;
   }
   if (isBotAuthor && !consumedFirstToken) {
     process.stderr.write(
@@ -3564,9 +3570,10 @@ function autoDispatch(opts) {
     return null;
   }
   if (!executable) {
+    if (!firstToken) return null;
     const profileMissing = aliased ? getProfileInputs(aliased) === null : true;
     process.stderr.write(
-      `[kody] dispatch: no executable resolved for issue_comment (firstToken=${firstToken ?? "<none>"}, aliased=${aliased ?? "<none>"}, profileFound=${!profileMissing}, defaultExecutable=${opts?.config?.defaultExecutable ?? "<unset>"})
+      `[kody] dispatch: no executable resolved for issue_comment (firstToken=${firstToken ?? "<none>"}, aliased=${aliased ?? "<none>"}, profileFound=${!profileMissing}, defaultExecutable=${opts?.config?.defaultExecutable ?? "<unset>"}, defaultPrExecutable=${opts?.config?.defaultPrExecutable ?? "<unset>"})
 `
     );
     return null;
@@ -3604,9 +3611,12 @@ function autoDispatchTyped(opts) {
   } catch {
     return { kind: "silent", reason: "GHA event payload unreadable" };
   }
-  const rawBody = String(event.comment?.body ?? "");
-  const authorLogin = String(event.comment?.user?.login ?? "");
-  const authorType = String(event.comment?.user?.type ?? "");
+  const comment = objectValue(event.comment);
+  const issue = objectValue(event.issue);
+  const user = objectValue(comment?.user);
+  const rawBody = String(comment?.body ?? "");
+  const authorLogin = String(user?.login ?? "");
+  const authorType = String(user?.type ?? "");
   if (!hasKodyMention(rawBody)) {
     return { kind: "silent", reason: "comment does not mention @kody" };
   }
@@ -3614,11 +3624,11 @@ function autoDispatchTyped(opts) {
     return { kind: "silent", reason: `bot-authored comment (${authorLogin || authorType})` };
   }
   if (!associationAllowed(event, opts?.config)) {
-    const assoc = String(event.comment?.author_association ?? "").toUpperCase() || "<none>";
+    const assoc = String(comment?.author_association ?? "").toUpperCase() || "<none>";
     return { kind: "silent", reason: `commenter association '${assoc}' not in access.allowedAssociations` };
   }
-  const targetNum = Number(event.issue?.number ?? 0);
-  const isPr = !!event.issue?.pull_request;
+  const targetNum = Number(issue?.number ?? 0);
+  const isPr = !!issue?.pull_request;
   if (!targetNum) {
     return { kind: "silent", reason: "comment has no associated issue/PR number" };
   }
@@ -3674,9 +3684,13 @@ function dispatchScheduledWatches(opts) {
 function associationAllowed(event, config) {
   const allowed = config?.access?.allowedAssociations;
   if (!allowed || allowed.length === 0) return true;
-  const assoc = String(event.comment?.author_association ?? "").toUpperCase();
+  const comment = objectValue(event.comment);
+  const assoc = String(comment?.author_association ?? "").toUpperCase();
   return allowed.includes(assoc);
 }
+function objectValue(value) {
+  return value && typeof value === "object" ? value : void 0;
+}
 var KODY_MENTION_RE = /(?:^|\s)@kody(?=\s|$|[^\w-])/i;
 function hasKodyMention(body) {
   return KODY_MENTION_RE.test(body);
@@ -5195,17 +5209,32 @@ function generateLitellmConfigYaml(model) {
     ""
   ].join("\n");
 }
+function litellmImportable() {
+  try {
+    execFileSync6("python3", ["-c", "import litellm"], { timeout: 1e4, stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveLitellmCommand() {
   try {
     execFileSync6("which", ["litellm"], { timeout: 3e3, stdio: "pipe" });
     return "litellm";
   } catch {
-    try {
-      execFileSync6("python3", ["-c", "import litellm"], { timeout: 1e4, stdio: "pipe" });
-      return "python3";
-    } catch {
-      throw new Error("litellm not installed \u2014 run: pip install 'litellm[proxy]'");
+    if (litellmImportable()) return "python3";
+    process.stderr.write("\u2192 kody: litellm not found \u2014 installing (pip install 'litellm[proxy]')\n");
+    let installed = false;
+    for (const pip of ["pip", "pip3"]) {
+      try {
+        execFileSync6(pip, ["install", "litellm[proxy]"], { timeout: 3e5, stdio: "inherit" });
+        installed = true;
+        break;
+      } catch {
+      }
     }
+    if (installed && litellmImportable()) return "python3";
+    throw new Error("litellm not installed and auto-install failed \u2014 run: pip install 'litellm[proxy]'");
   }
 }
 async function startLitellmIfNeeded(model, projectDir, url = LITELLM_DEFAULT_URL) {
@@ -9539,7 +9568,6 @@ jobs:
     if: >-
       \${{ github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'issue_comment' &&
-            !github.event.issue.pull_request &&
             contains(github.event.comment.body, '@kody')) }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -9564,7 +9592,14 @@ jobs:
 
       - env:
           ALL_SECRETS: \${{ toJSON(secrets) }}
-        run: npx -y -p @kody-ade/kody-engine@latest kody-engine ci --issue \${{ github.event.inputs.issue_number || github.event.issue.number }}
+        run: npx -y -p @kody-ade/kody-engine@latest kody-engine ci
+`;
+var DEFAULT_STAFF_PERSONA = `# Kody
+
+You are Kody, the default maintenance staff member for scheduled duties.
+
+Keep actions narrow, prefer read-only inspection, and only use the tools or commands named by the duty.
+When a duty writes a report or dispatches work, keep the output factual and concise.
 `;
 function defaultBranchFromGit(cwd) {
   try {
@@ -9625,6 +9660,15 @@ function performInit(cwd, force) {
       wrote.push(rel);
     }
   }
+  const staffDir = path28.join(cwd, ".kody", "staff");
+  const staffPath = path28.join(staffDir, "kody.md");
+  if (fs31.existsSync(staffPath) && !force) {
+    skipped.push(".kody/staff/kody.md");
+  } else {
+    fs31.mkdirSync(staffDir, { recursive: true });
+    fs31.writeFileSync(staffPath, DEFAULT_STAFF_PERSONA);
+    wrote.push(".kody/staff/kody.md");
+  }
   for (const exe of listExecutables()) {
     let profile;
     try {
@@ -9676,6 +9720,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
       - env:
           GH_TOKEN: \${{ secrets.KODY_TOKEN || github.token }}
         run: npx -y -p @kody-ade/kody-engine@latest kody-engine ${name}
@@ -13306,6 +13353,23 @@ var allScriptNames = /* @__PURE__ */ new Set([
 import * as fs39 from "fs";
 import * as path36 from "path";
 var DEFAULT_STAFF_DIR = ".kody/staff";
+var BUILTIN_PERSONAS = {
+  kody: [
+    "You are **kody**, the repository's autonomous engineer.",
+    "",
+    "- You work the way this repo already works: follow its conventions, its",
+    "  existing patterns, and its tests. Read before you write.",
+    "- You ship small, correct, reviewable changes. You don't refactor beyond the",
+    "  task, and you don't add scope nobody asked for.",
+    "- You are honest about outcomes: if something failed, didn't run, or you're",
+    "  unsure, you say so plainly rather than papering over it.",
+    "- The request that triggered you IS your authorization to do the work:",
+    "  opening a PR, pushing commits, and commenting are exactly what you're for \u2014",
+    "  do them without waiting for extra approval.",
+    "- You still don't weaken security, delete work you didn't create, or take",
+    "  destructive actions beyond the task you were given."
+  ].join("\n")
+};
 function stripFrontmatter(raw) {
   const match = /^---\n[\s\S]*?\n---\n?([\s\S]*)$/.exec(raw);
   return (match ? match[1] : raw).trim();
@@ -13314,12 +13378,16 @@ function loadStaffPersona(cwd, slug, staffDir = DEFAULT_STAFF_DIR) {
   const trimmed = slug.trim();
   if (!trimmed) throw new Error("loadStaffPersona: empty staff slug");
   const staffPath = path36.join(cwd, staffDir, `${trimmed}.md`);
-  if (!fs39.existsSync(staffPath)) {
-    throw new Error(`loadStaffPersona: staff '${trimmed}' declared but ${staffPath} does not exist`);
+  if (fs39.existsSync(staffPath)) {
+    const body = stripFrontmatter(fs39.readFileSync(staffPath, "utf-8"));
+    if (body) return body;
+    const builtinForEmpty = BUILTIN_PERSONAS[trimmed];
+    if (builtinForEmpty) return builtinForEmpty;
+    throw new Error(`loadStaffPersona: staff '${trimmed}' persona body is empty (${staffPath})`);
   }
-  const body = stripFrontmatter(fs39.readFileSync(staffPath, "utf-8"));
-  if (!body) throw new Error(`loadStaffPersona: staff '${trimmed}' persona body is empty (${staffPath})`);
-  return body;
+  const builtin = BUILTIN_PERSONAS[trimmed];
+  if (builtin) return builtin;
+  throw new Error(`loadStaffPersona: staff '${trimmed}' declared but ${staffPath} does not exist`);
 }
 function framePersona(slug, persona) {
   return [
@@ -13507,7 +13575,8 @@ async function runExecutable(profileName, input) {
     };
   })() : null;
   const ndjsonDir = path37.join(input.cwd, ".kody");
-  const staffPersona = typeof profile.staff === "string" && profile.staff.length > 0 ? framePersona(profile.staff, loadStaffPersona(input.cwd, profile.staff)) : null;
+  const personaSlug = typeof profile.staff === "string" && profile.staff.length > 0 ? profile.staff : typeof ctx.data.jobPersona === "string" && ctx.data.jobPersona.length > 0 ? ctx.data.jobPersona : null;
+  const staffPersona = personaSlug ? framePersona(personaSlug, loadStaffPersona(input.cwd, personaSlug)) : null;
   const invokeAgent = async (prompt) => {
     const externalPlugins = (profile.claudeCode.plugins ?? []).map((p) => path37.isAbsolute(p) ? p : path37.resolve(profile.dir, p)).filter((p) => p.length > 0);
     const syntheticPath = ctx.data.syntheticPluginPath;

package/dist/jobs/watch-stale-prs.md

@@ -1,5 +1,6 @@
 ---
 every: 7d
+staff: kody
 ---
 
 # watch-stale-prs

package/kody.config.schema.json

@@ -1,448 +1,176 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Kody Engine Lite Configuration",
-  "description": "Configuration for the Kody autonomous SDLC pipeline. See https://github.com/aharonyaircohen/Kody-Engine-Lite",
+  "title": "Kody Engine Configuration",
+  "description": "Configuration for @kody-ade/kody-engine consumer repositories.",
   "type": "object",
+  "required": ["github", "agent"],
+  "additionalProperties": false,
   "properties": {
+    "$schema": {
+      "type": "string"
+    },
     "quality": {
       "type": "object",
-      "description": "Quality gate commands run during the verify stage. Leave empty string to skip.",
+      "description": "Quality gate commands. Empty strings disable individual gates.",
+      "additionalProperties": false,
       "properties": {
-        "typecheck": {
-          "type": "string",
-          "description": "TypeScript type checking command (e.g., 'pnpm typecheck', 'pnpm tsc --noEmit')",
-          "default": "pnpm -s tsc --noEmit"
-        },
-        "lint": {
-          "type": "string",
-          "description": "Lint command (e.g., 'pnpm lint'). Empty to skip.",
-          "default": ""
-        },
-        "lintFix": {
-          "type": "string",
-          "description": "Auto-fix lint command, run when verify fails (e.g., 'pnpm lint:fix')",
-          "default": ""
-        },
-        "format": {
-          "type": "string",
-          "description": "Format check command (e.g., 'pnpm format:check', 'prettier --check .'). Empty to skip.",
-          "default": ""
-        },
-        "formatFix": {
-          "type": "string",
-          "description": "Auto-fix format command, run when verify fails (e.g., 'pnpm format')",
-          "default": ""
-        },
-        "testUnit": {
-          "type": "string",
-          "description": "Unit test command. Use test:unit to exclude integration/e2e tests (e.g., 'pnpm test:unit')",
-          "default": "pnpm -s test"
-        }
-      },
-      "additionalProperties": false
+        "typecheck": { "type": "string", "default": "" },
+        "lint": { "type": "string", "default": "" },
+        "format": { "type": "string", "default": "" },
+        "testUnit": { "type": "string", "default": "" }
+      }
     },
     "git": {
       "type": "object",
-      "description": "Git configuration",
+      "additionalProperties": false,
       "properties": {
         "defaultBranch": {
           "type": "string",
-          "description": "Default branch for PR base and branch syncing (e.g., 'main', 'dev')",
-          "default": "dev"
+          "description": "Default branch for PR base and branch syncing.",
+          "default": "main"
         }
-      },
-      "additionalProperties": false
+      }
     },
     "github": {
       "type": "object",
-      "description": "GitHub repository settings. Auto-detected from git remote by init.",
+      "required": ["owner", "repo"],
+      "additionalProperties": false,
       "properties": {
-        "owner": {
-          "type": "string",
-          "description": "GitHub organization or username (e.g., 'my-org')"
-        },
-        "repo": {
-          "type": "string",
-          "description": "GitHub repository name (e.g., 'my-repo')"
-        },
-        "postSummary": {
-          "type": "boolean",
-          "description": "Post a structured pipeline summary comment on the issue after completion. Default: true in CI, false locally.",
-          "default": true
-        }
-      },
-      "additionalProperties": false
+        "owner": { "type": "string" },
+        "repo": { "type": "string" }
+      }
     },
-    "timeouts": {
+    "agent": {
       "type": "object",
-      "description": "Per-stage timeout overrides in seconds. Defaults: taskify=600, plan=600, build=2400, verify=300, review=600, review-fix=1200, ship=240",
+      "required": ["model"],
+      "additionalProperties": false,
       "properties": {
-        "taskify": { "type": "number", "description": "Taskify stage timeout in seconds", "default": 600 },
-        "plan": { "type": "number", "description": "Plan stage timeout in seconds", "default": 600 },
-        "build": { "type": "number", "description": "Build stage timeout in seconds", "default": 2400 },
-        "verify": { "type": "number", "description": "Verify stage timeout in seconds", "default": 300 },
-        "review": { "type": "number", "description": "Review stage timeout in seconds", "default": 600 },
-        "review-fix": { "type": "number", "description": "Review-fix stage timeout in seconds", "default": 1200 },
-        "ship": { "type": "number", "description": "Ship stage timeout in seconds", "default": 240 }
-      },
-      "additionalProperties": false
+        "model": {
+          "type": "string",
+          "pattern": "^[^/]+/.+$",
+          "description": "Base provider/model string, for example minimax/MiniMax-M2.7-highspeed or claude/claude-sonnet-4-6."
+        },
+        "perExecutable": {
+          "type": "object",
+          "description": "Optional provider/model override by executable name.",
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^[^/]+/.+$"
+          }
+        }
+      }
     },
     "issueContext": {
       "type": "object",
-      "description": "kody: how many and how much of the issue's comments the agent sees in its prompt. Higher = more context but larger prompts. Defaults: 50 comments, 10000 bytes each.",
+      "additionalProperties": false,
       "properties": {
         "commentLimit": {
           "type": "integer",
-          "minimum": 1,
-          "description": "Max number of comments (most recent first) to include in the agent prompt. Default: 50.",
-          "default": 50
+          "minimum": 1
         },
         "commentMaxBytes": {
           "type": "integer",
-          "minimum": 1,
-          "description": "Max bytes per comment before truncation. Default: 10000.",
-          "default": 10000
+          "minimum": 1
         }
-      },
-      "additionalProperties": false
+      }
     },
     "testRequirements": {
       "type": "array",
-      "description": "kody enforces that newly added files matching `pattern` ship with a sibling test file matching `requireSibling`. Misses fail the run; the agent gets one retry with the gap as feedback. Empty array or absent = no enforcement.",
       "items": {
         "type": "object",
         "required": ["pattern", "requireSibling"],
         "additionalProperties": false,
         "properties": {
-          "pattern": {
-            "type": "string",
-            "description": "Glob-style pattern (* within segment, ** across segments). Example: 'src/app/api/**/route.ts'"
-          },
-          "requireSibling": {
-            "type": "string",
-            "description": "Sibling test path template. Tokens: {name} (filename without ext), {ext} (e.g. .ts). Example: '{name}.test{ext}'"
-          }
+          "pattern": { "type": "string" },
+          "requireSibling": { "type": "string" }
         }
       }
     },
-    "agent": {
-      "type": "object",
-      "description": "Agent execution configuration",
-      "properties": {
-        "model": {
-          "type": "string",
-          "pattern": "^[^/]+/.+$",
-          "description": "Single 'provider/model' string used by kody (single-session pipeline). Use 'claude/...' or 'anthropic/...' for direct Anthropic API; anything else routes through LiteLLM proxy.",
-          "examples": ["claude/claude-sonnet-4-6", "minimax/MiniMax-M2.7-highspeed"]
-        },
-        "perExecutable": {
-          "type": "object",
-          "description": "Per-executable model override. Wins over agent.model for the matching stage. Example: {\"classify\": \"claude/claude-haiku-4-5-20251001\", \"plan\": \"claude/claude-opus-4-7\"}.",
-          "additionalProperties": {
-            "type": "string",
-            "pattern": "^[^/]+/.+$"
-          }
-        },
-        "modelMap": {
-          "type": "object",
-          "description": "Maps model tiers to 'provider/model' strings. Use 'claude/...' or 'anthropic/...' for direct Anthropic API; anything else routes through LiteLLM proxy.",
-          "properties": {
-            "cheap": {
-              "type": "string",
-              "pattern": "^[^/]+/.+$",
-              "description": "Fast/cheap 'provider/model' for taskify (e.g., 'claude/claude-haiku-4-5-20251001', 'minimax/MiniMax-M2.7-highspeed')",
-              "examples": ["claude/claude-haiku-4-5-20251001", "minimax/MiniMax-M2.7-highspeed"]
-            },
-            "mid": {
-              "type": "string",
-              "pattern": "^[^/]+/.+$",
-              "description": "Mid-tier 'provider/model' for build, review-fix, autofix (e.g., 'claude/claude-sonnet-4-6')",
-              "examples": ["claude/claude-sonnet-4-6", "minimax/MiniMax-M2.7-highspeed"]
-            },
-            "strong": {
-              "type": "string",
-              "pattern": "^[^/]+/.+$",
-              "description": "Strongest 'provider/model' for plan, review — deep reasoning (e.g., 'claude/claude-opus-4-6')",
-              "examples": ["claude/claude-opus-4-6", "minimax/MiniMax-M2.7-highspeed"]
-            }
-          },
-          "additionalProperties": false
-        },
-        "defaultRunner": {
-          "type": "string",
-          "description": "Name of the default runner when multiple runners are configured (advanced)",
-          "default": "claude"
-        },
-        "runners": {
-          "type": "object",
-          "description": "Named runner definitions (advanced)",
-          "additionalProperties": {
-            "type": "object",
-            "properties": {
-              "type": {
-                "type": "string",
-                "enum": ["claude-code"]
-              }
-            },
-            "required": ["type"]
-          }
-        },
-        "stageRunners": {
-          "type": "object",
-          "description": "Per-stage runner assignment (advanced). Maps stage name to runner name.",
-          "properties": {
-            "taskify": { "type": "string" },
-            "plan": { "type": "string" },
-            "build": { "type": "string" },
-            "autofix": { "type": "string" },
-            "review": { "type": "string" },
-            "review-fix": { "type": "string" }
-          },
-          "additionalProperties": false
-        },
-        "default": {
-          "type": "string",
-          "pattern": "^[^/]+/.+$",
-          "description": "Default 'provider/model' string applied to every stage. Use 'claude/<model>' for direct Anthropic API; anything else routes through LiteLLM proxy. Overridden by entries in 'stages'.",
-          "examples": ["claude/claude-sonnet-4-6", "minimax/MiniMax-M2.7-highspeed", "openai/gpt-4o"]
-        },
-        "stages": {
-          "type": "object",
-          "description": "Per-stage 'provider/model' overrides. Takes precedence over 'default' and 'modelMap'.",
-          "properties": {
-            "taskify": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "plan": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "build": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "verify": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "review": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "review-fix": { "type": "string", "pattern": "^[^/]+/.+$" },
-            "ship": { "type": "string", "pattern": "^[^/]+/.+$" }
-          },
-          "additionalProperties": false
-        },
-        "escalateOnTimeout": {
-          "type": "boolean",
-          "description": "Escalate to a stronger model tier when a stage times out and retries. Default: true.",
-          "default": true
-        }
-      },
-      "additionalProperties": false
+    "defaultExecutable": {
+      "type": "string",
+      "description": "Executable used for bare @kody comments on issues.",
+      "default": "run"
     },
-    "watch": {
-      "type": "object",
-      "description": "Kody Watch — periodic health monitoring. Runs every 30 minutes via GitHub Actions to check pipeline health, security, and configuration.",
-      "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Enable Kody Watch periodic monitoring",
-          "default": false
-        },
-        "activityLog": {
-          "type": "number",
-          "description": "GitHub issue number for posting activity log reports. Auto-created by bootstrap."
-        },
-        "model": {
-          "type": "string",
-          "pattern": "^[^/]+/.+$",
-          "description": "'provider/model' string for watch agents. Falls back to agent.modelMap.cheap if not set.",
-          "examples": ["claude/claude-sonnet-4-6", "claude/claude-haiku-4-5-20251001", "minimax/MiniMax-M1"]
-        }
-      },
-      "additionalProperties": false
+    "defaultPrExecutable": {
+      "type": "string",
+      "description": "Optional executable used for bare @kody comments on PRs. Leave unset to require explicit PR commands."
     },
-    "decompose": {
+    "onPullRequest": {
+      "type": "string",
+      "description": "Optional executable to run on pull_request opened, synchronize, or reopened events."
+    },
+    "aliases": {
       "type": "object",
-      "description": "Decompose command configuration for splitting complex tasks into parallel sub-tasks.",
-      "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Enable the decompose command. Default: true.",
-          "default": true
-        },
-        "maxParallelSubTasks": {
-          "type": "number",
-          "description": "Maximum number of sub-tasks to build in parallel. Default: 3.",
-          "default": 3
-        },
-        "minComplexityScore": {
-          "type": "number",
-          "description": "Minimum complexity score (1-10) for a task to be decomposed. Set lower to decompose more tasks. Default: 4.",
-          "default": 4
-        }
-      },
-      "additionalProperties": false
+      "description": "Comment subcommand aliases, mapping typed word to executable name.",
+      "additionalProperties": {
+        "type": "string"
+      }
     },
-    "mcp": {
+    "classify": {
       "type": "object",
-      "description": "MCP (Model Context Protocol) server configuration. Enables external tools like browser automation.",
+      "additionalProperties": false,
       "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Enable MCP server integration",
-          "default": false
-        },
-        "servers": {
+        "labelMap": {
           "type": "object",
-          "description": "Named MCP server definitions. Each key is a server name.",
           "additionalProperties": {
-            "type": "object",
-            "properties": {
-              "command": {
-                "type": "string",
-                "description": "Command to start the MCP server (e.g., 'npx')"
-              },
-              "args": {
-                "type": "array",
-                "items": { "type": "string" },
-                "description": "Command arguments"
-              },
-              "env": {
-                "type": "object",
-                "additionalProperties": { "type": "string" },
-                "description": "Environment variables for the server process"
-              }
-            },
-            "required": ["command"]
+            "type": "string"
           }
-        },
-        "stages": {
-          "type": "array",
-          "items": { "type": "string" },
-          "description": "Stages that can use MCP tools. Defaults to [\"build\", \"verify\", \"review\", \"review-fix\"]",
-          "default": ["build", "verify", "review", "review-fix"]
-        },
-        "devServer": {
-          "type": "object",
-          "description": "DEPRECATED: Use top-level devServer instead. Kept for backward compatibility.",
-          "properties": {
-            "command": {
-              "type": "string",
-              "description": "Command to start the dev server (e.g., 'pnpm dev')"
-            },
-            "url": {
-              "type": "string",
-              "description": "URL where the dev server will be accessible (e.g., 'http://localhost:3000')"
-            },
-            "readyPattern": {
-              "type": "string",
-              "description": "Regex pattern to match in stdout when server is ready. Default: 'Ready in|compiled|started server|Local:'"
-            },
-            "readyTimeout": {
-              "type": "number",
-              "description": "Seconds to wait for the server to be ready. Default: 180"
-            }
-          },
-          "required": ["command", "url"]
         }
-      },
-      "required": ["enabled", "servers"],
-      "additionalProperties": false
+      }
     },
     "release": {
       "type": "object",
-      "description": "Release automation configuration. Used by 'kody-engine release' command.",
+      "additionalProperties": false,
       "properties": {
         "versionFiles": {
           "type": "array",
-          "items": { "type": "string" },
-          "description": "Files containing version strings to update on release. Default: [\"package.json\"]",
-          "default": ["package.json"]
-        },
-        "publishCommand": {
-          "type": "string",
-          "description": "Shell command to run after tagging for publishing. Empty = skip. NOT hardcoded to any registry.",
-          "default": "",
-          "examples": ["npm publish --access public", "cargo publish", "make publish"]
-        },
-        "notifyCommand": {
-          "type": "string",
-          "description": "Shell command for post-release notifications. $VERSION is interpolated at runtime. Empty = skip.",
-          "default": "",
-          "examples": ["curl -X POST $SLACK_WEBHOOK -d '{\"text\": \"Released v$VERSION\"}'"]
-        },
-        "e2eCommand": {
-          "type": "string",
-          "description": "Shell command to run E2E tests as a release gate. Runs before publishCommand. $VERSION is interpolated at runtime. Empty = skip (no E2E gate).",
-          "default": "",
-          "examples": ["pnpm test:e2e", "npm run e2e", "playwright test"]
+          "items": { "type": "string" }
         },
+        "publishCommand": { "type": "string" },
+        "notifyCommand": { "type": "string" },
+        "e2eCommand": { "type": "string" },
+        "draftRelease": { "type": "boolean" },
+        "releaseBranch": { "type": "string" },
         "timeoutMs": {
           "type": "integer",
-          "description": "Timeout in milliseconds for e2eCommand, publishCommand, and notifyCommand. Default: 600000 (10 minutes).",
-          "default": 600000,
-          "examples": [600000, 1200000, 1800000]
-        },
-        "releaseBranch": {
-          "type": "string",
-          "description": "Production branch — E2E gates PRs into this branch. Release PR targets git.defaultBranch. Defaults to 'main'.",
-          "default": "main"
-        },
-        "labels": {
-          "type": "array",
-          "items": { "type": "string" },
-          "description": "Labels to add to the release PR. Default: [\"release\"]",
-          "default": ["kody:release"]
-        },
-        "draftRelease": {
-          "type": "boolean",
-          "description": "Create GitHub Releases as drafts. Default: false",
-          "default": false
+          "minimum": 1
         }
-      },
-      "additionalProperties": false
+      }
     },
     "jobs": {
       "type": "object",
-      "description": "File-based job configuration. Jobs are long-running scheduled executables defined under .kody/duties/<slug>.md.",
+      "additionalProperties": false,
       "properties": {
         "stateBackend": {
           "type": "string",
           "enum": ["contents-api", "local-file"],
-          "description": "Storage backend for job state. \"contents-api\" (default) commits state to a tracked file via the GitHub Contents API — durable across runs but creates a commit per change. \"local-file\" stores state on disk and snapshots it to the GitHub Actions cache between workflow runs — no commit churn, but bound to cache eviction (7-day idle).",
           "default": "contents-api"
         }
-      },
-      "additionalProperties": false
+      }
     },
     "access": {
       "type": "object",
-      "description": "Who may trigger kody via an @kody comment. Gates on the GitHub comment.author_association already present on the issue_comment event (no API call, no read:org token).",
+      "additionalProperties": false,
       "properties": {
         "allowedAssociations": {
           "type": "array",
+          "description": "GitHub author_association values allowed to trigger @kody. Empty array disables the gate.",
           "items": {
             "type": "string",
-            "enum": ["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR", "FIRST_TIME_CONTRIBUTOR", "FIRST_TIMER", "MANNEQUIN", "NONE"]
+            "enum": [
+              "OWNER",
+              "MEMBER",
+              "COLLABORATOR",
+              "CONTRIBUTOR",
+              "FIRST_TIME_CONTRIBUTOR",
+              "FIRST_TIMER",
+              "MANNEQUIN",
+              "NONE"
+            ]
           },
-          "description": "Allowlist of author_association values permitted to trigger kody. OMIT this key for the secure default — only the team (OWNER, MEMBER, COLLABORATOR) may trigger; public drive-by comments are silently ignored. A non-empty list overrides which associations are allowed. An explicit empty list ([]) DISABLES the gate (anyone may trigger). MEMBER applies only to org-owned repos; on a user-owned repo the owner is OWNER and invited people are COLLABORATOR.",
           "default": ["OWNER", "MEMBER", "COLLABORATOR"]
         }
-      },
-      "additionalProperties": false
-    },
-    "devServer": {
-      "type": "object",
-      "description": "Dev server configuration for browser tool verification. Works with any provider (MCP or CLI-based).",
-      "properties": {
-        "command": {
-          "type": "string",
-          "description": "Command to start the dev server (e.g., 'pnpm dev')"
-        },
-        "url": {
-          "type": "string",
-          "description": "URL where the dev server will be accessible (e.g., 'http://localhost:3000')"
-        },
-        "readyPattern": {
-          "type": "string",
-          "description": "Regex pattern to match in stdout when server is ready. Default: 'Ready in|compiled|started server|Local:'"
-        },
-        "readyTimeout": {
-          "type": "number",
-          "description": "Seconds to wait for the server to be ready. Default: 180"
-        }
-      },
-      "required": ["command", "url"]
+      }
     }
-  },
-  "additionalProperties": false
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.206",
+  "version": "0.4.207-next.1",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative executable profiles.",
   "license": "MIT",
   "type": "module",