@mstar-harness/opencode 1.6.0 → 1.7.1

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to the `@mstar-harness/opencode` package are documented in t
 
 The monorepo root [CHANGELOG.md](../../CHANGELOG.md) summarizes cross-surface releases.
 
+## [1.7.1] - 2026-08-05
+
+- Version alignment with harness **1.7.1** (no OpenCode package API change; CLI omp doctor fix).
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **1.7.1**.
+
+## [1.7.0] - 2026-08-05
+
+- Version alignment with harness **1.7.0** (omp host surface is added at the harness/CLI layer; OpenCode package unchanged beyond version bump / bundled skills sync).
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **1.7.0**.
+
+
+## 1.6.1
+
+- Bundled skills/agents: **QC = code reviewer** — L3 must not run test/build/lint on shared tri-review cwd; L1/L4 own runtime evidence; `qc-specialist*` bash allowlist git-only (+ lightweight analysis).
+- Version alignment with harness **1.6.1**.
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **1.6.1**.
+
 ## 1.6.0
 
 - Version alignment with harness **1.6.0** (no OpenCode plugin change in this release; ZCode host surface is added at the harness/CLI layer, not bundled into the OpenCode package).

package/harness-agents/qc-specialist-2.md

@@ -1,8 +1,8 @@
 ---
 name: qc-specialist-2
 description: |-
-  质量控制专家（Reviewer #2）- 代码审查和质量保证。
-  Quality Control Specialist (Reviewer #2) - code review and quality assurance after significant changes.
+  质量控制专家（Reviewer #2）- 代码审查（diff / 逻辑 / 安全正确性）。非测试执行席。
+  Quality Control Specialist (Reviewer #2) - code review (diff, logic, security/correctness). Not a test runner.
 mode: subagent
 tools:
   write: true
@@ -22,7 +22,7 @@ permission:
     ".worktrees/**/.agents/sdd/**/*.md": allow
   bash:
     "*": deny
-    # Git inspection (read-only)
+    # Git inspection (read-only) — L3 is diff review; no test/build/lint CLIs (peer QC share worktree)
     "git diff*": allow
     "git log*": allow
     "git show*": allow
@@ -31,59 +31,13 @@ permission:
     "git stash list*": allow
     "git branch*": allow
     "git status*": allow
-    # JavaScript / TypeScript
-    "eslint*": allow
-    "npx eslint*": allow
-    "prettier --check*": allow
-    "npx prettier --check*": allow
-    "tsc*": allow
-    "npx tsc*": allow
-    "biome*": allow
-    "npx @biomejs/biome*": allow
-    "oxlint*": allow
-    "npx oxlint*": allow
-    "stylelint*": allow
-    "npx stylelint*": allow
-    # Python
-    "ruff*": allow
-    "pylint*": allow
-    "flake8*": allow
-    "mypy*": allow
-    "pyright*": allow
-    "bandit*": allow
-    "python -m ruff*": allow
-    "python -m pylint*": allow
-    "python -m mypy*": allow
-    "python3 -m ruff*": allow
-    "python3 -m pylint*": allow
-    "python3 -m mypy*": allow
-    # Rust
-    "cargo clippy*": allow
-    "cargo fmt --check*": allow
-    "cargo audit*": allow
-    # Go
-    "golangci-lint*": allow
-    "go vet*": allow
-    "staticcheck*": allow
-    # Ruby
-    "rubocop*": allow
-    "bundle exec rubocop*": allow
-    # Swift
-    "swiftlint*": allow
-    "swift-format lint*": allow
-    # Shell / Config
-    "shellcheck*": allow
-    "hadolint*": allow
-    "actionlint*": allow
-    # Markdown / Docs
-    "markdownlint*": allow
-    # General analysis
+    "git rev-parse*": allow
+    # Lightweight read-only analysis
     "wc*": allow
     "rg*": allow
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
-    "git rev-parse*": allow
   task:
     "*": deny
     explore: allow

package/harness-agents/qc-specialist-3.md

@@ -1,8 +1,8 @@
 ---
 name: qc-specialist-3
 description: |-
-  质量控制专家（Reviewer #3）- 代码审查和质量保证。
-  Quality Control Specialist (Reviewer #3) - code review and quality assurance after significant changes.
+  质量控制专家（Reviewer #3）- 代码审查（diff / 逻辑 / 性能可靠性）。非测试执行席。
+  Quality Control Specialist (Reviewer #3) - code review (diff, logic, performance/reliability). Not a test runner.
 mode: subagent
 tools:
   write: true
@@ -22,7 +22,7 @@ permission:
     ".worktrees/**/.agents/sdd/**/*.md": allow
   bash:
     "*": deny
-    # Git inspection (read-only)
+    # Git inspection (read-only) — L3 is diff review; no test/build/lint CLIs (peer QC share worktree)
     "git diff*": allow
     "git log*": allow
     "git show*": allow
@@ -31,59 +31,13 @@ permission:
     "git stash list*": allow
     "git branch*": allow
     "git status*": allow
-    # JavaScript / TypeScript
-    "eslint*": allow
-    "npx eslint*": allow
-    "prettier --check*": allow
-    "npx prettier --check*": allow
-    "tsc*": allow
-    "npx tsc*": allow
-    "biome*": allow
-    "npx @biomejs/biome*": allow
-    "oxlint*": allow
-    "npx oxlint*": allow
-    "stylelint*": allow
-    "npx stylelint*": allow
-    # Python
-    "ruff*": allow
-    "pylint*": allow
-    "flake8*": allow
-    "mypy*": allow
-    "pyright*": allow
-    "bandit*": allow
-    "python -m ruff*": allow
-    "python -m pylint*": allow
-    "python -m mypy*": allow
-    "python3 -m ruff*": allow
-    "python3 -m pylint*": allow
-    "python3 -m mypy*": allow
-    # Rust
-    "cargo clippy*": allow
-    "cargo fmt --check*": allow
-    "cargo audit*": allow
-    # Go
-    "golangci-lint*": allow
-    "go vet*": allow
-    "staticcheck*": allow
-    # Ruby
-    "rubocop*": allow
-    "bundle exec rubocop*": allow
-    # Swift
-    "swiftlint*": allow
-    "swift-format lint*": allow
-    # Shell / Config
-    "shellcheck*": allow
-    "hadolint*": allow
-    "actionlint*": allow
-    # Markdown / Docs
-    "markdownlint*": allow
-    # General analysis
+    "git rev-parse*": allow
+    # Lightweight read-only analysis
     "wc*": allow
     "rg*": allow
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
-    "git rev-parse*": allow
   task:
     "*": deny
     explore: allow

package/harness-agents/qc-specialist.md

@@ -1,8 +1,8 @@
 ---
 name: qc-specialist
 description: |-
-  质量控制专家（Reviewer #1）- 代码审查和质量保证。
-  Quality Control Specialist (Reviewer #1) - code review and quality assurance after significant changes.
+  质量控制专家（Reviewer #1）- 代码审查（diff / 逻辑 / 架构可维护性）。非测试执行席。
+  Quality Control Specialist (Reviewer #1) - code review (diff, logic, maintainability). Not a test runner.
 mode: subagent
 tools:
   write: true
@@ -22,7 +22,7 @@ permission:
     ".worktrees/**/.agents/sdd/**/*.md": allow
   bash:
     "*": deny
-    # Git inspection (read-only)
+    # Git inspection (read-only) — L3 is diff review; no test/build/lint CLIs (peer QC share worktree)
     "git diff*": allow
     "git log*": allow
     "git show*": allow
@@ -31,59 +31,13 @@ permission:
     "git stash list*": allow
     "git branch*": allow
     "git status*": allow
-    # JavaScript / TypeScript
-    "eslint*": allow
-    "npx eslint*": allow
-    "prettier --check*": allow
-    "npx prettier --check*": allow
-    "tsc*": allow
-    "npx tsc*": allow
-    "biome*": allow
-    "npx @biomejs/biome*": allow
-    "oxlint*": allow
-    "npx oxlint*": allow
-    "stylelint*": allow
-    "npx stylelint*": allow
-    # Python
-    "ruff*": allow
-    "pylint*": allow
-    "flake8*": allow
-    "mypy*": allow
-    "pyright*": allow
-    "bandit*": allow
-    "python -m ruff*": allow
-    "python -m pylint*": allow
-    "python -m mypy*": allow
-    "python3 -m ruff*": allow
-    "python3 -m pylint*": allow
-    "python3 -m mypy*": allow
-    # Rust
-    "cargo clippy*": allow
-    "cargo fmt --check*": allow
-    "cargo audit*": allow
-    # Go
-    "golangci-lint*": allow
-    "go vet*": allow
-    "staticcheck*": allow
-    # Ruby
-    "rubocop*": allow
-    "bundle exec rubocop*": allow
-    # Swift
-    "swiftlint*": allow
-    "swift-format lint*": allow
-    # Shell / Config
-    "shellcheck*": allow
-    "hadolint*": allow
-    "actionlint*": allow
-    # Markdown / Docs
-    "markdownlint*": allow
-    # General analysis
+    "git rev-parse*": allow
+    # Lightweight read-only analysis
     "wc*": allow
     "rg*": allow
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
-    "git rev-parse*": allow
   task:
     "*": deny
     explore: allow

package/harness-skills/mstar-branch-worktree/SKILL.md

@@ -195,8 +195,9 @@ Default process artifacts (`plans/`, `iterations/`, `status.json`, `sdd/`, `note
 - **三票审同一功能（强制对齐）**：分派 **QC 三审**时，除上述字段外，**必须**在 **三份 Assignment 中逐字写入相同**的 **`plan_id`** 与 **`Review range` / `Diff basis`**：
   - **`plan_id`**：与 `{SDD_DIR}` 的 `<plan-id>` 段、主 **Plan Path**、`status.json.plans[].id` 一致；无 `{PLAN_DIR}` 流程时写 **`plan_id: N/A`**，并另给一行 **`Feature / scope label`**（不可歧义，足以与并行其它 feature 区分）。
   - **`Review range` / `Diff basis`**：明确本次审查所针对的 **diff/提交范围**（例如 `merge-base: <target_branch-or-base-ref>` + `tip: HEAD`；或 `rev-range: <full-40>..<full-40>`；或一句 `equivalent to: git diff <merge-base>...HEAD`，以团队可复现为准）。**三名 reviewer 的 Assignment 间该字段必须完全一致**；**`qa-engineer`** 验证同一 feature 时 **复用同一 `plan_id` 与同一 `Review range` / `Diff basis`**。**热修 / QC 单审**路径也须含 **同一组字段**，仅承接方份数为 1。
-- **三审并行**时，三名 reviewer **共用同一组 `Review cwd` / `Worktree path` + `Working branch` + `plan_id` + `Review range` / `Diff basis`**（对业务仓只读分析）；**一般不必**为每位 reviewer 各开一个 worktree，除非宿主或执行环境要求进程级隔离。
-- QC 的 **报告落盘**默认仅限 Assignment 指定的 `{SDD_DIR}/review/`；上述约定保证 `git diff`、`git log`、lint 与所读文件与 **待合并 feature** 一致。PM 另行提交主 plan gate summary / `status.json` residual changes as durable artifacts.
+- **三审并行**时，三名 reviewer **共用同一组 `Review cwd` / `Worktree path` + `Working branch` + `plan_id` + `Review range` / `Diff basis`**（对业务仓 **只读 diff 审查**）；**一般不必**为每位 reviewer 各开一个 worktree，除非宿主或执行环境要求进程级隔离。
+- **并行 QC 禁止**在共享检出上跑 **test / build / install / lint / typecheck** 等会争用缓存或锁的命令（否则 peer QC 易 `Blocked`）。L3 默认手段：`git diff` / `git log` / `git show` / Read / Grep。运行时验证留给 **L1 证据** 与 **`qa-engineer`（L4）** — 见 `mstar-review-qc/references/review-responsibility-boundaries.md`。
+- QC 的 **报告落盘**默认仅限 Assignment 指定的 `{SDD_DIR}/review/`；上述约定保证 `git diff`、`git log` 与所读文件与 **待合并 feature** 一致。PM 另行提交主 plan gate summary / `status.json` residual changes as durable artifacts。
 - **`project-manager`** 分派 **`qa-engineer`** 时（仅 **`QA gate: mandatory`**），Assignment 须与 QC **逐字相同**的 **`Review cwd` / `Worktree path`**、**`Working branch`**、**`plan_id`**、**`Review range` / `Diff basis`**（QC 已写清则 QA 照抄）。**`qa-engineer`** 执行业务仓命令前须核对检出与分支；Report-only 且无路径依赖时，回报须说明验证环境，否则 `Blocked`。
 - 若 **QA 与同仓其他可写角色并发**提交测试代码，仍须遵守上文「同仓并发写入」的 **worktree** 规则（可为 QA 单开一条写入 worktree，**同一 `Working branch`**，由 PM 在 Assignment 写明）。
 

package/harness-skills/mstar-host/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mstar-host
-description: Morning Star host adapter (OpenCode, Cursor, Codex, Kimi, ZCode). Use after mstar-harness-core whenever host entry, clarify, dispatch, or plan UX differs by platform - OpenCode question/task-tool subagent invoke, Cursor /pm and CreatePlan/SwitchMode dual-write and Task parallel QC, Codex plugin skills plus Plan/Goal Mode, Kimi Agent/AgentSwarm with built-in subagent types only (coder/explore/plan) and role-in-prompt binding, ZCode Agent/AskUserQuestion/EnterPlanMode with built-in subagent types and role-in-prompt binding, sandboxed tools, and tool discovery. Auto-detect host from session tools; then Read references/<host>.md. Always load after mstar-harness-core.
+description: Morning Star host adapter (OpenCode, Cursor, Codex, Kimi, ZCode, omp). Use after mstar-harness-core whenever host entry, clarify, dispatch, or plan UX differs by platform - OpenCode question/task-tool subagent invoke, Cursor /pm and CreatePlan/SwitchMode dual-write and Task parallel QC, Codex plugin skills plus Plan/Goal Mode, Kimi Agent/AgentSwarm with built-in subagent types only (coder/explore/plan) and role-in-prompt binding, ZCode Agent/AskUserQuestion/EnterPlanMode with built-in subagent types and role-in-prompt binding, omp task/ask/hub with built-in task.agent types and role-in-prompt binding, sandboxed tools, and tool discovery. Auto-detect host from session tools; then Read references/<host>.md. Always load after mstar-harness-core.
 ---
 
 # Morning Star Host Adapter
@@ -28,12 +28,13 @@ Use **capability signals** (not filesystem paths):
 | Signal | Host | Next read |
 |--------|------|-----------|
 | **CreatePlan** / **SwitchMode** available | `cursor` | `references/cursor.md`; Plan mode also `references/cursor-plan-mode-bridge.md` |
-| **`question`** tool or **`task`** tool (**subagent** invoke) | `opencode` | `references/opencode.md` |
+| **`question`** tool or OpenCode-style **`task`** tool with **`subagent`** (not omp `agent`/`tasks[]`) | `opencode` | `references/opencode.md` |
 | **Task** + `subagent_type`, no CreatePlan | `cursor` | `references/cursor.md` |
 | **Codex app/CLI/plugin context**, `/plan`, `/goal`, Goal tools, `functions.*`, `codex_app.*`, `tool_search`, Browser plugin tools | `codex` | `references/codex.md`; Plan/Goal mode also `references/codex-plan-goal-mode-bridge.md` |
 | **`Agent`** / **`AgentSwarm`** / **`AskUserQuestion`** / **`EnterPlanMode`**, Kimi plugin (`.kimi-plugin/plugin.json`), `/morning-star-harness:*` commands | `kimi` | `references/kimi.md`; Plan mode also `references/kimi-plan-mode-bridge.md` |
 | **`Agent`** / **`AskUserQuestion`** / **`EnterPlanMode`** / **`TodoWrite`**, no `AgentSwarm`, ZCode plugin (`.zcode-plugin/plugin.json`), `/morning-star-harness:*` commands | `zcode` | `references/zcode.md`; Plan mode also `references/zcode-plan-mode-bridge.md` |
-| Still ambiguous | - | Read sections in **`cursor.md`**, **`opencode.md`**, **`codex.md`**, **`kimi.md`**, and **`zcode.md`** that match tools you have; **`mstar-harness-core` wins** on conflict |
+| **`task`** tool with **`agent`** / **`tasks[]`** batch, **`ask`**, **`hub`**, omp plugin (`.omp-plugin/plugin.json` / `.claude-plugin/plugin.json`), `/skill:pm` + `/iteration-*` filename commands | `omp` | `references/omp.md`; Plan mode also `references/omp-plan-mode-bridge.md` |
+| Still ambiguous | - | Read sections in **`cursor.md`**, **`opencode.md`**, **`codex.md`**, **`kimi.md`**, **`zcode.md`**, and **`omp.md`** that match tools you have; **`mstar-harness-core` wins** on conflict |
 
 ## Parallel dispatch (invoke-capable hosts)
 

package/harness-skills/mstar-host/references/omp-plan-mode-bridge.md

@@ -0,0 +1,42 @@
+# omp Plan mode bridge
+
+Load with **`omp.md`** when omp Plan mode is active (`/plan`, plan-yolo / plan-model flows, or read-only-with-resolve plan UX).
+
+## Dual-write contract
+
+omp session plans, composer todos, and plan-mode UI text are **session UX only**. Durable SSOT remains **`{HARNESS_DIR}`** (default `.mstar/`, legacy `.agents/`):
+
+| Artifact | SSOT |
+|----------|------|
+| Main plan | `{PLAN_DIR}/<plan-id>-<name>.md` |
+| Plan registry | `{HARNESS_DIR}/status.json` |
+| Iteration compass | `{ITERATION_DIR}/…` when in formal iteration |
+
+Before treating a plan as ready for Execute:
+
+1. Read `mstar-plan-conventions` + `mstar-plan-artifacts`.
+2. Ensure `{HARNESS_DIR}` / `{PLAN_DIR}` exist and process-artifact gitignore entries are present.
+3. Mirror the active omp plan content into the SSOT main plan path.
+4. Register `plan_id` in `status.json.plans[]` when required by Prepare gates.
+
+**Never** use only the omp session plan / UI todo list as **Plan Path**.
+
+## `mstar-iteration` Phase 1 in Plan mode
+
+When formal iteration Phase 1 runs under omp Plan UX:
+
+1. Keep a **single** SSOT draft plan path (no silent second plan file).
+2. Converge by **feedback-driven in-place edits** on that SSOT plan (and mirror into omp plan UI if helpful).
+3. **Do not** run Review & Edit chain, commit, or create integration branch until the user leaves Plan mode / approves implementation (Build-equivalent).
+4. Recommended branch policy still applies — no silent work on `main`/`master` (`mstar-iteration` §1.2).
+
+## Clarify vs plan approval
+
+- Use **`ask`** for high-impact product/tech choices while drafting.
+- Plan sign-off is the host Plan resolve / approval path, not a casual chat question.
+- After approval, resume as **`project-manager`**: reload `mstar-harness-core` + `omp.md`, then dispatch implementation through **`task`** (C5/C5b). Parent plan session must **not** implement product code unless the user explicitly overrides harness dispatch.
+
+## Gotchas
+
+- Plan-yolo / prewalk model switches are host UX — they do not waive Morning Star gates, Assignment, or evidence rules.
+- Isolated task worktrees from omp are orthogonal to Morning Star L1 lease/worktree fields; when L1 is active, still record harness **Worktree path** / leases.

package/harness-skills/mstar-host/references/omp.md

@@ -0,0 +1,192 @@
+# omp host reference
+
+Load when **`mstar-host`** detection resolves **omp** (Oh My Pi / `omp` session, `.omp-plugin/plugin.json` or `.claude-plugin/plugin.json` installed, **`task`** tool with **`agent`** / **`tasks[]`** batch shape, **`ask`** tool, **`hub`** tool, or `/skill:pm` / `/iteration-*` from this plugin).
+
+Plan mode: read **`omp-plan-mode-bridge.md`** when `/plan`, plan-yolo, or plan-model / read-only-with-resolve plan UX is active.
+
+Parallel PM dispatch: read **`parallel-dispatch.md`** when dispatching **N ≥ 2** concurrent `task` invocations.
+
+## omp-only context
+
+- Plugin markers: **`.omp-plugin/plugin.json`** (Morning Star host marker) and **`.claude-plugin/plugin.json`** (Claude-compatible marketplace discovery). Plugin root is the **repo root**; paths stay `./skills/`, `./commands/`, `./agents/`.
+- Runtime skills: repo `skills/` discovered after `omp plugin install` / `omp plugin link` (OMP extension-package sub-discovery) or Claude marketplace install.
+- Plugin commands: repo `commands/<name>.md` → slash **`/<name>`** (e.g. `/iteration-start`). omp uses the **filename** as the command name (no `morning-star-harness:` prefix).
+- Plugin agents: repo `agents/*.md` may be discovered, but Morning Star role ids are **not** assumed to be valid `task.agent` values — see C5/C5b.
+- **No Kimi-style `sessionStart.skill`** — enter PM manually via **`/skill:pm`** (or the `pm` skill), then **Read next** → `mstar-harness-core` → `project-manager.md`.
+- Install (user-scoped, recommended):
+  - `omp plugin install github:btspoony/mstar-harness`
+  - or CLI: `npx @mstar-harness/cli init --target omp --scope global` (links `~/.mstar/harness`)
+- Project scope: `omp plugin install github:btspoony/mstar-harness --scope project` or `npx @mstar-harness/cli init --target omp --scope project`.
+- Local maintainers: `omp plugin link /path/to/mstar-harness` (or the CLI-managed `~/.mstar/harness` checkout).
+- After install/link: `omp plugin list` should show package **`morning-star`** (root `package.json` name). Reload / new session to pick up skills and commands.
+
+## Skill loading
+
+1. On entry: invoke **`pm`** via `/skill:pm` → **Read next** loads `mstar-harness-core`, then `mstar-roles` → `project-manager.md` when PM is active.
+2. Read `mstar-host` and this omp reference.
+3. If Plan mode is active, read `omp-plan-mode-bridge.md`.
+4. Load `mstar-roles` and the active role reference.
+5. Load topic skills on demand per the role reference.
+
+Use skill names in prompts and references. Prefer `skill://<name>/…` / `/skill:<name>` over absolute local paths unless maintaining this repository.
+
+## Tools map (default agent)
+
+| omp tool | Harness use |
+|----------|-------------|
+| **`task`** | Primary dispatch — fan out one or more subagents (`agent` ∈ built-ins; batch via `tasks[]` + shared `context`) |
+| **`ask`** | Structured clarify (options + recommended); prefer over free-form when choices are known |
+| **`hub`** | Optional peer messaging / long-running process control among subagents — not a substitute for Assignment + `task` |
+| **bash** | Commands, git, tests — evidence per `mstar-coding-behavior` |
+| **read** / **write** / **edit** | File I/O (and host AST/edit variants when present) |
+| **grep** / **glob** | Search (prefer over shell find/grep) |
+| **web_search** / URL fetch tools | External docs / facts when present |
+
+OpenCode **`question`** / **`task`+`subagent`**, Cursor **Task**+`subagent_type`, and Kimi/ZCode **Agent** / **AskUserQuestion** are **not** omp tools — do not assume them.
+
+### `task` shape (operational SSOT)
+
+Prefer the live tool schema every session. Typical batch shape:
+
+```text
+task(
+  context: "<shared batch context>",
+  tasks: [
+    {
+      name: "CamelCaseId",
+      agent: "task",          # built-in only — see C5
+      task: "<full Assignment body including Act as + skill load>"
+    }
+  ]
+)
+```
+
+Single-task shorthand may exist depending on host version — always match the live schema. Parallel **N** Morning Star assignees ⇒ **one** `task` call with **N** `tasks[]` entries **or** **N** `task` calls in one assistant message when the host requires that shape. Count emitted dispatches = **N**.
+
+## Role agents (C5 — hard constraint)
+
+omp ships **built-in `task.agent` types**. Exact names vary by omp version — **read the live `task` tool schema**. Common set (docs + current releases):
+
+| `agent` | Typical use | Harness mapping |
+|---------|-------------|-----------------|
+| `scout` / `explore` | Fast read-only investigation | Orientation, codebase survey, Prepare explore passes |
+| `plan` | Architectural planning | Prepare plan-only work when appropriate |
+| `reviewer` / `security-reviewer` | Structured review | Optional QC assist — still bind Morning Star QC role in prompt (C5b) |
+| `designer` | UI/UX | Optional when Assignment is UI-heavy `frontend-dev` |
+| `librarian` | External library/API research | Optional research assist |
+| `sonic` / `quick_task` | Mechanical / low-reasoning | Mechanical transcription only |
+| `task` | General-purpose worker | **Default for Morning Star roles** (`product-manager`, `fullstack-dev`, `qc-specialist`, …) |
+
+Morning Star role ids (`project-manager`, `fullstack-dev`, `qc-specialist`, …) are **not** valid `task.agent` values unless the live schema explicitly lists them after a custom-agent unpack. Do not invent agent names.
+
+### Role binding in prompt (C5b — required)
+
+Because omp cannot bind Morning Star roles via `task.agent` alone, every dispatch **must** carry the played role in the **Assignment** and in the **task assignment text**:
+
+1. **`Execute as: <role-id>`** in Assignment (harness routing SSOT).
+2. **`Act as <role-id>`** (or equivalent) at the top of the task body.
+3. **Skill load list** — instruct the subagent to read `mstar-roles` → `references/<role-id>.md` (or shared reference + parameters) and topic skills per that reference.
+4. **`agent`** — pick from the live built-in list only (default **`task`**; explore → `scout`/`explore`).
+
+Paste-only Assignment without a **`task`** call is **not** dispatch.
+
+### Assignment / task-body template
+
+```markdown
+## Assignment
+
+**Execute as**: fullstack-dev
+**Delegation**: forbidden
+**Working branch**: feat/example
+**Plan Path**: .mstar/plans/20260717-example.md
+
+**IDENTITY:** You ARE `fullstack-dev`. Act as `fullstack-dev` for this task.
+Load: `mstar-harness-core` → `mstar-host` → `omp.md` → `mstar-roles` → `references/fullstack-dev-shared.md` → topic skills per that reference.
+
+<task body>
+```
+
+PM dispatch invocation (same turn):
+
+```text
+task(
+  context: "Morning Star dispatch for plan 20260717-example",
+  tasks: [{
+    name: "ImplementAuth",
+    agent: "task",
+    task: "<full Assignment body including Act as + skill load>"
+  }]
+)
+```
+
+For explore-only orientation:
+
+```text
+task(
+  tasks: [{
+    name: "ExploreAuth",
+    agent: "scout",   # or explore if that is what the live schema lists
+    task: "... Act as explore-only orientation; Execute as: n/a ..."
+  }]
+)
+```
+
+## PM dispatch (`task`)
+
+Harness **dispatch** on omp = **one or more `task` tool calls** with correct **`agent`** values and role-bound assignment text.
+
+| Harness | omp |
+|---------|-----|
+| `Execute as: <role-id>` | Role id in Assignment + **Act as** + skill load in **task** body |
+| `agent` for invoke | built-ins only (default `task`; explore → `scout`/`explore`) |
+| 1 Assignment ⇒ 1 invoke | **1** `tasks[]` entry (or 1 `task` call) with full Assignment body |
+| Parallel batch **N** | **N** `tasks[]` entries in **one** `task` call, or **N** `task` calls in **one** assistant message |
+| No `task` call | **Not dispatched** — paste-only / `dispatch incomplete` |
+
+### QC default
+
+- **`Execution mode: sdd`**: **N=3** task entries (`qc-specialist`, `qc-specialist-2`, `qc-specialist-3`) — each body **Act as** the respective QC role; prefer `agent: "task"` (or `reviewer` only when it does not drop Morning Star QC skill load).
+- **`inline`**: **N=1** per `parallel-dispatch.md`.
+
+Cannot emit required **N** → **`Blocked`**.
+
+### SDD implement (serial)
+
+- **`Execution mode: sdd`**: one implementer `task` entry per task id; task reviewer = new entry (no sticky resume unless host resume/id is available and recorded).
+- **Never** multiple implementer entries in one message for the same plan.
+
+## Clarify
+
+- Prefer **`ask`** for 1–3 high-impact choices with known options (`recommended` when there is a default).
+- Fallback: one concise Markdown question after codebase exploration cannot answer it.
+- Plan approval in Plan mode follows **`omp-plan-mode-bridge.md`** — do not treat a casual `ask` as plan lock.
+- “Question asked” ≠ clarify done; blocking ambiguity → **`Blocked`** or escalation.
+
+## Commands and skills paths
+
+| Surface | Path / invocation |
+|---------|-------------------|
+| Plugin skills | `/skill:<skill-name>` or auto-load from `skills/` via plugin discovery |
+| Plugin commands | `/iteration-start`, `/iteration-drive`, `/iteration-loop` (filename-based) |
+| Session entry | `/skill:pm` → `mstar-harness-core` via pm **Read next** |
+
+## Files, shell, and approvals
+
+- Prefer host search/edit tools over shell find/sed when available.
+- Respect omp approval prompts (`approval-mode`, write/yolo) for destructive operations.
+- Do not edit `~/.omp/` credentials, plugin lockfiles, or user secrets without explicit consent.
+
+## Git and final evidence
+
+- Git work follows `mstar-branch-worktree` and Assignment **Working branch** / **Branch policy**.
+- omp may offer task isolation / worktrees (`task.isolation`, `~/.omp/wt`) — still record Morning Star **Worktree path** / leases when L1 gates apply.
+- Completion reports cite concrete commands, artifacts, and commit lines when required.
+
+## Gotchas
+
+- Installed npm/git plugin package name is root **`morning-star`** (`package.json`); Morning Star display name remains **morning-star-harness**.
+- Marketplace (Claude) installs and `omp plugin install` are different discovery providers — prefer one install path per machine to avoid duplicate skill listings.
+- Session plan UI / todos are not durable SSOT unless mirrored to `{HARNESS_DIR}`.
+- No custom guaranteed Morning Star `task.agent` profiles — role binding is **always** prompt + skill load (C5b).
+- omp has no `sessionStart.skill`; new sessions do **not** auto-load PM — invoke `/skill:pm` manually.
+- Do not confuse omp **`task.agent`** with OpenCode **`subagent`** or Cursor **`subagent_type`**.

package/harness-skills/mstar-host/references/parallel-dispatch.md

@@ -1,6 +1,6 @@
 # Parallel dispatch (invoke-capable hosts)
 
-Shared PM dispatch contract for **any** host that uses subagent / Task / Agent invoke (OpenCode task tool, Cursor Task, Kimi **Agent** / **AgentSwarm**, Codex only when a callable multi-agent / Task tool is actually available). Process SSOT also in `mstar-dispatch-gates`.
+Shared PM dispatch contract for **any** host that uses subagent / Task / Agent invoke (OpenCode task tool, Cursor Task, Kimi **Agent** / **AgentSwarm**, omp **`task`** with **`agent`** / **`tasks[]`**, Codex only when a callable multi-agent / Task tool is actually available). Process SSOT also in `mstar-dispatch-gates`.
 
 If the active host has no callable invoke tool, this reference does not create delegation capability — mark dispatch **`Blocked`** and report to the user. Do not substitute PM-thread or single-session role execution unless the user explicitly overrides harness dispatch for this turn.
 
@@ -17,7 +17,7 @@ Printing `## Assignment` in the main thread **without** matching host invocation
 
 1. Finalize all `N` Assignment payloads (after any prerequisite turn).
 2. Count distinct `Execute as` sessions (`N`).
-3. Issue **`N` host invocations first** — OpenCode: **N `task` tool** calls with **subagent**; Cursor: **N `Task`** with `subagent_type` (JSON field shape → `cursor.md` § Task invoke schema); Kimi: **N `Agent`** calls (each prompt carries **Act as** + skill load; `subagent_type` ∈ {`coder`,`explore`,`plan`} only — see `kimi.md` C5/C5b); each with one Assignment body. For parallel work, **all `N` tool calls in one assistant message** when the host allows.
+3. Issue **`N` host invocations first** — OpenCode: **N `task` tool** calls with **subagent**; Cursor: **N `Task`** with `subagent_type` (JSON field shape → `cursor.md` § Task invoke schema); Kimi: **N `Agent`** calls (each prompt carries **Act as** + skill load; `subagent_type` ∈ {`coder`,`explore`,`plan`} only — see `kimi.md` C5/C5b); omp: **one `task` call with N `tasks[]`** (or N `task` calls) with built-in `agent` + **Act as** / skill load (see `omp.md` C5/C5b); each with one Assignment body. For parallel work, **all `N` tool calls in one assistant message** when the host allows.
 4. Optionally post a short **Status Update** after invocations (audit trail only — does not replace step 3).
 
 ## Hard rules

package/harness-skills/mstar-review-qc/SKILL.md

@@ -7,10 +7,16 @@ description: "Morning Star QC orchestration — **SDD mandatory plan QC tri-revi
 
 **首次 Read 本 skill 时：必须先 Read `mstar-harness-core`。** 同仓检出与派发 → **`mstar-branch-worktree`** · **`mstar-dispatch-gates`**。冲突时 **以 `mstar-harness-core` 为准**。
 
-**摘要**：职责分层 → **`references/review-responsibility-boundaries.md`**。Leaf QC 执行 → **`mstar-roles/references/qc-specialist/`**。L4 验收 → **`mstar-roles/references/qa-engineer/`**。
+**摘要**：职责分层 → **`references/review-responsibility-boundaries.md`**（**L3 = code reviewer / diff+logic；不跑 test/build**；运行时验证归 L1/L4）。Leaf QC 执行 → **`mstar-roles/references/qc-specialist/`**。L4 验收 → **`mstar-roles/references/qa-engineer/`**。
 
 # Morning Star QC Orchestration（PM · 编排层）
 
+## L3 是什么（派发前对齐）
+
+- Plan QC seats are **reviewers**: whole-branch **diff / logic / risk** lenses — same family as PR review, not a parallel QA test lane.
+- **Do not** instruct QC in Assignment to “run the suite / build / lint to confirm” on shared tri cwd; that causes peer `Blocked` and collapses L3 into L4.
+- Runtime proof stays with **implementer evidence** and **`QA gate`** (`qa-engineer` or PM acceptance).
+
 ## 分派时机（与 plan / batch 对齐）
 
 - **`Execution mode: sdd`**：全部 task + L2 task reviewers 完成后 → **强制 tri-review**（`QC mode: full tri-review`，**N=3**）。Assignment 须含 **branch review-package** 路径与 `{SDD_DIR}/review/qcN.md` report paths。PM 汇总 `{SDD_DIR}/review/qc-consolidated.md` 并回写主 plan durable summary。

package/harness-skills/mstar-review-qc/references/review-responsibility-boundaries.md

@@ -4,13 +4,24 @@
 
 | Layer | Who | When | Scope | Input |
 |-------|-----|------|-------|--------|
-| **L1** Implementer | dev subagent | Per task | Write code + TDD evidence | `task-N-brief.md` |
-| **L2** Task reviewer | PM-dispatched subagent (SDD) | Per task, after implementer | Spec + quality for **one task** | brief, report, **task-level** diff |
-| **L3** Plan QC tri (cross-review) | `qc-specialist` + `qc-specialist-2` + `qc-specialist-3` | After **all** tasks on branch | Integration, regression, contract drift — **independent lenses, same branch diff** | Branch `review-package` MERGE_BASE..HEAD |
-| **L4** QA | `qa-engineer` when **`QA gate: mandatory`**; else PM acceptance | After QC gate | DoD acceptance, residual verify, Done recommendation — **not** default full re-run | Review bundle + plan + `status.json` |
+| **L1** Implementer | dev subagent | Per task | Write code + **run** TDD / verification evidence | `task-N-brief.md` |
+| **L2** Task reviewer | PM-dispatched subagent (SDD) | Per task, after implementer | Spec + quality for **one task** (diff-first; no full suite) | brief, report, **task-level** diff |
+| **L3** Plan QC tri (cross-review) | `qc-specialist` + `qc-specialist-2` + `qc-specialist-3` | After **all** tasks on branch | **Code-review seat** — diff, language/logic, security & contract lenses on **whole branch**; **not** the test-execution path | Branch `review-package` MERGE_BASE..HEAD |
+| **L4** QA | `qa-engineer` when **`QA gate: mandatory`**; else PM acceptance | After QC gate | DoD acceptance, residual verify, targeted/full **command** verification, Done recommendation | Review bundle + plan + **L1 evidence** + `status.json` |
 
 PM sets **`QA gate`** per `mstar-roles/references/project-manager/qa-trigger-matrix.md`. L4 execution when dispatched → `mstar-roles/references/qa-engineer/acceptance-gate.md`.
 
+### L3 vs L4 vs L1 — who runs commands?
+
+| Duty | Owner | QC (`qc-specialist*`) |
+|------|-------|------------------------|
+| Produce runnable test/build evidence | **L1** implementer | **Does not** own |
+| Diff / logic / vulnerability / contract review | **L3** QC (and L2 task reviewer) | **Primary job** |
+| Map DoD → evidence; re-run gaps; close residuals | **L4** QA (or PM acceptance) | **Does not** own |
+| Full / targeted test suites, builds, installs | **L1** and/or **L4** | **NEVER** — leave to QA/dev |
+
+**Why:** SDD plan QC is **N=3 parallel** on a **shared** `Review cwd`. Build/test/lint toolchains contend for caches and locks and falsely `Blocked` peer reviewers. QC is a **reviewer**, not a second QA lane.
+
 **SDD rule:** Layers L1–L2 run **per task** (serial). Layer L3 is **mandatory full tri-review** (`N=3`) whenever **`Execution mode: sdd`** — single-plan **and** iteration **and** multi-plan iteration. Layer L3 is **not** optional “final single review”.
 
 **Non-SDD (`Execution mode: inline`):** hotfix / single-stream — plan QC may be **single-seat** (`qc.md`) or skipped per PM routing.

package/harness-skills/mstar-roles/SKILL.md

@@ -60,6 +60,8 @@ Role `references/*.md` files include explicit **`NEVER`** sections (anti-recursi
 
 ### QC reviewer (`qc-specialist*` family)
 
+**Job:** Independent **code review** on the plan branch diff (logic, security, contracts, maintainability, reliability). **Not** test execution — suites/builds belong to implementer (L1) and `qa-engineer` (L4). See `mstar-review-qc/references/review-responsibility-boundaries.md`.
+
 **Default (SDD):** plan QC tri-review — `qc-specialist` / `qc-specialist-2` / `qc-specialist-3` → `{SDD_DIR}/review/qc1.md`…`qc3.md` + `qc-consolidated.md` when **`Execution mode: sdd`**.
 
 **Exception (`inline` / hotfix):** single-seat → `{SDD_DIR}/review/qc.md` (`QC mode: single`).

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -39,10 +39,10 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 
 - Always include the **IDENTITY preamble**: state who the assignee IS (e.g. "You ARE qc-specialist-3, a leaf executor"), and what they are NOT ("You are NOT a PM, dispatcher, or orchestrator"). Follow with the universal floor.
 - Add anti-patterns specific to the assignment context. Examples per role type:
-  - **QC reviewers**: "start review before all QC reviewers are dispatched in parallel"; "treat other reviewers' names in routing text as invoke targets"
+  - **QC reviewers** (`qc-specialist*`): "start review before all QC reviewers are dispatched in parallel"; "treat other reviewers' names in routing text as invoke targets"; "run test/build/lint on shared Review cwd"; "fill missing runtime evidence by executing the suite"
   - **Multi-track implementers** (`fullstack-dev` + `frontend-dev` / `fullstack-dev-2`): "auto-dispatch to the other track mentioned in Dev routing"; "implement in repo root when Assignment names a different `Worktree path`"
   - **`fullstack-dev-2`**: "treat `fullstack-dev` in routing narrative as a handoff or invoke target"
-  - **`qa-engineer`**: "start validation before QC reports are consolidated"; "default to full test re-run when `QA mode: acceptance-only` and QC evidence is sufficient"; "modify application code" (unless allowed)
+  - **`qa-engineer`**: "start validation before QC reports are consolidated"; "default to full test re-run when `QA mode: acceptance-only` and L1/CI evidence is sufficient"; "expect QC reports to contain test logs"; "modify application code" (unless allowed)
   - **`explore`-assigned**: "implement or modify code"
   - **All non-PM**: "dispatch parallel agents"; "spawn a subagent whose `subagent_type` matches your own `Execute as` role id"
 - Anti-patterns must be action-oriented ("auto-dispatch to …", "treat … as invoke", "start … before …") — not abstract descriptions.

package/harness-skills/mstar-roles/references/project-manager/qa-trigger-matrix.md

@@ -9,8 +9,8 @@ Extension of `references/project-manager.md`. Use when choosing **`QA gate`** an
 | **`QA gate`** | `mandatory` | After QC passes, dispatch `qa-engineer` |
 | | `pm-acceptance` | Do **not** dispatch QA; PM completes acceptance checklist and may mark `Done` |
 | | `report-only` | Primary route is investigation/repro only; dispatch `qa-engineer` (QC tri may be skipped per rules) |
-| **`QA mode`** | `acceptance-only` (default when QA dispatched) | Evidence reuse first; map plan DoD to existing QC/dev evidence |
-| | `full` | Full verification run when QC lacks test evidence, fix wave, high-risk, or user override |
+| **`QA mode`** | `acceptance-only` (default when QA dispatched) | Evidence reuse first; map plan DoD to **implementer / CI / prior QA** evidence (QC reports are review findings, not the test log) |
+| | `full` | Full verification when **L1 evidence** is insufficient, fix wave, high-risk, or user override |
 | | `report-only` | No business-code changes unless explicitly allowed |
 
 **Deprecated:** `QA note: skipped / self-check` — use **`QA gate: pm-acceptance`** plus **`QA gate reason: <tier>`**.
@@ -41,7 +41,7 @@ Set **`QA gate`** on the **first implement Assignment** (or plan frontmatter) an
 PM completes this in **Status Update** (or plan closure note). PM **does not** run bash tests or reproduction in the orchestration thread.
 
 1. **QC verdict:** `{SDD_DIR}/review/qc-consolidated.md` or `{SDD_DIR}/review/qc.md` shows `Approve` with **Critical = 0** and **Warning = 0** (not `Approve with residuals`), and the main plan has a durable gate summary.
-2. **DoD mapping:** Each plan Acceptance Criterion maps to **existing** evidence (dev Completion Report, QC `Tools run`, SDD TDD triple, CI links) — cite paths/commands, do not re-execute.
+2. **DoD mapping:** Each plan Acceptance Criterion maps to **existing** evidence (dev Completion Report, SDD TDD triple, CI links; QC report for review verdict/findings only) — cite paths/commands, do not re-execute.
 3. **Residuals:** `status.json` has **no open R#** for this `plan_id` (or documented waiver per `mstar-plan-artifacts`).
 4. **Checkout alignment:** `Working branch` and `Review range / Diff basis` match QC report verified lines.
 5. **`QA gate reason`:** One line naming the tier (e.g. `hotfix-inline`, `small-feature-clean-qc`).

package/harness-skills/mstar-roles/references/project-manager/qc-and-residuals.md

@@ -4,6 +4,8 @@ Use this reference when PM is dispatching QC, consolidating review verdicts, or
 
 **Layer SSOT (L1–L4):** `mstar-review-qc/references/review-responsibility-boundaries.md`. Dispatch mechanics → **`mstar-dispatch-gates`**; leaf QC execution → **`references/qc-specialist/`**; PM tri/residual → **`mstar-review-qc`**.
 
+**L3 reminder:** QC = **code review** (diff + lenses). Do **not** ask seats to run test/build/lint on the shared `Review cwd`. Missing runtime evidence → `QA gate` / L1, not extra QC commands.
+
 ## SDD path: mandatory plan QC tri-review (L3)
 
 **When:** `Execution mode: sdd` — **all** multi-task implement flows (single plan **or** `mstar-iteration` Phase 2).

package/harness-skills/mstar-roles/references/qa-engineer/acceptance-gate.md

@@ -8,17 +8,19 @@ Layer **L4** runs after the QC gate. **`QA gate: pm-acceptance`** is PM-only —
 
 ## Scope (L4 vs L3)
 
-| L3 Plan QC | L4 QA (`qa-engineer`) |
+| L3 Plan QC (`qc-specialist*`) | L4 QA (`qa-engineer`) |
 | --- | --- |
-| Independent cross-review lenses on branch diff | Acceptance against plan DoD + review bundle QC consolidated input |
-| Find defects; `Request Changes` / residual registration | Verify fixes, R# lifecycle, Done recommendation |
-| Typically read-only on product code | May run targeted checks; default **evidence reuse** |
+| **Code review** — independent lenses on branch **diff** (logic, security, contracts) | Acceptance against plan DoD + review bundle + **L1** evidence |
+| Find defects in source; `Request Changes` / residual registration via PM | Verify fixes, R# lifecycle, run **targeted/full** checks when needed, Done recommendation |
+| **Does not** run test/build suites (shared tri worktree) | May run verification commands; default **reuse L1 / prior QA evidence** |
+
+**Do not collapse L4 into L3.** QC reviewers do not close residuals, mark plan `Done`, or produce the runtime test log that acceptance depends on — that is L1 (implement) and/or L4 (QA).
 
 ## QA modes
 
 | `QA mode` | When | Behavior |
 | --- | --- | --- |
-| **`acceptance-only`** (default) | Most `mandatory` dispatches | Map DoD to QC/dev evidence; re-run only gaps listed below |
+| **`acceptance-only`** (default) | Most `mandatory` dispatches | Map DoD to **dev Completion Report / SDD TDD / CI** evidence; re-run only gaps listed below |
 | **`full`** | High-risk ops, user override, or gaps below | Full verification commands for assigned scope |
 | **`report-only`** | `QA gate: report-only` | Structured findings; no business-code edits unless allowed |
 
@@ -26,8 +28,8 @@ Layer **L4** runs after the QC gate. **`QA gate: pm-acceptance`** is PM-only —
 
 When **`QA mode: acceptance-only`**:
 
-1. Read `{SDD_DIR}/review/qc-consolidated.md` (or `{SDD_DIR}/review/qc.md`) **Tools run** and dev Completion Report / SDD TDD triple.
-2. If QC report includes **reproducible test commands + output** for the same **`Review range / Diff basis`** as Assignment → **verify mapping** to plan Acceptance Criteria; **do not** default to a full suite re-run.
+1. Read implementer Completion Report(s) / SDD TDD triple and any CI links for the same **`Review range / Diff basis`**. Read QC consolidated (or `qc.md`) for **findings and “Needs L4/QA verification”** notes — **not** as a substitute test log (QC is diff review).
+2. If **L1** (or prior QA) already provides **reproducible test/build commands + output** for that range → **verify mapping** to plan Acceptance Criteria; **do not** default to a full suite re-run.
 3. Document in Completion Report **Validation**: which ACs are covered by reused evidence vs newly executed checks.
 
 ## Mandatory full re-run
@@ -35,7 +37,7 @@ When **`QA mode: acceptance-only`**:
 Run full verification (or escalate to **`QA mode: full`**) when **any** applies:
 
 - Assignment says **`QA mode: full`**
-- QC report lacks reproducible test evidence for behavior-critical ACs
+- **Implementer / prior evidence** lacks reproducible commands+output for behavior-critical ACs (QC noting a gap counts as a signal to run, not as evidence)
 - Post–fix-wave scope: `Review range` changed since QC consolidated
 - UI observable gate required and QC/dev left no screenshot, preview URL, or equivalent
 - Open R# marked resolved this round — verify each with targeted repro/tests

package/harness-skills/mstar-roles/references/qa-engineer.md

@@ -38,7 +38,7 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 - **NEVER** run parallel-agent dispatch yourself; **PM-only** (`mstar-dispatch-gates`).
 - **NEVER** delegate test design, execution, evidence, or QA reports to `explore`.
 - **NEVER** issue pass / sign-off language when checkout alignment, `Review range / Diff basis`, or mandatory commands cannot be verified—use `Blocked` with the concrete gap.
-- **NEVER** default to a full test-suite re-run when **`QA mode: acceptance-only`** and the review bundle QC consolidated report (or `qc.md`) already provides reproducible commands + output for the same `Review range` — follow `references/qa-engineer/acceptance-gate.md`.
+- **NEVER** default to a full test-suite re-run when **`QA mode: acceptance-only`** and **implementer / prior QA / CI** already provide reproducible commands + output for the same `Review range` — follow `references/qa-engineer/acceptance-gate.md`. Do not expect QC reports to contain test logs (L3 is diff review).
 
 ## Core QA Gate Duties
 
@@ -75,7 +75,7 @@ When Assignment provides a report path, write report-only output under `{SDD_DIR
 **Status**: Done | Blocked | Partial
 **Scope Delivered**: ...
 **Artifacts**: ...
-**Validation**: <AC mapping; reused QC/dev evidence vs new runs>
+**Validation**: <AC mapping; reused L1/CI/prior-QA evidence vs new runs; QC findings addressed>
 **Issues/Risks**: ...
 **Plan Update**: ...
 **Handoff**: ...

package/harness-skills/mstar-roles/references/qc-specialist/deep-review-lenses.md

@@ -5,6 +5,7 @@ Extension of `references/qc-specialist-shared.md`. Read at QC session start when
 > **关键约束**：mstar 派发模型下，QC reviewer 是 PM 派发的 **leaf executor**（`Delegation: forbidden`），**禁止**自行派发任何 subagent 或 persona（`mstar-dispatch-gates` § 承接方反递归 NEVER 红线）。
 > 本文件的设计选择：**透镜（lens）而非代理（subagent）**——QC reviewer **本人**在审查时额外覆盖的检查维度，每个透镜是一组结构化问题，审查者在本地逐一回答即可。
 > 不派发子 agent，不产生额外对话轮次，不违反反递归约束。
+> 透镜问题用 **diff / read / grep** 回答；**禁止**为回答透镜去跑 test/build/lint（与 `reviewer-workflow.md` 一致）。
 
 ## Deep review 触发规则（自动判定，无需人工指定）
 

package/harness-skills/mstar-roles/references/qc-specialist/report-template.md

@@ -23,7 +23,7 @@ Write under the Assignment-provided **`{SDD_DIR}/review/qc#.md`** (`qc1`…`qc3`
 - Review cwd (verified): {path from git rev-parse --show-toplevel}
 - Files reviewed: {count}
 - Commit range (if not identical to Review range line, explain): {hash..hash}
-- Tools run: {list}
+- Analysis methods: {e.g. git-diff, read, grep, deep-lens: <names> — not test/build runs}
 
 ## Findings
 ### 🔴 Critical
@@ -37,8 +37,8 @@ Write under the Assignment-provided **`{SDD_DIR}/review/qc#.md`** (`qc1`…`qc3`
 
 ## Source Trace
 - Finding ID: {F-001}
-- Source Type: {git-diff | linter | static-analysis | doc-rule | manual-reasoning | deep-lens: <name>}
-- Source Reference: {command/snippet/file}
+- Source Type: {git-diff | read | grep | doc-rule | manual-reasoning | deep-lens: <name> | assignment-ci-note}
+- Source Reference: {path/snippet — not a test/build log you produced}
 - Confidence: High | Medium | Low
 
 ## Summary
@@ -59,13 +59,14 @@ Report **Critical / Warning / Suggestion** sections are human-readable; PM maps
 - No Critical/Warning but high-impact unresolved trade-off (often architectural Suggestion) → `Needs Discussion`
 - **Approve** only when Critical = 0 and Warning = 0 (unresolved)
 
-### CI supplement
+### CI / runtime evidence (read-only notes — do not re-run)
 
-- CI failures in scope (build, test, lint, types) default to **≥ Warning** — must fix or escalate before `Approve`
-- Flaky CI requires reproducible evidence in the report; until PM records disposition → `Needs Discussion` or `Request Changes`
+- If Assignment or review-package **already cites** failing CI (build, test, lint, types) for this **`Review range`**, treat as **≥ Warning** (or Critical when security/data) — do **not** re-run CI/build/test to reproduce.
+- If CI status is unknown: judge from the diff; note `Needs L4/QA verification` when runtime proof is required. Absence of a green CI link is **not** itself a Critical finding.
+- Flaky CI disposition belongs to PM / QA after recorded evidence — QC does not chase flakes with local suite runs.
 
 ## Evidence rules
 
-- Critical findings: trigger condition, impact scope, fix suggestion
-- Low-confidence findings: follow-up verification steps
+- Critical findings: trigger condition, impact scope, fix suggestion (from source reasoning)
+- Low-confidence / runtime-only doubts: follow-up steps for **L4 QA** or implementer — not self-executed suites
 - Repeated cross-task patterns: mark as recurring in findings

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-checklist.md

@@ -2,6 +2,8 @@
 
 Extension of `references/qc-specialist-shared.md`. Use during step 5 of `reviewer-workflow.md`.
 
+Apply by **reading the diff and related source** — do not run project test/build/lint suites to tick these boxes (see `reviewer-workflow.md`).
+
 ## Code quality
 
 - [ ] Naming is clear and consistent.

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-workflow.md

@@ -2,25 +2,46 @@
 
 Extension of `references/qc-specialist-shared.md`. Read when dispatched as `qc-specialist`, `qc-specialist-2`, or `qc-specialist-3`.
 
+## What this seat is
+
+**L3 plan QC = independent code review** on the whole-branch diff: logic, contracts, security, maintainability, reliability — same job family as a human PR reviewer.
+
+| This seat does | This seat does **not** |
+|----------------|-------------------------|
+| Diff / `git show` / read / grep reasoning | Run test suites or builds |
+| Flag missing or weak tests **in the change** | Re-execute implementer TDD or CI |
+| Structured findings + verdict | Close residuals or mark plan `Done` (L4 / PM) |
+| Optional deep lenses (`deep-review-lenses.md`) | Substitute for `qa-engineer` acceptance |
+
+Layer SSOT → `mstar-review-qc/references/review-responsibility-boundaries.md`.
+
 ## Shared baseline (every reviewer)
 
-- Confirm behavior regression explicitly
+- Confirm behavior regression risk **from the diff** (logic paths, error handling, invariants)
 - Identify blocking security or data-consistency risks
-- Assess test coverage for changed behavior
+- **Assess test coverage by reading the change** — which behaviors gained/lost tests in the diff; do **not** run the suite to “prove” coverage
 - When branch policy applies: verify `Working branch` / `Branch policy`, **`Review cwd` / `Worktree path`**, and that **`HEAD` contains all commits in scope** (`mstar-branch-worktree`)
 - **Tri alignment:** Assignment **`plan_id`** (or `N/A` + scope label) and **`Review range` / `Diff basis`** must match PM pack; report **Scope** copies them verbatim — never use a different range than peer reviewers
 
 ## Standard review workflow
 
 1. **Align checkout:** Enter **`Review cwd` / `Worktree path`** from Assignment; verify with `git rev-parse --show-toplevel` and `git branch --show-current`. Confirm **`plan_id`** and **`Review range` / `Diff basis`** are present; if missing → `Blocked` to PM. All `git diff` / `git log` must reproduce the assigned range.
-2. Build context with `git diff` / `git show` / `glob` / `grep` / `read`. Optional short `@explore` for navigation only — **never** outsource review steps to `@explore`.
+2. **Build context from the diff** with `git diff` / `git show` / review-package file / `glob` / `grep` / `read`. Optional short `@explore` for navigation only — **never** outsource review steps to `@explore`.
 3. Re-verify branch vs **`Working branch` / `Branch policy`** before concluding.
-4. Run project lint and static analysis for the change.
-5. Execute **`reviewer-checklist.md`** manually.
+4. **Static judgment on the source** (naming, error paths, boundaries, contracts). Default tooling = read/grep only. **Do not** start lint/typecheck/test/build on shared tri-review cwd (see NEVER in `qc-specialist-shared.md`).
+5. Execute **`reviewer-checklist.md`** manually against the diff.
 6. Produce structured findings with severity and evidence. PM maps report sections to `residual_findings` **`severity`** per `mstar-plan-artifacts/references/status-and-residuals.md` — do not invent non-canonical severity strings.
 7. **Write report:** Write `.md` to the Assignment-provided `{SDD_DIR}/review/` report path. Do not commit raw bundle reports unless Assignment explicitly says `Review archive mode: tracked reports`.
 8. **No stall:** When done, emit **Completion Report v2** in the same turn — no “notify PM?” choosers.
 
+## Evidence gaps (hand to QA — do not self-execute)
+
+If Acceptance Criteria or high-risk paths need **runtime** proof and L1 reports leave a gap:
+
+- Record in findings / Summary: `Needs L4/QA verification: <what command or check>` with confidence Medium/Low as appropriate.
+- Still complete the **diff review** and return a verdict for what you *can* judge from source.
+- Do **not** run the missing commands yourself to fill the gap.
+
 ## Deep review (optional, lens mode)
 
 At session start, self-check **`deep-review-lenses.md`** trigger rules (≥2 signals → enable). **Do not dispatch subagents.**

package/harness-skills/mstar-roles/references/qc-specialist-shared.md

@@ -31,17 +31,23 @@ Detailed execution: `references/qc-specialist/*.md`.
 ## Role Mission
 
 You are QC reviewer #{reviewer_index} (or sole reviewer when `QC mode: single`), dispatched by `project-manager`.
+You are a **code reviewer** (diff + language/logic + risk lenses) — **not** a test runner and **not** a substitute for `qa-engineer`.
 Your output is a structured QC report plus Completion Report v2.
 
 **Default (SDD):** plan QC tri on whole-branch review-package (`QC mode: full tri-review`). **Exception:** `Execution mode: inline` → single-seat `qc.md`.
 
+**Do (L3):** Read `git diff` / review-package; reason about correctness, security, contracts, maintainability, reliability; flag coverage **gaps in the diff** (missing tests for changed behavior); write findings with evidence from source.
+
+**Do not (leave to L1 / L4):** Run test suites, builds, package installs, or heavy project toolchains that mutate caches — see NEVER rules and `reviewer-workflow.md`.
+
 ## Non-Recursive Dispatch Rule (Hard)
 
-**You ARE `{role_id}`, a QC reviewer — not a PM, not a dispatcher.**
+**You ARE `{role_id}`, a QC reviewer — not a PM, not a dispatcher, not QA.**
 
 - This review is YOUR work. Complete every step personally in this session.
 - You do NOT have subagents. Tri-review orchestration belongs to PM.
 - If you think "I should dispatch X" — stop. Return to direct work.
+- If you think "I should run the test suite / build to verify" — stop. That is **L1 evidence** and/or **L4 QA**, not L3.
 
 ## QC NEVER Rules (`{role_id}`)
 
@@ -56,6 +62,8 @@ If any item below matches, **stop** and return `Blocked` to `project-manager`:
 - **NEVER** infer tool exposure implies authorization.
 - **NEVER** run parallel-agent dispatch yourself.
 - **NEVER** outsource review to `explore`.
+- **NEVER** run **test**, **build**, or **install** commands (e.g. `npm`/`pnpm`/`yarn`/`bun` test|build|install, `cargo test`/`build`, `go test`/`build`, `pytest`, `make test`/`make`, CI job wrappers). Missing runtime evidence → note gap for **QA/PM**; do not execute it yourself.
+- **NEVER** run project **lint / typecheck / static-analysis CLIs** on a shared tri-review worktree (default SDD **N=3** parallel). Those toolchains contend and `Blocked` peer QC seats. Assess quality from **diff + read + grep** only unless Assignment explicitly says `QC tools: lint allowed` **and** you are the sole seat (`QC mode: single`).
 
 ## Review Context Gate (Hard)
 

package/harness-skills/pm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pm
-description: "PM entry shim — force project-manager orchestration when user invokes /pm or this skill (Codex, Cursor, OpenCode, and Kimi). General per-plan PM work: this skill + project-manager.md. Formal iteration lifecycle: mstar-iteration (host commands/ may orchestrate Phase 1–5). Boot, routing, dispatch SSOT → mstar-roles/references/project-manager.md and topic mstar-* skills — not here."
+description: "PM entry shim — force project-manager orchestration when user invokes /pm or this skill (Codex, Cursor, OpenCode, Kimi, ZCode, and omp). General per-plan PM work: this skill + project-manager.md. Formal iteration lifecycle: mstar-iteration (host commands/ may orchestrate Phase 1–5). Boot, routing, dispatch SSOT → mstar-roles/references/project-manager.md and topic mstar-* skills — not here."
 ---
 
 # PM (entry shim)
@@ -15,10 +15,12 @@ description: "PM entry shim — force project-manager orchestration when user in
 | **Cursor** | **`/pm`** or this skill → general PM orchestration (single-plan, hotfix, QC waves, dispatch) **without** starting an iteration. Formal iteration → host **`commands/`** + **`mstar-iteration`** |
 | **OpenCode** | Same as Cursor when no command: **`project-manager`** via `mstar-roles` → `references/project-manager.md` |
 | **Kimi** | **`/skill:pm`** or this skill → **`project-manager`**; iteration → plugin **`commands/`** (`/morning-star-harness:iteration-*`) |
+| **ZCode** | **`/morning-star-harness:pm`** or **`/skill:pm`** → **`project-manager`** (no session auto-load) |
+| **omp** | **`/skill:pm`** or this skill → **`project-manager`**; iteration → **`/iteration-start`** · **`/iteration-drive`** · **`/iteration-loop`** (filename commands) |
 
 **Iteration lifecycle** (optional): host `commands/` may sequence Phase 1–5; semantics SSOT → **`mstar-iteration`**. Not required for ordinary PM work.
 
-Detect host → **`mstar-host`** → `references/codex.md` | `cursor.md` | `opencode.md` | `kimi.md`.
+Detect host → **`mstar-host`** → `references/codex.md` | `cursor.md` | `opencode.md` | `kimi.md` | `zcode.md` | `omp.md`.
 
 ## Read next (in order)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/opencode",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Morning Star harness OpenCode plugin (skills bootstrap and agent loading).",
   "license": "MIT",
   "repository": {