@mstar-harness/opencode 1.7.1 → 1.8.1

package/harness-skills/mstar-roles/references/_shared/leaf-executor-core.md

@@ -0,0 +1,46 @@
+# Leaf Executor Core (shared blocks)
+
+> Shared by all leaf-executor role references in `mstar-roles/references/`. Each role file references this for the identical Completion Report template, repo-write Git discipline, and plan/documentation rules. **Read `mstar-harness-core` first.** Role-specific NEVER rules, mission, and responsibilities stay in each role file — this file holds only the uniform blocks.
+
+## Completion Report
+
+Every leaf executor returns this template (only `**Agent**` and content fields change per role):
+
+```markdown
+## Completion Report
+
+**Agent**: {role_id}
+**Task**: ...
+**Status**: Done | Blocked | Partial
+**Scope Delivered**: ...
+**Artifacts**: ...
+**Validation**: ...
+**Issues/Risks**: ...
+**Plan Update**: ...
+**Handoff**: ...
+**Git**: ...
+```
+
+`{role_id}` = the role's own id (e.g. `fullstack-dev`, `frontend-dev`, `ops-engineer`, `qa-engineer`, `architect`, `product-manager`, `prompt-engineer`, `writing-specialist`, `qc-specialist*`).
+
+## Git NEVER (repo writes)
+
+Apply when the assignment writes tracked repo files:
+
+- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files — Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
+- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+
+## Plan & Documentation Rules
+
+- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
+- Update assigned task checkboxes and plan notes for your scope.
+- Do not mark full plan `Done` (only `project-manager` or `qa-engineer` per `mstar-harness-core`).
+
+## Non-Recursive Dispatch Rule (shared shape)
+
+All leaf executors share this hard rule (role-specific sibling lists stay in each role file):
+
+- Complete assigned work in this session.
+- Do not recursively dispatch sibling roles unless explicitly authorized via `Delegation: allowed (...)`.
+- `Execute as: {role_id}` is identity lock, not orchestration permission.
+- If required inputs are missing or prerequisites unmet, return `Blocked` to PM rather than inventing delegation.

package/harness-skills/mstar-roles/references/architect.md

@@ -105,30 +105,10 @@ Do not create your own branch strategy.
 ## Effort (agent-oriented)
 ```
 
-## Completion Report v2
+## Completion Report
 
-```markdown
-## Completion Report v2
-
-**Agent**: architect
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+Template (`{role_id}` = `architect`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
 ## Plan & Documentation Rules
 
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
-- Update architecture-related plan sections and task checkboxes only for your assigned scope.
-- Do not mark overall plan `Done`; that authority belongs to `project-manager` or `qa-engineer` only (`mstar-harness-core`).
-
-### Git NEVER (when you touched tracked repo files)
-
-- **NEVER** finish a task ID / coverage unit with saves but **no** `git commit` on the authorized `Working branch` when repo writes were required—Completion Report **Git** must show a real `git log -1 --oneline` (not `N/A`) unless the assignment declared read-only or user-exclusive commits.
-- **NEVER** defer every commit to one giant end-of-task batch unless PM explicitly allowed batched commits for this scope.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。**Architect-specific**：只更新 architecture 相关 plan section 与本 scope task checkbox；不标 overall plan `Done`。

package/harness-skills/mstar-roles/references/frontend-dev.md

@@ -61,30 +61,10 @@ If plan drift appears during implementation, request plan write-back before cont
 - Same-repo concurrent writes require worktree isolation
 - Do not self-decide branch pivots to default branch
 
-## Completion Report v2
-
-```markdown
-## Completion Report v2
-
-**Agent**: frontend-dev
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+## Completion Report
 
-## Plan & Documentation Rules
-
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
-- Update assigned task checkboxes and related plan sections.
-- Do not mark full plan `Done` (only `project-manager` or `qa-engineer` per `mstar-harness-core`).
+Template (`{role_id}` = `frontend-dev`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
-### Git NEVER (repo writes)
+## Plan & Documentation Rules
 
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。

package/harness-skills/mstar-roles/references/fullstack-dev-shared.md

@@ -80,30 +80,10 @@ If plan drift appears, request plan update before continuing.
 3. Test implementation for assigned scope
 4. Self-verification and evidence generation
 
-## Completion Report v2
-
-```markdown
-## Completion Report v2
-
-**Agent**: {role_id}
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+## Completion Report
 
-## Plan & Documentation Rules
-
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
-- Update assigned task checkboxes and plan notes for your scope.
-- Do not mark full plan `Done` (only `project-manager` or `qa-engineer` per `mstar-harness-core`).
+Template (fill `{role_id}` = `{role_id}`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
-### Git NEVER (repo writes)
+## Plan & Documentation Rules
 
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。

package/harness-skills/mstar-roles/references/ops-engineer.md

@@ -69,30 +69,10 @@ When assignment is marked `high-risk`:
 ## Monitoring Checks
 ```
 
-## Completion Report v2
+## Completion Report
 
-```markdown
-## Completion Report v2
-
-**Agent**: ops-engineer
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+Template (`{role_id}` = `ops-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
 ## Plan & Documentation Rules
 
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` from `mstar-plan-conventions`.
-- Update assigned plan tasks and notes.
-- Do not mark full plan `Done`.
-
-### Git NEVER (repo writes)
-
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。

package/harness-skills/mstar-roles/references/product-manager.md

@@ -98,30 +98,10 @@ If writing files to business repo, use only PM-assigned `Working branch` / `Bran
 
 - **NEVER** embed human calendar estimates (person-days, FTE, “waiting for review X days”) inside **Effort (agent-oriented)** fields; keep agent-only sizing per `mstar-plan-conventions` `references/effort-estimation.md`.
 
-## Completion Report v2
+## Completion Report
 
-```markdown
-## Completion Report v2
-
-**Agent**: product-manager
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+Template (`{role_id}` = `product-manager`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
 ## Plan & Documentation Rules
 
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` from `mstar-plan-conventions`.
-- Update assigned plan sections and task checkboxes.
-- Do not set full plan to `Done`.
-
-### Git NEVER (repo writes)
-
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。**Product-specific**：只更新 assigned plan section 与 task checkbox；不标 full plan `Done`。

package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md

@@ -27,7 +27,7 @@ For assignees (non-PM):
 - **NEVER** assume exposed `Task` / subagent menus imply you may call them; **tool availability ≠ delegation authorization**.
 - **NEVER** execute parallel-agent dispatch as a leaf assignee; dispatch is **PM-orchestration-only** (`mstar-dispatch-gates`).
 - **NEVER** delegate the main deliverable of this assignment to `explore` (read-only orientation only, per `mstar-harness-core`).
-- **NEVER** claim `Done` / pass in **Completion Report v2** without the commands, logs, or artifacts explicitly required by the assignment’s **Evidence Required** section (see `mstar-harness-core` evidence gates).
+- **NEVER** claim `Done` / pass in **Completion Report** without the commands, logs, or artifacts explicitly required by the assignment’s **Evidence Required** section (see `mstar-harness-core` evidence gates).
 
 ## Assignment Template (Canonical)
 
@@ -103,7 +103,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 **PM Task Board coverage**: <task ids>
 **Roadmap / deferred scope**: <required when staged, partial, or temporary; otherwise N/A>
 **Task**: <concrete work aligned with coverage>
-**Checkpoint Comment Rule**: commit -> Completion Report v2 -> PM Status Update -> next batch
+**Checkpoint Comment Rule**: commit -> Completion Report -> PM Status Update -> next batch
 **Why batching is safe**: <required when batching >=3 IDs>
 **Scope**:
 - In: ...
@@ -124,7 +124,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
 - `explore` is read-only orientation only
 - Tool availability ≠ delegation authorization
 **Plan Path**: absolute `<control_worktree_path>/{PLAN_DIR}/...` when L1 lease gate active | `{PLAN_DIR}/...` when waived / single checkout | N/A
-**Report Format**: Completion Report v2
+**Report Format**: Completion Report
 **Execution evidence**: <RCA/test-first/review feedback/evidence expectations for the assignee, if applicable>
 ```
 
@@ -140,10 +140,10 @@ When `metadata.control_worktree_path` is set and worktree mode is **not** waived
 | **`SDD dir`** | Absolute under control harness; run `sdd-workspace` with `MSTAR_CONTROL_ROOT=<control_worktree_path>` when cwd is the feature tree |
 
 Do **not** waive worktree because default-gitignored `plans/` are missing under the feature checkout — see `mstar-branch-worktree` 「Harness path SSOT under default gitignore」.
-## Completion Report v2 Template
+## Completion Report Template
 
 ```markdown
-## Completion Report v2
+## Completion Report
 
 **Agent**: <role-id>
 **Task**: ...

package/harness-skills/mstar-roles/references/project-manager.md

@@ -138,18 +138,9 @@ If any item below matches, fix the dispatch/plan state or mark `Blocked`—do **
 
 ---
 
-## Phase Gates (Minimal Tree)
+## Phase Gates
 
-Before first implement dispatch (non-hotfix):
-
-1. `specify` done
-2. `clarify` done (no unresolved high-impact ambiguity)
-3. `plan` done and referenceable
-4. `tasks` + PM Task Board ready for non-trivial plan
-5. Roadmap written when delivery is split, deferred, or temporary
-6. New constraints discovered are written back to plan first
-
-If any fail -> do not dispatch implement.
+完整 Prepare/Execute 门禁树（`specify → clarify → plan` → `plan(locked) → tasks → implement`）、意图门禁、hotfix 压缩路径、Phase Gate 最小证据 → **`mstar-phase-gates`**。PM 首次 implement dispatch（非 hotfix）前须确认 phase-gates 全绿：specify/clarify/plan 完成、tasks + PM Task Board ready、split/deferred/temporary 已写 roadmap、新约束已回写 plan。任一未过 → 不 dispatch implement。
 
 ### PM entry sessions
 
@@ -252,7 +243,7 @@ Before first implement dispatch:
 - If delivery spans batches, include the full roadmap: batch order, deferred scope, dependencies, owner/trigger, and final Done definition
 - Every implement Assignment declares `PM Task Board coverage`
 - Default batch size 1-2 IDs; `>=3` requires `Why batching is safe`
-- Completion rhythm: commit -> Completion Report v2 -> PM Status Update -> next dispatch
+- Completion rhythm: commit -> Completion Report -> PM Status Update -> next dispatch
 
 ---
 
@@ -281,7 +272,7 @@ Use canonical templates from:
 `references/project-manager/dispatch-and-assignment.md`
 
 - `## Assignment`
-- `## Completion Report v2`
+- `## Completion Report`
 - `## Status Update`
 
 Minimum invariants:

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -62,29 +62,10 @@ When creating a new skill, making a major skill rewrite, changing frontmatter `d
 - Redundancy removed before adding new constraints
 - At least one replayable scenario exists for regression check
 
-## Completion Report v2
-
-```markdown
-## Completion Report v2
-
-**Agent**: prompt-engineer
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+## Completion Report
 
-## Plan & Documentation Rules
-
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
-- Keep role text concise; move reusable long-form guidance into shared `mstar-*` skills.
+Template (`{role_id}` = `prompt-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
-### Git NEVER (repo writes)
+## Plan & Documentation Rules
 
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must list real commits unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。**Prompt-engineer-specific**：role text 保持精简；可复用长文 guidance 移入 shared `mstar-*` skills。

package/harness-skills/mstar-roles/references/qa-engineer.md

@@ -65,32 +65,13 @@ When Assignment provides a report path, write report-only output under `{SDD_DIR
 ## Recommended owners
 ```
 
-## Completion Report v2
+## Completion Report
 
-```markdown
-## Completion Report v2
-
-**Agent**: qa-engineer
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: <AC mapping; reused L1/CI/prior-QA evidence vs new runs; QC findings addressed>
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+Template (`{role_id}` = `qa-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
 ## Plan & Residual Rules
 
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` from `mstar-plan-conventions`; residual lifecycle from `mstar-plan-artifacts`.
-- QA and PM are the only roles allowed to finalize plan `Done`.
-
-### Git NEVER (repo writes)
-
-- **NEVER** skip per–task-ID commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be a real `git log -1 --oneline` unless read-only was assigned.
-- **NEVER** batch everything into a single closing commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。**QA-specific**：QA 和 PM 是唯一可终结 plan `Done` 的角色；residual lifecycle 来自 `mstar-plan-artifacts`。
 
 ## Detailed References Index
 

package/harness-skills/mstar-roles/references/qc-specialist/deep-review-lenses.md

@@ -47,81 +47,22 @@ QC reviewer 在开工时根据以下信号自判是否启用 deep review。满
 
 ---
 
-## 透镜清单（结构化检查表）
-
-每个透镜是一组审查问题。QC reviewer 在报告中按透镜分节列出发现，每个发现标注来自哪个透镜。
-
-### Modularity Lens
-- [ ] 本次变更是否引入了新的模块依赖？方向是否合理？
-- [ ] 是否有逻辑被放在不合适的模块/层级中（如 controller 中的业务逻辑、model 中的视图逻辑）？
-- [ ] 新引入的公共接口是否职责单一、边界清晰？
-- [ ] 是否存在循环依赖或隐含的耦合将被后续变更放大？
-
-### Contract Lens
-- [ ] 任何公共 API/接口签名是否发生了不兼容变更？
-- [ ] 若有 breaking change，是否在 plan 中声明？是否有迁移说明？
-- [ ] 新增的 API 端点是否遵循现有命名和参数约定？
-- [ ] 接口返回类型是否稳定（新增字段不使用破坏已有字段解析的方式）？
-
-### Security Lens
-- [ ] 变更是否涉及认证/授权流程？session、token、permission 逻辑是否正确？
-- [ ] 是否存在未验证的用户输入被直接用于数据库查询、命令执行或文件操作？
-- [ ] 敏感数据（密钥、token、密码、PII）是否在日志/错误信息/返回值中泄露？
-- [ ] 新增的访问控制点是否覆盖了所有调用路径？
-
-### Correctness Lens
-- [ ] 错误处理是否显式、可恢复？是否有吞掉关键异常的 catch-all？
-- [ ] 边界条件是否覆盖？（空值、零值、溢出、并发冲突）
-- [ ] 状态转换逻辑是否一致？是否存在中间状态会被外部观察到？
-- [ ] 返回值/副作用是否与声明一致？
-
-### Performance Lens
-- [ ] 是否引入了 N+1 查询？新增的 ORM 调用是否有 eager loading？
-- [ ] 循环或批处理中是否有无界操作？
-- [ ] 新索引是否必要且不会造成写入性能退化？
-- [ ] 大对象/大列表是否做分页或流式处理？
-
-### Reliability Lens
-- [ ] 资源（连接、文件句柄、锁）是否在异常路径中也正确释放？
-- [ ] 外部服务调用是否有超时和重试策略？
-- [ ] 缓存失效策略是否正确（不会长期返回过期数据）？
-- [ ] 是否存在可能无限增长的结构（无界缓存、无界日志、无界队列）？
-
-### Auth Lens
-- [ ] 认证中间件是否覆盖了所有新增端点？
-- [ ] 权限检查是否在业务逻辑执行前完成（先鉴权再操作）？
-- [ ] session 生命周期管理是否正确（创建、续期、失效）？
-- [ ] 是否有权限提升路径（如 admin 操作需二次确认）？
-
-### Input Validation Lens
-- [ ] 所有外部输入（query params、body、headers）是否经过类型/范围/格式验证？
-- [ ] 是否存在可通过输入触发的路径遍历、注入或 XSS？
-- [ ] 文件上传是否有大小/类型检查？
-- [ ] API 返回的错误信息是否在暴露内部实现细节？
-
-### Data Migration Lens
-- [ ] migration 是否可回滚？`down` 方法是否存在且正确？
-- [ ] 是否对大数据量表使用了非阻塞的 migration 策略？
-- [ ] 数据迁移是否保持了一致性（不丢数据、不产生中间脏状态）？
-- [ ] 是否考虑了并发写入场景下的迁移安全性？
-
-### Error Handling Lens
-- [ ] 异常层级是否清晰（业务异常 vs 系统异常）？
-- [ ] 面向用户的错误消息是否安全（不泄露内部细节）？
-- [ ] 关键操作失败后的副作用是否被正确处理（事务回滚、补偿操作）？
-- [ ] 是否有"静默失败"的路径（错误被忽略但后续逻辑假定成功）？
-
-### Standards Lens
-- [ ] 代码风格、命名、文件组织是否符合项目已有约定？
-- [ ] 是否引入了与现有方案冲突的重复实现？
-- [ ] 新依赖的引入是否有充分理由？
-- [ ] 是否遵循了项目 `AGENTS.md` 中的维护契约？
-
-### Testing Lens
-- [ ] 对关键逻辑路径是否有测试覆盖？
-- [ ] 边界和异常路径是否被测试覆盖？
-- [ ] 是否存在仅验证 happy path 而跳过了 failure mode 的测试？
-- [ ] 集成测试是否覆盖了与外部服务的交互边界？
+## 透镜清单（每透镜一行焦点；详细追问由 reviewer 按专业判断展开）
+
+每个透镜是一组审查焦点。QC reviewer 在报告中按透镜分节列出发现，每个发现标注来自哪个透镜（`Source Type: deep-lens: <Lens>`）。
+
+- **Modularity Lens** — 新依赖方向合理；无逻辑错放层级（controller 业务逻辑、model 视图逻辑）；公共接口职责单一边界清晰；无循环依赖/隐含耦合。
+- **Contract Lens** — 公共 API/接口签名无未声明 breaking change（有则 plan 声明 + 迁移说明）；新端点遵循命名/参数约定；返回类型稳定（新字段不破坏已有解析）。
+- **Security Lens** — 认证/授权/session/token/permission 逻辑正确；未验证输入未直入 DB/命令/文件；敏感数据（密钥/token/PII）未在日志/错误/返回值泄露；新访问控制点覆盖所有调用路径。
+- **Correctness Lens** — 错误处理显式可恢复（无吞关键异常的 catch-all）；边界条件覆盖（空/零/溢出/并发）；状态转换一致（无外部可观察中间态）；返回值/副作用与声明一致。
+- **Performance Lens** — 无 N+1 查询（ORM eager loading）；循环/批处理无无界操作；新索引必要且不退化写入；大对象/列表分页或流式。
+- **Reliability Lens** — 资源（连接/句柄/锁）异常路径也释放；外部调用有超时+重试；缓存失效正确（不长期返回过期）；无可能无限增长的结构（无界缓存/日志/队列）。
+- **Auth Lens** — 认证中间件覆盖所有新端点；权限检查在业务逻辑前（先鉴权再操作）；session 生命周期正确（创建/续期/失效）；权限提升路径需二次确认。
+- **Input Validation Lens** — 外部输入（query/body/headers）经类型/范围/格式验证；无可触发路径遍历/注入/XSS；文件上传有大小/类型检查；错误信息不暴露内部实现细节。
+- **Data Migration Lens** — migration 可回滚（`down` 存在且正确）；大表用非阻塞策略；数据一致（不丢/无脏中间态）；并发写入下安全。
+- **Error Handling Lens** — 异常层级清晰（业务 vs 系统）；面向用户错误消息安全；关键操作失败副作用正确处理（事务回滚/补偿）；无"静默失败"路径。
+- **Standards Lens** — 风格/命名/文件组织符项目约定；无与现有冲突的重复实现；新依赖有充分理由；遵循项目 `AGENTS.md` 维护契约。
+- **Testing Lens** — 关键逻辑路径有覆盖；边界/异常路径覆盖；无仅 happy-path 跳 failure-mode；集成测试覆盖外部服务交互边界。
 
 ---
 

package/harness-skills/mstar-roles/references/qc-specialist/reviewer-workflow.md

@@ -32,7 +32,7 @@ Layer SSOT → `mstar-review-qc/references/review-responsibility-boundaries.md`.
 5. Execute **`reviewer-checklist.md`** manually against the diff.
 6. Produce structured findings with severity and evidence. PM maps report sections to `residual_findings` **`severity`** per `mstar-plan-artifacts/references/status-and-residuals.md` — do not invent non-canonical severity strings.
 7. **Write report:** Write `.md` to the Assignment-provided `{SDD_DIR}/review/` report path. Do not commit raw bundle reports unless Assignment explicitly says `Review archive mode: tracked reports`.
-8. **No stall:** When done, emit **Completion Report v2** in the same turn — no “notify PM?” choosers.
+8. **No stall:** When done, emit **Completion Report** in the same turn — no “notify PM?” choosers.
 
 ## Evidence gaps (hand to QA — do not self-execute)
 

package/harness-skills/mstar-roles/references/qc-specialist-shared.md

@@ -32,7 +32,7 @@ Detailed execution: `references/qc-specialist/*.md`.
 
 You are QC reviewer #{reviewer_index} (or sole reviewer when `QC mode: single`), dispatched by `project-manager`.
 You are a **code reviewer** (diff + language/logic + risk lenses) — **not** a test runner and **not** a substitute for `qa-engineer`.
-Your output is a structured QC report plus Completion Report v2.
+Your output is a structured QC report plus Completion Report.
 
 **Default (SDD):** plan QC tri on whole-branch review-package (`QC mode: full tri-review`). **Exception:** `Execution mode: inline` → single-seat `qc.md`.
 
@@ -107,22 +107,9 @@ generated_at: "YYYY-MM-DD"
 ---
 ```
 
-## Completion Report v2
-
-```markdown
-## Completion Report v2
-
-**Agent**: {role_id}
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+## Completion Report
+
+Template (fill `{role_id}`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
 ## Repository Write Scope
 

package/harness-skills/mstar-roles/references/writing-specialist.md

@@ -50,30 +50,10 @@ If any item below matches, **stop** and return `Blocked` to `project-manager` in
 - Keep writing usable and publication-ready
 - Include source notes when factual claims require evidence
 
-## Completion Report v2
-
-```markdown
-## Completion Report v2
-
-**Agent**: writing-specialist
-**Task**: ...
-**Status**: Done | Blocked | Partial
-**Scope Delivered**: ...
-**Artifacts**: ...
-**Validation**: ...
-**Issues/Risks**: ...
-**Plan Update**: ...
-**Handoff**: ...
-**Git**: ...
-```
+## Completion Report
 
-## Plan Rules
-
-- Follow `{HARNESS_DIR}` / `{PLAN_DIR}` conventions from `mstar-plan-conventions`.
-- Update assigned plan tasks only.
-- Do not mark full plan `Done`.
+Template (`{role_id}` = `writing-specialist`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
 
-### Git NEVER (repo writes)
+## Plan Rules
 
-- **NEVER** skip commits on the authorized `Working branch` when you wrote tracked files—Completion Report **Git** must be honest unless read-only was assigned.
-- **NEVER** batch unrelated edits into one opaque commit unless PM explicitly allowed it.
+Repo-write Git discipline + plan/documentation rules → **`references/_shared/leaf-executor-core.md`**（「Git NEVER (repo writes)」+「Plan & Documentation Rules」）。**Writing-specific**：只更新 assigned plan tasks；writing-only scope，PM/QA 拥有 closure。

package/harness-skills/mstar-sdd/SKILL.md

@@ -124,3 +124,4 @@ From repo: `skills/mstar-sdd/scripts/` (bundled in OpenCode as `harness-skills/m
 - `references/implementer-prompt.md`
 - `references/implementer-continuation-prompt.md`
 - `references/task-reviewer-prompt.md`
+- `mstar-plan-artifacts/references/plan-quality-bar.md` — plan self-containment standard (plans must meet this before SDD dispatch)

package/harness-skills/pm/SKILL.md

@@ -20,6 +20,8 @@ description: "PM entry shim — force project-manager orchestration when user in
 
 **Iteration lifecycle** (optional): host `commands/` may sequence Phase 1–5; semantics SSOT → **`mstar-iteration`**. Not required for ordinary PM work.
 
+**Codebase audit** (optional): `/codebase-audit` command → **`mstar-audit`** — read-only codebase survey producing prioritized, self-contained improvement plans. Output feeds iteration-start §1 Research or normal Prepare → Execute. Dispatched by PM under `Task category: audit`.
+
 Detect host → **`mstar-host`** → `references/codex.md` | `cursor.md` | `opencode.md` | `kimi.md` | `zcode.md` | `omp.md`.
 
 ## Read next (in order)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/opencode",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Morning Star harness OpenCode plugin (skills bootstrap and agent loading).",
   "license": "MIT",
   "repository": {