@mstar-harness/opencode 1.8.8 → 2.0.0

package/CHANGELOG.md

@@ -6,6 +6,34 @@ The monorepo root [CHANGELOG.md](../../CHANGELOG.md) summarizes cross-surface re
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-08
+
+### Bundled harness skills (`harness-skills/` at publish)
+
+- **Bash SDD/rollup scripts removed (engine CLI is the documented path)**: `skills/mstar-sdd/scripts/{sdd-workspace,task-brief,review-package}` and `skills/mstar-plan-artifacts/scripts/tech-debt-rollup.sh` are deleted. Skill text now documents `mstar sdd workspace|task-brief|review-package` and the engine `techDebtRollup` import (`mstar status validate` remains the schema gate); parity tests compare engine output against stored golden fixtures captured from the byte-proven ports (slice 2).
+- Added the **`@mstar-harness/engine`** package scaffold: a version-aligned workspace library (`zod` + `ajv`, `node:*` only, no `bin`) with a typed `ValidationResult` + `readHarnessVersion()` placeholder core, wired into the release surface list (10 → 11), changelog assembly, and root workspaces.
+- **Engine hardening (QC fix wave, slice 1)**: lease location/orphan/dual-write verify (`lease.verify.*`) moved into `@mstar-harness/engine` (CLI `mstar lease verify` is now a thin wrapper); `archiveResiduals` gained a plan-id path-traversal guard, the status write lock, and append dedup; `withStatusWriteLock` gained an ownership guard (never removes another writer's lockdir), a `holder.pid` crash-diagnosis file, and fast-fail reentrancy detection; `readHarnessVersion` reads the module's own manifest first (published installs no longer regress to `0.0.0`); `tech-debt-rollup` parity now mirrors jq `//` exactly (`false`/`0` edges tested against the bash oracle); residual closed-lifecycle completeness (`closed_at` + `closure_note`) and plan-row `Done` ⇒ no-lease invariants added. Release prep now ensures the `@mstar-harness/engine` registry row + package-history link in root changelog heads.
+- **Harness Workflow Engine positioning (iteration v2.0.0)**: unified engine-first descriptions across the 7 plugin manifests and the 4 package manifests; added `workflow-engine` / `workflow-enforcement` / `deterministic-workflow` / `harness-workflow` keywords to the root plugin manifest; re-framed README.md / README_CN.md around deterministic workflow gates enforced by a TS engine (not prompts alone) with judgment staying in `mstar-*` skills, plus a What-ships table (Harness Workflow Engine / mstar CLI / `mstar-*` skills / host adapters).
+
+- Version alignment with harness **2.0.0** (no OpenCode package API change).
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **2.0.0**.
+
+### Changed
+
+- `beforeDispatch` Assignment lint is engine-only: local `validateAssignmentPresence` parser removed (qc1 F-002); branch-form parsing via engine `parseAssignmentBranchForms` / `parseBranchPolicyDirectOnBranch` (qc1 F-001); read-only roles (scout/explore) skip the branch-form + default-branch gates (qc3 F-1 / qc2 S-5).
+- `antiRecursionPrecheck` wired into the hook: task dispatch whose role binding (`args.subagent` / `args.subagent_type`) equals the Assignment's `Execute as` warns at critical severity, warn-only (qc1 F-004 / qc2 S-2).
+
+## [1.8.9] - 2026-08-07
+
+### Harness
+
+- **Phase 5 checkout**: merge-ready product fixes edit **directly** on the control / `spec_integration_branch` checkout; **forbid** opening a separate Phase 5 feature/fix worktree or applying Phase 2's "no product edits on control" rule. SSOT stays in `mstar-iteration` (`phase-4-5-pr-delivery` §5.0); **not** in the general `mstar-branch-worktree` skill.
+
+- Version alignment with harness **1.8.9** (no OpenCode package API change).
+
+See root [CHANGELOG.md](../../CHANGELOG.md) **1.8.9**.
+
 ## [1.8.8] - 2026-08-06
 
 ### Bundled harness skills (`harness-skills/` at publish)
@@ -114,7 +142,7 @@ See root [CHANGELOG.md](../../CHANGELOG.md) **1.5.6**.
 
 ## 1.5.5
 
-- Version alignment with harness **1.5.5** (bundled skills: control-path harness under default gitignore + `sdd-workspace` `MSTAR_CONTROL_ROOT`).
+- Version alignment with harness **1.5.5** (bundled skills: control-path harness under default gitignore + SDD workspace `MSTAR_CONTROL_ROOT` resolution).
 
 See root [CHANGELOG.md](../../CHANGELOG.md) **1.5.5**.
 
@@ -397,7 +425,7 @@ See root [CHANGELOG.md](../../CHANGELOG.md) **0.6.2**.
 
 ## 0.6.1
 
-- Bundled skills: `tech-debt-rollup.sh`, PM dual fullstack spread defaults, routing-eval v6.
+- Bundled skills: tech-debt rollup script, PM dual fullstack spread defaults, routing-eval v6.
 
 See root [CHANGELOG.md](../../CHANGELOG.md) **0.6.1**.
 

package/README.md

@@ -32,6 +32,16 @@ npx @mstar-harness/cli init --target opencode
 
 The plugin resolves **only paths inside this package** — not `process.cwd()/skills`, so your app repo root does not affect harness loading.
 
+## Status write lint (hook coverage)
+
+The plugin registers a non-blocking `tool.execute.before` lint for `write`/`edit` tools that target `{HARNESS_DIR}/status.json`: the about-to-be-written (or current on-disk) document is validated against the engine `status.validateStatus` schema and violations are logged as warnings. The hook never blocks and never modifies the write.
+
+Hook coverage follows the engine `resolveHarnessDir` probe order (`.mstar/` → `.agents/` → `.plans/`/`plans/` walking up from the target file). Repos whose harness root is not one of those names — e.g. the `.harness/` layout used by this monorepo itself — are **not** auto-discovered: set **`MSTAR_HARNESS_DIR`** in the OpenCode server environment (absolute path to the harness root) to enable the lint for such repos.
+
+## Dispatch presence lint (hook coverage)
+
+The plugin registers a non-blocking `tool.execute.before` lint for the `task` tool (subagent dispatch): the prompt is parsed for the three core Assignment header fields — `Execute as: <role-id>`, `Delegation: allowed|forbidden`, `Task category: <category>` — and each missing field is logged as a warning (`assignment.presence.missing-*`, `high` for `Execute as`, `medium` otherwise). The hook never blocks and never modifies the prompt; prompts that are not Assignment-shaped (no `## Assignment` heading and none of the three fields) stay silent. Field **presence** only: value-level Assignment validation (Working-branch forms, N→seat mapping, tri identity) is a later-slice extension via `dispatch.validateAssignmentFields`.
+
 ## Quick start
 
 1. Install the plugin (above).

package/dist/mstar.js

@@ -1,3 +1,446 @@
+// ../engine/dist/engine.js
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join2, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "node:fs";
+import { join as join4, resolve as resolve4 } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
+function applyEnforcement(gate, opts) {
+  return { ...gate, hardBlocked: opts.hard && gate.violations.length > 0 };
+}
+function readJson(filePath) {
+  if (!existsSync(filePath))
+    return {};
+  const content = readFileSync(filePath, "utf8").trim();
+  if (!content)
+    return {};
+  try {
+    return JSON.parse(content);
+  } catch (error) {
+    throw new Error(`Invalid JSON in ${filePath}: ${error.message}`);
+  }
+}
+function resolveHarnessDir(startDir = process.cwd(), opts = {}) {
+  const start = resolve2(startDir);
+  const explicit = opts.harnessDir ?? process.env.MSTAR_HARNESS_DIR;
+  if (explicit)
+    return resolve2(start, explicit);
+  let dir = start;
+  for (;; ) {
+    for (const candidate of [join2(dir, ".mstar"), join2(dir, ".agents"), join2(dir, ".plans"), join2(dir, "plans")]) {
+      if (isDirectory(candidate))
+        return candidate;
+    }
+    const parent = dirname2(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveIterationDir(harnessDir) {
+  return join2(resolve2(harnessDir), "iterations");
+}
+var GITIGNORE_SNIPPET = `# Morning Star harness (.mstar/)
+# Principle: process stays local; results are shared with the team.
+# Ignored (process / coordination):
+.mstar/archived/
+.mstar/iterations/
+.mstar/plans/
+.mstar/sdd/
+.mstar/notes.json
+.mstar/status.json
+# Tracked (results): .mstar/AGENTS.md, .mstar/knowledge/, .mstar/specs/
+`;
+var GITIGNORE_SNIPPET_AGENTS = `# Morning Star harness (.agents/) — legacy
+.agents/archived/
+.agents/iterations/
+.agents/plans/
+.agents/sdd/
+.agents/notes.json
+.agents/status.json
+# Tracked (results): .agents/AGENTS.md, .agents/knowledge/, .agents/specs/
+`;
+var GITIGNORE_PROCESS_ENTRIES = GITIGNORE_SNIPPET.split(`
+`).filter((line) => line.startsWith(".mstar/")).map((line) => line.trim());
+var GITIGNORE_PROCESS_ENTRIES_AGENTS = GITIGNORE_SNIPPET_AGENTS.split(`
+`).filter((line) => line.startsWith(".agents/")).map((line) => line.trim());
+function isDirectory(dir) {
+  try {
+    return statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var DATE_PART = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
+var RFC3339_Z_RE = new RegExp(String.raw`^${DATE_PART}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
+var DATE_ONLY_RE = new RegExp(String.raw`^${DATE_PART}$`);
+var heldLockDirs = new AsyncLocalStorage;
+var BRANCH_FORMS_HINT = '"Working branch: <existing>" | "Working branch: create <new> from <base>" | "Branch policy: direct on <branch> — <reason>"';
+var REQUIRED_FIELDS = [
+  { key: "executeAs", label: "Execute as", code: "execute-as" },
+  { key: "delegation", label: "Delegation", code: "delegation" },
+  { key: "taskCategory", label: "Task category", code: "task-category" }
+];
+function violation2(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function parseAssignmentFields(assignmentText) {
+  const fields = {};
+  for (const line of assignmentText.split(/\r?\n/)) {
+    const match = line.match(/^[ \t]*(?:[-*][ \t]+)?\*\*\s*([^*:]+?)\s*\*\*\s*:\s*(.*)$/) ?? line.match(/^[ \t]*(?:[-*][ \t]+)?([A-Za-z][A-Za-z -]*?)\s*:\s*(.*)$/);
+    if (!match)
+      continue;
+    const label = match[1].trim();
+    const value = match[2].trim();
+    const known = REQUIRED_FIELDS.find((f) => f.label === label);
+    if (known) {
+      fields[known.key] = value;
+      continue;
+    }
+    if (label === "Working branch")
+      fields.workingBranch = value;
+    else if (label === "Branch policy")
+      fields.branchPolicy = value;
+  }
+  return fields;
+}
+var ASSIGNMENT_ENFORCEMENT_BOLD_RE = /^[ \t]*(?:[-*][ \t]+)?\*\*\s*Enforcement\s*\*\*\s*:\s*(.*)$/m;
+var ASSIGNMENT_ENFORCEMENT_PLAIN_RE = /^[ \t]*(?:[-*][ \t]+)?Enforcement\s*:\s*(.*)$/m;
+var COMPASS_ENFORCEMENT_RE = /^enforcement\s*:\s*(.*)$/m;
+function enforcementValue(raw) {
+  const value = raw.trim();
+  const unquoted = value.replace(/^(['"])(.*)\1$/, "$2");
+  return unquoted.trim().toLowerCase();
+}
+var ASSIGNMENT_BODY_START_RE = /^(?:#{1,6}[ \t]+Task\b|-{3,}[ \t]*$|#[ \t])/m;
+function assignmentHeaderRegion(assignmentText) {
+  const marker = assignmentText.match(ASSIGNMENT_BODY_START_RE);
+  return marker !== null ? assignmentText.slice(0, marker.index) : assignmentText;
+}
+function parseEnforcementFlag(text) {
+  const bold = text.match(ASSIGNMENT_ENFORCEMENT_BOLD_RE);
+  if (bold !== null)
+    return { hard: enforcementValue(bold[1]) === "hard", source: "assignment" };
+  const plain = text.match(ASSIGNMENT_ENFORCEMENT_PLAIN_RE);
+  if (plain !== null)
+    return { hard: enforcementValue(plain[1]) === "hard", source: "assignment" };
+  const compass = text.match(COMPASS_ENFORCEMENT_RE);
+  if (compass !== null)
+    return { hard: enforcementValue(compass[1]) === "hard", source: "compass" };
+  return { hard: false, source: "none" };
+}
+function requireField(violations, value, label, code) {
+  if (value === undefined) {
+    const v = violation2("high", `assignment.field.missing-${code}`, `missing required Assignment field: ${label}`, `add "**${label}**: <value>" to the Assignment`);
+    v.aliases = [`assignment.presence.missing-${code}`];
+    violations.push(v);
+  } else if (value === "") {
+    const v = violation2("high", `assignment.field.invalid-${code}`, `${label} must be non-empty`, `fill in "**${label}**: <value>"`);
+    v.aliases = [`assignment.presence.missing-${code}`];
+    violations.push(v);
+  }
+}
+function parseWorkingBranchValue(value) {
+  if (value === "")
+    return {};
+  const create = value.match(/^create\s+(\S+)(?:\s+from\s+(\S+))?$/i);
+  if (create)
+    return { createForm: { name: create[1], base: create[2] } };
+  const danglingFrom = value.match(/^create\s+(\S+)\s+from$/i);
+  if (danglingFrom)
+    return { createForm: { name: danglingFrom[1], base: "" } };
+  const missingName = value.match(/^create\s+from\s+(\S+)$/i);
+  if (missingName)
+    return { createForm: { name: "", base: missingName[1] } };
+  return { workingBranch: value.split(/\s+/)[0] };
+}
+function parseAssignmentBranchForms(assignmentText) {
+  const fields = parseAssignmentFields(assignmentText);
+  const forms = {};
+  if (fields.workingBranch !== undefined && fields.workingBranch !== "") {
+    const parsed = parseWorkingBranchValue(fields.workingBranch);
+    if (parsed.createForm !== undefined)
+      forms.createForm = parsed.createForm;
+    else
+      forms.workingBranch = parsed.workingBranch;
+  }
+  if (fields.branchPolicy !== undefined && fields.branchPolicy !== "") {
+    const direct = fields.branchPolicy.match(/^direct\s+on\s+(\S+)/i);
+    if (direct) {
+      const strict = fields.branchPolicy.match(/^direct\s+on\s+(\S+)(?:\s*(?:[—–]|--|-)\s*(.+))?$/);
+      forms.directOn = { branch: direct[1].trim(), reason: strict ? (strict[2] ?? "").trim() : "" };
+    }
+  }
+  return forms;
+}
+function parseBranchPolicyDirectOnBranch(assignmentText) {
+  const directOn = parseAssignmentBranchForms(assignmentText).directOn;
+  return directOn !== undefined && directOn.reason !== "" ? directOn.branch : undefined;
+}
+function isReadOnlyAssignmentRole(roleId) {
+  const role = roleId.trim().toLowerCase();
+  return role === "scout" || role === "explore";
+}
+function validateAssignmentFields(assignmentText, opts = {}) {
+  const violations = [];
+  const fields = parseAssignmentFields(assignmentText);
+  const writable = opts.writable !== false;
+  for (const { key, label, code } of REQUIRED_FIELDS) {
+    requireField(violations, fields[key], label, code);
+  }
+  if (writable) {
+    const workingPresent = fields.workingBranch !== undefined && fields.workingBranch !== "";
+    const policyPresent = fields.branchPolicy !== undefined && fields.branchPolicy !== "";
+    const formCount = Number(workingPresent) + Number(policyPresent);
+    const forms = parseAssignmentBranchForms(assignmentText);
+    if (formCount === 0) {
+      violations.push(violation2("high", "assignment.field.branch-missing", "writable assignment must contain exactly one branch form", `add exactly one of: ${BRANCH_FORMS_HINT}`));
+    } else if (formCount > 1) {
+      violations.push(violation2("high", "assignment.field.branch-multiple", `writable assignment contains ${formCount} branch forms (Working branch + Branch policy) — exactly one required`, `keep exactly one of: ${BRANCH_FORMS_HINT}`));
+    } else if (workingPresent) {
+      const create = forms.createForm;
+      if (create !== undefined && (create.base === undefined || create.base.trim() === "" || create.name.trim() === "")) {
+        violations.push(violation2("high", "assignment.field.branch-missing-base", `create-form Working branch is incomplete: "${fields.workingBranch}" (expected "create <new-branch> from <base>")`, "write both the new branch name and the ancestor branch after `from` (main / existing feature branch / remote-tracking branch / `current`)"));
+      }
+    } else if (policyPresent) {
+      const direct = forms.directOn;
+      if (direct === undefined) {
+        violations.push(violation2("high", "assignment.field.branch-policy-missing-branch", `unparseable Branch policy: "${fields.branchPolicy}" (expected "direct on <branch> — <reason>")`, "start the field with `direct on <branch>`"));
+      } else if (direct.reason === "") {
+        violations.push(violation2("high", "assignment.field.branch-policy-missing-reason", `Branch policy "direct on ${direct.branch}" is missing the reason`, 'append "— <reason>" after the branch name'));
+      }
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function assertDefaultBranchProtected(branch, opts = {}) {
+  const defaultBranches = opts.defaultBranches ?? ["main", "master"];
+  const violations = [];
+  const normalized = branch.trim();
+  if (normalized !== "" && defaultBranches.includes(normalized) && opts.directOnException !== true) {
+    violations.push(violation2("high", "dispatch.default-branch.protected", `writable work on default protected branch "${normalized}" requires an explicit direct-on exception`, `add "Branch policy: direct on ${normalized} — <reason>" to the Assignment, or use a feature branch`));
+  }
+  return { ok: violations.length === 0, violations };
+}
+function antiRecursionPrecheck(subagentType, executeAs) {
+  const binding = subagentType.trim().toLowerCase();
+  const role = executeAs.trim().toLowerCase();
+  if (binding !== "" && binding === role) {
+    return {
+      ok: false,
+      violations: [
+        violation2("critical", "dispatch.anti-recursion.self-type", `recursive dispatch refused: role binding "${subagentType}" equals Execute as "${executeAs}" (leaf executors must not re-invoke their own role)`, "complete the work in this session, or return Blocked to project-manager")
+      ]
+    };
+  }
+  return { ok: true, violations: [] };
+}
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var PLAN_STATUSES = ["Todo", "InProgress", "InReview", "Blocked", "Done"];
+var RESIDUAL_DECISIONS = ["defer", "accept", "risk-accepted"];
+var RESIDUAL_LIFECYCLES = ["open", "resolved", "waived", "superseded", "duplicate"];
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function violation3(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function validateNonEmptyString2(violations, value, field, missingCode, invalidCode) {
+  if (value === undefined) {
+    violations.push(violation3("high", missingCode, `missing required field: ${field}`));
+  } else if (typeof value !== "string" || value.trim() === "") {
+    violations.push(violation3("medium", invalidCode, `${field} must be a non-empty string`));
+  }
+}
+function validatePlanRow(row) {
+  const violations = [];
+  if (!isPlainObject2(row)) {
+    return { ok: false, violations: [violation3("high", "status.plan-row.invalid", "plan row must be an object")] };
+  }
+  const { id, plan_id: planId, title, file, status, metadata, execution_lease } = row;
+  if (id === undefined && planId === undefined) {
+    violations.push(violation3("high", "status.plan-row.missing-id", "missing required field: id (or legacy plan_id)"));
+  } else {
+    if (id !== undefined) {
+      validateNonEmptyString2(violations, id, "id", "status.plan-row.missing-id", "status.plan-row.invalid-id");
+    }
+    if (planId !== undefined) {
+      validateNonEmptyString2(violations, planId, "plan_id", "status.plan-row.missing-plan-id", "status.plan-row.invalid-plan-id");
+    }
+    if (id !== undefined && planId !== undefined && id !== planId) {
+      violations.push(violation3("medium", "status.plan-row.dual-id", "row has both id and plan_id with different values — write one canonical key (prefer id)"));
+    }
+  }
+  validateNonEmptyString2(violations, title, "title", "status.plan-row.missing-title", "status.plan-row.invalid-title");
+  validateNonEmptyString2(violations, file, "file", "status.plan-row.missing-file", "status.plan-row.invalid-file");
+  if (status === undefined) {
+    violations.push(violation3("high", "status.plan-row.missing-status", "missing required field: status"));
+  } else if (typeof status !== "string" || !PLAN_STATUSES.includes(status)) {
+    violations.push(violation3("medium", "status.plan-row.invalid-status", `status must be one of ${PLAN_STATUSES.join(" | ")} — got ${JSON.stringify(status)}`));
+  }
+  if (metadata !== undefined && !isPlainObject2(metadata)) {
+    violations.push(violation3("medium", "status.plan-row.invalid-metadata", "metadata must be an object"));
+  }
+  if (execution_lease !== undefined && !isPlainObject2(execution_lease)) {
+    violations.push(violation3("medium", "status.plan-row.invalid-execution-lease", "execution_lease must be an object"));
+  }
+  if (status === "Done" && execution_lease !== undefined) {
+    violations.push(violation3("medium", "status.plan-row.done-with-lease", 'plan status Done must not carry an execution_lease — the Done authority deletes the lease in the same complete-file update as status: "Done" (status-and-residuals.md § Hold, release, and override)', 'delete plans[].execution_lease in the same update that sets status: "Done"'));
+  }
+  return { ok: violations.length === 0, violations };
+}
+function validateResidual(entry) {
+  const violations = [];
+  if (!isPlainObject2(entry)) {
+    return { ok: false, violations: [violation3("high", "status.residual.invalid", "residual entry must be an object")] };
+  }
+  const { id, title, severity, source, scope, decision, owner, target, tracking, detail_doc, lifecycle, closed_at } = entry;
+  validateNonEmptyString2(violations, id, "id", "status.residual.missing-id", "status.residual.invalid-id");
+  validateNonEmptyString2(violations, title, "title", "status.residual.missing-title", "status.residual.invalid-title");
+  validateNonEmptyString2(violations, source, "source", "status.residual.missing-source", "status.residual.invalid-source");
+  validateNonEmptyString2(violations, scope, "scope", "status.residual.missing-scope", "status.residual.invalid-scope");
+  validateNonEmptyString2(violations, owner, "owner", "status.residual.missing-owner", "status.residual.invalid-owner");
+  if (severity === undefined) {
+    violations.push(violation3("high", "status.residual.missing-severity", "missing required field: severity"));
+  } else if (typeof severity !== "string" || !SEVERITY_ORDER.includes(severity) && severity !== "warning") {
+    violations.push(violation3("medium", "status.residual.invalid-severity", `severity must be one of ${SEVERITY_ORDER.join(" | ")} — got ${JSON.stringify(severity)}`));
+  } else if (severity === "warning") {
+    violations.push(violation3("low", "status.residual.legacy-warning", `severity "warning" is legacy — forbidden on new entries; read paths normalize it to "low"`, `use "low" (normalizeSeverity maps 'warning' → 'low')`));
+  }
+  if (decision === undefined) {
+    violations.push(violation3("high", "status.residual.missing-decision", "missing required field: decision"));
+  } else if (typeof decision !== "string" || !RESIDUAL_DECISIONS.includes(decision)) {
+    violations.push(violation3("medium", "status.residual.invalid-decision", `decision must be one of ${RESIDUAL_DECISIONS.join(" | ")} — got ${JSON.stringify(decision)}`));
+  }
+  if (target === undefined) {
+    violations.push(violation3("high", "status.residual.missing-target", "missing required field: target"));
+  } else if (typeof target !== "string" && target !== null) {
+    violations.push(violation3("medium", "status.residual.invalid-target", "target must be a string or null"));
+  }
+  if (tracking === undefined) {
+    violations.push(violation3("high", "status.residual.missing-tracking", "missing required field: tracking"));
+  } else if (typeof tracking !== "string" && tracking !== null) {
+    violations.push(violation3("medium", "status.residual.invalid-tracking", "tracking must be a string or null"));
+  }
+  if (detail_doc !== undefined && typeof detail_doc !== "string" && detail_doc !== null) {
+    violations.push(violation3("medium", "status.residual.invalid-detail-doc", "detail_doc must be a string or null"));
+  }
+  if (closed_at !== undefined && (typeof closed_at !== "string" || !DATE_RE.test(closed_at))) {
+    violations.push(violation3("medium", "status.residual.invalid-closed-at", "closed_at must be YYYY-MM-DD"));
+  }
+  if (lifecycle !== undefined) {
+    if (typeof lifecycle !== "string" || !RESIDUAL_LIFECYCLES.includes(lifecycle)) {
+      violations.push(violation3("medium", "status.residual.invalid-lifecycle", `lifecycle must be one of ${RESIDUAL_LIFECYCLES.join(" | ")} — got ${JSON.stringify(lifecycle)}`));
+    } else if (lifecycle !== "open") {
+      if (closed_at === undefined) {
+        violations.push(violation3("high", "status.residual.closed-missing-closed-at", `lifecycle "${lifecycle}" requires closed_at (YYYY-MM-DD)`, 'set closed_at (e.g. "2026-08-08")'));
+      }
+      if (entry.closure_note === undefined) {
+        violations.push(violation3("medium", "status.residual.closed-missing-closure-note", `lifecycle "${lifecycle}" requires closure_note (what changed; how verified)`, "add closure_note explaining the close"));
+      }
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function validateStatus(docOrPath) {
+  let doc;
+  if (typeof docOrPath === "string") {
+    try {
+      doc = readJson(docOrPath);
+    } catch (error) {
+      return {
+        ok: false,
+        violations: [violation3("high", "status.invalid-json", error.message)]
+      };
+    }
+  } else {
+    doc = docOrPath;
+  }
+  const violations = [];
+  const { version, updated_at, plans, residual_findings, metadata } = doc;
+  if (version === undefined) {
+    violations.push(violation3("high", "status.missing-version", "missing required field: version"));
+  } else if (typeof version !== "number" || !Number.isInteger(version)) {
+    violations.push(violation3("high", "status.invalid-version", "version must be an integer"));
+  } else if (version !== 1) {
+    violations.push(violation3("medium", "status.unsupported-version", `unsupported status.json schema version ${version} — expected 1`));
+  }
+  if (updated_at === undefined) {
+    violations.push(violation3("high", "status.missing-updated-at", "missing required field: updated_at"));
+  } else if (typeof updated_at !== "string" || !DATE_RE.test(updated_at)) {
+    violations.push(violation3("medium", "status.invalid-updated-at", "updated_at must be YYYY-MM-DD"));
+  }
+  if (plans === undefined) {
+    violations.push(violation3("high", "status.missing-plans", "missing required field: plans"));
+  } else if (!Array.isArray(plans)) {
+    violations.push(violation3("high", "status.invalid-plans", "plans must be an array"));
+  } else {
+    for (const row of plans) {
+      violations.push(...validatePlanRow(row).violations);
+    }
+  }
+  if (residual_findings === undefined) {
+    violations.push(violation3("high", "status.missing-residual-findings", "missing required field: residual_findings (root-only canonical)"));
+  } else if (!isPlainObject2(residual_findings)) {
+    violations.push(violation3("high", "status.invalid-residual-findings", "residual_findings must be an object at root"));
+  } else {
+    for (const [planId, list] of Object.entries(residual_findings)) {
+      if (!Array.isArray(list)) {
+        violations.push(violation3("high", "status.residual.invalid-list", `residual_findings["${planId}"] must be an array`));
+      } else if (list.length === 0) {
+        violations.push(violation3("low", "status.residual.empty-key", `residual_findings["${planId}"] is empty — delete the key (no "plan-id": [])`));
+      } else {
+        for (const entry of list) {
+          violations.push(...validateResidual(entry).violations);
+        }
+      }
+    }
+  }
+  if (metadata === undefined) {
+    violations.push(violation3("high", "status.missing-metadata", "missing required field: metadata"));
+  } else if (!isPlainObject2(metadata)) {
+    violations.push(violation3("high", "status.invalid-metadata", "metadata must be an object"));
+  } else if (Object.prototype.hasOwnProperty.call(metadata, "residual_findings")) {
+    violations.push(violation3("medium", "status.dual-write-residuals", "residual_findings must be root-only — metadata.residual_findings is legacy read-only; remove it (no dual-write)", "move entries to root residual_findings and delete metadata.residual_findings"));
+  }
+  return { ok: violations.length === 0, violations };
+}
+function resolveCompassEnforcement(harnessDir) {
+  const iterationsDir = resolveIterationDir(harnessDir);
+  if (!existsSync2(iterationsDir))
+    return { hard: false, source: "none" };
+  let entries;
+  try {
+    entries = readdirSync2(iterationsDir, { withFileTypes: true });
+  } catch {
+    return { hard: false, source: "none" };
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory())
+      continue;
+    const compassPath = join4(iterationsDir, entry.name, "delivery-compass.md");
+    if (!existsSync2(compassPath))
+      continue;
+    let content;
+    try {
+      content = readFileSync3(compassPath, "utf8");
+    } catch {
+      continue;
+    }
+    const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    const fm = frontmatter !== null ? frontmatter[1] : "";
+    if (!/^status[ \t]*:[ \t]*(?:active|locked)[ \t]*$/m.test(fm))
+      continue;
+    const flag = parseEnforcementFlag(fm);
+    if (flag.hard)
+      return flag;
+  }
+  return { hard: false, source: "none" };
+}
+var GIT_CAPTURE_MAX_BYTES = 64 * 1024 * 1024;
+var WALK_SKIP_DIRS = new Set(["node_modules", ".git", "dist"]);
+
 // src/mstar.ts
 import fs from "node:fs";
 import os from "node:os";
@@ -149,6 +592,89 @@ var loadBundledCommands = () => {
   }
   return result;
 };
+var defaultStatusLogger = (level, message) => {
+  const line = `[mstar-harness] ${message}`;
+  if (level === "warn")
+    console.warn(line);
+  else if (level === "error")
+    console.error(line);
+  else
+    console.log(line);
+};
+var STATUS_FILE = "status.json";
+function validateStatusWrite(targetPath, opts = {}) {
+  const log = opts.log ?? defaultStatusLogger;
+  try {
+    const resolved = path.resolve(targetPath);
+    if (path.basename(resolved) !== STATUS_FILE)
+      return null;
+    const harnessDir = resolveHarnessDir(path.dirname(resolved));
+    if (!harnessDir || path.join(harnessDir, STATUS_FILE) !== resolved)
+      return null;
+    const result = opts.doc !== undefined ? validateStatus(opts.doc) : fs.existsSync(resolved) ? validateStatus(resolved) : null;
+    if (!result)
+      return null;
+    const enforcement = opts.enforcement ?? resolveCompassEnforcement(harnessDir);
+    if (!result.ok) {
+      for (const violation of result.violations) {
+        const fix = violation.fix ? ` (fix: ${violation.fix})` : "";
+        if (enforcement.hard) {
+          log("error", `status.json validation (hard gate): [${violation.severity}] ${violation.code}: ${violation.message}${fix} — hardBlocked per Enforcement: hard; refusal requires a host refusal channel (skill: mstar-plan-artifacts/references/status-and-residuals.md)`);
+        } else {
+          log("warn", `status.json validation: [${violation.severity}] ${violation.code}: ${violation.message}${fix}`);
+        }
+      }
+    }
+    return applyEnforcement(result, { hard: enforcement.hard });
+  } catch (error) {
+    log("error", `status.json validation aborted: ${error.message}`);
+    return null;
+  }
+}
+var ASSIGNMENT_HEADING_RE = /^#{1,6}\s+Assignment\s*$/m;
+var ASSIGNMENT_FIELD_RE = /^[ \t]*(?:[-*][ \t]+)?\*{0,2}(Execute as|Delegation|Task category)\*{0,2}[ \t]*:[ \t]*(\S.*)$/gm;
+function isAssignmentShaped(assignmentText) {
+  return ASSIGNMENT_HEADING_RE.test(assignmentText) || assignmentText.match(ASSIGNMENT_FIELD_RE) !== null;
+}
+function validateDispatchAssignment(assignmentText, opts = {}) {
+  const log = opts.log ?? defaultStatusLogger;
+  try {
+    if (!isAssignmentShaped(assignmentText))
+      return { ok: true, violations: [] };
+    const violations = [];
+    const fields = parseAssignmentFields(assignmentText);
+    const writable = isReadOnlyAssignmentRole(fields.executeAs ?? "") ? false : undefined;
+    violations.push(...validateAssignmentFields(assignmentText, { writable }).violations);
+    const binding = opts.subagentType ?? "";
+    if (binding.trim() !== "") {
+      violations.push(...antiRecursionPrecheck(binding, fields.executeAs ?? "").violations);
+    }
+    if (writable !== false) {
+      const forms = parseAssignmentBranchForms(assignmentText);
+      const branch = forms.createForm?.name ?? forms.workingBranch ?? forms.directOn?.branch ?? process.env.MSTAR_WORKING_BRANCH;
+      if (branch !== undefined && branch.trim() !== "") {
+        const directOnException = parseBranchPolicyDirectOnBranch(assignmentText) === branch.trim();
+        violations.push(...assertDefaultBranchProtected(branch.trim(), { directOnException }).violations);
+      }
+    }
+    const result = { ok: violations.length === 0, violations };
+    const enforcement = parseEnforcementFlag(assignmentHeaderRegion(assignmentText));
+    if (!result.ok) {
+      for (const violation of result.violations) {
+        const fix = violation.fix ? ` (fix: ${violation.fix})` : "";
+        if (enforcement.hard) {
+          log("error", `assignment validation (hard gate): [${violation.severity}] ${violation.code}: ${violation.message}${fix} — hardBlocked per Enforcement: hard; refusal requires a host refusal channel (skill: mstar-dispatch-gates)`);
+        } else {
+          log("warn", `assignment validation: [${violation.severity}] ${violation.code}: ${violation.message}${fix}`);
+        }
+      }
+    }
+    return applyEnforcement(result, { hard: enforcement.hard });
+  } catch (error) {
+    log("error", `assignment validation aborted: ${error.message}`);
+    return null;
+  }
+}
 var MorningStarHarnessPlugin = async () => {
   const homeDir = os.homedir();
   const envConfigDir = normalizePath(process.env.OPENCODE_CONFIG_DIR, homeDir);
@@ -183,6 +709,39 @@ var MorningStarHarnessPlugin = async () => {
         };
       }
     },
+    "tool.execute.before": async (input, output) => {
+      const args = output?.args ?? {};
+      if (input.tool === "task" && typeof args.prompt === "string") {
+        const subagentType = typeof args.subagent === "string" ? args.subagent : typeof args.subagent_type === "string" ? args.subagent_type : "";
+        const gate = validateDispatchAssignment(args.prompt, { subagentType });
+        if (gate?.hardBlocked) {
+          defaultStatusLogger("error", "hard-gate blocked (hardBlocked=true) — refusal requires a host refusal channel");
+        }
+        return;
+      }
+      if (typeof args.filePath !== "string")
+        return;
+      if (input.tool === "write") {
+        const rawContent = args.content;
+        let doc;
+        if (typeof rawContent === "string") {
+          try {
+            doc = JSON.parse(rawContent);
+          } catch {
+            doc = undefined;
+          }
+        }
+        const gate = validateStatusWrite(args.filePath, { doc });
+        if (gate?.hardBlocked) {
+          defaultStatusLogger("error", "hard-gate blocked (hardBlocked=true) — refusal requires a host refusal channel");
+        }
+      } else if (input.tool === "edit") {
+        const gate = validateStatusWrite(args.filePath);
+        if (gate?.hardBlocked) {
+          defaultStatusLogger("error", "hard-gate blocked (hardBlocked=true) — refusal requires a host refusal channel");
+        }
+      }
+    },
     "experimental.chat.messages.transform": async (_input, output) => {
       const bootstrap = loadBootstrapContent();
       if (!bootstrap || !output.messages.length)
@@ -203,5 +762,7 @@ var MorningStarHarnessPlugin = async () => {
   };
 };
 export {
+  validateStatusWrite,
+  validateDispatchAssignment,
   MorningStarHarnessPlugin
 };