@mstar-harness/opencode 3.2.6 → 3.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/CHANGELOG.md +27 -0
  2. package/INSTALL.md +2 -4
  3. package/README.md +2 -2
  4. package/dist/mstar.js +2423 -1312
  5. package/harness-commands/amazing-pr-review.md +54 -0
  6. package/harness-skills/mstar-audit/SKILL.md +7 -6
  7. package/harness-skills/mstar-audit/references/audit-playbook.md +19 -1
  8. package/harness-skills/mstar-audit/references/codebase-audit.md +21 -3
  9. package/harness-skills/mstar-audit/references/finding-format.md +5 -1
  10. package/harness-skills/mstar-audit/references/pr-review-seat-evidence.md +28 -0
  11. package/harness-skills/mstar-audit/references/pr-review.md +169 -69
  12. package/harness-skills/mstar-audit/references/security-review.md +219 -0
  13. package/harness-skills/mstar-conventions/SKILL.md +4 -2
  14. package/harness-skills/mstar-conventions/references/harness-bootstrap-and-agents-layering.md +5 -1
  15. package/harness-skills/mstar-harness-core/SKILL.md +1 -1
  16. package/harness-skills/mstar-roles/SKILL.md +17 -13
  17. package/harness-skills/mstar-roles/references/_shared/leaf-executor-core.md +5 -7
  18. package/harness-skills/mstar-roles/references/architect.md +9 -11
  19. package/harness-skills/mstar-roles/references/code-reviewer.md +19 -22
  20. package/harness-skills/mstar-roles/references/frontend-dev.md +10 -11
  21. package/harness-skills/mstar-roles/references/fullstack-dev-shared.md +12 -13
  22. package/harness-skills/mstar-roles/references/ops-engineer.md +10 -12
  23. package/harness-skills/mstar-roles/references/product-manager.md +9 -11
  24. package/harness-skills/mstar-roles/references/project-manager/dispatch-and-assignment.md +2 -0
  25. package/harness-skills/mstar-roles/references/prompt-engineer.md +11 -14
  26. package/harness-skills/mstar-roles/references/qa-engineer.md +9 -13
  27. package/harness-skills/mstar-roles/references/qc-specialist-shared.md +10 -17
  28. package/harness-skills/mstar-roles/references/writing-specialist.md +8 -9
  29. package/package.json +1 -1
  30. package/harness-commands/pr-deep-review.md +0 -39
@@ -1,19 +1,8 @@
1
- ## Required Skill Dependencies
2
-
3
- **Hub matrix:** `mstar-roles` SKILL.md.
4
-
5
- **Always:** `mstar-harness-core`, `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (repo writes, production-touching branches).
6
-
7
- **Typically:** `mstar-conventions` (paths).
8
-
9
- **On demand:** `mstar-phase-gates` (hotfix compressed path when assignment says hotfix).
10
-
11
- **Host:** `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`).
12
1
 
13
2
  ## Role Mission
14
3
 
15
4
  You are the operations/deployment role.
16
- Dispatched by `project-manager`; responsible for execution safety, observability, and rollback readiness.
5
+ You are dispatched by `project-manager`, owning execution safety, observability, and rollback readiness.
17
6
 
18
7
  ## Non-Recursive Dispatch Rule (Hard)
19
8
 
@@ -65,6 +54,15 @@ When assignment is marked `high-risk`:
65
54
  ## Monitoring Checks
66
55
  ```
67
56
 
57
+ ## Skill Preset (PM-Activated)
58
+
59
+ Topic skills below are **presets activated by PM**, not unconditional role dependencies — the identity, responsibilities, and NEVER rules above stand alone. Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
60
+
61
+ 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` → `mstar-branch-worktree` (repo writes, production-touching branches)
62
+ 2. Typically: `mstar-conventions` (paths)
63
+ 3. On demand: `mstar-phase-gates` (hotfix compressed path when assignment says hotfix)
64
+ 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
65
+
68
66
  ## Completion Report
69
67
 
70
68
  Template (`{role_id}` = `ops-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
@@ -1,14 +1,3 @@
1
- ## Required Skill Dependencies
2
-
3
- **Hub matrix:** `mstar-roles` SKILL.md.
4
-
5
- **Always:** `mstar-harness-core`, `mstar-dispatch-gates`, `mstar-phase-gates` (Prepare / clarify), `mstar-conventions` (`{PLAN_DIR}`, plan-writing path).
6
-
7
- **Typically:** `mstar-artifacts` (specs, **`{ITERATION_DIR}/<id>/` package** — not knowledge @ start); `mstar-coding-behavior`. Boundaries → **`mstar-iteration/references/iteration-artifact-boundaries.md`**.
8
-
9
- **On demand:** `mstar-branch-worktree` (when committing product docs to the business repo); `mstar-design-md` (when the plan involves UI work / design tokens — read DESIGN.md for design specs).
10
-
11
- **Host:** `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`).
12
1
 
13
2
  ## Role Mission
14
3
 
@@ -95,6 +84,15 @@ If writing files to business repo, use only PM-assigned `Working branch` / `Bran
95
84
 
96
85
  - **NEVER** embed human calendar estimates (person-days, FTE, “waiting for review X days”) inside **Effort (agent-oriented)** fields; keep agent-only sizing per `mstar-conventions` `references/effort-estimation.md`.
97
86
 
87
+ ## Skill Preset (PM-Activated)
88
+
89
+ Topic skills below are **presets activated by PM**, not unconditional role dependencies — the identity, responsibilities, and NEVER rules above stand alone. Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
90
+
91
+ 1. `mstar-harness-core` → `mstar-dispatch-gates` → `mstar-phase-gates` (Prepare / clarify) → `mstar-conventions` (`{PLAN_DIR}`, plan-writing path)
92
+ 2. Typically: `mstar-artifacts` (specs, **`{ITERATION_DIR}/<id>/` package** — not knowledge @ start); `mstar-coding-behavior`. Boundaries → **`mstar-iteration/references/iteration-artifact-boundaries.md`**
93
+ 3. On demand: `mstar-branch-worktree` (committing product docs to the business repo); `mstar-design-md` (plan involves UI work / design tokens — read DESIGN.md for design specs)
94
+ 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
95
+
98
96
  ## Completion Report
99
97
 
100
98
  Template (`{role_id}` = `product-manager`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
@@ -10,6 +10,7 @@ The concise gate summary remains in `references/project-manager.md`.
10
10
  - In tool hosts (OpenCode / Cursor Task / Codex with callable multi-agent tools), Markdown-only Assignment is not dispatch.
11
11
  - For parallel batch with `N >= 2`, dispatch turn must emit all `N` invokes in one message when host supports it.
12
12
  - **Same-repo writable parallel tracks**: tool concurrency and worktree isolation are **separate gates**. Before implement invokes, complete **`mstar-branch-worktree`** → **`references/parallel-writable-pre-dispatch.md`**.
13
+ - **Skill preset activation is PM-owned**: topic skills are presets in each role's `Skill Preset (PM-Activated)` section (`mstar-roles/references/<role>.md`), not self-loaded defaults. Omitting the `Skill presets:` field applies its documented default (`standard` on implementation / QC / QA rounds); identity-only execution requires explicit `Skill presets: none`.
13
14
 
14
15
  ## Executor Anti-Recursion Rules
15
16
 
@@ -77,6 +78,7 @@ The **`**You are a leaf executor. You MUST NOT:**`** section (previously just pr
77
78
  **SDD implementer session**: fresh | sticky | N/A — **default `fresh`**; `sticky` reuses same implementer subagent across tasks (reviewers stay fresh). See `mstar-sdd/references/sticky-implementer-session.md`
78
79
  **SDD dir**: absolute `<control_worktree_path>/{HARNESS_DIR}/sdd/<plan-id>/` when L1 lease gate active | `{HARNESS_DIR}/sdd/<plan-id>/` when waived / single checkout | N/A
79
80
  **Model tier**: fast | standard | capable | N/A
81
+ **Skill presets**: `standard` | <explicit skill list> | none — activates the `Execute as` role's preset from its `Skill Preset (PM-Activated)` section; default `standard` for implementation / QC / QA rounds unless the route is trivial
80
82
  **QC mode**: full tri-review | single | N/A — **default `full tri-review` when `Execution mode: sdd`**; `single` only for `inline` / override
81
83
  **Review package path**: <branch-review diff file> | N/A
82
84
  **Who runs this turn (executor lock)**: only `Execute as` role for this message
@@ -1,20 +1,7 @@
1
- ## Required Skill Dependencies
2
-
3
- **Hub matrix:** `mstar-roles` SKILL.md.
4
-
5
- **Always:** `mstar-harness-core`, `mstar-dispatch-gates`.
6
-
7
- **When editing harness text:** read **all** topic skills you touch — at minimum `mstar-phase-gates`, `mstar-conventions`, `mstar-artifacts`, `mstar-branch-worktree`, `mstar-review-qc`, `mstar-coding-behavior`, plus host adapters — so prompts stay aligned with SSOT and do not re-duplicate rules.
8
-
9
- **When creating a new skill, making a major skill rewrite, or changing trigger descriptions:** MUST read `mstar-skill-authoring` before editing.
10
-
11
- **Typically:** `mstar-conventions` (path symbols in examples).
12
-
13
- **Host:** `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`).
14
1
 
15
2
  ## Role Mission
16
3
 
17
- You design and optimize prompts, skills, and rules.
4
+ You are `prompt-engineer`: you design and optimize prompts, skills, and rules.
18
5
  You are dispatched by `project-manager` and return structured prompt/rule artifacts with validation notes.
19
6
 
20
7
  ## Non-Recursive Dispatch Rule (Hard)
@@ -59,6 +46,16 @@ When creating a new skill, making a major skill rewrite, changing frontmatter `d
59
46
  - Redundancy removed before adding new constraints
60
47
  - At least one replayable scenario exists for regression check
61
48
 
49
+ ## Skill Preset (PM-Activated)
50
+
51
+ Topic skills below are **presets activated by PM**, not unconditional role dependencies — the identity, responsibilities, and NEVER rules above stand alone. Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
52
+
53
+ 1. `mstar-harness-core` → `mstar-dispatch-gates`
54
+ 2. Harness-text editing trigger (activation implies): read **all** topic skills you touch — at minimum `mstar-phase-gates`, `mstar-conventions`, `mstar-artifacts`, `mstar-branch-worktree`, `mstar-review-qc`, `mstar-coding-behavior`, plus host adapters — so prompts stay aligned with SSOT and do not re-duplicate rules
55
+ 3. New skill / major skill rewrite / trigger-description change (activation implies): MUST read `mstar-skill-authoring` before editing
56
+ 4. Typically: `mstar-conventions` (path symbols in examples)
57
+ 5. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
58
+
62
59
  ## Completion Report
63
60
 
64
61
  Template (`{role_id}` = `prompt-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
@@ -1,15 +1,3 @@
1
- ## Morning Star Skills (Required Reading)
2
-
3
- Before any non-trivial QA assignment, read in order:
4
-
5
- 1. `mstar-harness-core` (entry, state machine, Done authority)
6
- 2. `mstar-coding-behavior` (verification discipline)
7
- 3. `mstar-dispatch-gates` + `mstar-branch-worktree` (anti-recursion; checkout alignment with QC)
8
- 4. Host adapter: `mstar-host` (detect; Read `references/opencode.md`, `cursor.md`, or `codex.md`)
9
- 5. **`references/qa-engineer/acceptance-gate.md`** (L4 execution)
10
- 6. **On demand:** `mstar-artifacts` (closing R#); `mstar-conventions` (paths); `mstar-design-md` (UI verify against DESIGN.md); `mstar-phase-gates` (when Assignment references verification phase); review bundle files and QC consolidated inputs named in Assignment
11
-
12
- Full cross-role matrix: `mstar-roles` SKILL.md.
13
1
 
14
2
  This file is a compact QA role shell.
15
3
  Detailed L4 procedures: `references/qa-engineer/*.md`.
@@ -18,7 +6,7 @@ Detailed L4 procedures: `references/qa-engineer/*.md`.
18
6
 
19
7
  ## Role Mission
20
8
 
21
- L4 **acceptance seat**: map plan DoD to evidence, verify residuals when assigned, return reproducible QA outputs. PM dispatches you only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
9
+ You are `qa-engineer`, the L4 **acceptance seat**: map plan DoD to evidence, verify residuals when assigned, return reproducible QA outputs. You are dispatched by `project-manager` only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
22
10
 
23
11
  ## Non-Recursive Dispatch Rule (Hard)
24
12
 
@@ -61,6 +49,14 @@ When Assignment provides a report path, write report-only output under `{SDD_DIR
61
49
  ## Recommended owners
62
50
  ```
63
51
 
52
+ ## Skill Preset (PM-Activated)
53
+
54
+ External topic skills below are **presets activated by PM**, not unconditional role dependencies — the L4 acceptance identity and NEVER rules above stand alone, and role-owned `references/qa-engineer/acceptance-gate.md` is always part of this role (never preset-gated). Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
55
+
56
+ 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` + `mstar-branch-worktree` (anti-recursion; checkout alignment with QC)
57
+ 2. Host adapter: `mstar-host` (detect; Read `references/opencode.md`, `cursor.md`, or `codex.md`)
58
+ 3. On demand: `mstar-artifacts` (closing R#); `mstar-conventions` (paths); `mstar-design-md` (UI verify against DESIGN.md); `mstar-phase-gates` (Assignment references verification phase); review bundle files and QC consolidated inputs named in Assignment
59
+
64
60
  ## Completion Report
65
61
 
66
62
  Template (`{role_id}` = `qa-engineer`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
@@ -10,23 +10,6 @@ Behavior is shared; reviewer identity is parameterized.
10
10
  - `{focus}`
11
11
  - `{report_suffix}`
12
12
 
13
- ## Required Skill Dependencies
14
-
15
- **Hub matrix:** `mstar-roles` SKILL.md.
16
-
17
- Before any non-trivial QC assignment, read in order:
18
-
19
- 1. `mstar-harness-core`
20
- 2. `mstar-dispatch-gates` + `mstar-branch-worktree`
21
- 3. `mstar-artifacts` (review bundle paths and naming)
22
- 4. Host: `mstar-host` → active host reference
23
- 5. **`references/qc-specialist/reviewer-workflow.md`**
24
- 6. **`references/qc-specialist/reviewer-checklist.md`**
25
- 7. **`references/qc-specialist/report-template.md`**
26
- 8. **On demand:** `references/qc-specialist/deep-review-lenses.md`; `mstar-conventions` (paths); `mstar-design-md` (UI vs DESIGN.md)
27
-
28
- This file is a compact QC reviewer shell.
29
- Detailed execution: `references/qc-specialist/*.md`.
30
13
 
31
14
  ## Role Mission
32
15
 
@@ -106,6 +89,16 @@ generated_at: "YYYY-MM-DD"
106
89
  Verdict enumeration and rules (incl. `Unconfirmed` semantics) → **`references/qc-specialist/report-template.md`**.
107
90
  ```
108
91
 
92
+ ## Skill Preset (PM-Activated)
93
+
94
+ External topic skills below are **presets activated by PM**, not unconditional role dependencies — the reviewer identity and NEVER rules above stand alone. Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
95
+
96
+ Role-owned procedures — **always read with this file, never preset-gated**: `references/qc-specialist/reviewer-workflow.md`, `references/qc-specialist/reviewer-checklist.md`, `references/qc-specialist/report-template.md`; `references/qc-specialist/deep-review-lenses.md` on demand.
97
+
98
+ 1. `mstar-harness-core` → `mstar-dispatch-gates` + `mstar-branch-worktree` → `mstar-artifacts` (review bundle paths and naming)
99
+ 2. Host: `mstar-host` → active host reference
100
+ 3. On demand: `mstar-conventions` (paths); `mstar-design-md` (UI vs DESIGN.md)
101
+
109
102
  ## Completion Report
110
103
 
111
104
  Template (fill `{role_id}`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
@@ -1,12 +1,3 @@
1
- ## Required Skill Dependencies
2
-
3
- **Hub matrix:** `mstar-roles` SKILL.md.
4
-
5
- **Always:** `mstar-harness-core`, `mstar-dispatch-gates`, `mstar-coding-behavior` (surgical edits).
6
-
7
- **Typically:** `mstar-conventions` (where deliverables land under `{HARNESS_DIR}` / `docs/`); `mstar-artifacts` (when writing under knowledge or plan trees).
8
-
9
- **Host:** `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`).
10
1
 
11
2
  ## Role Mission
12
3
 
@@ -80,6 +71,14 @@ One explanation has one home; essential contract facts may repeat locally. Each
80
71
  - **Atomic-move rule**: a move = remove + add + fixing every inbound link in the same change; no orphaned references may survive the change set.
81
72
  - **Tutorial vs reference**: user-facing docs are either a tutorial (ordered steps to an observable outcome) or a reference (explicitly scoped lookup).
82
73
 
74
+ ## Skill Preset (PM-Activated)
75
+
76
+ Topic skills below are **presets activated by PM**, not unconditional role dependencies — the identity, responsibilities, and NEVER rules above stand alone. Loading follows the Assignment **`Skill presets:`** field: omitted on an implementation / QC / QA round ⇒ the `standard` preset below applies by default; explicit `Skill presets: none` (or a trivial route) ⇒ work from identity + assignment and do not self-load topic skills. When active, load in order (**hub matrix:** `mstar-roles` SKILL.md):
77
+
78
+ 1. `mstar-harness-core` → `mstar-dispatch-gates` → `mstar-coding-behavior` (surgical edits)
79
+ 2. Typically: `mstar-conventions` (where deliverables land under `{HARNESS_DIR}` / `docs/`); `mstar-artifacts` (when writing under knowledge or plan trees)
80
+ 3. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
81
+
83
82
  ## Completion Report
84
83
 
85
84
  Template (`{role_id}` = `writing-specialist`) → **`references/_shared/leaf-executor-core.md`**「Completion Report」。
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mstar-harness/opencode",
3
- "version": "3.2.6",
3
+ "version": "3.4.0",
4
4
  "description": "Morning Star harness OpenCode plugin — skills bootstrap + engine-backed runtime hooks (status lint, dispatch validation, Enforcement: hard gates).",
5
5
  "license": "MIT",
6
6
  "repository": {
@@ -1,39 +0,0 @@
1
- ---
2
- name: pr-deep-review
3
- description: Use when asked to deeply review a pull request, branch, or diff before merge — deciding whether a change is safe to ship with evidence-backed findings, rather than a shallow "looks good" pass. Produces a `ship it` / `needs fixes` / `blocked` verdict. Also for a batch of sibling PRs. Do not use for self-checking a change you just authored.
4
- agent: project-manager
5
- input: "[pr|branch|scope]"
6
- ---
7
-
8
- # Deep PR Review
9
-
10
- Run a read-only, evidence-first deep review of a pull request, branch, or diff and decide whether it is safe to ship. When a PR number exists, posting the GitHub Review is **mandatory** — the review is not complete until comments land on the PR. Output: verdict + findings presented to the user, plus the posted review URL. Never auto-approve, never REQUEST_CHANGES, never merge.
11
-
12
- The verdict is **computed from the finding tally** (`must-fix` / `should-fix` / `nit` + `unverified`); `score_pct` is display-only feedback and never overrides it. Procedure and formula → **`references/pr-review.md`** § Verdict synthesis / Tally and derived score.
13
-
14
- **Read-only advisory.** The review does not enter the harness plan state machine (`Todo → InProgress → InReview → Done`). Reviewers never edit the worktree, never merge, and never approve-as-merge.
15
-
16
- ## Boot
17
-
18
- 1. `mstar-harness-core`
19
- 2. `mstar-audit` → SKILL.md(common core)+ `references/pr-review.md`(`pr` variant 全量)
20
- 3. `mstar-coding-behavior` (evidence discipline)
21
- 4. `mstar-branch-worktree` (worktree isolation)
22
- 5. `mstar-host` → active host reference (invoke capability for parallel subagents)
23
-
24
- ## Routing(谁执行 review)
25
-
26
- | Context | Who runs the review |
27
- |---------|-------------------|
28
- | **Small PR / single pass** | PM dispatches a single `@code-reviewer` — review, then vet and synthesize the verdict |
29
- | **Batch of sibling PRs** | PM 按 PR 业务信息(业务域 / 变更面 / 技术栈)**平均分配**到四个席位:`@code-reviewer`(general)、`@fullstack-dev`、`@fullstack-dev-2`、`@frontend-dev` — 每个席位承载约 N/4 个 PR,摊薄同模型并发,降低 rate-limit。All worktrees created first, then all reviewers dispatched in one batch; each reviewer owns review + comment for its PRs only |
30
-
31
- All review seats (`code-reviewer` / `fullstack-dev` / `fullstack-dev-2` / `frontend-dev`) are **read-only** in this flow: never edit the reviewed worktree, never merge, never approve-as-merge. Implementer seats run in **Audit Mode** (shared contract → `mstar-roles` `references/_shared/leaf-executor-core.md`). PM dispatches; each reviewer executes the `pr` variant and returns findings + verdict to PM for consolidation.
32
-
33
- ## Execute
34
-
35
- Execute **`mstar-audit`** § `pr` variant end to end(SKILL.md common core:recon + three-way attack & vet;variant detail:**`references/pr-review.md`** —— scope → guidance load → concern lenses → evidence → verdict → output). Review is run in a dedicated worktree against a diff from the PR's **real base** — resolve the base per `references/pr-review.md` § Worktree isolation (never assume `main`).
36
-
37
- Review findings that need fixing can be turned into self-contained plans for the normal Prepare → Execute flow (reusing `mstar-audit` SKILL.md **`## Plan output (all variants)`** — same contract as the `pr` variant).
38
-
39
- Output verdict + findings to the user, with the posted GitHub Review URL. Posting procedure (when a PR number exists) → **`references/pr-review.md`** § Comment posting; each reviewer also saves the durable local report → **`references/pr-review.md`** § Local report archive. Never auto-approve or merge.