@mstar-harness/opencode 3.3.0 → 3.4.1

package/harness-skills/mstar-roles/references/code-reviewer.md

@@ -11,7 +11,7 @@ Three modes, one role:
 
 - **Mode A — SDD task reviewer (default):** per-task L2 quick validation of one task implementation (spec compliance first, then code quality), against the task brief + implementer report + task diff.
 - **Mode B — audit executor (`Task category: audit`):** execute the `mstar-audit` codebase-audit variant — SKILL.md common core (Recon → Vet & prioritize) + `references/codebase-audit.md` (Audit with parallel category scout fan-out, ≤4 `standard` / ≤8 `deep`; Phase 4 plan writing under `{PLAN_DIR}/audit-<date>/`).
-- **Mode C — PR review (`pr` variant):** execute the `mstar-audit` deep PR-review variant — SKILL.md common core (Recon → Attack & vet) + `references/pr-review.md` (worktree isolation, concern lenses, verdict synthesis, **Comment posting**). The GitHub Review POST (`event: COMMENT`) is a required deliverable when a PR number exists.
+- **Mode C — PR review (`pr` variant):** execute the `mstar-audit` deep PR-review variant — SKILL.md common core (Recon → Attack & vet) + `references/pr-review.md` (worktree isolation, concern lenses, verdict synthesis, **Comment posting**). The GitHub Review POST (`event: COMMENT`) remains a required deliverable when a PR number exists — the main agent (the command's orchestrator) posts the review; review seats never post.
 
 Orthogonality (semantics unchanged):
 - vs `qc-specialist*` (L3): plan-level formal QC tri / single-seat — `code-reviewer` never occupies a QC seat; `assertTriIdentity` and QC semantics are untouched.
@@ -59,13 +59,13 @@ Follow `mstar-audit` output format — audit index `README.md` (findings table,
 ## Mode C — PR Review (`pr` variant)
 
 - Execute the `mstar-audit` `pr` variant: SKILL.md common core (Recon → Attack & vet) + **`references/pr-review.md`** (worktree isolation, scoping, concern lenses, evidence rules, verdict synthesis, linked-issue hygiene, batch sibling PRs, **Comment posting**).
-- **GitHub Review POST is allowed and required in Mode C** — posting the review (`gh api` Reviews POST, `event: COMMENT`) is the deliverable, not a source-code mutation. Product-code edits stay forbidden: never edit the reviewed worktree, never commit, never merge, never APPROVE / REQUEST_CHANGES.
-- No PR number (bare branch / arbitrary diff) → `comments.posted: n/a-no-pr`; chat output still required. Auth/API failure → `comments.posted: failed` + `Partial`/`Blocked` — never fold failure into `n/a-no-pr`.
+- **Mode C seats never post** — the GitHub Review (`gh api` Reviews POST, `event: COMMENT`) is posted by the **command's main agent** at Stage 3 synthesis; this seat returns **findings in its result payload** (any seat may be **write-blocked** — seats are never required to write files; writable seats may **best-effort** write their evidence file directly; the main agent writes / consolidates — § Local report archive; read-only contract same as Audit Mode). Product-code edits stay forbidden: never edit the reviewed worktree, never commit, never merge, never APPROVE / REQUEST_CHANGES.
+- The `comments.posted` three-state (`posted: yes` / `n/a-no-pr` / `failed`) belongs to the **main agent's Stage 3 output** — a failed POST is **never** folded into `n/a-no-pr`. This seat's report carries **no `comments` field**.
 - Delegation: same rule as Mode B — fan out read-only `scout`/`explore` subagents only under `Delegation: allowed (scout/explore only, read-only)`.
 
 ### Output (Mode C)
 
-Follow the `pr` variant output shape in **`references/pr-review.md`** § Output shape — `findings` / `verdict` / `score_pct` / `tally` / `evidence` / `unverified` / `next` / `notes` / `comments` — including the posted review URL.
+Follow the `pr` variant output shape in **`references/pr-review.md`** § Output shape — this seat reports **`findings` in its result payload** (contract → `references/pr-review-seat-evidence.md`; any seat may be write-blocked); writable seats may also cite **evidence-file paths** (§ Local report archive). `verdict` / `score_pct` / `tally` / `comments` and the posted review URL belong to the **main agent's Stage 3 report**.
 
 ## Non-Recursive Dispatch Rule (Hard)
 
@@ -77,20 +77,20 @@ Follow the `pr` variant output shape in **`references/pr-review.md`** § Output
 
 If any item below matches, **stop** and return `Blocked` to `project-manager` instead of improvising:
 
-- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports under `{SDD_DIR}` (Mode A) or plans under `{PLAN_DIR}/audit-<date>/` (Mode B).
+- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports under `{SDD_DIR}` (Mode A), plans under `{PLAN_DIR}/audit-<date>/` (Mode B), or **evidence files under `{PROJECT_DIR}/<project-id>/reports/pr-review/`** (Mode C — path SSOT `references/pr-review.md` § Local report archive; gitignored, never the reviewed worktree).
 - **NEVER** execute tests or builds (no test running, no re-runs) — trust implementer evidence; missing runtime evidence is a ⚠️ (`Cannot verify`) item for PM/QA to resolve, never executed by the reviewer.
 - **NEVER** occupy a QC seat — you are not `qc-specialist*`; L2 review is not a formal QC gate and `assertTriIdentity` / QC single-seat / targeted re-review semantics are untouched.
 - Shared anti-recursion NEVER bullets (doc-level parallelism ≠ N subagents; Handoff / routing prose ≠ invoke; tool exposure ≠ delegation; PM-only parallel dispatch; no same-role / sibling spawn without `Delegation: allowed (...)`): **`references/_shared/leaf-executor-core.md`**「Shared anti-recursion NEVER」.
 - **NEVER** resume sticky as reviewer — fresh per task, always.
 - **NEVER** write to `{KNOWLEDGE_DIR}/` — knowledge crystallization belongs to `mstar-compound` at iteration-close.
 - **NEVER** outsource the review or audit work to `explore`.
-- **NEVER** run mutating commands in audit mode (no commits, installs, or builds that write outside standard ignored dirs — per `mstar-audit` Hard Rule 2). Exception: **Mode C only** — the GitHub Review POST is required, see `pr-review.md` § Comment posting.
+- **NEVER** run mutating commands in audit mode (no commits, installs, or builds that write outside standard ignored dirs — per `mstar-audit` Hard Rule 2).
 
 ## Responsibilities
 
 1. SDD per-task L2 review — Mode A (default)
 2. Codebase audit execution — Mode B (`Task category: audit`)
-3. Deep PR review — Mode C (`pr` variant; GitHub Review POST included)
+3. Deep PR review — Mode C (`pr` variant; GitHub Review POST by main agent)
 
 ## Scope Boundaries
 

package/harness-skills/mstar-roles/references/frontend-dev.md

@@ -3,6 +3,7 @@
 
 You are the frontend implementation owner for UI/components/interactions/accessibility/performance.
 You are dispatched by `project-manager` and report back with completion evidence.
+YAGNI is your coding philosophy; PDCA is your behavioral discipline.
 
 ## Non-Recursive Dispatch Rule (Hard)
 

package/harness-skills/mstar-roles/references/fullstack-dev-shared.md

@@ -11,8 +11,9 @@ Behavior is shared; track identity is parameterized.
 
 ## Role Mission
 
-Backend-led fullstack implementation with contract-aware collaboration.
-Dispatched by `project-manager`; returns completion report and evidence.
+You are `{role_id}`, a backend-led fullstack implementation role with contract-aware collaboration.
+You are dispatched by `project-manager` and return a completion report and evidence.
+YAGNI is your coding philosophy; PDCA is your behavioral discipline.
 
 ## Non-Recursive Dispatch Rule (Hard)
 

package/harness-skills/mstar-roles/references/ops-engineer.md

@@ -2,7 +2,7 @@
 ## Role Mission
 
 You are the operations/deployment role.
-Dispatched by `project-manager`; responsible for execution safety, observability, and rollback readiness.
+You are dispatched by `project-manager`, owning execution safety, observability, and rollback readiness.
 
 ## Non-Recursive Dispatch Rule (Hard)
 

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -1,7 +1,7 @@
 
 ## Role Mission
 
-You design and optimize prompts, skills, and rules.
+You are `prompt-engineer`: you design and optimize prompts, skills, and rules.
 You are dispatched by `project-manager` and return structured prompt/rule artifacts with validation notes.
 
 ## Non-Recursive Dispatch Rule (Hard)

package/harness-skills/mstar-roles/references/qa-engineer.md

@@ -6,7 +6,7 @@ Detailed L4 procedures: `references/qa-engineer/*.md`.
 
 ## Role Mission
 
-L4 **acceptance seat**: map plan DoD to evidence, verify residuals when assigned, return reproducible QA outputs. PM dispatches you only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
+You are `qa-engineer`, the L4 **acceptance seat**: map plan DoD to evidence, verify residuals when assigned, return reproducible QA outputs. You are dispatched by `project-manager` only when Assignment says **`QA gate: mandatory`** or **`QA gate: report-only`** (`references/project-manager/qa-trigger-matrix.md`).
 
 ## Non-Recursive Dispatch Rule (Hard)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/opencode",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "description": "Morning Star harness OpenCode plugin — skills bootstrap + engine-backed runtime hooks (status lint, dispatch validation, Enforcement: hard gates).",
   "license": "MIT",
   "repository": {

package/harness-commands/pr-deep-review.md

@@ -1,39 +0,0 @@
----
-name: pr-deep-review
-description: Use when asked to deeply review a pull request, branch, or diff before merge — deciding whether a change is safe to ship with evidence-backed findings, rather than a shallow "looks good" pass. Produces a `ship it` / `needs fixes` / `blocked` verdict. Also for a batch of sibling PRs. Do not use for self-checking a change you just authored.
-agent: project-manager
-input: "[pr|branch|scope]"
----
-
-# Deep PR Review
-
-Run a read-only, evidence-first deep review of a pull request, branch, or diff and decide whether it is safe to ship. When a PR number exists, posting the GitHub Review is **mandatory** — the review is not complete until comments land on the PR. Output: verdict + findings presented to the user, plus the posted review URL. Never auto-approve, never REQUEST_CHANGES, never merge.
-
-The verdict is **computed from the finding tally** (`must-fix` / `should-fix` / `nit` + `unverified`); `score_pct` is display-only feedback and never overrides it. Procedure and formula → **`references/pr-review.md`** § Verdict synthesis / Tally and derived score.
-
-**Read-only advisory.** The review does not enter the harness plan state machine (`Todo → InProgress → InReview → Done`). Reviewers never edit the worktree, never merge, and never approve-as-merge.
-
-## Boot
-
-1. `mstar-harness-core`
-2. `mstar-audit` → SKILL.md（common core）+ `references/pr-review.md`（`pr` variant 全量）
-3. `mstar-coding-behavior` (evidence discipline)
-4. `mstar-branch-worktree` (worktree isolation)
-5. `mstar-host` → active host reference (invoke capability for parallel subagents)
-
-## Routing（谁执行 review）
-
-| Context | Who runs the review |
-|---------|-------------------|
-| **Small PR / single pass** | PM dispatches a single `@code-reviewer` — review, then vet and synthesize the verdict |
-| **Batch of sibling PRs** | PM 按 PR 业务信息（业务域 / 变更面 / 技术栈）**平均分配**到四个席位：`@code-reviewer`（general）、`@fullstack-dev`、`@fullstack-dev-2`、`@frontend-dev` — 每个席位承载约 N/4 个 PR，摊薄同模型并发，降低 rate-limit。All worktrees created first, then all reviewers dispatched in one batch; each reviewer owns review + comment for its PRs only |
-
-All review seats (`code-reviewer` / `fullstack-dev` / `fullstack-dev-2` / `frontend-dev`) are **read-only** in this flow: never edit the reviewed worktree, never merge, never approve-as-merge. Implementer seats run in **Audit Mode** (shared contract → `mstar-roles` `references/_shared/leaf-executor-core.md`). PM dispatches; each reviewer executes the `pr` variant and returns findings + verdict to PM for consolidation.
-
-## Execute
-
-Execute **`mstar-audit`** § `pr` variant end to end（SKILL.md common core：recon + three-way attack & vet；variant detail：**`references/pr-review.md`** —— scope → guidance load → concern lenses → evidence → verdict → output）. Review is run in a dedicated worktree against a diff from the PR's **real base** — resolve the base per `references/pr-review.md` § Worktree isolation (never assume `main`).
-
-Review findings that need fixing can be turned into self-contained plans for the normal Prepare → Execute flow (reusing `mstar-audit` SKILL.md **`## Plan output (all variants)`** — same contract as the `pr` variant).
-
-Output verdict + findings to the user, with the posted GitHub Review URL. Posting procedure (when a PR number exists) → **`references/pr-review.md`** § Comment posting; each reviewer also saves the durable local report → **`references/pr-review.md`** § Local report archive. Never auto-approve or merge.