@open-agent-toolkit/cli 0.1.13 → 0.1.15

package/assets/skills/oat-project-review-receive-remote/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-review-receive-remote
-version: 1.3.0
+version: 1.4.0
 description: Use when processing GitHub PR review comments within project context. Fetches PR comments, creates plan tasks, and updates project artifacts.
 disable-model-invocation: true
 user-invocable: true
@@ -139,11 +139,11 @@ Before prompting dispositions, print:
 
 Disposition options:
 
-- `convert` (default for critical/important/medium)
-- `defer` (default for minor)
+- `convert` (default for critical/important/medium/minor)
+- `defer`
 - `dismiss`
 
-Require rationale for `defer`/`dismiss`.
+Require concrete rationale for `defer`/`dismiss` at any severity, including minor. Small findings are usually cheaper to fix inline than to track as backlog items, so a minor `defer` must be justified just like any other deferral.
 
 ### Step 5: Convert Findings to Plan Tasks
 

package/assets/skills/oat-review-provide/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-review-provide
-version: 1.2.0
+version: 1.2.1
 description: Use when you need an ad-hoc review outside an active OAT project lifecycle. Reviews code or artifacts without project phase state, unlike oat-project-review-provide.
 argument-hint: '[unstaged|staged|base_branch=<branch>|base_sha=<sha>|<sha1>..<sha2>|--files <path1,path2,...>] [--output <path>] [--mode auto|local|tracked|inline]'
 disable-model-invocation: true
@@ -137,7 +137,7 @@ bash .agents/skills/oat-review-provide/scripts/resolve-review-output.sh --mode a
 
 Policy:
 
-- If `.oat/repo/reviews` exists and is not gitignored, assume user wants tracked active artifacts there.
+- If `.oat/repo/reviews` exists and new review artifacts under it are not gitignored, assume user wants tracked active artifacts there.
 - Otherwise default to active local `.oat/projects/local/orphan-reviews`.
 - Do **not** write new review artifacts directly into any `archived/` directory; those are historical locations used after `oat-review-receive` processes a review.
 - If user preference is unclear, ask and recommend local-only.

package/assets/skills/oat-review-provide/scripts/resolve-review-output.sh

@@ -18,7 +18,7 @@ Policy:
 - If --output is provided, use it directly.
 - If mode=inline, no artifact file is written.
 - In auto mode:
-  - If .oat/repo/reviews exists and is NOT gitignored, use it (tracked convention).
+  - If .oat/repo/reviews exists and new review artifacts under it are NOT gitignored, use it (tracked convention).
   - Otherwise, use .oat/projects/local/orphan-reviews (local-only default).
 USAGE
 }
@@ -67,12 +67,22 @@ is_gitignored() {
   fi
 }
 
+artifact_probe_path() {
+  local output_dir="$1"
+  printf '%s/%s\n' "${output_dir%/}" "ad-hoc-review-gitignore-probe.md"
+}
+
+is_output_gitignored() {
+  local output_dir="$1"
+  is_gitignored "$(artifact_probe_path "$output_dir")"
+}
+
 # Resolve explicit output first
 if [[ -n "$OUTPUT" ]]; then
   echo "review_mode=file"
   echo "output_dir=$OUTPUT"
   echo "output_kind=custom"
-  echo "output_gitignored=$(is_gitignored "$OUTPUT")"
+  echo "output_gitignored=$(is_output_gitignored "$OUTPUT")"
   echo "reason=explicit_output"
   exit 0
 fi
@@ -93,7 +103,7 @@ if [[ "$MODE" == "tracked" ]]; then
   echo "review_mode=file"
   echo "output_dir=$TRACKED_DIR"
   echo "output_kind=tracked"
-  echo "output_gitignored=$(is_gitignored "$TRACKED_DIR")"
+  echo "output_gitignored=$(is_output_gitignored "$TRACKED_DIR")"
   echo "reason=forced_tracked"
   exit 0
 fi
@@ -102,13 +112,13 @@ if [[ "$MODE" == "local" ]]; then
   echo "review_mode=file"
   echo "output_dir=$LOCAL_DIR"
   echo "output_kind=local"
-  echo "output_gitignored=$(is_gitignored "$LOCAL_DIR")"
+  echo "output_gitignored=$(is_output_gitignored "$LOCAL_DIR")"
   echo "reason=forced_local"
   exit 0
 fi
 
 # auto mode
-if [[ -d "$TRACKED_DIR" ]] && [[ "$(is_gitignored "$TRACKED_DIR")" == "false" ]]; then
+if [[ -d "$TRACKED_DIR" ]] && [[ "$(is_output_gitignored "$TRACKED_DIR")" == "false" ]]; then
   echo "review_mode=file"
   echo "output_dir=$TRACKED_DIR"
   echo "output_kind=tracked"
@@ -120,5 +130,5 @@ fi
 echo "review_mode=file"
 echo "output_dir=$LOCAL_DIR"
 echo "output_kind=local"
-echo "output_gitignored=$(is_gitignored "$LOCAL_DIR")"
+echo "output_gitignored=$(is_output_gitignored "$LOCAL_DIR")"
 echo "reason=default_local_only"

package/assets/skills/oat-review-provide-remote/SKILL.md

@@ -0,0 +1,273 @@
+---
+name: oat-review-provide-remote
+version: 1.0.3
+description: Use when reviewing a GitHub PR opened on another machine and posting findings back as a single PR review, outside any OAT project context. Fetches the PR via gh, reviews it, and posts via gh api.
+disable-model-invocation: true
+user-invocable: true
+allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+---
+
+# Remote Review Provide (Ad-hoc GitHub PR)
+
+Review a GitHub PR opened by an agent on another machine and post the findings back as a single GitHub PR review — without requiring an active OAT project. GitHub is the source of truth: no local artifact is written and no lifecycle bookkeeping happens here. The posted review carries metadata markers so `oat-review-receive-remote` can round-trip the findings into tasks on the originating machine.
+
+## Prerequisites
+
+- `gh` CLI is installed and authenticated (`gh auth status`).
+- The PR to review exists on GitHub and is reachable from the current repo's remote.
+- Optionally `npx agent-reviews` for posting symmetry (capability-probed at startup; `gh api` is the fallback).
+- User wants an ad-hoc remote review outside the OAT project lifecycle.
+
+## Mode Assertion
+
+**OAT MODE: Remote Review Provide**
+
+**Purpose:** Fetch a GitHub PR, review it inline against the ad-hoc review checklist + severity model, and post a single PR review (summary + severity counts + inline comments + metadata markers) back to GitHub.
+
+**BLOCKED Activities:**
+
+- No `plan.md`, `state.md`, or `implementation.md` lifecycle mutations.
+- No local review artifact written on this machine (GitHub is the source of truth).
+- No mutation of the caller's working tree — all checkout happens in an ephemeral worktree.
+- No implementing fixes, commits, or pushes (this skill reviews; it does not fix).
+- No posting a review to GitHub without explicit user confirmation.
+
+**ALLOWED Activities:**
+
+- Resolve the PR number.
+- Acquire PR content via ephemeral worktree + `gh pr checkout` (or `gh pr diff` fallback).
+- Detect prior provide-remote reviews and narrow re-review scope (with the stale-SHA guard).
+- Run the ad-hoc review inline (no tier model).
+- Build the posted-review body + inline-comment array.
+- Post a single PR review via `agent-reviews` (if probed supported) else `gh api` (with user confirmation).
+
+**Self-Correction Protocol:**
+If you catch yourself:
+
+- Running `gh pr checkout` in the caller's working tree instead of an ephemeral worktree -> STOP, acquire the worktree first, and check out inside it.
+- Writing a review artifact file on this machine -> STOP; the posted PR review is the only output.
+- Editing project lifecycle artifacts (`plan.md`, `state.md`, `implementation.md`) -> STOP and revert to review-and-post only.
+- Posting the review to GitHub without explicit user confirmation -> STOP and present the body + verdict for approval first.
+- Narrowing against a prior review SHA without running the existence + ancestry guard -> STOP and run the guard first.
+- Forgetting to remove the ephemeral worktree after posting (or on failure) -> STOP and release it in a `finally`.
+
+## Progress Indicators (User-Facing)
+
+Print this banner once at start:
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+OAT ▸ REMOTE REVIEW PROVIDE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Use step indicators:
+
+- `[1/7] Resolving PR...`
+- `[2/7] Checking out PR (ephemeral worktree)...`
+- `[3/7] Detecting prior reviews + narrowing scope...`
+- `[4/7] Running review...`
+- `[5/7] Mapping inline comments to the diff...`
+- `[6/7] Building review body + verdict...`
+- `[7/7] Posting review + cleanup...`
+
+## Arguments
+
+```
+oat-review-provide-remote [--pr <N>] [--no-checkout] [--narrow|--no-narrow]
+```
+
+- `--pr <N>`: target PR number. When omitted, auto-detect from the current branch.
+- `--no-checkout`: skip the ephemeral worktree and review from `gh pr diff` only (degraded context).
+- `--narrow` / `--no-narrow`: force or forbid re-review narrowing against a prior provide-remote review. When neither is passed, honor `workflow.autoNarrowReReviewScope` (no prompt when `true`; confirm prompt otherwise).
+
+Inputs are CLI-style args parsed from `$ARGUMENTS`. No file inputs. No file outputs on this machine.
+
+## Findings Model
+
+Normalize every finding to this shape (matches the ad-hoc review checklist and the `oat-review-receive-remote` model):
+
+```yaml
+finding:
+  id: "C1" | "I1" | "M1" | "m1"
+  severity: critical | important | medium | minor
+  title: string
+  file: string | null
+  line: number | null
+  body: string
+  fix_guidance: string | null
+```
+
+Severity conventions:
+
+- `critical`: Broken behavior, security risk, or missing P0 requirement.
+- `important`: Missing P1 requirement, major robustness issue.
+- `medium`: Meaningful but non-blocking quality/maintainability issue.
+- `minor`: Cosmetic/style/documentation issue.
+
+Checklist + severity model source of truth: `.agents/skills/oat-review-provide/references/review-artifact-template.md`.
+
+## Process
+
+### Step 1: Resolve PR Number
+
+PR resolution order:
+
+1. `--pr <N>` from `$ARGUMENTS`.
+2. Auto-detect from the current branch: `gh pr view --json number -q .number`.
+
+Confirm `gh auth status` succeeds. Ask the user to confirm the resolved PR number before checkout. Capture the PR HEAD SHA (full 40-char) for the marker block and the narrowing guard:
+
+```bash
+PR_HEAD_SHA=$(gh pr view "$PR" --json headRefOid -q .headRefOid)
+```
+
+### Step 2: Check Out the PR (Hybrid Read)
+
+Acquire an ephemeral worktree FIRST, then run `gh pr checkout` inside it so the caller's working tree is never mutated. Use repo-scoped git commands so the skill works regardless of the caller's CWD (design.md → Data Flow step 2). This shell flow parallels the tested TypeScript helper at `packages/cli/src/review-remote/worktree.ts` (`acquireWorktree` / `runInWorktree` / `releaseWorktree`) — keep the two in sync if you change either:
+
+```bash
+REPO_ROOT=$(git rev-parse --show-toplevel)
+EPHEMERAL_PATH=$(mktemp -d)
+rmdir "$EPHEMERAL_PATH"   # git worktree add requires a non-existent target
+git -C "$REPO_ROOT" worktree add --detach "$EPHEMERAL_PATH" HEAD
+( cd "$EPHEMERAL_PATH" && gh pr checkout "$PR" )
+```
+
+The `-C "$REPO_ROOT"` flag is load-bearing — it lets the command run even when the caller's CWD is not inside the repository.
+
+Fallback to diff-only mode when `--no-checkout` is set, or when worktree creation / `gh pr checkout` fails (capture exit code + stderr; distinguish auth from network from branch-state failures). On checkout failure, clean up the partial worktree (`git -C "$REPO_ROOT" worktree remove --force "$EPHEMERAL_PATH"`), then warn the user that context is degraded and continue with:
+
+```bash
+gh pr diff "$PR" > "$DIFF_FILE"
+gh pr view "$PR" --json title,body,headRefOid,baseRefName,state
+```
+
+### Step 3: Detect Prior Reviews + Narrow Scope
+
+List prior PR reviews and parse each body's marker block. Filter to reviews where `oat_provide_remote: true` AND `oat_review_scope == "ad-hoc"` AND no `oat_project` key — project-rail markers are ignored by the ad-hoc filter.
+
+```bash
+gh api "/repos/{owner}/{repo}/pulls/$PR/reviews"
+```
+
+Take the most recent matching review (by submitted timestamp). Before narrowing to `<prior_sha>..<HEAD>`, run the stale-SHA guard (design.md → Error Handling → Stale prior-review SHA):
+
+Run the guard in the available git context `$GIT_CTX` — `$EPHEMERAL_PATH` in rich-context (checkout) mode, or `$REPO_ROOT` in diff-only mode (where no worktree exists):
+
+1. **Existence:** `git -C "$GIT_CTX" cat-file -e <prior_sha>` (diff-only mode: `git -C "$REPO_ROOT" fetch origin <prior_sha>:refs/oat-prior-review` first, then re-check; if that fetch fails, fall back to full PR scope).
+2. **Ancestry:** `git -C "$GIT_CTX" merge-base --is-ancestor <prior_sha> "$PR_HEAD_SHA"`.
+
+Guard outcomes:
+
+- Both pass -> narrow to `<prior_sha>..<HEAD>`.
+- Either fails -> fall back to full PR scope and warn that the prior SHA is unreachable (likely rebase/force-push).
+- `--narrow` set AND guard fails -> hard error; surface unreachability and stop.
+- `workflow.autoNarrowReReviewScope == true` -> never prompt; guard failure auto-falls back to full scope with the warning as the auto-fallback notice.
+- No matching prior review -> use full PR diff.
+
+### Step 4: Run the Review (Inline)
+
+Review inline (no tier model — matches local `oat-review-provide`) using the ad-hoc review checklist + severity model. Scope to the narrowing range when one was chosen; otherwise the full PR diff. Assign finding IDs per severity bucket (`C1`, `I1`, `M1`, `m1`).
+
+### Step 5: Map Inline Comments to the Diff
+
+For each finding with non-null `file` + `line`, classify it against the PR diff BEFORE adding it to the inline `comments[]` payload (design.md → Error Handling → Inline-comment line mapping):
+
+- Rich-context mode: parse hunk ranges from `gh api /repos/{owner}/{repo}/pulls/$PR/files` (per-file `patch` field).
+- Diff-only mode: parse hunk headers (`@@ -a,b +c,d @@`) from the `gh pr diff` output.
+- `side: RIGHT` for additions/context; `side: LEFT` only when the finding is explicitly about removed code.
+- **Renamed files:** a `gh api .../files` entry carries the pre-rename path in a sibling `previous_filename` field (not in `patch`). When a finding references the pre-rename path, remap it to the entry's post-rename `filename` before classifying, or it will be treated as out-of-diff.
+- If `line` falls outside the diff: downgrade the finding to a top-level "Findings outside the PR diff" subsection with its `file:line` reference. NEVER silently drop it and NEVER shift the line to the nearest in-diff line.
+
+> **Reference implementation:** the canonical, tested logic for this step lives in `packages/cli/src/review-remote/line-mapper.ts` (`parsePullFilesPatch` / `parseUnifiedDiff` / `classifyFinding`). The bash/`jq` flow here mirrors it — keep the two in sync. See `packages/cli/src/review-remote/README.md`; `bl-a7cd` tracks wiring this skill to call the helpers directly. The same applies to the marker block (`marker-parser.ts`), body/verdict (`body-builder.ts`), and re-review narrowing (`narrowing.ts`) used in the steps below.
+
+### Step 6: Build the Review Body + Verdict
+
+Build the posted-review body (design.md → Data Models → Posted-review-body): a leading HTML-comment marker block, then summary, severity counts, the minor-fix "Notes" nudge (only when minor findings are present), and optional verification commands.
+
+Markers (ad-hoc rail):
+
+```
+<!-- oat-review-metadata
+oat_provide_remote: true
+oat_review_head_sha: <PR_HEAD_SHA>
+oat_review_scope: ad-hoc
+oat_review_invocation: manual
+-->
+```
+
+`oat_project` is omitted entirely on the ad-hoc rail. Verdict: `REQUEST_CHANGES` when any critical or important finding exists; `COMMENT` otherwise (including a clean, zero-findings review — never auto-`APPROVE`).
+
+### Step 7: Post the Review + Clean Up
+
+Probe `agent-reviews` for a posting flow with a non-mutating check (`npx agent-reviews --help`), cached for the run:
+
+- If a posting flow is supported -> prefer `agent-reviews` for tooling symmetry.
+- Otherwise (or if the probe is inconclusive) -> post via `gh api`. As of the current `agent-reviews` release there is no review-posting flow, so `gh api` is the expected path.
+
+Present the body + verdict + inline-comment count to the user and get explicit confirmation, then post a single review.
+
+`gh api --field`/`-f`/`-F` only set top-level scalar values; they CANNOT build the nested `comments[]` array of objects the reviews endpoint requires for inline comments. Construct the complete review payload as JSON and pipe it through `--input -` instead (a heredoc or a temp JSON file both work). Each in-diff finding (from Step 5) becomes one `comments[]` entry `{ path, line, side, body }`; out-of-diff findings are NOT added here — they were already downgraded into `$REVIEW_BODY` in Step 5. `event` is the Step 6 verdict (`REQUEST_CHANGES` when any critical/important finding exists, else `COMMENT`). A body-only review (zero in-diff findings) uses an empty `comments` array or omits the key:
+
+```bash
+# Build the payload as JSON. `comments` is the in-diff findings array; jq
+# assembles it safely (escaping body text, numbers as numbers). For a
+# body-only review, COMMENTS_JSON is `[]`.
+jq -n \
+  --arg event "$VERDICT" \
+  --arg body "$REVIEW_BODY" \
+  --argjson comments "$COMMENTS_JSON" \
+  '{event: $event, body: $body, comments: $comments}' \
+| gh api --method POST "/repos/{owner}/{repo}/pulls/$PR/reviews" --input -
+
+# COMMENTS_JSON is a JSON array, one object per in-diff finding, e.g.:
+#   [
+#     { "path": "src/foo.ts", "line": 42, "side": "RIGHT", "body": "..." },
+#     { "path": "src/bar.ts", "line": 17, "side": "LEFT",  "body": "..." }
+#   ]
+# `side` is RIGHT for additions/context, LEFT only for explicit removed-code
+# findings (Step 5). Use `[]` when there are no in-diff findings.
+```
+
+Posting failure handling (design.md → Error Handling → Posting failures): on auth failure, surface `gh auth status` and stop (findings kept in memory). On PR closed/merged, surface a clear message and present findings inline. On inline-comment rejection, re-map against the current file list and retry once; if still rejected, downgrade the offending finding(s) and retry. On rate limit, surface the window and stop. NEVER silently drop a finding.
+
+Always release the ephemeral worktree in a `finally`, even when review or posting fails:
+
+```bash
+git -C "$REPO_ROOT" worktree remove --force "$EPHEMERAL_PATH" || git -C "$REPO_ROOT" worktree prune
+rm -rf "$EPHEMERAL_PATH"
+```
+
+## Troubleshooting
+
+- Auth failure: run `gh auth status`; re-authenticate, then retry.
+- No PR detected: pass explicit `--pr <N>`.
+- Checkout fails: the skill auto-falls back to diff-only mode with a degraded-context warning; pass `--no-checkout` to force it.
+- Prior-review SHA unreachable: re-invoke without `--narrow` to review full scope.
+- Inline comment rejected at a file:line: the finding is downgraded to the top-level body, not dropped.
+- Network / rate-limit errors: retry after backoff; report blocked state if persistent.
+
+## Output Contract
+
+At completion, report:
+
+- PR number and HEAD SHA reviewed.
+- Read mode (worktree checkout vs diff-only).
+- Narrowing decision (full scope vs `<prior_sha>..<HEAD>`, and why).
+- Severity counts and total findings.
+- Inline-comment count posted vs findings downgraded to the body (out-of-diff).
+- Verdict (`REQUEST_CHANGES` or `COMMENT`).
+- Posting mechanism (`agent-reviews` or `gh api`) and whether the review was posted.
+- Confirmation that the ephemeral worktree was removed.
+
+## Success Criteria
+
+- PR scope resolved and confirmed.
+- PR content acquired via ephemeral worktree (or diff-only fallback) without mutating the caller's working tree.
+- Prior provide-remote reviews detected; re-review narrowing applied only after the stale-SHA guard passes.
+- Findings produced with consistent 4-tier severities and file:line references.
+- Inline comments mapped to in-diff positions; out-of-diff findings downgraded to the body, never dropped.
+- Posted-review body carries the marker block first, correct severity counts, and the minor-fix nudge when minors are present.
+- Verdict matches the C/I rule (`REQUEST_CHANGES` vs `COMMENT`; never auto-`APPROVE`).
+- Single PR review posted (with user confirmation) via `agent-reviews` if supported, else `gh api`.
+- Ephemeral worktree removed on success and on failure.
+- No local artifact, no lifecycle bookkeeping, no fixes/commits/pushes on this machine.

package/assets/skills/oat-review-receive/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-review-receive
-version: 1.3.0
+version: 1.4.0
 description: Use when processing review findings outside project context. Converts local review artifacts into actionable task lists.
 disable-model-invocation: true
 user-invocable: true
@@ -41,8 +41,8 @@ If you catch yourself:
 
 - Editing project lifecycle docs in ad-hoc mode -> STOP and revert to task-list output only.
 - Triaging without presenting a findings overview first -> STOP and show overview before disposition prompts.
-- Skipping Medium finding rationale when proposing deferral -> STOP and collect explicit rationale.
-- Auto-deferring Minor findings without checking future cleanup likelihood or fix cost -> STOP and re-evaluate the recommendation.
+- Skipping rationale when proposing deferral at any severity (including Minor) -> STOP and collect explicit rationale.
+- Defaulting a Minor finding to `defer` instead of `convert` -> STOP; the Minor default is `convert` (fix inline), and `defer` requires concrete rationale.
 
 **Recovery:**
 
@@ -182,12 +182,12 @@ Default suggestions:
 - Critical -> `convert`
 - Important -> `convert`
 - Medium -> `convert` (propose `defer` only with concrete rationale)
-- Minor -> `convert` when future cleanup is likely or the fix is trivial; otherwise `defer` with concrete rationale
+- Minor -> `convert` (propose `defer` only with concrete rationale)
 
 Rules:
 
-- Require explicit rationale for `defer` or `dismiss`.
-- Do not recommend `defer` for a Minor finding solely because it does not impact current functionality. If there is a better-than-even chance the team will need to clean it up later, or the fix is `Negligible`/`Minor`, recommend `convert`.
+- Require explicit rationale for `defer` or `dismiss` at any severity, including Minor. Small findings are cheap to fix inline, so deferring a Minor into a backlog item must be justified just like any other deferral.
+- Do not recommend `defer` for a Minor finding solely because it does not impact current functionality — fixing inline is usually cheaper than tracking it. Reserve `defer` for the genuine cases (low-probability cleanup, blocked dependency, duplicated elsewhere, explicitly out of scope, or disproportionate churn now).
 - Do not silently skip findings.
 
 ### Step 5: Generate Task List Output

package/assets/skills/oat-review-receive-remote/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-review-receive-remote
-version: 1.2.0
+version: 1.3.0
 description: Use when processing GitHub PR review comments outside project context. Fetches PR comments via agent-reviews and converts them into actionable task lists.
 disable-model-invocation: true
 user-invocable: true
@@ -145,14 +145,14 @@ Before triage prompts, output:
 
 Disposition options per finding:
 
-- `convert` (default for critical/important/medium)
-- `defer` (default for minor)
+- `convert` (default for critical/important/medium/minor)
+- `defer`
 - `dismiss`
 
 Rules:
 
-- Require rationale for `defer`/`dismiss`.
-- For medium deferral, require concrete rationale (duplicate, dependency, explicit out-of-scope follow-up, risky churn).
+- Require concrete rationale for `defer`/`dismiss` at any severity, including minor. Small findings are usually cheaper to fix inline than to track as backlog items, so a minor `defer` must be justified just like any other deferral.
+- For any deferral (minor included), require a concrete reason (duplicate, dependency, explicit out-of-scope follow-up, risky churn).
 
 ### Step 5: Generate Standalone Task List
 

package/dist/commands/init/tools/shared/skill-manifest.d.ts

@@ -11,7 +11,7 @@ export interface PackMetadata {
 }
 export declare const PACK_METADATA: Record<string, PackMetadata>;
 export declare function resolvePackDefaultScope(packName: string): 'user' | 'project';
-export declare const WORKFLOW_SKILLS: readonly ["oat-project-capture", "oat-project-clear-active", "oat-project-complete", "oat-project-design", "oat-project-discover", "oat-project-document", "oat-project-implement", "oat-project-import-plan", "oat-project-new", "oat-project-next", "oat-project-open", "oat-project-plan", "oat-project-plan-writing", "oat-project-pr-final", "oat-project-pr-progress", "oat-project-progress", "oat-project-promote-spec-driven", "oat-project-quick-start", "oat-project-reconcile", "oat-project-revise", "oat-project-review-provide", "oat-project-review-receive", "oat-project-review-receive-remote", "oat-project-spec", "oat-project-split", "oat-project-summary", "oat-repo-knowledge-index", "oat-worktree-bootstrap", "oat-worktree-bootstrap-auto", "oat-wrap-up"];
+export declare const WORKFLOW_SKILLS: readonly ["oat-project-capture", "oat-project-clear-active", "oat-project-complete", "oat-project-design", "oat-project-discover", "oat-project-document", "oat-project-implement", "oat-project-import-plan", "oat-project-new", "oat-project-next", "oat-project-open", "oat-project-plan", "oat-project-plan-writing", "oat-project-pr-final", "oat-project-pr-progress", "oat-project-progress", "oat-project-promote-spec-driven", "oat-project-quick-start", "oat-project-reconcile", "oat-project-revise", "oat-project-review-provide", "oat-project-review-provide-remote", "oat-project-review-receive", "oat-project-review-receive-remote", "oat-project-spec", "oat-project-split", "oat-project-summary", "oat-repo-knowledge-index", "oat-worktree-bootstrap", "oat-worktree-bootstrap-auto", "oat-wrap-up"];
 export declare const WORKFLOW_AGENTS: readonly ["oat-codebase-mapper.md", "oat-phase-implementer.md", "oat-reviewer.md"];
 export declare const WORKFLOW_TEMPLATES: readonly ["state.md", "discovery.md", "spec.md", "design.md", "plan.md", "implementation.md", "summary.md"];
 export declare const WORKFLOW_SCRIPTS: readonly ["generate-oat-state.sh", "generate-thin-index.sh", "resolve-tracking.sh"];
@@ -19,7 +19,7 @@ export declare const IDEA_SKILLS: readonly ["oat-idea-new", "oat-idea-ideate", "
 export declare const CORE_SKILLS: readonly ["oat-docs", "oat-doctor"];
 export declare const DOCS_SKILLS: readonly ["oat-agent-instructions-analyze", "oat-agent-instructions-apply", "oat-docs-analyze", "oat-docs-apply", "oat-docs-bootstrap"];
 export declare const DOCS_SCRIPTS: readonly ["resolve-tracking.sh"];
-export declare const UTILITY_SKILLS: readonly ["create-agnostic-skill", "oat-repo-maintainability-review", "oat-review-provide", "oat-review-receive", "oat-review-receive-remote"];
+export declare const UTILITY_SKILLS: readonly ["create-agnostic-skill", "oat-repo-maintainability-review", "oat-review-provide", "oat-review-provide-remote", "oat-review-receive", "oat-review-receive-remote"];
 export declare const PROJECT_MANAGEMENT_SKILLS: readonly ["oat-pjm-add-backlog-item", "oat-pjm-update-repo-reference", "oat-pjm-review-backlog"];
 export declare const PROJECT_MANAGEMENT_TEMPLATES: readonly ["backlog-item.md", "roadmap.md"];
 export declare const PROJECT_MANAGEMENT_SCRIPTS: readonly [];

package/dist/commands/init/tools/shared/skill-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-manifest.d.ts","sourceRoot":"","sources":["../../../../../src/commands/init/tools/shared/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAKtD,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5E;AAID,eAAO,MAAM,eAAe,wvBA+BlB,CAAC;AAEX,eAAO,MAAM,eAAe,oFAIlB,CAAC;AAEX,eAAO,MAAM,kBAAkB,6GAQrB,CAAC;AAEX,eAAO,MAAM,gBAAgB,qFAInB,CAAC;AAIX,eAAO,MAAM,WAAW,2FAKd,CAAC;AAIX,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAI/D,eAAO,MAAM,WAAW,yIAMd,CAAC;AAEX,eAAO,MAAM,YAAY,kCAAmC,CAAC;AAI7D,eAAO,MAAM,cAAc,gJAMjB,CAAC;AAIX,eAAO,MAAM,yBAAyB,kGAI5B,CAAC;AAEX,eAAO,MAAM,4BAA4B,4CAG/B,CAAC;AAEX,eAAO,MAAM,0BAA0B,aAAc,CAAC;AAItD,eAAO,MAAM,iBAAiB,6BAA8B,CAAC;AAI7D,eAAO,MAAM,eAAe,2EAMlB,CAAC;AAEX,eAAO,MAAM,eAAe,qCAAsC,CAAC"}
+{"version":3,"file":"skill-manifest.d.ts","sourceRoot":"","sources":["../../../../../src/commands/init/tools/shared/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAKtD,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5E;AAID,eAAO,MAAM,eAAe,6xBAgClB,CAAC;AAEX,eAAO,MAAM,eAAe,oFAIlB,CAAC;AAEX,eAAO,MAAM,kBAAkB,6GAQrB,CAAC;AAEX,eAAO,MAAM,gBAAgB,qFAInB,CAAC;AAIX,eAAO,MAAM,WAAW,2FAKd,CAAC;AAIX,eAAO,MAAM,WAAW,qCAAsC,CAAC;AAI/D,eAAO,MAAM,WAAW,yIAMd,CAAC;AAEX,eAAO,MAAM,YAAY,kCAAmC,CAAC;AAI7D,eAAO,MAAM,cAAc,6KAOjB,CAAC;AAIX,eAAO,MAAM,yBAAyB,kGAI5B,CAAC;AAEX,eAAO,MAAM,4BAA4B,4CAG/B,CAAC;AAEX,eAAO,MAAM,0BAA0B,aAAc,CAAC;AAItD,eAAO,MAAM,iBAAiB,6BAA8B,CAAC;AAI7D,eAAO,MAAM,eAAe,2EAMlB,CAAC;AAEX,eAAO,MAAM,eAAe,qCAAsC,CAAC"}

package/dist/commands/init/tools/shared/skill-manifest.js

@@ -37,6 +37,7 @@ export const WORKFLOW_SKILLS = [
     'oat-project-reconcile',
     'oat-project-revise',
     'oat-project-review-provide',
+    'oat-project-review-provide-remote',
     'oat-project-review-receive',
     'oat-project-review-receive-remote',
     'oat-project-spec',
@@ -89,6 +90,7 @@ export const UTILITY_SKILLS = [
     'create-agnostic-skill',
     'oat-repo-maintainability-review',
     'oat-review-provide',
+    'oat-review-provide-remote',
     'oat-review-receive',
     'oat-review-receive-remote',
 ];

package/dist/commands/project/new/index.d.ts

@@ -10,6 +10,7 @@ interface ProjectNewDependencies {
         force: boolean;
         setActive: boolean;
         refreshDashboard: boolean;
+        commit: boolean;
     }) => Promise<ScaffoldProjectResult>;
 }
 export declare function createProjectNewCommand(overrides?: Partial<ProjectNewDependencies>): Command;

package/dist/commands/project/new/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/new/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAE5C,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AASpB,UAAU,sBAAsB;IAC9B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,eAAe,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,mBAAmB,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtC;AAiED,wBAAgB,uBAAuB,CACrC,SAAS,GAAE,OAAO,CAAC,sBAAsB,CAAM,GAC9C,OAAO,CAiCT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/new/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAE5C,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAgBpB,UAAU,sBAAsB;IAC9B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,eAAe,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,mBAAmB,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC;KACjB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtC;AAoFD,wBAAgB,uBAAuB,CACrC,SAAS,GAAE,OAAO,CAAC,sBAAsB,CAAM,GAC9C,OAAO,CAkCT"}

package/dist/commands/project/new/index.js

@@ -2,6 +2,11 @@ import { buildCommandContext, } from '../../../app/command-context.js';
 import { readGlobalOptions } from '../../shared/shared.utils.js';
 import { Command, Option } from 'commander';
 import { scaffoldProject as defaultScaffoldProject, } from './scaffold.js';
+const COMMIT_STATUS_MESSAGES = {
+    skipped_disabled: 'Scaffold commit: skipped (--no-commit)',
+    skipped_no_worktree: 'Scaffold commit: skipped (not a git work tree)',
+    skipped_nothing: 'Scaffold commit: skipped (nothing to commit)',
+};
 const DEFAULT_DEPENDENCIES = {
     buildCommandContext,
     scaffoldProject: defaultScaffoldProject,
@@ -18,6 +23,10 @@ function reportSuccess(context, projectName, result) {
             skippedFiles: result.skippedFiles,
             activePointerUpdated: result.activePointerUpdated,
             dashboardRefreshed: result.dashboardRefreshed,
+            committed: result.committed,
+            commitSha: result.commitSha,
+            commitStatus: result.commitStatus,
+            commitError: result.commitError,
         });
         return;
     }
@@ -26,6 +35,18 @@ function reportSuccess(context, projectName, result) {
     if (result.activePointerUpdated) {
         context.logger.info('Active project updated in local config: .oat/config.local.json');
     }
+    if (result.commitStatus === 'committed') {
+        context.logger.info(`Scaffold commit: ${result.commitSha?.slice(0, 7) ?? 'committed'}`);
+    }
+    else if (result.commitStatus === 'failed') {
+        // The scaffold itself succeeded, so this is a warning, not an error: do not
+        // change the process exit code. Make clear the baseline was NOT committed.
+        const detail = result.commitError ? `: ${result.commitError}` : '';
+        context.logger.warn(`Warning: scaffold commit failed${detail}. The scaffolded files were written but NOT committed.`);
+    }
+    else {
+        context.logger.info(COMMIT_STATUS_MESSAGES[result.commitStatus]);
+    }
 }
 async function runProjectNew(projectName, options, context, dependencies) {
     try {
@@ -36,6 +57,7 @@ async function runProjectNew(projectName, options, context, dependencies) {
             force: options.force,
             setActive: options.setActive,
             refreshDashboard: options.dashboard,
+            commit: options.commit,
         });
         reportSuccess(context, projectName, result);
         process.exitCode = 0;
@@ -65,6 +87,7 @@ export function createProjectNewCommand(overrides = {}) {
         .option('--force', 'Non-destructive scaffold; create missing files only')
         .option('--no-set-active', 'Do not update active project in local config')
         .option('--no-dashboard', 'Do not refresh .oat/state.md after scaffold')
+        .option('--no-commit', 'Do not git-commit the scaffolded project directory')
         .action(async (name, options, command) => {
         if (name.startsWith('-')) {
             command.help();

package/dist/commands/project/new/scaffold.d.ts

@@ -6,11 +6,24 @@ export interface ScaffoldProjectOptions {
     force?: boolean;
     setActive?: boolean;
     refreshDashboard?: boolean;
+    /**
+     * Commit the freshly scaffolded project directory so the artifact baseline is
+     * git-tracked from t=0. Opt-in (default false) so library callers that manage
+     * their own commits (e.g. the project-split flow) are unaffected; only the
+     * `oat project new` command enables it by default.
+     */
+    commit?: boolean;
     env?: NodeJS.ProcessEnv;
     today?: string;
     nowUtc?: string;
     refreshDashboardCallback?: (repoRoot: string) => void | Promise<void>;
 }
+/**
+ * Classified outcome of the scoped scaffold commit. Distinguishing the skip
+ * reasons (and `failed`) lets the CLI surface accurate, distinct messaging
+ * instead of collapsing every non-commit into a single benign "skipped" line.
+ */
+export type CommitScaffoldStatus = 'committed' | 'skipped_disabled' | 'skipped_no_worktree' | 'skipped_nothing' | 'failed';
 export interface ScaffoldProjectResult {
     mode: ProjectScaffoldMode;
     projectsRoot: string;
@@ -19,6 +32,10 @@ export interface ScaffoldProjectResult {
     skippedFiles: string[];
     activePointerUpdated: boolean;
     dashboardRefreshed: boolean;
+    committed: boolean;
+    commitSha?: string;
+    commitStatus: CommitScaffoldStatus;
+    commitError?: string;
 }
 export declare function scaffoldProject(options: ScaffoldProjectOptions): Promise<ScaffoldProjectResult>;
 //# sourceMappingURL=scaffold.d.ts.map

package/dist/commands/project/new/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/new/scaffold.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAwMD,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAqDhC"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/new/scaffold.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,kBAAkB,GAClB,qBAAqB,GACrB,iBAAiB,GACjB,QAAQ,CAAC;AAEb,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoRD,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA4EhC"}