@open-agent-toolkit/cli 0.2.57 → 0.2.58

package/assets/agents/oat-phase-implementer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-phase-implementer
-version: 1.1.2
+version: 1.1.3
 description: Implements one plan phase end-to-end, commits each task separately, self-checks between tasks, and handles bounded review fixes when resumed by oat-project-implement.
 tools: Read, Write, Edit, Bash, Grep, Glob, Task
 color: cyan
@@ -358,6 +358,46 @@ Do not launch a child, continue sequentially, review, or repair the invalid run.
 
 ### 2. Execute Tasks in Plan Order
 
+#### Cross-Cutting Option Sweep
+
+Before the first edit of a task that adds, renames, retypes, or changes the
+default or meaning of an option, argument, flag, configuration field, schema
+property, or policy value consumed outside the module that defines it,
+inventory that symbol repository-wide. A value that is defined, read, and
+written only inside its own module does not trigger this rule.
+
+The inventory is repository-wide. It is never limited to the declared file
+boundary and never limited to production source: sweep declarations and type
+definitions, constructors and factories, adapters and wrappers, serializers and
+deserializers, persisted schemas and templates, fixtures, mocks, snapshots, and
+tests, and every call site that constructs, forwards, or defaults the value.
+Use `rg` or an equivalent repository-wide search together with whatever
+language-aware check this repository already provides; no single tool is proof
+of completeness, so search the property name, its serialized spelling, and its
+accessors.
+
+A declared file list is review scope, not a correctness boundary. When the
+sweep finds files outside that list:
+
+- **Widen mechanically and proceed** when every discovered file is already
+  required by the declared task outcome, the edit to it is mechanical
+  propagation of the same value, and no sibling or active parallel task owns
+  it. The effective task boundary is the declared list plus those mechanically
+  discovered files. Record every addition in the Task Outcomes `Files` cell and
+  in Self-Review Observations, and never edit `plan.md` to match.
+- **Stop and report** the exact discovered file set and the ownership conflict
+  when the expansion would change the declared task outcome, cross sibling or
+  parallel-lane ownership, invalidate a plan-declared parallel group, or
+  require a new design, architecture, or public-behavior decision.
+
+Threading an already-agreed option through four call sites that would otherwise
+keep the stale default is mechanical propagation. Adding new behavior at a
+discovered call site, changing an unrelated default, or deciding how two lanes
+divide a shared file is not, and stops for direction. This pre-edit rule
+matches the mechanically derived, in-phase widening already allowed during
+post-commit recovery, and it never relaxes the standing rule against scope
+expansion beyond the phase.
+
 For every task:
 
 1. Record `PRE_TASK_HEAD`.
@@ -380,7 +420,9 @@ For every task:
    mutate Git config or use `--no-verify`.
 9. Verify:
    - HEAD is exactly one commit after `PRE_TASK_HEAD`;
-   - the commit changes only declared task files;
+   - the commit changes only files in the effective task boundary, which is
+     the declared task files plus any mechanical additions permitted by, and
+     reported under, the cross-cutting option sweep;
    - every task verification passed; and
    - the worktree is clean.
 10. Perform a brief between-task transition check before starting the next

package/assets/bundle-metadata.json

@@ -1,4 +1,4 @@
 {
   "schemaVersion": 1,
-  "oatVersion": "0.2.57"
+  "oatVersion": "0.2.58"
 }

package/assets/docs/contributing/smoke-testing.md

@@ -249,6 +249,50 @@ journaled worktree that is already gone from disk is still recoverable; a
 contradictory or unjournaled resource fails closed with a refusal rather than
 guessing.
 
+### Reserved versus registered ownership
+
+The deterministic provider's nested phase worktrees are journaled as a
+transaction, so an interruption can no longer leave an _unjournaled_ child.
+It can still leave state cleanup refuses by design — an interruption inside
+`git worktree add` may leave a path with no Git registration, and that is
+refused rather than deleted.
+
+Other nested creators still register directly after creation. Their entries are
+read as ownership the same way, but they are validated more loosely: a
+directly-registered entry carries no reservation origin, so it is not subject
+to the run-directory containment and run-baseline checks a finalized
+reservation gets. Their creation transaction has not been migrated yet.
+
+The two reservation states are:
+
+- **`reserved`** — the exact branch, worktree path, marker path, expected
+  baseline, shared Git directory, and run identity are written to the manifest
+  _before_ `git worktree add` runs. The entry is durable intent, not ownership.
+- **`registered`** — the child's marker, Git worktree registration, branch,
+  HEAD ancestry, and shared Git directory have all been corroborated.
+  Finalization only flips a matching reservation; it never rewrites what was
+  reserved, and a child contradicting its reservation is refused.
+
+Cleanup reconciles a reservation only against exactly matching state. If
+neither the branch nor the worktree was ever created, nothing is deleted and
+the reservation goes away with the manifest. If both exist exactly as reserved,
+they are removed after baseline, shared Git directory, and run-marker
+corroboration. If only the branch survives, its tip must equal the reserved
+baseline exactly. Anything else — an occupied path Git never registered, a
+different branch at the reserved path, a missing marker — fails closed.
+
+Manifests written before this transaction existed use ownership journal schema
+version 1. They stay readable and all of their entries read as already
+`registered`. Such a manifest is never rewritten to a newer schema version and
+never gains a reservation, and a v1 entry claiming reserved state is refused
+rather than treated as owned. Direct registration may still append a
+`registered` entry to one, which leaves its schema version untouched.
+
+Nothing is ever pruned by `smoke-*` name, path prefix, run age, or ancestry
+alone. Without an ownership lease the runner cannot tell a stale run from an
+active one, so it refuses instead of guessing and leaves the state for you to
+resolve.
+
 To finish a stalled run, re-run the matching `--stage collect` (collection-only
 triggers cleanup) or start a fresh run; the runner reconciles journaled
 resources on the next errored or collection-bearing invocation. If cleanup fails

package/assets/docs/workflows/projects/implementation-execution.md

@@ -88,7 +88,7 @@ The phase implementer receives one `Phase Scope`, reads the relevant artifacts
 once, and directly executes each task in plan order. For every task it:
 
 1. records the pre-task HEAD;
-2. implements only the declared task files;
+2. implements the declared task files plus any mechanical additions permitted by, and reported under, the cross-cutting option sweep (a repository-wide sweep for every consumer of a changed option; cross-owner expansions stop and report instead);
 3. runs task verification;
 4. self-checks requirements and scope before commit;
 5. creates exactly one task commit; and

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.2.57",
-  "docs-config": "0.2.57",
-  "docs-theme": "0.2.57",
-  "docs-transforms": "0.2.57"
+  "cli": "0.2.58",
+  "docs-config": "0.2.58",
+  "docs-theme": "0.2.58",
+  "docs-transforms": "0.2.58"
 }

package/assets/skills/oat-project-design/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-design
-version: 2.3.2
+version: 2.3.3
 description: Use when discovery is complete and implementation-ready decisions are needed. Runs a collaborative, selective collaborative, or draft-and-review design flow, confirms requirements and produces both `spec.md` and `design.md`, and commits artifacts before the user-review gate.
 disable-model-invocation: true
 user-invocable: true
@@ -402,6 +402,20 @@ Draft `design.md` section-by-section (Collaborative mode) or in a single pass (D
 11. **Implementation Phases** — Break work into manageable phases (1-3 days each). Per-phase structure: Goal, Tasks (high-level), Verification.
 12. **Risks and Mitigation** — For each significant risk: Probability | Impact; Mitigation; Contingency.
 
+**Standing invariants (Error Handling and Testing Strategy):** when a section
+states a standing invariant — an "every", "always", "only", ordering, or
+completeness claim expected to hold for the life of the feature — name its
+executable owner and its verification method in the same design: the specific
+test or check that fails when the claim breaks, and how that failure surfaces.
+Route a claim decidable from tracked files to a contract test, and a claim that
+depends on execution state or ordering to the code that owns the operation and
+emits a structured result. A point-in-time observation about today's codebase
+needs a citation, not an owner. Record the owner beside the error category it
+guards, or in the Requirement-to-Test Mapping row it belongs to. The full
+taxonomy, stable-identity, and same-PR rules live in the `create-oat-skill`
+skill; do not restate them here. Changing this paragraph means updating its
+contract case in `packages/cli/src/validation/skills.test.ts` in the same PR.
+
 ### Step 4a: Selective Review Pass
 
 If `DESIGN_MODE == "selective"`, classify every section before drafting and present the Section Review Plan to the user. Use `.agents/skills/oat-project-design/references/selective-review-pass.md` for the full signal set, grounding rules, edge cases, and dogfood notes.

package/assets/skills/oat-project-implement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-implement
-version: 2.3.2
+version: 2.3.3
 description: Use when plan.md is ready for execution. Dispatches one phase implementer per phase, owns independent phase review and bounded fix routing, and supports plan-declared worktree-isolated parallel phases.
 oat_gateable: true
 argument-hint: '[--retry-limit <N>] [--dry-run]'

package/assets/skills/oat-project-implement/references/phase-execution.md

@@ -605,9 +605,13 @@ Both accepted success and accepted terminal-stop branches must:
 - for a Phase Implementation Report, verify task count; for a Phase Recovery
   Continuation Report, verify the original task and commit instead;
 - only for a Phase Implementation Report, verify each planned task commit is
-  exactly one append-only commit in plan order, changes only declared files, and
-  has passing task verification; never require a Phase Recovery Continuation
-  Report to replay or restate all planned task outcomes;
+  exactly one append-only commit in plan order, changes only declared or
+  mechanically derived in-phase files, meaning the task's declared files plus
+  the mechanical additions permitted by, and reported under, the phase
+  implementer's cross-cutting option sweep, and has passing task verification;
+  a plan-list-only file set is not the acceptance boundary; never require a
+  Phase Recovery Continuation Report to replay or restate all planned task
+  outcomes;
 - for each reported attempted recovery (`recovered` or `failed-attempt`), verify
   attempt accounting, the immutable original commit and original request,
   exact-target provenance, one in-scope append-only recovery commit when

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.57",
+  "version": "0.2.58",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.57"
+    "@open-agent-toolkit/control-plane": "0.2.58"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",