@open-agent-toolkit/cli 0.2.63 → 0.2.65

package/assets/skills/oat-explainer-kit/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-explainer-kit
-version: 1.0.7
 description: Use when building project explainers or recaps from OAT configuration, state, and lifecycle artifacts.
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob, AskUserQuestion
+metadata:
+  version: 1.0.8
 ---
 
 # OAT Explainer Kit

package/assets/skills/oat-explainer-kit/scripts/check-core.mjs

@@ -104,11 +104,331 @@ function failure({
   };
 }
 
-function readFrontmatterVersion(content) {
-  const match = content.match(/^version:\s*([^\s#]+)\s*(?:#.*)?$/m);
+/**
+ * Read a skill's canonical version from its frontmatter, with
+ * `metadata.version` taking precedence over the deprecated top-level `version`
+ * alias.
+ *
+ * ACCEPTED EXCEPTION to the repository rule that only
+ * `packages/cli/src/commands/shared/frontmatter.ts` implements this precedence:
+ * this script is installed into user projects by pack install, where it can
+ * import neither that resolver nor the `yaml` package, so it carries a
+ * self-contained reader. The parity contract
+ * `tools/smoke/explainer-kit/check-core-version-parity.test.mjs` runs one
+ * shared fixture corpus — plus every bundled `SKILL.md` — through this reader
+ * and the canonical resolver and requires the same answer; a change to the
+ * canonical precedence rule must update those fixtures and this reader
+ * together.
+ *
+ * Anything the canonical resolver cannot resolve cleanly returns `null` so the
+ * compatibility check fails closed instead of guessing: a conflict between the
+ * two positions, a malformed block, a duplicate key, a tagged, anchored, or
+ * aliased scalar, and a plain scalar YAML would read as a number, boolean, or
+ * null.
+ *
+ * Deliberate limits of a parser-free reader, all of which fail closed rather
+ * than guess a version: flow collections (`metadata: {version: 1.2.3}`), block
+ * scalars, quoted keys, quote escape sequences, multi-line plain scalars, and
+ * document markers inside the block all return `null` even where a full YAML
+ * parser would resolve them. Nothing in the authoring templates emits those
+ * shapes.
+ *
+ * Every key and value in the block is checked, not just `version`, and the
+ * whole block is walked to any depth, so a syntax error anywhere in it fails
+ * closed rather than leaving a readable version behind. What remains outside
+ * the reader's reach is the content of a shape it refuses outright — the body
+ * of a block scalar, or anything inside a flow collection — which it never
+ * parses because it never accepts the shape that introduces it.
+ */
+export function readFrontmatterVersion(content) {
+  const block = frontmatterBlock(content);
+  if (block === null) {
+    return null;
+  }
+
+  const root = readBlockMap(block.split('\n').map(classifyLine), -1);
+  if (root === null || (root.indent !== null && root.indent !== 0)) {
+    return null;
+  }
+
+  let topLevel;
+  let metadata;
+  let unusable = false;
+
+  for (const child of root.children) {
+    if (child.name === 'version') {
+      const scalar = declaredScalar(child);
+      if (scalar === null) {
+        unusable = true;
+      } else {
+        topLevel = scalar;
+      }
+      continue;
+    }
+    if (child.name === 'metadata') {
+      // A `metadata:` key with a scalar or flow value is not the block map the
+      // canonical resolver requires, and one with no children is a null scalar.
+      if (scalarText(child.value) !== '' || child.map.indent === null) {
+        return null;
+      }
+      const nested = child.map.children.find(
+        (entry) => entry.name === 'version',
+      );
+      if (nested !== undefined) {
+        const scalar = declaredScalar(nested);
+        if (scalar === null) {
+          unusable = true;
+        } else {
+          metadata = scalar;
+        }
+      }
+    }
+  }
+
+  if (unusable) {
+    return null;
+  }
+  if (metadata !== undefined) {
+    return topLevel !== undefined && topLevel !== metadata ? null : metadata;
+  }
+  return topLevel ?? null;
+}
+
+function frontmatterBlock(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
   return match?.[1] ?? null;
 }
 
+/**
+ * Sort one frontmatter line into the few shapes this reader understands.
+ *
+ * A key must be followed by `:` and then whitespace or the end of the line,
+ * which is what YAML requires of a block mapping: `version:1.2.3` is a plain
+ * scalar, not a key, and the canonical resolver reads no version from it. A tab
+ * in the indentation is never valid YAML indentation, and a quoted key is a
+ * shape this reader refuses rather than compares raw against a plain one.
+ */
+function classifyLine(line) {
+  if (line.trim() === '') {
+    return { kind: 'blank' };
+  }
+  const indentation = line.match(/^[ \t]*/)[0];
+  if (indentation.includes('\t')) {
+    return { kind: 'invalid' };
+  }
+  const indent = indentation.length;
+  const rest = line.slice(indent);
+  if (rest.startsWith('#')) {
+    return { kind: 'comment', indent };
+  }
+  const key = rest.match(/^([^\s:#]+):(?=[ \t]|$)([ \t].*)?$/);
+  // A key is a plain scalar too: a quoted key is a shape this reader refuses
+  // rather than compares raw against a plain one, and a key opening with an
+  // indicator is not a key at all.
+  if (key === null || /^["']/.test(key[1]) || !isPlainScalar(key[1])) {
+    return { kind: 'invalid', indent };
+  }
+  return { kind: 'key', indent, name: key[1], value: key[2] ?? '' };
+}
+
+/**
+ * Read one block map and everything under it, rejecting every structure this
+ * reader cannot validate: an inconsistent indent, a duplicate key at any depth,
+ * a value shape it cannot read, or a line it cannot classify. Rejection is
+ * always `null`, never a guess.
+ */
+function readBlockMap(lines, parentIndent) {
+  let indent = null;
+  const names = [];
+  const children = [];
+
+  for (let index = 0; index < lines.length; ) {
+    const line = lines[index];
+    if (line.kind === 'invalid') {
+      return null;
+    }
+    if (line.kind === 'blank' || line.kind === 'comment') {
+      index += 1;
+      continue;
+    }
+    if (line.indent <= parentIndent) {
+      return null;
+    }
+    if (indent === null) {
+      indent = line.indent;
+    }
+    if (line.indent !== indent) {
+      return null;
+    }
+    const identity = keyIdentity(line.name);
+    if (names.includes(identity) || !isReadableValue(line.value)) {
+      return null;
+    }
+    names.push(identity);
+
+    let end = index + 1;
+    while (
+      end < lines.length &&
+      (lines[end].kind === 'blank' ||
+        lines[end].kind === 'comment' ||
+        lines[end].kind === 'invalid' ||
+        lines[end].indent > indent)
+    ) {
+      end += 1;
+    }
+    const body = lines.slice(index + 1, end);
+    const map = body.some((entry) => entry.kind !== 'blank')
+      ? readBlockMap(body, indent)
+      : { indent: null, children: [] };
+    // A key cannot own both a scalar and a nested map. This also refuses a
+    // multi-line plain scalar, whose continuation lines arrive here as
+    // children: folding one is beyond a parser-free reader, so it fails closed.
+    if (
+      map === null ||
+      (map.indent !== null && scalarText(line.value) !== '')
+    ) {
+      return null;
+    }
+    children.push({ ...line, map });
+    index = end;
+  }
+
+  return { indent, children };
+}
+
+/**
+ * The scalar a key declares, or `null` when it declares something this reader
+ * refuses to read as a version — including a multi-line scalar or a nested map,
+ * both of which arrive here as children.
+ */
+function declaredScalar(child) {
+  return child.map.indent === null ? scalarValue(child.value) : null;
+}
+
+/**
+ * Whether a raw value is a shape this reader can read at all. Every key's value
+ * is checked, not just `version`, so no syntax error is silently walked past:
+ * the canonical resolver rejects the whole document for any of them.
+ */
+function isReadableValue(raw) {
+  const text = raw.trim();
+  if (text === '' || text.startsWith('#')) {
+    return true;
+  }
+  if (/^["']/.test(text)) {
+    return quotedScalar(text) !== null;
+  }
+  return isPlainScalar(scalarText(text));
+}
+
+/**
+ * Whether a comment-stripped value is a plain scalar YAML reads as a string.
+ *
+ * Refused: every character YAML forbids at the start of a plain scalar — the
+ * flow, block-scalar, anchor, alias, and tag indicators, and the reserved `@`,
+ * `` ` ``, and `%` — plus `-`, `?`, and `:` when whitespace or the end of the
+ * value follows, which is what makes them indicators rather than the first
+ * letter of a word. A `:` anywhere in the value gets the same treatment,
+ * because `: ` opens a nested mapping instead of continuing the scalar.
+ *
+ * Still readable, because none of these is an indicator in block context: a `:`
+ * inside a word (`https://example.com`), a `,` after the first character
+ * (`allowed-tools: Read, Write`), and a leading `-` or `?` that starts a word
+ * (`-word`).
+ */
+function isPlainScalar(plain) {
+  return (
+    !/^[&*!|>[\]{},@`%]/.test(plain) &&
+    !/^[-?](?:[ \t]|$)/.test(plain) &&
+    !/:(?:[ \t]|$)/.test(plain)
+  );
+}
+
+/**
+ * The identity YAML gives a mapping key, so two spellings of one key are caught
+ * as the duplicate they are: `true` and `True` are the same boolean key, and
+ * `1` and `01` the same integer key, even though their text differs.
+ */
+function keyIdentity(name) {
+  if (/^(null|Null|NULL|~)$/.test(name)) {
+    return 'null';
+  }
+  if (/^(true|True|TRUE)$/.test(name)) {
+    return 'bool:true';
+  }
+  if (/^(false|False|FALSE)$/.test(name)) {
+    return 'bool:false';
+  }
+  if (
+    /^[-+]?[0-9]+$/.test(name) ||
+    /^0x[0-9a-fA-F]+$/.test(name) ||
+    /^0o[0-7]+$/.test(name) ||
+    /^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$/.test(name)
+  ) {
+    return `number:${Number(name)}`;
+  }
+  return `string:${name}`;
+}
+
+/**
+ * Strip a trailing comment from a raw value. YAML only starts a comment at a
+ * `#` preceded by whitespace, so `1.2.3#note` is the string it looks like.
+ */
+function scalarText(raw) {
+  const text = raw.trim();
+  if (text.startsWith('#')) {
+    return '';
+  }
+  const comment = text.search(/[ \t]#/);
+  return (comment === -1 ? text : text.slice(0, comment)).trim();
+}
+
+function quotedScalar(text) {
+  const quoted =
+    text.match(/^"([^"\\]*)"(?:[ \t]+#.*)?$/) ??
+    text.match(/^'([^']*)'(?:[ \t]+#.*)?$/);
+  return quoted?.[1] ?? null;
+}
+
+/**
+ * Read one plain or quoted string scalar, returning `null` for every value the
+ * canonical resolver refuses to treat as a version string.
+ */
+function scalarValue(raw) {
+  const text = raw.trim();
+  if (text === '' || text.startsWith('#')) {
+    return null;
+  }
+
+  if (/^["']/.test(text)) {
+    const quoted = quotedScalar(text)?.trim();
+    return quoted === undefined || quoted === '' ? null : quoted;
+  }
+
+  const plain = scalarText(text);
+  if (plain === '') {
+    return null;
+  }
+  if (!isPlainScalar(plain)) {
+    return null;
+  }
+  // Core-schema scalars that resolve to a non-string type: `version: 1.10` is
+  // the number 1.1, never the string an author meant to write.
+  if (
+    /^(null|Null|NULL|~)$/.test(plain) ||
+    /^(true|True|TRUE|false|False|FALSE)$/.test(plain) ||
+    /^[-+]?[0-9]+$/.test(plain) ||
+    /^0o[0-7]+$/.test(plain) ||
+    /^0x[0-9a-fA-F]+$/.test(plain) ||
+    /^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$/.test(plain) ||
+    /^[-+]?\.(inf|Inf|INF)$/.test(plain) ||
+    /^\.(nan|NaN|NAN)$/.test(plain)
+  ) {
+    return null;
+  }
+  return plain;
+}
+
 function parseVersion(value) {
   if (typeof value !== 'string') {
     return null;

package/assets/skills/oat-idea-ideate/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-idea-ideate
-version: 1.2.2
 description: Use when continuing an existing tracked idea or expanding an explicit scratchpad seed from {IDEAS_ROOT}/scratchpad.md. Do NOT use to start a brand-new, destinationless brainstorm; use oat-brainstorm for that.
 argument-hint: '[--global]'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, AskUserQuestion
+metadata:
+  version: 1.2.3
 ---
 
 # Ideate

package/assets/skills/oat-idea-new/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-idea-new
-version: 1.2.1
 description: Use when starting ideation for a new concept or problem. Creates an idea directory for lightweight capture and handoff to ongoing ideation.
 argument-hint: '<idea-name> [--global]'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, AskUserQuestion
+metadata:
+  version: 1.2.2
 ---
 
 # New Idea

package/assets/skills/oat-idea-scratchpad/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-idea-scratchpad
-version: 1.2.0
 description: Use when you need quick idea capture or want to review scratchpad entries. Manages lightweight idea seeds and optional notes.
 argument-hint: '[review | capture] [--global]'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, AskUserQuestion
+metadata:
+  version: 1.2.1
 ---
 
 # Scratchpad

package/assets/skills/oat-idea-summarize/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-idea-summarize
-version: 1.3.0
 description: Use when an idea is mature enough to move from brainstorming into the backlog. Generates a summary document and adds the idea to the backlog.
 argument-hint: '[--global]'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.3.1
 ---
 
 # Summarize Idea

package/assets/skills/oat-pjm-add-backlog-item/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-pjm-add-backlog-item
-version: 1.4.0
 description: Use when the user requests or confirms adding a new repo backlog item — e.g. "add a backlog item for X", "capture that as backlog", "track that follow-up", "file a backlog ticket", or confirms a previously offered backlog capture. Do NOT auto-invoke when a follow-up is mentioned. Creates the item file in the file-per-item backlog structure, regenerates the index, and prompts for curated overview updates.
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.4.1
 ---
 
 # Add Backlog Item

package/assets/skills/oat-pjm-decision/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-pjm-decision
-version: 1.1.0
 description: Use when the user requests or confirms recording a durable repo decision — e.g. "capture that as a decision", "write an ADR for X", "record this architectural choice", or confirms a previously offered decision capture. Creates a file-per-record decision under reference/decisions/ via `oat decision new` and refreshes the generated decision index. Do NOT auto-invoke for routine choices that do not warrant durable history.
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.1.1
 ---
 
 # Record Repo Decision

package/assets/skills/oat-pjm-review-backlog/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-pjm-review-backlog
-version: 1.6.1
 description: Use when prioritizing the file-backed repo backlog or evaluating roadmap alignment. Produces value-effort ratings, dependency mapping, execution recommendations, and an optional external-plan handoff.
 argument-hint: '[backlog-root] [--roadmap=<path>] [--output=<path>]'
 disable-model-invocation: true
 allowed-tools: Read, Write, Glob, Grep, Bash(git:*), AskUserQuestion, Task
 user-invocable: true
+metadata:
+  version: 1.6.2
 ---
 
 # Review Backlog

package/assets/skills/oat-pjm-update-repo-reference/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-pjm-update-repo-reference
-version: 1.4.0
 description: Use when repo reference artifacts need updating — roadmap, decision records, backlog status, or completed history. Frequently invoked at project completion, often chained from `oat-project-document`, to ensure active `.oat/repo/pjm/` state and durable `.oat/repo/reference/` records reflect what shipped.
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.4.1
 ---
 
 # Update Repo Reference

package/assets/skills/oat-project-autonomous/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-project-autonomous
-version: 1.0.13
 description: Use when a user explicitly asks to run an OAT project autonomously end-to-end. Activates session-only autonomy, resumes the correct lifecycle phase, and drives the existing OAT skills through final PR or a reported boundary.
 argument-hint: '<goal | project-slug | ticket-ref>'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, Task
+metadata:
+  version: 1.0.14
 ---
 
 # Autonomous OAT Project

package/assets/skills/oat-project-autonomous/references/gate-inventory.md

@@ -193,6 +193,7 @@ remains.
 | PRFINAL-02       | `oat-project-pr-final`           | Missing title/base                            | Ask for title and resolve base                            | Use the documented ticket/conventional-title and base-branch resolution chains                                                                                                                                                                                                                                                               | `auto-resolve`                                                                  | PR artifact frontmatter and command                                  |
 | PRFINAL-03       | `oat-project-pr-final`           | Final review not passed                       | Ask whether to proceed anyway                             | Never proceed in autonomy; stop and route to final review/re-review                                                                                                                                                                                                                                                                          | `boundary:unresolved-critical-findings`                                         | Final review row and blocker report                                  |
 | PRFINAL-04       | `oat-project-pr-final`           | Push/PR policy or credentials                 | Ask operator to authorize or authenticate                 | Stop when repository policy or missing credentials prevent push/PR creation                                                                                                                                                                                                                                                                  | `boundary:repository-policy-approval` / `boundary:missing-credentials`          | PR state and redacted command error                                  |
+| PRFINAL-05       | `oat-project-pr-final`           | Unresolved review-ledger artifact path        | Report the offending row and stop                         | Stop before push and PR creation; a `## Reviews` artifact path that does not resolve to a regular file inside the project is never auto-resolved, and repairing the row is the only route forward                                                                                                                                            | `boundary:unresolved-critical-findings`                                         | Offending ledger row (scope, type, artifact)                         |
 | COMPLETE-01      | `oat-project-complete`           | Batched completion/archive/summary/PR choices | Confirm completion and choose optional actions            | Confirm only after gates pass; honor explicit config, refresh missing/stale summary, avoid duplicate PR, and archive only when configured                                                                                                                                                                                                    | `auto-resolve`                                                                  | Completion state and summary                                         |
 | COMPLETE-02      | `oat-project-complete`           | Required documentation missing                | Run document or explicitly skip                           | Run autonomous documentation; do not silently skip a required gate                                                                                                                                                                                                                                                                           | `auto-resolve` / `boundary:repository-policy-approval`                          | Documentation state                                                  |
 | COMPLETE-03      | `oat-project-complete`           | Unsatisfied completion gates                  | Continue anyway                                           | Never continue silently; unresolved final review is a review boundary and other hard policies remain boundaries                                                                                                                                                                                                                              | `boundary:unresolved-critical-findings` / `boundary:repository-policy-approval` | Combined gate report                                                 |

package/assets/skills/oat-project-capture/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-capture
-version: 1.0.2
 description: Use when work happened outside the OAT project workflow and needs retroactive project tracking. Creates a full project from an existing branch and conversation context.
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.0.3
 ---
 
 # Capture Untracked Work

package/assets/skills/oat-project-clear-active/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-clear-active
 description: Use when switching context or cleaning up project state. Clears the active OAT project.
-version: 1.2.0
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, AskUserQuestion
+metadata:
+  version: 1.2.1
 ---
 
 # Clear Active Project

package/assets/skills/oat-project-complete/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-complete
-version: 1.7.8
 description: Use when all implementation work is finished and the project is ready to close. Marks the OAT project lifecycle as complete.
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, AskUserQuestion
+metadata:
+  version: 1.7.9
 ---
 
 # Complete Project

package/assets/skills/oat-project-design/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-design
-version: 2.3.4
 description: Use when discovery is complete and implementation-ready decisions are needed. Runs a collaborative, selective collaborative, or draft-and-review design flow, confirms requirements and produces both `spec.md` and `design.md`, and commits artifacts before the user-review gate.
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Glob, Grep, AskUserQuestion
+metadata:
+  version: 2.3.5
 ---
 
 # Design Phase

package/assets/skills/oat-project-discover/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-discover
-version: 2.2.5
 description: Use when the user explicitly asks to continue discovery for an active spec-driven OAT project — e.g. "continue discovery", "run discovery", or confirms a previously offered discovery step. Do NOT auto-invoke for new ideas or quick/lite-mode projects. Gathers requirements and context before spec/design.
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Bash(oat:*), Bash(pnpm:*), Glob, Grep, AskUserQuestion
+metadata:
+  version: 2.2.6
 ---
 
 # Discovery Phase

package/assets/skills/oat-project-dispatch-subagents/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: oat-project-dispatch-subagents
-version: 1.1.4
 description: Use when an OAT project lifecycle skill needs to translate project state, phase or task scope, gates, and write authority into a provider-neutral subagent dispatch.
 disable-model-invocation: true
 user-invocable: false
 allowed-tools: Read, Bash
+metadata:
+  version: 1.1.5
 ---
 
 # Dispatching OAT Project Subagents

package/assets/skills/oat-project-document/SKILL.md

@@ -1,11 +1,12 @@
 ---
 name: oat-project-document
-version: 1.8.2
 description: Use when the user requests or confirms documenting an active OAT project — e.g. "document the project", "update the docs", "run oat-project-document", or confirms a previously offered documentation run. Do NOT auto-invoke when implementation completes. Analyzes project artifacts, presents a documentation delta plan, and applies approved changes.
 argument-hint: '[project-path] [--auto]'
 disable-model-invocation: false
 user-invocable: true
 allowed-tools: Read, Write, Edit, Bash(git:*), Bash(jq:*), Bash(oat pjm:*), Bash(oat project push:*), Bash(oat project scope:*), Bash(oat tools:*), Glob, Grep, AskUserQuestion, Skill
+metadata:
+  version: 1.8.3
 ---
 
 # Project Documentation Sync

package/assets/skills/oat-project-document/references/docs/autonomy-contract.md

@@ -193,6 +193,7 @@ remains.
 | PRFINAL-02       | `oat-project-pr-final`           | Missing title/base                            | Ask for title and resolve base                            | Use the documented ticket/conventional-title and base-branch resolution chains                                                                                                                                                                                                                                                               | `auto-resolve`                                                                  | PR artifact frontmatter and command                                  |
 | PRFINAL-03       | `oat-project-pr-final`           | Final review not passed                       | Ask whether to proceed anyway                             | Never proceed in autonomy; stop and route to final review/re-review                                                                                                                                                                                                                                                                          | `boundary:unresolved-critical-findings`                                         | Final review row and blocker report                                  |
 | PRFINAL-04       | `oat-project-pr-final`           | Push/PR policy or credentials                 | Ask operator to authorize or authenticate                 | Stop when repository policy or missing credentials prevent push/PR creation                                                                                                                                                                                                                                                                  | `boundary:repository-policy-approval` / `boundary:missing-credentials`          | PR state and redacted command error                                  |
+| PRFINAL-05       | `oat-project-pr-final`           | Unresolved review-ledger artifact path        | Report the offending row and stop                         | Stop before push and PR creation; a `## Reviews` artifact path that does not resolve to a regular file inside the project is never auto-resolved, and repairing the row is the only route forward                                                                                                                                            | `boundary:unresolved-critical-findings`                                         | Offending ledger row (scope, type, artifact)                         |
 | COMPLETE-01      | `oat-project-complete`           | Batched completion/archive/summary/PR choices | Confirm completion and choose optional actions            | Confirm only after gates pass; honor explicit config, refresh missing/stale summary, avoid duplicate PR, and archive only when configured                                                                                                                                                                                                    | `auto-resolve`                                                                  | Completion state and summary                                         |
 | COMPLETE-02      | `oat-project-complete`           | Required documentation missing                | Run document or explicitly skip                           | Run autonomous documentation; do not silently skip a required gate                                                                                                                                                                                                                                                                           | `auto-resolve` / `boundary:repository-policy-approval`                          | Documentation state                                                  |
 | COMPLETE-03      | `oat-project-complete`           | Unsatisfied completion gates                  | Continue anyway                                           | Never continue silently; unresolved final review is a review boundary and other hard policies remain boundaries                                                                                                                                                                                                                              | `boundary:unresolved-critical-findings` / `boundary:repository-policy-approval` | Combined gate report                                                 |

package/assets/skills/oat-project-implement/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: oat-project-implement
-version: 2.3.6
 description: Use when plan.md is ready for execution. Dispatches one phase implementer per phase, owns independent phase review and bounded fix routing, and supports plan-declared worktree-isolated parallel phases.
 oat_gateable: true
 argument-hint: '[--retry-limit <N>] [--dry-run]'
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash(git:*), Bash(oat:*), Bash(oat project log:*), Glob, Grep, AskUserQuestion, Task
+metadata:
+  version: 2.3.7
 ---
 
 # Implementation Phase

package/assets/skills/oat-project-implement/references/docs/autonomy-contract.md

@@ -193,6 +193,7 @@ remains.
 | PRFINAL-02       | `oat-project-pr-final`           | Missing title/base                            | Ask for title and resolve base                            | Use the documented ticket/conventional-title and base-branch resolution chains                                                                                                                                                                                                                                                               | `auto-resolve`                                                                  | PR artifact frontmatter and command                                  |
 | PRFINAL-03       | `oat-project-pr-final`           | Final review not passed                       | Ask whether to proceed anyway                             | Never proceed in autonomy; stop and route to final review/re-review                                                                                                                                                                                                                                                                          | `boundary:unresolved-critical-findings`                                         | Final review row and blocker report                                  |
 | PRFINAL-04       | `oat-project-pr-final`           | Push/PR policy or credentials                 | Ask operator to authorize or authenticate                 | Stop when repository policy or missing credentials prevent push/PR creation                                                                                                                                                                                                                                                                  | `boundary:repository-policy-approval` / `boundary:missing-credentials`          | PR state and redacted command error                                  |
+| PRFINAL-05       | `oat-project-pr-final`           | Unresolved review-ledger artifact path        | Report the offending row and stop                         | Stop before push and PR creation; a `## Reviews` artifact path that does not resolve to a regular file inside the project is never auto-resolved, and repairing the row is the only route forward                                                                                                                                            | `boundary:unresolved-critical-findings`                                         | Offending ledger row (scope, type, artifact)                         |
 | COMPLETE-01      | `oat-project-complete`           | Batched completion/archive/summary/PR choices | Confirm completion and choose optional actions            | Confirm only after gates pass; honor explicit config, refresh missing/stale summary, avoid duplicate PR, and archive only when configured                                                                                                                                                                                                    | `auto-resolve`                                                                  | Completion state and summary                                         |
 | COMPLETE-02      | `oat-project-complete`           | Required documentation missing                | Run document or explicitly skip                           | Run autonomous documentation; do not silently skip a required gate                                                                                                                                                                                                                                                                           | `auto-resolve` / `boundary:repository-policy-approval`                          | Documentation state                                                  |
 | COMPLETE-03      | `oat-project-complete`           | Unsatisfied completion gates                  | Continue anyway                                           | Never continue silently; unresolved final review is a review boundary and other hard policies remain boundaries                                                                                                                                                                                                                              | `boundary:unresolved-critical-findings` / `boundary:repository-policy-approval` | Combined gate report                                                 |

package/assets/skills/oat-project-import-plan/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: oat-project-import-plan
-version: 1.4.14
 description: Use when you have an external markdown plan to execute with OAT. Preserves the source plan and normalizes it into canonical plan.md format.
 argument-hint: '<path-to-plan.md> [--provider codex|cursor|claude] [--project <name>]'
 oat_gateable: true
 disable-model-invocation: true
 user-invocable: true
 allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
+metadata:
+  version: 1.4.15
 ---
 
 # Import External Plan