@orchestrator-claude/definitions 3.31.0 → 3.31.1

package/agents/adversarial-reviewer.md

@@ -54,7 +54,7 @@ MUST follow these steps in order. Do not skip steps.
 
 7. **Store critique artifact** — call `artifactStore` with:
    - `artifact_kind: adversarial_review`
-   - `phase`: same phase as the artifact under review
+   - `phase: "adversarial_review"` — **always use this literal string, regardless of the phase of the artifact under review** (S188 fix: OQ-1 Option B; S185 artifacts stored at `phase='research'` are NOT migrated — applies from S186 onward)
    - `content`: the full structured critique (see Output Format)
    - `metadata.persona_id`: the persona used
    - `metadata.iteration`: iteration number

package/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: Agente Revisor que valida artefatos e codigo produzidos por outros agentes. Use para code review, validacao de specs/plans/tasks, e aprovacao de gates.
-tools: Read, Grep, Glob, Bash, Write, Edit, mcp__orchestrator-extended__artifactRetrieve
+tools: Read, Grep, Glob, Bash, Write, Edit, mcp__orchestrator-extended__artifactRetrieve, mcp__orchestrator-extended__artifactStore
 model: sonnet
 color: yellow
 permissionMode: default
@@ -29,6 +29,8 @@ Sua funcao e revisar e validar artefatos e codigo produzidos por outros agentes.
 ## Ferramentas Disponiveis
 
 ### MCP Tools
+- `artifactRetrieve(artifactId)`: Retrieve artifact under review from MinIO
+- `artifactStore(workflowId, phase, content, ...)`: **Store review artifact directly** — your own review output (review.md, findings, verdict). Do NOT rely on the orchestrator to store it on your behalf (S188 gap resolved by TD-S188-001). Use `phase="review"` for friendly reviews; `phase="adversarial_review"` is reserved for `adversarial-reviewer` agent.
 - `validateArtifact(path, type)`: Validacao automatizada
 - `lookupKnowledgeBase(topic)`: Busca padroes e convencoes
 

package/manifest.json

@@ -1,15 +1,15 @@
 {
   "schema": "orchestrator-definitions/v1",
   "namespace": "orchestrator",
-  "version": "3.31.0",
-  "generatedAt": "2026-05-13T16:19:36.507Z",
+  "version": "3.31.1",
+  "generatedAt": "2026-05-23T19:07:04.611Z",
   "definitions": {
     "agents": [
       {
         "slug": "adversarial-reviewer",
         "file": "agents/adversarial-reviewer.md",
         "version": "1.0.0",
-        "checksum": "sha256:d05c462525282e157bfa9d41465c550ce190d12d782a337e9064ff4cd38abf6e",
+        "checksum": "sha256:1ef78465016dab1cb1a615494a2008bcb210757e64584dfd291768b178f96293",
         "supersedes": null,
         "metadata": {}
       },
@@ -145,7 +145,7 @@
         "slug": "reviewer",
         "file": "agents/reviewer.md",
         "version": "1.0.0",
-        "checksum": "sha256:b7485f4c44badeb5507d5717dc472cd3e08ab6f0a7c710aadbb154a1cdfaef8a",
+        "checksum": "sha256:9486f431017050ee188314a6f0225dbb654bf9202d5377be5b71fa77e7422046",
         "supersedes": null,
         "metadata": {}
       },
@@ -299,7 +299,7 @@
         "slug": "orchestrator",
         "file": "skills/orchestrator/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:e6cf7a13c0d5c15f731b4a9e2ce12f3578055c4a602a56d94e3f1c7f06717d62",
+        "checksum": "sha256:89cd6fe31a0a8626bada2eb99e2c74118127174f662466b09813a74b16b58694",
         "supersedes": null,
         "metadata": {}
       },
@@ -347,7 +347,7 @@
         "slug": "release",
         "file": "skills/release/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:70e2fbeafede7e606edc9f1de6b5a91f7ed00ac0d839ad6f15d8ad175bb8bb21",
+        "checksum": "sha256:97e132fc96b1a0c65d77f3ad209dd1a23e9518a29eb775529f4e1cb6ea248c26",
         "supersedes": null,
         "metadata": {}
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestrator-claude/definitions",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "description": "Built-in definitions (agents, skills, hooks, workflows, KB seeds) for the Orchestrator ecosystem",
   "type": "module",
   "main": "dist/index.js",

package/skills/orchestrator/SKILL.md

@@ -83,6 +83,23 @@ Sub-agents MUST persist artifacts to MinIO via `artifactStore` (universal rule,
 
 <!-- TODO S182 (OQ-4): per-phase agent override (.phases[n].agent) deferred — S182 will resolve permissive vs registry-validated vs KnownAgent-enum strategy after agent list complete -->
 
+#### 2c.1 Implementer-specific dispatch addenda (TD-S188-002)
+
+When dispatching `implementer` (phase=`implement`), the generic template above is **insufficient**. The S188 implement phase surfaced an ambiguity: the implementer interpreted `createCheckpoint` as requiring a git commit beforehand, producing 4 unsolicited commits per dispatch (commit prefix also leaked from BACKLOG context: `feat(s186)` instead of `feat(s188)`). To prevent recurrence, append the following **commit policy block** to every implementer dispatch prompt:
+
+```
+[Commit Policy]
+- createCheckpoint (mcp__orchestrator-tools__createCheckpoint) is a PostgreSQL state snapshot per RFC-012. It is INDEPENDENT of git. You do NOT need to commit before calling it. Calling createCheckpoint with no uncommitted changes is the normal path.
+- Commit policy for this dispatch: <one of>
+    a) "DO NOT commit — orchestrator owns the closure commit at review gate."
+    b) "Commit per-phase using prefix `<feat|fix|refactor>(s<N>): <subject>` — confirm prefix before commit." (use when implement phase exceeds 80k tokens or spans multiple fases)
+- If you commit, the prefix MUST be: `<feat|fix|refactor>(s<CURRENT_SESSION>):` — do NOT infer from BACKLOG examples or previous session context.
+```
+
+Substitute `<CURRENT_SESSION>` with the active session number (e.g., `s189`) and pick **exactly one** of (a) or (b) — never leave both options visible. The block goes **after** `[Task]` and **before** the artifactStore instruction.
+
+If the orchestrator (main) wants to own all commits, prefer option (a) + call `createCheckpoint` itself after the implement phase completes — do NOT delegate that call to implementer.
+
 ### 2d. Gate Check
 
 After each sub-agent completes, present the artifact summary and ask for approval:

package/skills/release/SKILL.md

@@ -250,6 +250,46 @@ git commit -m "chore: sync definitions manifest checksums"
 
 **REGRA:** Nunca faca release com definitions alteradas sem manifest actualizado. Isso causa uma release extra desnecessaria (como aconteceu no v3.9.3 -> v3.9.4).
 
+## Secret Audit (Quarterly — TD-S188-003)
+
+Release CI/CD depende de 3 secrets em `.github/workflows/release.yml`:
+
+| Secret | Purpose | Notas |
+|---|---|---|
+| `NPM_TOKEN` | Publica `@orchestrator-claude/*` packages | type=Automation (bypassa 2FA em CI). 404 PUT durante publish = token issue, NÃO scope-missing (S186 hard rule). |
+| `DOCKER_PASSWORD` | Login Docker Hub (user `cmac01`) | NÃO confundir com `DOCKER_TOKEN`. S186 release quebrou porque release.yml linhas 40+83 referenciavam o nome errado. Cross-reference `grep DOCKER_ release.yml` antes de instruir user a regerar secret. |
+| `DOCKER_USERNAME` | Docker Hub user identifier | Raramente roda; muda só se conta migrar. |
+
+**Hard rule:** Antes de QUALQUER release, audite idade dos 3 secrets críticos. Se algum > 90 dias, **bloqueie release** e rotacione primeiro.
+
+### Comando de audit
+
+```bash
+# Lista timestamp + idade em dias dos 3 secrets críticos do release.yml
+gh secret list --json name,updatedAt | jq -r \
+  '.[] | select(.name | IN("NPM_TOKEN","DOCKER_PASSWORD","DOCKER_USERNAME")) |
+   "\(.name)\tupdated \(.updatedAt)\tage \(((now - (.updatedAt | fromdateiso8601)) / 86400 | floor))d"'
+```
+
+Output esperado (idade < 90d em todos):
+```
+DOCKER_PASSWORD updated 2026-02-10T...   age 92d   ← ROTACIONAR
+DOCKER_USERNAME updated 2025-08-15T...   age 271d  ← stable, mas confirme válido
+NPM_TOKEN       updated 2026-04-20T...   age 23d   ← OK
+```
+
+### Rotação de secret expirante
+
+1. **Pause release** — NÃO execute `release.sh`.
+2. Regere o secret na origem:
+   - `NPM_TOKEN`: https://www.npmjs.com/settings/<user>/tokens (Generate New → Automation type)
+   - `DOCKER_PASSWORD`: Docker Hub → Account Settings → Security → New Access Token
+3. Atualize no GitHub: `gh secret set <NAME> --body "<new-value>"` (executar do CWD repo)
+4. Re-rode comando de audit acima — confirmar `updatedAt` fresco (idade < 1d).
+5. Proceda com release.
+
+**Histórico:** S186 release pipeline broke porque DOCKER_PASSWORD estava ausente (incorretamente referenciado como `DOCKER_TOKEN` em `release.yml` linhas 40+83). Aprendizagem capturada em hard rules S185→S188 carryover (BACKLOG).
+
 ## Checklist Pre-Release
 
 - [ ] CHANGELOG.md atualizado com todas as mudancas
@@ -259,3 +299,4 @@ git commit -m "chore: sync definitions manifest checksums"
 - [ ] Na branch main
 - [ ] Dry-run executado e revisado
 - [ ] Definitions manifest sincronizado (se houve alteracao em definitions)
+- [ ] **Secret audit executado** — nenhum dos 3 secrets críticos (`NPM_TOKEN`, `DOCKER_PASSWORD`, `DOCKER_USERNAME`) > 90 dias (ver seção "Secret Audit")