@orchestrator-claude/definitions 3.31.0 → 3.31.2

package/manifest.json

@@ -1,15 +1,15 @@
 {
   "schema": "orchestrator-definitions/v1",
   "namespace": "orchestrator",
-  "version": "3.31.0",
-  "generatedAt": "2026-05-13T16:19:36.507Z",
+  "version": "3.31.2",
+  "generatedAt": "2026-06-25T14:31:07.105Z",
   "definitions": {
     "agents": [
       {
         "slug": "adversarial-reviewer",
         "file": "agents/adversarial-reviewer.md",
         "version": "1.0.0",
-        "checksum": "sha256:d05c462525282e157bfa9d41465c550ce190d12d782a337e9064ff4cd38abf6e",
+        "checksum": "sha256:1ef78465016dab1cb1a615494a2008bcb210757e64584dfd291768b178f96293",
         "supersedes": null,
         "metadata": {}
       },
@@ -145,7 +145,7 @@
         "slug": "reviewer",
         "file": "agents/reviewer.md",
         "version": "1.0.0",
-        "checksum": "sha256:b7485f4c44badeb5507d5717dc472cd3e08ab6f0a7c710aadbb154a1cdfaef8a",
+        "checksum": "sha256:9486f431017050ee188314a6f0225dbb654bf9202d5377be5b71fa77e7422046",
         "supersedes": null,
         "metadata": {}
       },
@@ -211,7 +211,7 @@
         "slug": "backlog-synthesis",
         "file": "skills/backlog-synthesis/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:2c15ca7c45b052c929fe7a5ab34be7a82f6f8805f99dbb930c5f7cfbee91b828",
+        "checksum": "sha256:e077bbf16cfbb6a79fbda114df884066b57b93fff83d5d0bffdace46f62ae964",
         "supersedes": null,
         "metadata": {}
       },
@@ -299,7 +299,7 @@
         "slug": "orchestrator",
         "file": "skills/orchestrator/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:e6cf7a13c0d5c15f731b4a9e2ce12f3578055c4a602a56d94e3f1c7f06717d62",
+        "checksum": "sha256:89cd6fe31a0a8626bada2eb99e2c74118127174f662466b09813a74b16b58694",
         "supersedes": null,
         "metadata": {}
       },
@@ -347,7 +347,7 @@
         "slug": "release",
         "file": "skills/release/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:70e2fbeafede7e606edc9f1de6b5a91f7ed00ac0d839ad6f15d8ad175bb8bb21",
+        "checksum": "sha256:97e132fc96b1a0c65d77f3ad209dd1a23e9518a29eb775529f4e1cb6ea248c26",
         "supersedes": null,
         "metadata": {}
       },
@@ -403,7 +403,7 @@
         "slug": "workflow-status",
         "file": "skills/workflow-status/SKILL.md",
         "version": "1.0.0",
-        "checksum": "sha256:96c2afc874e1d783435b8fffb654caea5307338d5f53ccfa56ce9d17a097bfbc",
+        "checksum": "sha256:7390c8d966110f5e0f8935b61363c6252cde5674423355742a5ebe8c76b790ad",
         "supersedes": null,
         "metadata": {}
       }
@@ -413,7 +413,7 @@
         "slug": "dangling-guard",
         "file": "hooks/dangling-guard.ts",
         "version": "1.0.0",
-        "checksum": "sha256:9f26167f1e001c4740faa3434483286d26b566ca98802b26fd142c068ef18088",
+        "checksum": "sha256:795ab6cb17039f6fd503d484a49a9bfe1b8a4b735098a9499bd679e534296da1",
         "supersedes": null,
         "metadata": {}
       },
@@ -421,7 +421,7 @@
         "slug": "gate-guardian",
         "file": "hooks/gate-guardian.ts",
         "version": "1.0.0",
-        "checksum": "sha256:25b4d3a6d7f15943f3873a92414d3bceadefe89eb41c75874623b8b5eca05e82",
+        "checksum": "sha256:d4098999b3f4cf28f9bc309f6355a00aaa4d9df90b66c17ec32f27bd20d55bf9",
         "supersedes": null,
         "metadata": {}
       },
@@ -429,7 +429,23 @@
         "slug": "api-client",
         "file": "hooks/lib/api-client.ts",
         "version": "1.0.0",
-        "checksum": "sha256:3872730877dc22c73f9bc3c5f49f752d90bd98db9deaa5e693e4fde15deadc25",
+        "checksum": "sha256:fdac374cfabb58865d676e24157d15bc9d81cdabf62a5a6d28c66e9a95fdf69e",
+        "supersedes": null,
+        "metadata": {}
+      },
+      {
+        "slug": "capability-scanner",
+        "file": "hooks/lib/capability-scanner.ts",
+        "version": "1.0.0",
+        "checksum": "sha256:f366c0afdcc06224d2e80566b3e5eaf6e06cf9af3b80c10d3c9acae4690f1c97",
+        "supersedes": null,
+        "metadata": {}
+      },
+      {
+        "slug": "finops-parser",
+        "file": "hooks/lib/finops-parser.ts",
+        "version": "1.0.0",
+        "checksum": "sha256:4acdcd904dd956c0375b11ebfbadca904b51635033c64d10f96f721235247c55",
         "supersedes": null,
         "metadata": {}
       },
@@ -437,7 +453,7 @@
         "slug": "gate-logic",
         "file": "hooks/lib/gate-logic.ts",
         "version": "1.0.0",
-        "checksum": "sha256:156607b7f34da7fdef1aa05f05c5b61673249fc84685ed1e121c1cef8174488c",
+        "checksum": "sha256:d3fe80209e5a8267214c314ef7f6fad474764fddb9d398c660e33071ee604a7a",
         "supersedes": null,
         "metadata": {}
       },
@@ -445,31 +461,39 @@
         "slug": "git-checkpoint",
         "file": "hooks/lib/git-checkpoint.ts",
         "version": "1.0.0",
-        "checksum": "sha256:d816d30a840e2a12ad7261779bedf0b42affa14ac37a1cfed8a4b7217798fa55",
+        "checksum": "sha256:9a001448abbb96d974af14db0a93763426a6409aaa68fb338547795f493ac636",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "mailbox-listener",
-        "file": "hooks/mailbox-listener.ts",
+        "slug": "observations-helper",
+        "file": "hooks/lib/observations-helper.ts",
         "version": "1.0.0",
-        "checksum": "sha256:ac237b81575182b2d4c7fba2c84dd6c6dd2d11c323a4f48b0e586c1b71ca34ab",
+        "checksum": "sha256:76b531c227e616582a0a2989d19e60e3fe86bfc02a2dee12e32a8b7acfe18faf",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "post-compact",
-        "file": "hooks/post-compact.ts",
+        "slug": "sprint-context",
+        "file": "hooks/lib/sprint-context.ts",
         "version": "1.0.0",
-        "checksum": "sha256:9fce966c6e08cbd1241a42ab14c89f98f92adb569fbe149f59ef4cf0d5084bd9",
+        "checksum": "sha256:fc681215c9a41615d8d902e0a39f18406d6e130780d7408ed264fbfc9eab8f1c",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "pre-agent-dispatch",
-        "file": "hooks/pre-agent-dispatch.ts",
+        "slug": "mailbox-listener",
+        "file": "hooks/mailbox-listener.ts",
+        "version": "1.0.0",
+        "checksum": "sha256:8112646bf356b209e986af38d2f9e8f71a01a38947540af76611ccc0725a718d",
+        "supersedes": null,
+        "metadata": {}
+      },
+      {
+        "slug": "post-compact",
+        "file": "hooks/post-compact.ts",
         "version": "1.0.0",
-        "checksum": "sha256:888b511de88c71ce3c429b8681a3e301f308f4f208ae101c5820885916eae445",
+        "checksum": "sha256:966ca9cf9dc32fc1b31e28fb36fdfc4732cd785bbbef7909de6d10ab1a79aec9",
         "supersedes": null,
         "metadata": {}
       },
@@ -477,7 +501,7 @@
         "slug": "session-start",
         "file": "hooks/session-start.ts",
         "version": "1.0.0",
-        "checksum": "sha256:7d8c69c9f9d3cc219aa15bca152777328ac9d7bc9da42b7eb7f6182bc98b8ecf",
+        "checksum": "sha256:c8adea2c3cdfd0eebfe488d81260fb0eed26e88a231586b4af6174efebe87781",
         "supersedes": null,
         "metadata": {}
       },
@@ -485,7 +509,7 @@
         "slug": "sprint-registry",
         "file": "hooks/sprint-registry.ts",
         "version": "1.0.0",
-        "checksum": "sha256:324dcea52ca724cd89cd8ce73eb8e9dca78e578cde1078b3a0bbf95df3cdd6f2",
+        "checksum": "sha256:340e40adc35b75c1b09bdc5b9166272098e52db7a91e6d870ba7cd6ccba8b4ab",
         "supersedes": null,
         "metadata": {}
       },
@@ -493,7 +517,7 @@
         "slug": "subagent-start",
         "file": "hooks/subagent-start.ts",
         "version": "1.0.0",
-        "checksum": "sha256:724b4ff1a9bc9b46964e490b805dfca9efebfd72d94908929c5836682b079627",
+        "checksum": "sha256:1c9ea66ec85376d7a40b943d3b8b44c602faedad809df0419d85d8e454664a24",
         "supersedes": null,
         "metadata": {}
       },
@@ -501,7 +525,7 @@
         "slug": "subagent-stop",
         "file": "hooks/subagent-stop.ts",
         "version": "1.0.0",
-        "checksum": "sha256:6d16bb0649c27897d6bc79f0af8d2f7f04071b163989b7014e7c1aece3057622",
+        "checksum": "sha256:569408e36602087ccc8ada1f61de3a365fe92a4705332913094a6160cacee753",
         "supersedes": null,
         "metadata": {}
       },
@@ -509,15 +533,7 @@
         "slug": "user-prompt",
         "file": "hooks/user-prompt.ts",
         "version": "1.0.0",
-        "checksum": "sha256:59e701c9642a25fe60f975dd6b114d9de33cf0bfaeada0a5600c47cf2620847f",
-        "supersedes": null,
-        "metadata": {}
-      },
-      {
-        "slug": "verification-before-completion",
-        "file": "hooks/verification-before-completion.ts",
-        "version": "1.0.0",
-        "checksum": "sha256:83fc4baf7a5117cd6c0368592fc1ee254d1b138f0a38f88c554c72aa63713279",
+        "checksum": "sha256:93e247dffd5609cf9c179f653bf072be19e4c94d11bf420743046795e68cf9d3",
         "supersedes": null,
         "metadata": {}
       },
@@ -525,7 +541,7 @@
         "slug": "workflow-guard",
         "file": "hooks/workflow-guard.ts",
         "version": "1.0.0",
-        "checksum": "sha256:6ebc0c67afb4d5a1a94174054d64809866b8741b477cc72483634e14c5d2af46",
+        "checksum": "sha256:b70edb5d65d370ce230b1666171230c58c9f425e9cbb49687f08d236bc164e2c",
         "supersedes": null,
         "metadata": {}
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestrator-claude/definitions",
-  "version": "3.31.0",
+  "version": "3.31.2",
   "description": "Built-in definitions (agents, skills, hooks, workflows, KB seeds) for the Orchestrator ecosystem",
   "type": "module",
   "main": "dist/index.js",

package/skills/backlog-synthesis/SKILL.md

@@ -18,7 +18,7 @@ cat .claude/agent-memory/orchestrator/MEMORY.md 2>/dev/null || echo "(empty)"
 ```
 
 ### Step 2: Query Active Workflows
-Use MCP tool getWorkflows or getStatus to check active workflow state.
+Use MCP tool listWorkflowDefinitions or getStatus to check active workflow state.
 
 ### Step 3: Cross-Reference and Synthesize
 Look for:

package/skills/orchestrator/SKILL.md

@@ -83,6 +83,23 @@ Sub-agents MUST persist artifacts to MinIO via `artifactStore` (universal rule,
 
 <!-- TODO S182 (OQ-4): per-phase agent override (.phases[n].agent) deferred — S182 will resolve permissive vs registry-validated vs KnownAgent-enum strategy after agent list complete -->
 
+#### 2c.1 Implementer-specific dispatch addenda (TD-S188-002)
+
+When dispatching `implementer` (phase=`implement`), the generic template above is **insufficient**. The S188 implement phase surfaced an ambiguity: the implementer interpreted `createCheckpoint` as requiring a git commit beforehand, producing 4 unsolicited commits per dispatch (commit prefix also leaked from BACKLOG context: `feat(s186)` instead of `feat(s188)`). To prevent recurrence, append the following **commit policy block** to every implementer dispatch prompt:
+
+```
+[Commit Policy]
+- createCheckpoint (mcp__orchestrator-tools__createCheckpoint) is a PostgreSQL state snapshot per RFC-012. It is INDEPENDENT of git. You do NOT need to commit before calling it. Calling createCheckpoint with no uncommitted changes is the normal path.
+- Commit policy for this dispatch: <one of>
+    a) "DO NOT commit — orchestrator owns the closure commit at review gate."
+    b) "Commit per-phase using prefix `<feat|fix|refactor>(s<N>): <subject>` — confirm prefix before commit." (use when implement phase exceeds 80k tokens or spans multiple fases)
+- If you commit, the prefix MUST be: `<feat|fix|refactor>(s<CURRENT_SESSION>):` — do NOT infer from BACKLOG examples or previous session context.
+```
+
+Substitute `<CURRENT_SESSION>` with the active session number (e.g., `s189`) and pick **exactly one** of (a) or (b) — never leave both options visible. The block goes **after** `[Task]` and **before** the artifactStore instruction.
+
+If the orchestrator (main) wants to own all commits, prefer option (a) + call `createCheckpoint` itself after the implement phase completes — do NOT delegate that call to implementer.
+
 ### 2d. Gate Check
 
 After each sub-agent completes, present the artifact summary and ask for approval:

package/skills/release/SKILL.md

@@ -250,6 +250,46 @@ git commit -m "chore: sync definitions manifest checksums"
 
 **REGRA:** Nunca faca release com definitions alteradas sem manifest actualizado. Isso causa uma release extra desnecessaria (como aconteceu no v3.9.3 -> v3.9.4).
 
+## Secret Audit (Quarterly — TD-S188-003)
+
+Release CI/CD depende de 3 secrets em `.github/workflows/release.yml`:
+
+| Secret | Purpose | Notas |
+|---|---|---|
+| `NPM_TOKEN` | Publica `@orchestrator-claude/*` packages | type=Automation (bypassa 2FA em CI). 404 PUT durante publish = token issue, NÃO scope-missing (S186 hard rule). |
+| `DOCKER_PASSWORD` | Login Docker Hub (user `cmac01`) | NÃO confundir com `DOCKER_TOKEN`. S186 release quebrou porque release.yml linhas 40+83 referenciavam o nome errado. Cross-reference `grep DOCKER_ release.yml` antes de instruir user a regerar secret. |
+| `DOCKER_USERNAME` | Docker Hub user identifier | Raramente roda; muda só se conta migrar. |
+
+**Hard rule:** Antes de QUALQUER release, audite idade dos 3 secrets críticos. Se algum > 90 dias, **bloqueie release** e rotacione primeiro.
+
+### Comando de audit
+
+```bash
+# Lista timestamp + idade em dias dos 3 secrets críticos do release.yml
+gh secret list --json name,updatedAt | jq -r \
+  '.[] | select(.name | IN("NPM_TOKEN","DOCKER_PASSWORD","DOCKER_USERNAME")) |
+   "\(.name)\tupdated \(.updatedAt)\tage \(((now - (.updatedAt | fromdateiso8601)) / 86400 | floor))d"'
+```
+
+Output esperado (idade < 90d em todos):
+```
+DOCKER_PASSWORD updated 2026-02-10T...   age 92d   ← ROTACIONAR
+DOCKER_USERNAME updated 2025-08-15T...   age 271d  ← stable, mas confirme válido
+NPM_TOKEN       updated 2026-04-20T...   age 23d   ← OK
+```
+
+### Rotação de secret expirante
+
+1. **Pause release** — NÃO execute `release.sh`.
+2. Regere o secret na origem:
+   - `NPM_TOKEN`: https://www.npmjs.com/settings/<user>/tokens (Generate New → Automation type)
+   - `DOCKER_PASSWORD`: Docker Hub → Account Settings → Security → New Access Token
+3. Atualize no GitHub: `gh secret set <NAME> --body "<new-value>"` (executar do CWD repo)
+4. Re-rode comando de audit acima — confirmar `updatedAt` fresco (idade < 1d).
+5. Proceda com release.
+
+**Histórico:** S186 release pipeline broke porque DOCKER_PASSWORD estava ausente (incorretamente referenciado como `DOCKER_TOKEN` em `release.yml` linhas 40+83). Aprendizagem capturada em hard rules S185→S188 carryover (BACKLOG).
+
 ## Checklist Pre-Release
 
 - [ ] CHANGELOG.md atualizado com todas as mudancas
@@ -259,3 +299,4 @@ git commit -m "chore: sync definitions manifest checksums"
 - [ ] Na branch main
 - [ ] Dry-run executado e revisado
 - [ ] Definitions manifest sincronizado (se houve alteracao em definitions)
+- [ ] **Secret audit executado** — nenhum dos 3 secrets críticos (`NPM_TOKEN`, `DOCKER_PASSWORD`, `DOCKER_USERNAME`) > 90 dias (ver seção "Secret Audit")

package/skills/workflow-status/SKILL.md

@@ -14,7 +14,7 @@ All workflow state is in **PostgreSQL** via MCP tools. NEVER read `.orchestrator
 | Tool | What it returns |
 |------|----------------|
 | `getStatus` | Current workflow: phase, status, pending action |
-| `getWorkflows` | All workflows with phase configs |
+| `listWorkflowDefinitions` | All workflow type definitions (phases, modes) |
 | `getNextAction` | Next pending action (agent + status) |
 | `getInvocations` | Agent invocation history |
 | `getMetrics` | Workflow metrics (duration, counts) |

package/hooks/pre-agent-dispatch.ts

@@ -1,57 +0,0 @@
-/**
- * pre-agent-dispatch.ts — PreToolUse hook for Agent tool (RFC-027 Sprint 4)
- *
- * Warns when dispatching known agents without subagent_type.
- * Non-blocking: always exits 0.
- */
-
-import { log, readStdin, getField, outputContext } from "./lib/api-client.js";
-
-const HOOK = "PRE-AGENT-DISPATCH";
-
-const KNOWN_AGENTS = [
-  "implementer",
-  "planner",
-  "specifier",
-  "reviewer",
-  "task-generator",
-  "researcher",
-];
-
-const KNOWN_AGENTS_REGEX = new RegExp(
-  `\\b(${KNOWN_AGENTS.join("|")})\\b`,
-  "i"
-);
-
-async function main(): Promise<void> {
-  const stdin = await readStdin();
-  const toolInput = getField(stdin, "tool_input") || "";
-  const subagentType =
-    getField(stdin, "tool_input.subagent_type") ||
-    getField(stdin, "tool_input.subagentType") ||
-    "";
-
-  // If subagent_type is present, no warning needed
-  if (subagentType) {
-    log(HOOK, `Agent dispatched with subagent_type="${subagentType}", OK`);
-    return;
-  }
-
-  // Check if prompt mentions a known agent
-  const prompt =
-    getField(stdin, "tool_input.prompt") ||
-    getField(stdin, "tool_input.description") ||
-    (typeof toolInput === "string" ? toolInput : JSON.stringify(toolInput));
-
-  const match = prompt.match(KNOWN_AGENTS_REGEX);
-  if (match) {
-    const detected = match[1].toLowerCase();
-    outputContext(
-      HOOK,
-      `[WARN] Agent dispatched without subagent_type. Known agent detected: "${detected}". Add subagent_type for proper frontmatter loading.`
-    );
-    log(HOOK, `WARN: known agent "${detected}" without subagent_type`);
-  }
-}
-
-main().catch(() => process.exit(0));

package/hooks/verification-before-completion.ts

@@ -1,97 +0,0 @@
-/**
- * verification-before-completion.ts — PreToolUse[Bash] hook
- *
- * Injects a verification reminder when the model is about to run
- * `git commit` or `git push`. Does NOT block — only adds context.
- *
- * Principle: Evidence before claims, always.
- * Source: verification-before-completion skill (superpowers 5.0.7)
- *
- * Flow:
- *   1. readStdin() → extract bash command
- *   2. commandMatchesGitOp() → check for commit/push
- *   3. If match → output allow + context reminder
- *   4. If no match → silent pass-through (no output)
- */
-
-import { log, readStdin, getField, outputPreToolUse } from "./lib/api-client.js";
-
-const HOOK = "VERIFICATION-REMINDER";
-
-// ─────────────────────────────────────────────────────────────
-// Dependency injection interface (enables testing without IO)
-// ─────────────────────────────────────────────────────────────
-
-export interface HookDeps {
-  readStdin: () => Promise<Record<string, unknown>>;
-  output: (opts: { decision: "allow" | "deny"; reason?: string; context?: string }) => void;
-  log: (prefix: string, msg: string) => void;
-}
-
-const defaultDeps: HookDeps = {
-  readStdin,
-  output: outputPreToolUse,
-  log,
-};
-
-// ─────────────────────────────────────────────────────────────
-// Pure helpers (exported for testing)
-// ─────────────────────────────────────────────────────────────
-
-/**
- * Returns true when the bash command string contains a git commit or git push
- * operation. Handles common variations: `git commit`, `git push`, multi-command
- * pipelines (`&&`, `;`), and quoted forms.
- */
-export function commandMatchesGitOp(command: string): boolean {
-  return /git\s+(commit|push)/.test(command);
-}
-
-// ─────────────────────────────────────────────────────────────
-// Core logic (exported for testing)
-// ─────────────────────────────────────────────────────────────
-
-export async function mainWithDeps(deps: HookDeps): Promise<void> {
-  const { readStdin, output, log } = deps;
-
-  const stdin = await readStdin();
-
-  // Extract the bash command from the tool input envelope
-  const command =
-    (getField(stdin, "tool_input.command") as string | undefined) ||
-    (getField(stdin, "command") as string | undefined) ||
-    "";
-
-  if (!commandMatchesGitOp(command)) {
-    // Silent pass-through — not a git commit/push, nothing to do
-    log(HOOK, `PASS (no git op): ${command.slice(0, 60)}`);
-    return;
-  }
-
-  log(HOOK, `REMIND git op detected: ${command.slice(0, 80)}`);
-
-  // Allow the command but inject a verification reminder as context.
-  // This hook NEVER blocks — it only nudges the model to verify first.
-  output({
-    decision: "allow",
-    context: [
-      "[VERIFICATION-REMINDER] You are about to run a git commit/push.",
-      "Before proceeding, confirm:",
-      "  1. Tests pass — run the test command and paste the output.",
-      "  2. Lint clean — run the lint command and confirm 0 errors.",
-      "  3. Build succeeds — run the build command and confirm exit 0.",
-      "  4. All acceptance criteria have matching test evidence.",
-      "Evidence before claims. No shortcuts for verification.",
-    ].join("\n"),
-  });
-}
-
-// ─────────────────────────────────────────────────────────────
-// Entry point (production use)
-// ─────────────────────────────────────────────────────────────
-
-async function main(): Promise<void> {
-  await mainWithDeps(defaultDeps);
-}
-
-main().catch(() => process.exit(0));