@sjawhar/opencode-legion-envoy 0.44.0 → 1.0.0

package/dist/src/server.js

@@ -14130,8 +14130,7 @@ var LegionDaemonApi = {
       roleTokens: record(string2(), string2()),
       controlSubject: nonEmptyString,
       gates: object({
-        design: _enum2(["root-issues", "off"]),
-        merge: _enum2(["human", "off"])
+        design: _enum2(["root-issues", "off"])
       }).optional(),
       secret: nonEmptyString
     })
@@ -14140,14 +14139,6 @@ var LegionDaemonApi = {
     request: architectCapability.extend({ generation: number2().int() }),
     response: object({})
   },
-  MergeGate: {
-    request: architectCapability.extend({ pr: number2().int().positive() }),
-    response: object({
-      approved: boolean2(),
-      pr: number2().int().positive(),
-      headSha: nonEmptyString
-    })
-  },
   ProcessExit: {
     request: architectCapability.extend({ generation: number2().int() }),
     response: object({})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/opencode-legion-envoy",
-  "version": "0.44.0",
+  "version": "1.0.0",
   "type": "module",
   "main": "dist/src/server.js",
   "exports": {

package/skills/AGENTS.md

@@ -34,6 +34,8 @@ directly for a durable human question; replies come back to the worker's own ses
 ## Durable artifacts
 
 Phase handoffs are committed in lifecycle order: architect, plan, implement, test, and review.
-The reviewer removes `.legion/` as its final commit; retro records its learning in
+A clean review ends with the `.legion/` deletion pushed by the implementer at the reviewer's
+direction (the review App holds no `contents` permission and cannot push), which the reviewer
+then approves; retro records its learning in
 `docs/solutions/` and writes no handoff. GitHub comments and reviews carry the required Legion
 footer so the daemon can attribute artifacts to their worker session.

package/skills/legion-architect/SKILL.md

@@ -164,28 +164,30 @@ Wait for the messaged implementer to report its durable retro result. Retro outp
 `docs/solutions/` plus an issue comment; it must not create a `.legion` file or change
 the reviewer-approved head after cleanup.
 
-## 6. Architect sign-off and final merge gate
+## 6. Architect sign-off and merge
 
 Sign off only when scope is fully met, integration evidence is current, corrective work
 is complete, review is clean, retro completed, and no necessary work was silently
 deferred. Make the sign-off comment explicit about that evidence.
 
-When the config-armed final merge gate applies, preserve this order exactly:
+Preserve this order exactly:
 
 1. tester green and review cycles complete;
-2. reviewer pushes the `.legion/` deletion as its final commit and approves that head;
-3. retro completes without dirtying the branch;
-4. enter the Sami-approval step by calling
-   `legion({ op: "merge_gate", pr: <pull request number> })`. The daemon performs one
-   current GitHub review read against the pinned head. If it returns `approved: true`, the
-   approval already satisfies the gate and you immediately continue to the merger; do not
-   wait for a new wake. If it returns `approved: false`, request or retain Sami approval
-   and park for a later `pr-ready` wake. Do not poll or retry this check;
-5. The merger verifies the approved head and publishes `READY #<n> at <sha>` to
-   `notifications.role.pr-queue`; it never merges. The merge queue approves and merges under its own authority.
-
-If anything changes the approved head, return to review; do not let the merger publish
-`READY` for an obsolete approval.
+2. on a clean review, `spawn_worker` the implementer once more to push only the `.legion/`
+   deletion (the review App holds no `contents` permission), then the reviewer approves that
+   head. The deletion must land before that approval, which is head-pinned. An implementer
+   completion always writes the issue's status as `testing`; this one is not a test round,
+   so on its `phase-complete` wake call `legion({ op: "set_status", issue, status: "retro" })`
+   before messaging the reviewer to approve;
+3. retro completes without dirtying the branch beyond `docs/solutions/`;
+4. the merger verifies the current head is the reviewer-approved head plus only the retro
+   commits and publishes `READY #<n> at <sha>` to `notifications.role.pr-queue`; it never
+   merges. The merge queue merges under its own authority and the repository's own rules
+   (branch protection, CODEOWNERS); whether a human must approve first is that repository's
+   setting, not Legion's, and you never ask for or wait on such an approval.
+
+If anything else changes the head, return to review; do not let the merger publish `READY`
+for an obsolete approval.
 
 ## 7. Close
 
@@ -193,7 +195,7 @@ After the merge result and sign-off are recorded, post the sign-off and close th
 through the Legion write surface:
 
 ```text
-dispatch_comment({ issue: "LEGION-40", body: "<sign-off: scope, integration evidence, review, retro, Sami approval, and merge>" })
+dispatch_comment({ issue: "LEGION-40", body: "<sign-off: scope, integration evidence, review, retro, and merge>" })
 legion({ op: "set_status", issue: "LEGION-40", status: "done" })
 ```
 
@@ -210,10 +212,11 @@ corresponding lifecycle procedure.
 | `child-closed` | Read the child completion and remaining open children. Re-scope or close obsolete open work; release an appropriate next wave, or await `children-complete`. |
 | `children-complete` | Execute steps 3–4: parent integration verification; failures become a new child wave, success advances to review and retro. |
 | `child-reopened` | Treat the completion edge as reset. Reassess the reopened child and return the tree to children-in-flight; do not continue an already-started end-game. |
-| `phase-complete` | Payload `{type:"phase-complete", issue, role, summary}`. May arrive live or via `catchup-overseer`'s `phaseCompletions`. Read the committed handoff for that phase, then spawn the next phase's owner, or `spawn_worker` on the same role again to resume it with corrections if the handoff shows unresolved gaps. |
+| `phase-complete` | Payload `{type:"phase-complete", issue, role, summary}`. May arrive live or via `catchup-overseer`'s `phaseCompletions`. Read the committed handoff for that phase, then spawn the next phase's owner, or `spawn_worker` on the same role again to resume it with corrections if the handoff shows unresolved gaps. A `reviewer` completion whose GitHub review is `CHANGES_REQUESTED` (the daemon has already returned the issue's Dispatch status to `in_progress` for this) means `spawn_worker` the **implementer** again with the review findings — thread URLs and blocking items — as its task, then route back through tester and reviewer in order; never `spawn_worker` the reviewer directly off this wake and never proceed to retro on this verdict. A reviewer completion with an `APPROVED` review proceeds to retro (step 5). |
 | `worker-queued` | Payload `{type:"worker-queued", issue, role}`. The deployment's worker cap is full; this role's spawn is queued. Do not respawn or retry — wait for `worker-started`. |
 | `worker-started` | Payload `{type:"worker-started", issue, role}`. A previously queued role has been promoted and is now running. Treat it exactly as a normal spawn: resume tracking that role's live session. |
-| `pr-ready` | Verify the live PR head, green status, and review state. Continue the review/retro/Sami/merger order only for that current head. |
+| `pr-ready` | Verify the live PR head, green status, and review state. Continue the review/retro/merger order only for that current head. |
+| `pr-review` | Payload `{type:"pr-review", state, author, body}`. Delivered to whichever role is currently active for the issue, falling back to you when no worker phase is active. Follows the same verdict rule as a reviewer's `phase-complete`: `state: "changes_requested"` sends the implementer back in with the review findings, then tester, then reviewer — never the reviewer again and never retro; `state: "approved"` proceeds toward retro (step 5) once the step 6 integration/merge-gate conditions are met. |
 | `pr-blocked` | Read the failed CI evidence and recovery attempts. Assign a focused implementer or corrective child, then return it through testing and review; do not treat the blocked PR as final. |
 | `pr-closed-unmerged` | Decide from current scope whether to reopen the work, send a fresh implementer, or cancel it with a reason. Delegate the repository action to the responsible phase worker and keep ownership. |
 | `issue-comment` | Interpret the comment in the issue's design context. Answer it, adjust the plan, or relay it via `envoy_publish` to the responsible worker's role token; scope and product decisions remain with you. |

package/skills/legion-retro/SKILL.md

@@ -15,14 +15,15 @@ Follow this ordering exactly. It keeps the reviewed branch clean while preservin
 retrospective's durable output.
 
 1. Tester green and all code-review cycles finish.
-2. The reviewer removes `.legion/`, pushes that deletion as its final commit, then approves.
+2. The implementer pushes the `.legion/` deletion at the reviewer's direction, and the reviewer
+   approves that head.
 3. Run this retro: commit durable learnings to `docs/solutions/` and post the issue comment.
    Retro writes **no `.legion` file**, so it never re-dirties the cleaned handoff tree.
-4. Sami approves the final reviewed head.
-5. The merger verifies the approved head, publishes `READY`, and pushes nothing; the merge queue merges.
+4. The merger verifies the approved head, publishes `READY`, and pushes nothing; the merge queue
+   merges under the repository's own rules.
 
-Do not start retro before step 2, skip it because the change seems mechanical, or merge before
-steps 3 and 4. The design gate is not a substitute for this final merge gate.
+Do not start retro before step 2, skip it because the change seems mechanical, or publish `READY`
+before step 3. The design gate is not a substitute for review and retro.
 
 ## Two perspectives
 
@@ -84,4 +85,4 @@ Before returning, verify all of the following:
 - The learning documents and issue comment both exist.
 - No `.legion` file was created or modified by retro.
 - The fresh-eyes analysis was considered alongside the implementer's context.
-- Sami's approval and the merger remain subsequent steps, not work performed by retro.
+- The merger remains a subsequent step, not work performed by retro.

package/skills/legion-worker/SKILL.md

@@ -219,8 +219,9 @@ Negative control: <deliberately broken input> → <refusal or failure observed>.
   never from a handoff — then runs `task(agent="thermonuclear-deep-review")` and
   `task(agent="thermonuclear-code-quality")` once at that head and records the verdict.
   Skip the `Thermo` line entirely on a docs-only PR. Post every correctness finding as a
-  PR review comment and return the issue to the architect; when clean, delete `.legion/`,
-  push, review **that** head, and approve it by name.
+  PR review comment and return the issue to the architect; when clean, have the architect send
+  the implementer back to push the `.legion/` deletion (the review App cannot push), then
+  review **that** head and approve it by name.
 - Once a base is frozen for others to stack on, never rewrite it — fixes land as new
   commits on top, and the `Chain` line records what is frozen.
 - The merger confirms the approved head still equals the current head, then publishes
@@ -262,8 +263,8 @@ cd -- "$LEGION_WORKSPACE" && \
 
 Do not report phase completion until the write, existence check, and handoff commit
 succeed; when an issue branch exists, its push is also required. This is the committed
-copy the next phase reads after revival. The reviewer later removes `.legion/` as its final
-commit; phase workers do not remove it.
+copy the next phase reads after revival. It is removed once, at the end of a clean review: the
+implementer pushes that deletion at the reviewer's direction. No other phase removes it.
 
 ## Completion: report to the architect, then stay