@sjawhar/opencode-legion-envoy 1.31.1 → 1.32.0

package/dist/src/server.js

@@ -14078,7 +14078,7 @@ var HANDOFF_SCHEMA_VERSION = 1;
 var HANDOFF_PHASES = ["architect", "plan", "implement", "test", "review"];
 var isoTimestamp = string2().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/);
 var handoffPhase = _enum2(HANDOFF_PHASES);
-var nonEmpty = string2().min(1);
+var nonEmpty = string2().trim().min(1);
 var proofSchema = object({
   criterion: nonEmpty,
   surface: nonEmpty,
@@ -14098,7 +14098,7 @@ var baseHandoffSchema = object({
   completed: isoTimestamp,
   learningsInjected: array(string2()).optional(),
   learningsHelpful: array(string2()).optional()
-});
+}).passthrough();
 var architectSchema = baseHandoffSchema.extend({
   phase: literal("architect"),
   scope: _enum2(["trivial", "small", "medium", "large"]).optional(),
@@ -14106,7 +14106,7 @@ var architectSchema = baseHandoffSchema.extend({
   subIssues: array(string2()).optional(),
   routingHints: routingHintsSchema,
   concerns: array(string2()).optional()
-}).passthrough();
+});
 var requiredSkillsSchema = object({
   implement: array(string2()).optional(),
   test: array(string2()).optional(),
@@ -14120,7 +14120,7 @@ var planSchema = baseHandoffSchema.extend({
   concerns: array(string2()).optional(),
   workflowRecommendation: string2().optional(),
   requiredSkills: requiredSkillsSchema
-}).passthrough();
+});
 var implementSchema = baseHandoffSchema.extend({
   phase: literal("implement"),
   filesChanged: array(string2()).optional(),
@@ -14131,7 +14131,7 @@ var implementSchema = baseHandoffSchema.extend({
   subPlanningNeeded: boolean2().optional(),
   discoveredComplexity: array(string2()).optional(),
   suggestedSubWorkers: number2().optional()
-}).passthrough();
+});
 var testSchema = baseHandoffSchema.extend({
   phase: literal("test"),
   passed: number2().optional(),
@@ -14141,9 +14141,15 @@ var testSchema = baseHandoffSchema.extend({
   proof: array(proofSchema).min(1).optional(),
   documentationFeedback: string2().optional(),
   observations: array(string2()).optional()
-}).passthrough().refine((handoff) => (handoff.failures?.length ?? 0) > 0 || (handoff.failed ?? 0) > 0 || (handoff.proof?.length ?? 0) > 0, {
+}).refine((handoff) => (handoff.failures?.length ?? 0) > 0 || (handoff.failed ?? 0) > 0 || (handoff.proof?.length ?? 0) > 0, {
   path: ["proof"],
   message: "a passing test handoff needs the tester's own production-like proof"
+}).refine((handoff) => (handoff.failed ?? 0) === 0 || (handoff.failures?.length ?? 0) > 0, {
+  path: ["failures"],
+  message: "a test handoff that reports failed > 0 records at least one failure"
+}).refine((handoff) => handoff.implementerProof.verdict !== "rejected" || (handoff.failures?.length ?? 0) > 0, {
+  path: ["failures"],
+  message: "a rejected implementer proof is a recorded failure"
 });
 var reviewSchema = baseHandoffSchema.extend({
   phase: literal("review"),
@@ -14152,7 +14158,7 @@ var reviewSchema = baseHandoffSchema.extend({
   minor: number2().optional(),
   verdict: _enum2(["approved", "changes_requested"]).optional(),
   keyFindings: array(object({ severity: string2(), file: string2(), description: string2() }).passthrough()).optional()
-}).passthrough();
+});
 var phaseHandoffSchema = discriminatedUnion("phase", [
   architectSchema,
   planSchema,
@@ -14225,6 +14231,12 @@ var stateTreeLocator = discriminatedUnion("runtime", [
   stateTmuxLocator.extend({ ompSessionFile: nonEmptyString.optional() }),
   stateK8sLocator.extend({ ompSessionFile: nonEmptyString.optional() })
 ]);
+var stateExternalControllerLocator = strictObject({
+  runtime: literal("kubernetes"),
+  external: literal(true),
+  sessionId: nonEmptyString,
+  registeredAt: number2().int().nonnegative()
+});
 var stateIssue = strictObject({
   key: nonEmptyString,
   title: string2(),
@@ -14280,7 +14292,7 @@ var LegionDaemonApi = {
         queue: array(nonEmptyString)
       }),
       gates: record(string2(), stateGate),
-      controllerLocator: stateTreeLocator.optional(),
+      controllerLocator: union([stateTreeLocator, stateExternalControllerLocator]).optional(),
       roles: record(string2(), stateRole),
       controllerPendingNotices: number2().int().nonnegative(),
       pendingStatusWrites: array(nonEmptyString),
@@ -14295,6 +14307,10 @@ var LegionDaemonApi = {
     }),
     response: object({})
   },
+  ControllerSecret: {
+    request: strictObject({}),
+    response: object({ secret: nonEmptyString })
+  },
   ProcessStarted: {
     request: strictObject({
       tree: nonEmptyString,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/opencode-legion-envoy",
-  "version": "1.31.1",
+  "version": "1.32.0",
   "type": "module",
   "main": "dist/src/server.js",
   "exports": {

package/skills/dispatch/SKILL.md

@@ -183,6 +183,10 @@ passage with `anchor`. Follow up on an ask or comment with `dispatch_comment`; c
 with a `dispatch://` reference (see [References](#references)). Never write "see above", "the
 message above", or "as attached".
 
+**A decision about an uploaded artifact links it.** If the human must read an artifact to answer,
+the question carries `dispatch://KEY/artifact/<slug>` (or `ref`), never just its filename. Text
+they must read to decide belongs in the spec in the first place — see [Artifacts](#artifacts).
+
 Before saying you are waiting for human input, call `dispatch_open_asks`. It lists this session's active asks across open issues and project documents, including whether the human or agent owes the next reply.
 
 **Anything that needs the human is an ask, or it does not exist.** An approval, a credential,
@@ -431,6 +435,15 @@ with your text. Never do that: the spec is edited in place with `dispatch_doc_ed
 artifact by the slug shown in the upload result or by its filename, and a project document by its artifact id, slug, or filename; the
 slug also arrives on `artifact.created` events.
 
+**Where a deliverable goes.** Text the human must read to decide — a draft message, a proposal,
+a summary — goes in the spec as a section: the spec is the one document they open. A separate
+artifact is for a real file: something sent as-is, a long report, a binary, a screenshot.
+
+When you do upload one, the spec links it as `dispatch://KEY/artifact/<slug>` (the `slug` from the
+upload result; it renders as a link) at the place the reader needs it, and the ask that needs the
+decision carries the same reference. A heading or a sentence naming the filename is not a
+reference.
+
 Documents are CommonMark. A bare `<https://example.com|text>` is a CommonMark autolink and is normalised: the angle brackets are
 dropped and the URL keeps `|text`. A backslash-escaped `\<https://example.com|text>` displays as `<https://example.com|text>` in the
 document but comes back re-escaped (`\<`) from `dispatch_doc_read`. A Slack mrkdwn draft, or any other payload that is not Markdown,
@@ -607,3 +620,38 @@ dispatch_message({
   body: "Release 1.4 is live on the devbox (dispatch://LEGION-815/artifact/release-notes). Nothing needed from you.",
 })
 ```
+
+Before — a draft the human must read is uploaded as a separate file, the spec only names it, and
+the ask does not point at it, so the reader has to go looking:
+
+```ts
+dispatch_artifact({ issue: "OPS-52", name: "cu-update-2026-09-15.md", content: "Hi team, ..." })
+dispatch_doc_edit({ issue: "OPS-52", artifact: "spec", ops: [
+  { op: "insert", after: "## Context", markdown: "## Draft (artifact cu-update-2026-09-15.md)" },
+]})
+dispatch_ask({ issue: "OPS-52", question: "Send the customer update as drafted?", options: [...] })
+```
+
+After — the draft is a section of the spec, and the ask anchors there. If it really must be a
+file (something to send as-is), the spec and the ask both link the slug from the upload result:
+
+```ts
+dispatch_doc_edit({ issue: "OPS-52", artifact: "spec", ops: [
+  { op: "insert", after: "## Context", markdown: "## Draft\n\nHi team, ..." },
+]})
+dispatch_ask({
+  issue: "OPS-52",
+  question: "Send the customer update as drafted?",
+  options: [...],
+  anchor: { artifact: "spec", quote: "Hi team," },
+})
+// or, for a real file — the spec links it where the reader needs it, and so does the ask:
+dispatch_doc_edit({ issue: "OPS-52", artifact: "spec", ops: [
+  { op: "insert", after: "## Context", markdown: "## Draft\n\nThe update to send as-is: dispatch://OPS-52/artifact/cu-update-2026-09-15-md" },
+]})
+dispatch_ask({
+  issue: "OPS-52",
+  question: "Send this customer update as-is? dispatch://OPS-52/artifact/cu-update-2026-09-15-md",
+  options: [...],
+})
+```

package/skills/legion-controller/SKILL.md

@@ -64,6 +64,26 @@ command run `/legion-claim-controller` again.
 This handshake lets the daemon redeliver held controller work. It does not turn the controller
 into a state holder: daemon state and the Dispatch project remain authoritative.
 
+### Started by the operator (runtime: kubernetes)
+
+When the daemon runs inside a Kubernetes cluster it cannot open a terminal anywhere, so nobody
+launched your pane: the operator ran `legion controller start --config controller.yaml
+[--daemon-url <port-forward>]` on their own machine, and you are that foreground OMP session.
+The command fetched a fresh controller secret from the daemon with the operator's token, wrote it
+to a 0600 file under `LEGION_STATE_DIR` (`~/.local/state/legion/<project>-controller` by default)
+beside the `gh` shim and the `legion` launcher, and started you with `LEGION_CONTROLLER=1` and
+the same environment a tmux controller pane carries — so the extension claims the role and calls
+`/controller/ready` exactly as under tmux, and nothing changes in how you handle wakes. The
+daemon records you as `controllerLocator: {runtime: "kubernetes", external: true, sessionId,
+registeredAt}` and reads your liveness from the Envoy role registry (the holder of
+`legion-<project>-controller` and its `last_seen`), not from a pane: keep the session running.
+Exiting it leaves the project without a controller until the operator runs the command again —
+the daemon logs `controller not registered; run legion controller start` once per boot-timeout
+interval and launches nothing itself. `legion state`, `legion gh -- <args>`, and
+`legion status <KEY> <status>` work here over `LEGION_DAEMON_URL` (the port-forward). A second
+`legion controller start` replaces you: it mints a new secret, so your grants stop working and
+the role moves to the new session.
+
 ## Deployment instructions
 
 Deployment instructions, when present, are the operator's standing rules for this repository —

package/skills/legion-retro/SKILL.md

@@ -99,7 +99,7 @@ dispatch_message({
 
 **Proofs read:** implementer <surface/command>, tester <surface/command>.
 
-**Production check:** <what the implementer will drive after the merge, or the action ask it opened>
+**Production check:** <what the implementer will drive after the merge, or the deploy/restart step a human will have to perform first>
 
 <!-- legion: {"session":"<session-id>","phase":"retro"} -->`,
 })

package/skills/legion-worker/SKILL.md

@@ -280,6 +280,25 @@ Verified the implementer's proof by <re-running its command | driving the same s
 **Retarget:** Retargeting a pull request to a new base does not re-run Tests; after a retarget, rebase onto the new base and push — the new head runs Tests against the new merge result — and cite that run in the PR body.
 ```
 
+**A proof** is the changed behaviour exercised on the surface a user reaches it through, recorded
+as the exact command or run id, what was observed, the head SHA, and one negative control —
+a deliberately broken input and the refusal or failure it produced. The surface is
+**production-like** — the repository's real-process test harness and fixtures, a sandbox
+repository, a real browser, a devN stack, staging, or a local stack with real migrations, one that
+has the resource the change touches — and each `E2E` line carries a **link** to that run,
+screenshot, or e2e; the merge queue does not approve a user-facing change without it, and a
+green unit suite is not it. A unit or integration test is a regression lock, never proof of a
+criterion. Sami, 2026-09-13, verbatim: "They need to test everything in a production-like
+environment before merging, and it is the agent that develops the feature that is responsible
+for doing that. If there's anything blocking that, we need to fix it: if it's infrastructure, we
+need to fix it; if it's tooling, we need to develop it; if it's skills, we need to fix the skills
+... it should not require deploying to production to realize your feature doesn't work."
+Evidence for the rule: in the week of 2026-09-08 three surfaces merged green and were wrong on
+inspection (the Astrolabe IPI stack, Dispatch on ECS, the candidate flow), and on 2026-09-12 six
+deploy slots died on code first executed after merge, including a production-only ECS bootstrap
+the whole staging gate never ran. The implementer's proof and the tester's proof below are both
+this proof.
+
 - **Threads are dispositioned individually, never resolved in bulk.** Every open review
   thread gets its own line naming the fixing commit or the reason it isn't a defect. The
   reviewer answers each thread it opened with exactly one of `Accepted: fixed in <commit> — <one line>`,
@@ -319,40 +338,23 @@ Verified the implementer's proof by <re-running its command | driving the same s
   field names naming, duplication, or wording cleanup only; anything that changes behaviour,
   hides an error, or breaks a gate lands in this PR.
 - **The implementer proves the change before its phase completes, and writes the `E2E (implementer)` line when the pull request opens.**
-  The proof is the changed behaviour exercised on the surface a user reaches it through — the daemon's
-  test harness (`packages/daemon/src/daemon/__tests__/`) and real-process fixtures; a live check at the
-  operator's next daemon restart, recorded on the PR; a sandbox repository, a real browser, a devN stack,
-  or a local stack with real migrations — with the exact command or run id, what was observed, the head SHA,
-  one negative control. The same proof goes into `.legion/implement.json` as its required `proof`
-  array (`legion handoff write --phase implement` refuses a payload without one and names the
-  field), and into the PR body, because the reviewer and the merger verify facts on GitHub and
-  never from a handoff. A unit or integration test is a regression lock, never proof of a
-  criterion.
+  The proof is the one defined above. It goes into `.legion/implement.json` as the required `proof`
+  array (`legion handoff write --phase implement` refuses a payload without one, or with a blank or
+  whitespace-only field, and names the field), and into the PR body, because the reviewer and the
+  merger verify facts on GitHub and never from a handoff.
 - **The tester verifies the implementer's proof and adds its own `E2E (tester)` line.** It re-runs
-  the implementer's command or drives the same surface independently, records the verdict in
-  `.legion/test.json` as `implementerProof` (`{verdict, how}`), and records its own proof beside
-  it. A test handoff whose predecessor carried no proof is a test failure, not a gap for the tester to fill:
+  the implementer's command or drives the same surface independently, and records the verdict in
+  `.legion/test.json` as `implementerProof` (`{verdict, how}`).
+  A test handoff whose predecessor carried no proof is a test failure, not a gap for the tester to fill:
   record it in `failures` with `implementerProof.verdict: "rejected"`, complete the phase, and let
   the architect return the issue to the implementer — the agent that developed the change owns
-  proving it. The tester's own proof names the real surface a user reaches the criterion
-  through, the exact command or run id, what was observed, the head SHA, and one negative
-  control — a deliberately broken input and the refusal or failure it produced. The surface is
-  **production-like** — a devN stack, staging, or a local stack with real migrations, one that
-  has the resource the change touches — and each `E2E` line carries a **link** to that run,
-  screenshot, or e2e; the merge queue does not approve a user-facing change without it, and a
-  green unit suite is not it. Sami, 2026-09-13, verbatim: "They need to test everything in a
-  production-like environment before merging, and it is the agent that develops the feature
-  that is responsible for doing that. If there's anything blocking that, we need to fix it: if
-  it's infrastructure, we need to fix it; if it's tooling, we need to develop it; if it's
-  skills, we need to fix the skills ... it should not require deploying to production to
-  realize your feature doesn't work." A code path whose first execution is after merge — a
+  proving it (`legion handoff write --phase test` refuses a rejected verdict, or `failed > 0`,
+  with no recorded failure). Otherwise, add your own proof before completing — a proof as defined
+  above — as the `E2E (tester)` line and the `proof` array `legion handoff write --phase test`
+  requires whenever you report no failure. A code path whose first execution is after merge — a
   deploy workflow's inline step, a post-merge helper, a production-only resource — is untested
   until the implementer has executed it against a devN stack; if no surface can reach it, the
-  tester names that missing surface as the blocker instead of passing the phase. Evidence for
-  the rule: in the week of 2026-09-08 three surfaces merged green and were wrong on inspection
-  (the Astrolabe IPI stack, Dispatch on ECS, the candidate flow), and on 2026-09-12 six deploy
-  slots died on code first executed after merge, including a production-only ECS bootstrap the
-  whole staging gate never ran. Environment or
+  tester names that missing surface as the blocker instead of passing the phase. Environment or
   secret-scrub evidence (e.g. "`LEGION_*`/`DISPATCH_*`/`ENVOY_*` unset") is recorded once, in
   `.legion/test.json`, and only when the issue's acceptance criteria call for it — never
   re-pasted into the PR body each round. After a conflict-forced rebase, compute the
@@ -536,10 +538,10 @@ and, for the implementer, until the push has too. This is the committed copy the
 reads after revival. It is removed once, at the end of a clean review: the implementer pushes
 that deletion at the reviewer's direction. No other phase removes it — and once it is gone
 (`jj -R "$LEGION_WORKSPACE" file list -r @- .legion` prints nothing on stdout; jj warns on
-stderr), this gate no longer applies: a later rebase, bare-gate re-check, confirmation, or retro
-writes no `.legion/<phase>.json`, commits no handoff, and reports with `legion handoff complete`
-alone (below). Recreating `.legion/` after its deletion changes the approved head and restarts
-the review loop this rule exists to end.
+stderr), this gate no longer applies: a later rebase, bare-gate re-check, confirmation, retro, or
+the post-merge production check writes no `.legion/<phase>.json`, commits no handoff, and reports
+with `legion handoff complete` alone (below). Recreating `.legion/` after its deletion changes the
+approved head and restarts the review loop this rule exists to end.
 
 ## Completion: report to the architect, then stay