@sjawhar/opencode-legion-envoy 1.43.0 → 1.44.0

package/dist/src/server.js

@@ -13816,6 +13816,20 @@ function documentOwnerValidation(requireArtifact, alwaysRequireArtifact = false)
     message: alwaysRequireArtifact ? "Exactly one of issue and project is required; artifact or ref must name the document." : "Exactly one of issue and project is required; with project, artifact names the document."
   };
 }
+var documentEditValidation = {
+  check: (value) => {
+    if (!documentOwnerValidation(true, true).check(value))
+      return false;
+    const input = value;
+    if (input.precondition === undefined)
+      return true;
+    if (typeof input.precondition !== "object" || input.precondition === null)
+      return false;
+    const precondition = input.precondition;
+    return typeof precondition.document === "string" !== Array.isArray(precondition.blocks);
+  },
+  message: "Exactly one of issue and project is required; artifact or ref must name the document. A precondition selects exactly one of document or blocks."
+};
 var commentOwner = documentOwnerValidation(true);
 var commentValidation = {
   check: (value) => {
@@ -14043,9 +14057,10 @@ var dispatchToolSpecs = [
     example: {
       issue: "DSP-1",
       artifact: "spec",
-      ops: [{ op: "delete_column", block: "table-123", index: 1 }]
+      ops: [{ op: "delete_column", block: "table-123", index: 1 }],
+      precondition: { blocks: [{ id: "table-123", token: "sha256:current-table-token" }] }
     },
-    description: "Apply deterministic document edits: replace or delete quoted text, insert markdown at an anchor, retype an identified paragraph or typed block into a schema-declared typed block, delete or move a whole block by its id, or delete a table row or column in place. " + "Do not use it for review feedback or for reading; use dispatch_comment, dispatch_suggest, or dispatch_doc_read instead. " + "For replace, delete, and quote anchors, find text as rendered: inline Markdown (**bold**, `code`) is tolerated; a leading '# ' matches a heading. replace is inline: with is the new text of the matched span, so a leading list or heading marker stays literal text. " + "A delete whose find is a block's entire text removes the block (a list emptied of its items goes too); delete with block removes any block by id, and move with block relocates one. delete_row and delete_column take a table block and a zero-based index, preserving the table block id and refusing to remove cells with open asks or unresolved comments. " + 'Insert and move anchors also accept "start", "end", "heading:<exact heading text>", and "block:<id>"; block ids are the #id of a typed block or come from GET /api/v1/artifacts/{artifact UUID}/blocks (the route takes the artifact UUID, not its slug). ' + `The spec (or any document) holds requirements, design, and decisions - never progress, status, or timestamps. ${OWNER_REFERENCE} ${SPEC_WRITING_GUIDANCE}`,
+    description: "Apply deterministic document edits: replace or delete quoted text, insert markdown at an anchor, retype an identified paragraph or typed block into a schema-declared typed block, delete or move a whole block by its id, or delete a table row or column in place. " + "Do not use it for review feedback or for reading; use dispatch_comment, dispatch_suggest, or dispatch_doc_read instead. " + "For replace, delete, and quote anchors, find text as rendered: inline Markdown (**bold**, `code`) is tolerated; a leading '# ' matches a heading. replace is inline: with is the new text of the matched span, so a leading list or heading marker stays literal text. " + "A delete whose find is a block's entire text removes the block (a list emptied of its items goes too); delete with block removes any block by id, and move with block relocates one. delete_row and delete_column take a table block and a zero-based index, preserving the table block id and refusing to remove cells with open asks or unresolved comments. " + 'Insert and move anchors also accept "start", "end", "heading:<exact heading text>", and "block:<id>"; block ids and their tokens come from GET /api/v1/artifacts/{artifact UUID}/blocks (the route takes the artifact UUID, not its slug). ' + "Optionally require the state just read: precondition selects exactly one of a document token from dispatch_doc_read, or block {id, token} values from /blocks. A block guard must include every block the batch changes; Dispatch resolves quote targets and rejects an uncovered batch rather than applying it. Use a document token for insert or move, which depend on document order. Prefer block tokens when the covered content blocks are independent sections. Tokens include inline marks, so a fresh human comment also makes a stale edit fail. PRECONDITION_FAILED means re-read; EDIT_QUEUE_FULL means back off before retrying. " + `The spec (or any document) holds requirements, design, and decisions - never progress, status, or timestamps. ${OWNER_REFERENCE} ${SPEC_WRITING_GUIDANCE}`,
     arguments: (z) => ({
       issue: z.string().describe(ISSUE_REFERENCE).optional(),
       project: z.string().describe("Project key owning the document.").optional(),
@@ -14064,14 +14079,21 @@ var dispatchToolSpecs = [
         type: z.string().describe("Typed block name for retype.").optional(),
         attributes: z.unknown().describe("Typed block attributes for retype.").optional()
       })).describe("Flat tagged edits; the server validates fields required for each operation."),
+      precondition: z.object({
+        document: z.string({ min: 1 }).describe("Token for the exact canonical document returned by dispatch_doc_read.").optional(),
+        blocks: z.array(z.object({
+          id: z.string({ min: 1 }).describe("Stable block id from GET /api/v1/artifacts/{id}/blocks."),
+          token: z.string({ min: 1 }).describe("That block's full-state token, including inline marks.")
+        }), { min: 1 }).describe("Every content block this batch changes, each with the token returned by /blocks.").optional()
+      }).describe("Optional optimistic-concurrency guard; select exactly one of document or blocks.").optional(),
       summary: z.string().describe("Optional named-version summary.").optional()
     }),
-    validation: documentOwnerValidation(true, true)
+    validation: documentEditValidation
   },
   {
     name: "dispatch_doc_read",
     example: { issue: "DSP-1" },
-    description: "Read a live document or a named document version. Do not use it for issue status, asks, or events; " + "use dispatch_read instead. Supply ref, issue, or project plus artifact; issue plus an omitted artifact reads the primary document. " + OWNER_REFERENCE,
+    description: "Read a live document or a named document version. Do not use it for issue status, asks, or events; " + "use dispatch_read instead. Supply ref, issue, or project plus artifact; issue plus an omitted artifact reads the primary document. " + "A live read returns its document token for an optional dispatch_doc_edit precondition; use /blocks for per-block tokens. " + OWNER_REFERENCE,
     arguments: (z) => ({
       issue: z.string().describe(ISSUE_REFERENCE).optional(),
       project: z.string().describe("Project key owning the document.").optional(),
@@ -14296,6 +14318,14 @@ var reviewSchema = baseHandoffSchema.extend({
   verdict: _enum2(["approved", "changes_requested"]).optional(),
   keyFindings: array(object({ severity: string2(), file: string2(), description: string2() }).passthrough()).optional()
 });
+var nonEmptySkillList = array(string2().trim().min(1)).min(1);
+var planWriteSchema = planSchema.extend({
+  requiredSkills: object({
+    implement: nonEmptySkillList,
+    test: nonEmptySkillList,
+    review: nonEmptySkillList
+  }).passthrough()
+});
 var phaseHandoffSchema = discriminatedUnion("phase", [
   architectSchema,
   planSchema,
@@ -14919,12 +14949,16 @@ class DispatchServiceError extends Error {
   code;
   status;
   candidates;
+  current;
+  mismatches;
   name = "DispatchServiceError";
-  constructor(code, status, message, candidates) {
+  constructor(code, status, message, candidates, current, mismatches) {
     super(message);
     this.code = code;
     this.status = status;
     this.candidates = candidates;
+    this.current = current;
+    this.mismatches = mismatches;
   }
 }
 function asErrorShape(value) {
@@ -15236,7 +15270,7 @@ class DispatchClient {
     }
     if (!response.ok) {
       const error = asErrorShape(payload);
-      throw new DispatchServiceError(error.code ?? `HTTP_${response.status}`, response.status, error.error ?? (typeof payload === "string" && payload ? payload : response.statusText), error.candidates);
+      throw new DispatchServiceError(error.code ?? `HTTP_${response.status}`, response.status, error.error ?? (typeof payload === "string" && payload ? payload : response.statusText), error.candidates, error.current, error.mismatches);
     }
     return payload;
   }
@@ -16586,9 +16620,12 @@ ${followsAsk(askOwner)}`,
       const resolved = await resolveArtifact(client, documentOwner(), stringArg(args, "artifact"));
       const ops = args.ops;
       const summary = optionalString(args, "summary");
+      const { precondition: rawPrecondition } = args;
+      const precondition = rawPrecondition;
       const edited = await client.docEdit(resolved.artifact.id, {
         ops,
         ...summary === undefined ? {} : { summary },
+        ...precondition === undefined ? {} : { precondition },
         actor
       });
       const retyped = ops.filter((operation) => operation.op === "retype").length;
@@ -16616,6 +16653,7 @@ ${followsAsk(askOwner)}`,
       const marks = marksResult.value;
       const approval = approvalLine(resolved.artifact);
       const trailer = [
+        ..."token" in document && document.token !== undefined ? [`Document token: ${document.token}`] : [],
         ...marks.length === 0 ? [] : [`Open anchored asks/comments: ${marks.join(", ")}`],
         ...approval === undefined ? [] : [approval]
       ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/opencode-legion-envoy",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "type": "module",
   "main": "dist/src/server.js",
   "exports": {

package/skills/AGENTS.md

@@ -4,44 +4,17 @@ Legion skills guide the architect and its sequential phase workers in a shared i
 They are Markdown instructions loaded by Oh My Pi sessions; the daemon and OMP extension own
 event intake, process lifecycle, credentials, and role delivery.
 
-## Structure
-
-```
-skills/
-├── dispatch/            # Writing specs, asks, comments, and artifacts on native Dispatch
-├── envoy/               # Envoy subscriptions, agent-to-agent messages, and topic formats
-├── legion-architect/    # Tree ownership, decomposition, gates, and scheduling
-├── legion-controller/   # Derived-verdict control-plane operation
-├── legion-oracle/       # Repository-grounded research
-├── legion-retro/        # Post-review retrospective
-└── legion-worker/       # Sequential architect, plan, implement, test, and review phases
-```
-
-## Phase workers
-
-The extension supplies a phase worker with its issue, workspace, role token, and structured
-output schema. The worker claims its supplied role, works only on its phase artifact, and
-returns that schema to the architect. It writes the same phase-specific payload to
-`.legion/<phase>.json`, verifies it exists, and commits the handoff before reporting completion.
-The committed predecessor handoff wins after revival or re-creation.
-
-Workers do not run a controller loop or mutate lifecycle labels. Workers coordinate
-lifecycle, scope, and cross-phase decisions with the owning architect by `envoy_publish` to its
-role topic, sending the verified observation and decision needed (`hub` reaches only subagents
-inside the worker's own process). A worker may call the native `dispatch_*` tools directly for a
-durable human question; replies come back to the worker's own session.
-
-## Durable artifacts
-
-Phase handoffs are committed in lifecycle order: architect, plan, implement, test, and review.
-Only the implementer pushes them: it and the merger act as the code-writing GitHub App, while
-the planner, tester, reviewer, and architects act as the review App (`appRoleForLegionRole`,
-`packages/daemon/src/daemon/github-apps.ts`), which holds no `contents` permission — their
-handoff commits stay on the shared workspace's issue branch and ride the implementer's next push.
-A clean review ends with the `.legion/` deletion pushed by the implementer at the reviewer's
-direction, which the reviewer then approves; retro records its learning in
-`docs/solutions/` and writes no handoff. GitHub comments and reviews carry the required Legion
-footer so the daemon can attribute artifacts to their worker session.
-The implement handoff carries the implementer's own production-like proof and the test handoff the
-tester's verdict on it plus the tester's own; `legion handoff write` refuses a payload the phase's
-schema rejects and names the field. Retro's message goes to the Dispatch issue (`dispatch_message`), never a GitHub issue.
+| Skill | Who reads it | What it owns |
+| --- | --- | --- |
+| `dispatch/` | every role, and any session writing to Dispatch | specs, asks, comments, artifacts, and messages on native Dispatch |
+| `envoy/` | every role | subscriptions, agent-to-agent messages, and topic formats |
+| `legion-architect/` | root and sub-architects | tree ownership, decomposition, waves, gates, integration, sign-off |
+| `legion-controller/` | the controller root process | wake routing, backlog admission, escalation |
+| `legion-oracle/` | any role doing research | repository-grounded research |
+| `legion-retro/` | the implementer, at retro | the pre-merge retrospective and its Dispatch message |
+| `legion-worker/` | planner, implementer, tester, reviewer, merger | the phase contracts: handoffs, GitHub identity, PR body and READY discipline, the merge-gate order |
+
+The owning skill above is where each contract is defined; a role prompt that needs a contract from its own seat points there or restates only its own step. This file lists and does not restate.
+The text a worker boots with (its role prompt) lives in `packages/pi-envoy/roles/` and is
+composed per role in `packages/daemon/src/daemon/processes.ts`; `packages/pi-envoy/roles/roles.test.ts`
+holds the structural rules for those parts.

package/skills/dispatch/SKILL.md

@@ -381,11 +381,12 @@ Read the current document before changing it:
 ```ts
 dispatch_doc_read({ issue?, project?, artifact?, version?, ref? })
 ```
-It returns live or versioned markdown with open marks. `issue` with an omitted `artifact` reads the issue specification; a project needs
-`artifact`; and a `dispatch://PROJECT/artifact/<document-ref>` ref supplies both, where `document-ref` is the id, slug, or filename.
+It returns live or versioned markdown with open marks. A live read ends with a document token; `issue` with an
+omitted `artifact` reads the issue specification; a project needs `artifact`; and a
+`dispatch://PROJECT/artifact/<document-ref>` ref supplies both, where `document-ref` is the id, slug, or filename.
 
 ```ts
-dispatch_doc_edit({ issue?, project?, artifact, ops, summary? })
+dispatch_doc_edit({ issue?, project?, artifact, ops, precondition?, summary? })
 ```
 It returns issue or project-document owner details plus `applied` and optional `version`. `ops` is an array of this
 exact `EditOp` shape:
@@ -445,6 +446,18 @@ an earlier `delete {block}` fails as `INVALID_OP` naming the earlier operation a
 whose anchor lies inside the moved block, or a delete that would leave a typed block without the body its content rule requires, is
 `INVALID_OP` naming the field and the rule.
 
+`GET /api/v1/artifacts/<artifact UUID>/blocks` includes a full-state `token` on every block, including
+inline marks. To reject a stale edit, pass `precondition` with exactly one of
+`{ document: "<token from dispatch_doc_read>" }` or
+`{ blocks: [{ id: "<block id>", token: "<block token>" }] }`. The server resolves the whole batch before
+mutation: a block guard must cover every content block it changes, or Dispatch returns
+`400 INVALID_PRECONDITION` without applying anything. Use a document token for insert and move because they
+depend on document order. A block token lets other sections change concurrently; a new anchored ask or comment
+changes the relevant token. A stale guard returns `409 PRECONDITION_FAILED` with each mismatch and current
+token; Dispatch applies no part of that batch. It is the hashline `#TAG` property applied to stable block ids,
+not line numbers: canonical Markdown lines shift under concurrent edits and rendering changes, while block ids
+survive moves and retyping.
+
 `retype` turns the paragraph or typed block with `block` into the named typed `type` in place. It keeps the
 block id, keeps a typed block's body, and uses `attributes` for client-owned typed attributes. Use it when
 an existing paragraph is the question that should become a decision.