@soleur/opencode 3.354.11 → 3.354.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soleur/opencode",
-  "version": "3.354.11",
+  "version": "3.354.13",
   "description": "Soleur AI organization plugin for OpenCode",
   "type": "module",
   "bin": {

package/skills/flag-set-role/SKILL.md

@@ -204,12 +204,13 @@ This is the migration verb (#4617), not a routine flip — it moves a feature of
 - `0` — success (or `--dry-run` clean).
 - `1` — fallback-fidelity rule violated (caller error), or the operator did not type `yes` (`SOLEUR_BOOTSTRAP_ABORTED stage=ack`; nothing written).
 - `2` — prerequisite missing (Doppler not authed, FLAGSMITH_MANAGEMENT_API_KEY unset, flag not in RUNTIME_FLAGS), a usage error, or an unknown flag (including the removed prompt-skip flag).
-- `3` — Flagsmith API error (network, 5xx, auth).
+- `3` — Flagsmith API error (network, 5xx, auth). On a write run this can fire AFTER the WORM audit row was appended (append-before-flip), so a failed write leaves an audit row with no matching change, and the dev env may already be flipped when the prd call fails: read the state back with `soleur:flag-list --json`, then re-run the same command (a retry appends a second, later audit row) and record the orphan row (what, when, why) in the issue. A `feature_states_to_update … segment: This field is required` response on an existing-override flip means a checkout older than the 2026-10-23 fix: update the branch and re-run.
 - `4` — Doppler write failed (skill aborts — Flagsmith state is now ahead of Doppler; operator must reconcile), or the WORM audit append failed before any write.
 - `64` — a write run with no TTY (`SOLEUR_BOOTSTRAP_INPUT_REQUIRED`): nothing was fetched or changed; hand the command to the operator (above).
 
 ## Sharp edges
 
+- Agent-runnable regression for the existing-override update arm: `bash "${CLAUDE_PLUGIN_ROOT}/test/flip-update-existing-override.test.sh"` (no TTY, stubbed network). The pty-driven suites (`flag-detach-shared`, `flag-org-scoping-pr2`) cannot run inside an agent session because the ack guard refuses a typed `yes` there. The stubbed run proves the request body shape; only the operator's typed-yes run followed by the `soleur:flag-list` read-back proves Flagsmith accepts it live.
 - The cache TTL in `apps/web-platform/lib/feature-flags/server.ts` is 30s per role. After a flip, the new state propagates per replica within 30s. Skill prints this hint after a successful flip.
 - The `dev off` rejection (Step 4) catches the case where prd is currently on AND you want to remove the dev cohort's preview. The correct sequence is: flip `prd off` first (which auto-flips both segments off via env-var mirror semantics, sort of), then leave dev where you want it. The plan's `dev off / prd on` case is intentionally unreachable.
 - Doppler mirror writes (Step 8) happen sequentially: dev first, then prd. If dev write fails, prd is not attempted (avoids cross-config divergence). Exit code 4.

package/skills/flag-set-role/scripts/flip.sh

@@ -309,6 +309,8 @@ print('missing')
 flip_segment_in_env() {
   local env_id="$1" feature_id="$2" segment_id="$3" enabled="$4"
   [[ "$feature_id" =~ ^[0-9]+$ ]] || { echo "invalid feature id (expected an integer)" >&2; return 1; }
+  [[ "$segment_id" =~ ^[1-9][0-9]*$ ]] || { echo "invalid segment id (expected an integer)" >&2; return 1; }
+  [[ "$enabled" == "true" || "$enabled" == "false" ]] || { echo "invalid enabled value (expected true or false)" >&2; return 1; }
 
   local existing_fs_id
   existing_fs_id=$(read_feature_segment_id "$env_id" "$feature_id" "$segment_id")
@@ -318,8 +320,10 @@ flip_segment_in_env() {
     # First-time override: feature_states_to_create.
     body=$(printf '{"feature_states_to_create":[{"feature_segment":{"segment":%d},"enabled":%s,"feature_state_value":{"type":"unicode","string_value":null,"integer_value":null,"boolean_value":null}}],"feature_states_to_update":[],"segment_ids_to_delete_overrides":[],"publish_immediately":true}' "$segment_id" "$enabled")
   else
-    # Existing override: feature_states_to_update referencing the fs_id.
-    body=$(printf '{"feature_states_to_create":[],"feature_states_to_update":[{"feature_segment":{"id":%d},"enabled":%s,"feature_state_value":{"type":"unicode","string_value":null,"integer_value":null,"boolean_value":null}}],"segment_ids_to_delete_overrides":[],"publish_immediately":true}' "$existing_fs_id" "$enabled")
+    # Existing override: feature_states_to_update referencing the fs_id. Flagsmith requires BOTH
+    # feature_segment.id and feature_segment.segment here: an {id}-only body was rejected live on
+    # 2026-10-23 with "segment: This field is required.".
+    body=$(printf '{"feature_states_to_create":[],"feature_states_to_update":[{"feature_segment":{"id":%d,"segment":%d},"enabled":%s,"feature_state_value":{"type":"unicode","string_value":null,"integer_value":null,"boolean_value":null}}],"segment_ids_to_delete_overrides":[],"publish_immediately":true}' "$existing_fs_id" "$segment_id" "$enabled")
   fi
 
   local resp

package/skills/review/references/risk-tier-and-fix-rounds.md

@@ -83,6 +83,8 @@ Two lessons from #9448 belong in every fix-agent and review-seat brief (full acc
 - **A diff under `docs/legal/` or `knowledge-base/legal/` has no seat arm in `fix-round-seats.sh`, and a legal-wording fix needs the CLO agent, not a vote.** Add `soleur:legal:legal-compliance-auditor` to the panel and to every fix round by hand (the script prints `unknown-seat:` for it), brief the history seat to check published-baseline claims against `origin/main` rather than the panel SHA (a fix round that re-dates an entry reads as an overwrite against the panel SHA), and send every wording doubt to the CLO agent as one batched spawn with the seat reports attached. **Why:** PR #10326 -- see `knowledge-base/project/learnings/2026-10-15-my-correction-pr-wrote-only-and-no-where-the-code-read-showed-more.md`.
 - **Seats share the session scratchpad, so a fixed-name pointer file (`sbx`, `mut.py`) is a collision.** On #10514 one seat overwrote another's sandbox pointer and ran its probes, including a hash-pinned `pip install`, inside the other seat's sandbox. Brief every seat to keep its sandbox path in its own shell variable or a seat-unique file name, and to re-run any result it measured after a pointer changed. See `knowledge-base/project/learnings/2026-10-19-a-newest-wins-reference-picked-my-own-unpushed-work-and-a-filtered-test-run-hid-an-import-error.md`.
 
+- **A fix agent's "suite green" covers only the files it was given; brief it on the repo-global ratchets by name, and run the combined-tree gate BEFORE the fix-round panel.** Editing a floor means running `scripts/guard-vacuity-floor.test.sh` (its floor detector parses only `-lt|-le|-ge`, so a `-ne` rewrite drops the file from the promoted set); adding a test that reads outside `apps/web-platform` means registering it in `test/repo-wide-suites.ts` (`repo-wide-containment.test.ts`); refactoring a symbol another test pins as source text means `git grep` of the old literal across `test/`. The lead then runs the affected gate or those suites by name on the COMBINED tree before spawning seats, so the panel reviews a tree that already passes; an affected gate that prints `ran=- of=-` / `budget-deferred` (queued behind sibling runs) is no verdict. **Why:** #10892 — three disjoint-scope fix agents each reported green and together broke all three gates; two panel seats found them by running suites nobody had touched. See `knowledge-base/project/learnings/2026-10-23-fix-round-agents-reported-green-on-their-own-files-and-broke-three-repo-global-gates.md`.
+
 ## Dedup-before-fixing ledger
 
 §5 Step 1's "Remove duplicate or overlapping findings" becomes a required emitted artifact, produced **before any fix dispatch**: