@toolu/opencode 6.8.0

package/plugins/toolu/settings/mcp-blocklist.txt

@@ -0,0 +1,8 @@
+# MCP server name prefixes to block (one per line; '#' starts a comment).
+# Match is against the leading mcp__<server>__ segment of the tool name.
+#
+# Entries are matched as PREFIXES of the server segment. So `claude_ai_`
+# blocks `mcp__claude_ai_Canva__*` and `mcp__claude_ai_Figma__*`. An exact
+# server name is the special case of a prefix with no extra characters.
+#
+# Empty by default — add one server-name prefix per line to block it.

package/plugins/toolu/settings/permissions.fragment.json

@@ -0,0 +1,36 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(*)",
+      "Bash(plugins/ast-grep/skills/ast-grep/scripts/ast-grep.sh:*)",
+      "Bash(.claude/worktrees/*/plugins/ast-grep/skills/ast-grep/scripts/ast-grep.sh:*)",
+      "Bash(ast-grep:*)",
+      "Bash(bun install:*)",
+      "Bash(bun run:*)",
+      "Bash(bun test:*)",
+      "Bash(bun x:*)",
+      "Bash(git add:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout --:*)",
+      "Bash(git checkout -b:*)",
+      "Bash(git commit:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git push:*)",
+      "Bash(git status)",
+      "Bash(ls:*)",
+      "Bash(mkdir:*)",
+      "Bash(node ./*:*)",
+      "Bash(pwd)",
+      "Bash(sg:*)",
+      "Bash(which:*)"
+    ],
+    "deny": [
+      "Bash(chmod 777:*)",
+      "Bash(dd if=/dev/zero:*)",
+      "Bash(mkfs:*)",
+      "Bash(rm -rf /)",
+      "Bash(sudo rm:*)"
+    ]
+  }
+}

package/plugins/toolu/settings/protected-files.txt

@@ -0,0 +1,30 @@
+# Protected file globs (one per line; '#' starts a comment).
+# bash extended-glob patterns matched against the edited file path.
+#
+# Paths are normalized to repo-relative before matching (the Edit/Write tool
+# sends absolute paths). Patterns are tried two ways: as written, and with an
+# implicit "**/" prefix so e.g. `hooks/lib/**` also matches `subtree/hooks/lib/x.sh`.
+# Bare-basename patterns (no `/`) additionally match against the file basename.
+#
+# This list gates Edit/Write/MultiEdit AND Bash/Shell (a command's candidate
+# write targets, extracted by bash_write_targets in hooks/lib/detect.sh).
+#
+# ⚠️  A match now PROMPTS YOU rather than denying outright: you approve or
+# refuse per call, and approving lets the write happen. Set
+# gates.protectedFiles.mode to "block" to restore the old hard deny.
+# See hooks/docs/gates.md and github.com/Falconiere/toolu/issues/176.
+#
+# Lint/format configs from the original hook.
+*.oxfmtrc.json
+*.oxlintrc.json
+# Always-protected: secrets and git internals.
+.env
+.env.*
+**/secrets/**
+.git/**
+# Trusted scripts — the hook framework itself and the ast-grep/comemory wrappers.
+# Protecting these prevents bypass-by-edit (security review concern).
+hooks/lib/**
+hooks/**/*.sh
+skills/ast-grep/scripts/**
+skills/agent-memory/scripts/**

package/plugins/toolu/settings/rust-unsafe-exemptions.txt

@@ -0,0 +1,5 @@
+# Rust crates allowed to use `unsafe` blocks/functions.
+# rust-quality.sh skips the unsafe check for files whose path contains
+# one of these crate names. Add one crate name per line; '#' starts a comment.
+#
+# Default: empty — projects opt in by editing this file.

package/plugins/toolu/settings/toolu.config.example.json

@@ -0,0 +1,130 @@
+{
+  "version": 1,
+  "gates": {
+    "preset": "balanced",
+    "pushReview": {
+      "mode": "advise"
+    },
+    "qualityGate": {
+      "mode": "block"
+    },
+    "commitGate": {
+      "mode": "advise"
+    },
+    "bashCommands": {
+      "mode": "advise"
+    },
+    "planLedger": {
+      "mode": "advise"
+    },
+    "docsSync": {
+      "mode": "advise"
+    },
+    "agentTier": {
+      "mode": "advise"
+    },
+    "sweep": true,
+    "stateTtlHours": 24,
+    "telemetryRetentionDays": 7
+  },
+  "permissions": {
+    "autoAllow": true,
+    "allow": [
+      "Bash(*)",
+      "Edit",
+      "Write"
+    ]
+  },
+  "skills": {
+    "ast-grep": true
+  },
+  "agents": {
+    "research-agent": true
+  },
+  "hooks": {
+    "session-start": true,
+    "user-prompt-submit": true,
+    "pre-tools": true,
+    "post-tools": true,
+    "pre-compact": true
+  },
+  "mcp": {},
+  "models": {
+    "enabled": true,
+    "mechanical": "haiku",
+    "exploration": "sonnet",
+    "implementation": "sonnet",
+    "review": "sonnet",
+    "synthesis": "opus",
+    "architecture": "opus",
+    "codex": {
+      "mechanical": {
+        "model": "gpt-5.6-luna",
+        "reasoningEffort": "medium"
+      },
+      "exploration": {
+        "model": "gpt-5.6-terra",
+        "reasoningEffort": "medium"
+      },
+      "implementation": {
+        "model": "gpt-5.6-terra",
+        "reasoningEffort": "medium"
+      },
+      "review": {
+        "model": "gpt-5.6-terra",
+        "reasoningEffort": "high"
+      },
+      "synthesis": {
+        "model": "gpt-5.6-sol",
+        "reasoningEffort": "high"
+      },
+      "architecture": {
+        "model": "gpt-5.6-sol",
+        "reasoningEffort": "high"
+      }
+    }
+  },
+  "telemetry": {
+    "enabled": true
+  },
+  "agentTier": {
+    "mode": "advise"
+  },
+  "planLedger": {
+    "blockOnUncoveredAcs": false
+  },
+  "docsSync": {
+    "mode": "advise",
+    "surfaces": [
+      "README.md",
+      "*/README.md",
+      "docs/*.md",
+      "*/SKILL.md"
+    ],
+    "surfaceExcludes": [
+      "docs/releases/*",
+      "*/docs/releases/*"
+    ],
+    "codeSurfaces": [
+      "*.ts",
+      "*.rs",
+      "*.sh",
+      "*/commands/*",
+      "*plugin.json",
+      "*.config.json"
+    ]
+  },
+  "lang": {
+    "ts": {
+      "maxFileLines": 300,
+      "maxFnLines": 60,
+      "noMocks": true
+    },
+    "rust": {
+      "maxFileLines": 500,
+      "maxFnLines": 50,
+      "maxImplLines": 200,
+      "noMocks": true
+    }
+  }
+}

package/plugins/toolu/skills/brainstorm/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: brainstorm
+description: "Use BEFORE writing code or planning a build, feature, refactor, or behavior change whose shape is unsettled. Tells: \"where do I even start\", \"this feels big\", \"help me scope it\", \"think through the approach and tradeoffs\", \"before I start coding\". Skip mechanical work with no design decision and already-scoped features."
+---
+
+# Brainstorm
+
+Choose the smallest amount of design work that removes material uncertainty.
+Default-and-proceed is the baseline: do not turn routine work into an interview.
+
+## Triage
+
+- **Skip** — mechanical work with no design decision: make the requested rename,
+  formatting change, dependency bump, or one-line correction directly.
+- **Compact** — bounded work with a material default or a small compatibility
+  risk. Produce a concise capsule, then continue.
+- **Full** — use only for cross-cutting work, a public interface,
+  persistence-or-migration, security-privacy, external-cost, or an unclear goal.
+  Evaluate only relevant axes and compare only genuinely distinct alternatives.
+
+## Evidence and decisions
+
+Start with memory recall, one targeted structural or exact-text search, then
+inspect the best hits. Reuse demonstrated repository conventions when they
+settle the choice. Delegate only when the search needs a broad map; keep the
+final trade-off decision in the main architecture tier. Use the tier rubric in
+[model-routing.md](../orchestrator/references/model-routing.md).
+
+Use the mandatory [Jev workflow](../../workflows/semantic-judgments.md) to compare
+alternatives per user preference. Keep architectural synthesis in the main thread.
+
+Set material defaults and proceed. Ask one structured question (2–3 options)
+only when prompt and repository evidence cannot settle a goal-defining or hard-to-reverse fork. If several forks qualify, ask about the
+highest-blast-radius decision and record defaults and risks for the rest.
+Use the structured-choice mapping in [host-mapping.md](../../workflows/host-mapping.md).
+
+## Compact capsule
+
+- **Outcome:** the intended, observable result.
+- **Material defaults/non-goal:** the chosen boundary and what stays out.
+- **Repository evidence:** the recalled decision or best matching hit.
+- **Risk:** the remaining compatibility, behavior, or delivery risk.
+- **Handoff:** straight to `plan` for bounded implementation; handoff to `spec`
+  when the contract is cross-cutting or must outlive this session.
+
+## Full path
+
+For each relevant material axis, state the default, evidence, and risk. Compare
+only alternatives that would change the outcome, interface, persistence,
+security, cost, or reversibility. Use the single-question exception above, then
+record the chosen approach, rejected alternatives, defaults, and open risks.
+
+## Handoff
+
+Skip goes to the requested mechanical work. Compact goes straight to `plan`.
+Full work hands off to `spec`, then `plan`. Carry forward real-data tests,
+concise docs, and any user-facing documentation updates.

package/plugins/toolu/skills/brainstorm/references/design-questions.md

@@ -0,0 +1,36 @@
+# Design question bank
+
+Referenced by `brainstorm` when triage selects the Full path. This is a menu of
+material axes, not a universal checklist: ignore axes that cannot change the
+design, state a supported default for the rest, and proceed.
+
+## Default-and-proceed
+
+Use repository evidence and the request to choose a default. Ask one structured
+question (2–3 options) only when neither can resolve a goal-defining or
+hard-to-reverse fork. When several forks qualify, ask the highest-blast-radius
+one and record defaults and risks for the rest.
+
+## Material axes
+
+Consider only the axes that fit the work:
+
+- **Intent and boundary:** observable outcome, non-goal, and first slice.
+- **Data and state:** source of truth, persistence, migration, and recovery.
+- **Interface:** public callers, names, UX, compatibility, and rollout.
+- **Failure behavior:** errors, partial results, retries, and safe fallback.
+- **Integration:** existing mechanisms, changed callers, and blast radius.
+- **Constraints:** security, privacy, external cost, performance, dependencies,
+  and supported platforms.
+- **Horizon:** smallest durable implementation versus a later extension.
+
+## Evidence order
+
+Recall prior decisions, run one targeted structural or exact-text search, and
+inspect the best hits before inventing alternatives. Delegate only for a broad
+map; the main architecture tier keeps the final trade-off decision.
+
+## Compact work
+
+For bounded work, record Outcome, Material defaults/non-goal, Repository
+evidence, Risk, and Handoff rather than sweeping these axes.

package/plugins/toolu/skills/commit/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: commit
+description: Use when the user asks to commit all current changes after running the repository's required quality gates.
+---
+
+# Commit
+
+Read [the canonical commit workflow](../../workflows/commit.md) and
+[the host mapping](../../workflows/host-mapping.md) completely, then execute
+them. Treat user arguments as commit-message context, not as permission to skip
+gates or hooks.

package/plugins/toolu/skills/debug/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: debug
+description: "Use when something is broken and you need the root cause — a failing or flaky test, a crash, a stack trace, wrong output, a regression, a Sentry issue. Drives a scientific-debug loop: reproduce → observe evidence → falsifiable hypothesis → instrument/bisect → isolate the ROOT cause (not the symptom) → fix → regression test → record. Tells: \"why does X fail\", \"it crashes\", \"this is broken\", \"flaky test\", \"debug this\", \"root cause\", \"it worked before\", \"track down this bug\", \"stack trace\". A non-chain break-glass loop in the toolu workflow — any phase can drop into it and return."
+---
+
+# Debug
+
+The break-glass loop of the toolu workflow. The six-stage delivery chain builds; this is what you reach for when something *broke*. It is not a chain step — any phase (most often `execution`, using the reusable `test` method) drops into it and returns. Its discipline is the session protocol made concrete: **evidence before claims; the same approach failed twice → stop and change the hypothesis, don't retry harder.**
+
+**Trigger phrases:** why does X fail, it crashes, this is broken, flaky test, debug this, find the root cause, it worked before, track down this bug, what's wrong with, stack trace.
+
+Use the mandatory [Jev workflow](../../workflows/semantic-judgments.md) after
+observations to compare hypotheses and prioritize experiments; allow insufficient evidence.
+Reproduction/tests establish causes.
+
+## The one rule that matters
+
+**Find the root cause, then fix the root cause.** Patching the symptom — silencing the error, adding a retry, special-casing the failing input — is the single most expensive mistake in debugging, because the bug survives and the next occurrence is harder to see. Every step below exists to push you toward the cause and away from the symptom.
+
+## The loop
+
+1. **Reproduce reliably.** Get a deterministic failing case before changing anything. If you cannot reproduce it, that *is* the first problem — narrow conditions (input, env, timing, order) until it fails on demand. A bug you can't reproduce, you can't prove you fixed.
+2. **Observe — gather evidence, do not guess.** Read the actual failure: test output, stack trace, logs, runtime state. Pipe raw signal through the evidence helpers (below) so it lands compact, not as a wall of text. Let the evidence narrow the search; never start from a hunch about the cause.
+3. **Hypothesize — one falsifiable claim.** State a single hypothesis precise enough to be *wrong*: "the token-expiry check uses `<` where it needs `<=`, so tokens expiring this exact second pass." Vague hypotheses ("something with auth") can't be tested.
+4. **Instrument & test the hypothesis.** Prove or kill it: add a targeted log/assert, bisect (`git bisect`, or halve the input/code path), or inspect the exact value. One change at a time — change two things and you learn nothing from the result.
+5. **Isolate the root cause.** Trace from symptom to the actual defect. Confirm it explains *all* the observed evidence, not just the loudest symptom. If your fix wouldn't explain every data point from step 2, you haven't found the cause yet.
+6. **Fix at the root, verify red → green.** Apply the minimal fix at the cause. Re-run the step-1 reproduction: it must go from failing to passing. No green reproduction, no fix.
+7. **Regression test (real data, no mocks).** Add a test that fails before the fix and passes after, in the toolu layout — see the `test` skill (TS `__tests__/`, Rust `tests/`). This is what stops the bug coming back.
+8. **Record.** Save the bug to comemory so the next encounter is a hit, not a re-investigation:
+   `comemory.sh save "<symptom>" "Root cause: <cause>. Fix: <what changed + path>." --kind bug`
+
+**Failed twice? Stop.** If two distinct attempts on the same hypothesis both failed, the hypothesis is wrong — return to step 2, gather more evidence, form a new one. Retrying a third time is how you burn a session.
+
+## Evidence helpers (the Observe step)
+
+Three language-agnostic collectors turn raw failure output into a compact, capped summary so Observe doesn't flood context. Each reads stdin or `--file <path>`, takes `--json`, and degrades to a capped raw passthrough on input it doesn't recognize. Caps are env-overridable (`DEBUG_MAX_*`).
+
+- `plugins/toolu/scripts/debug-testfail.sh` — failing-test transcript → failed test names, error/assertion lines, code `file:line` locations. `bun test out.txt | debug-testfail.sh` or `cargo test 2>&1 | debug-testfail.sh`.
+- `plugins/toolu/scripts/debug-stack.sh` — stack trace / backtrace → app frames first, framework/runtime frames collapsed.
+- `plugins/toolu/scripts/debug-log.sh` — large log → deduped error/warn lines + a tail, hard-capped in lines and bytes.
+
+Use them to *seed* the investigation; they observe, they don't diagnose.
+
+## Sentry adapter (opt-in, best-effort)
+
+When the bug originates from a Sentry issue and the Sentry MCP is authenticated, you can pull the event to seed Reproduce + Observe:
+
+1. The Sentry MCP's fetch tools only appear **after** OAuth — discover them at runtime with `ToolSearch` (e.g. query `+Sentry issue event`); do not assume tool names. If only `mcp__claude_ai_Sentry__authenticate` is present, the user hasn't connected it.
+2. Fetch the issue/event the user names (URL or short-id), extract the exception + stack + breadcrumbs, pipe the stack through `debug-stack.sh`, then proceed from Observe.
+3. **If Sentry is unavailable, unauthed, or exposes no fetch tool:** say so in one line ("Sentry unavailable, proceeding manually") and continue — ask the user to paste the stack/error. The loop never depends on Sentry.
+
+## Return to the chain
+
+A debug session ends by handing back: the fix re-enters `execution`, uses `test` to write and confirm the regression evidence, then completes execution's local readiness checks and authorized PR handoff. Don't call the work done from inside the loop — a fix without a regression test and a green gate isn't done.

package/plugins/toolu/skills/debug/evals/README.md

@@ -0,0 +1,17 @@
+# debug — trigger eval
+
+A held-out eval of whether the `debug` skill's `description` reliably routes the right prompts to it (spec acceptance criterion 1: 100% positive recall, 0 false-positives).
+
+## Method
+
+1. `cases.json` — 18 labeled prompts (12 positives that should fire `debug`, 6 negatives that belong to other skills: feature build, design review, writing new tests, mechanical refactor, research, explanation).
+2. A **router judge** is given ONLY the skill's frontmatter `description` (the real selection signal — not the body) plus each prompt, with no gold labels, and predicts fire/no-fire.
+3. Predictions are scored against the gold labels → precision, recall, F1 (`results.json`).
+
+This is an **LLM-judged** gate: `results.json` is a snapshot, and re-runs may vary slightly. To regenerate, re-run the router judge over `cases.json` prompts (judge sees the description only) and re-score.
+
+## Latest result
+
+precision 1.0, recall 1.0, F1 1.0 (tp 12, fp 0, fn 0, tn 6) — see `results.json`.
+
+Negatives confirm the boundary holds: feature work ("add a dark mode toggle"), design review, writing tests for new code (vs. fixing a break), refactors, version lookups, and "summarize this module" all correctly route away from `debug`. The split is deliberately clean; the value is the negative boundary against the adjacent `test` and `design-review` skills.

package/plugins/toolu/skills/debug/evals/cases.json

@@ -0,0 +1,24 @@
+{
+  "skill": "debug",
+  "method": "Held-out trigger eval. A judge sees ONLY the skill's frontmatter `description` (the real selection signal) plus the prompt, and predicts whether the debug skill should fire. Predictions are scored against the `expected` gold labels below → precision/recall. Bar: 100% positive recall, 0 false-positives. LLM-judged, so a results snapshot may vary slightly between runs.",
+  "cases": [
+    {"id": "p1",  "prompt": "why does this test keep failing?", "expected": true},
+    {"id": "p2",  "prompt": "the app crashes on startup, help me figure out why", "expected": true},
+    {"id": "p3",  "prompt": "this test is flaky — sometimes passes, sometimes fails", "expected": true},
+    {"id": "p4",  "prompt": "debug this stack trace for me", "expected": true},
+    {"id": "p5",  "prompt": "find the root cause of this null pointer exception", "expected": true},
+    {"id": "p6",  "prompt": "it worked before my last commit, now it's broken", "expected": true},
+    {"id": "p7",  "prompt": "the API returns a 500, track down why", "expected": true},
+    {"id": "p8",  "prompt": "wrong output: expected 5 but got -1, what's going on?", "expected": true},
+    {"id": "p9",  "prompt": "there's a memory leak somewhere, help me find it", "expected": true},
+    {"id": "p10", "prompt": "this function returns undefined and I can't tell why", "expected": true},
+    {"id": "p11", "prompt": "production threw this error overnight, what's the root cause?", "expected": true},
+    {"id": "p12", "prompt": "my cargo test panics with index out of bounds", "expected": true},
+    {"id": "n1",  "prompt": "add a dark mode toggle to the settings page", "expected": false},
+    {"id": "n2",  "prompt": "review this login screen for design quality", "expected": false},
+    {"id": "n3",  "prompt": "write tests for the new payment module", "expected": false},
+    {"id": "n4",  "prompt": "rename the getUser function to fetchUser across the repo", "expected": false},
+    {"id": "n5",  "prompt": "what's the latest version of the Anthropic SDK?", "expected": false},
+    {"id": "n6",  "prompt": "summarize what this module does", "expected": false}
+  ]
+}

package/plugins/toolu/skills/debug/evals/results.json

@@ -0,0 +1,34 @@
+{
+  "skill": "debug",
+  "generated_at": "2026-06-18",
+  "judge": "LLM router judge given the skill description only (no gold labels). Snapshot — LLM-judged, re-runs may vary slightly.",
+  "n": 18,
+  "positives": 12,
+  "negatives": 6,
+  "confusion": { "tp": 12, "fp": 0, "fn": 0, "tn": 6 },
+  "precision": 1,
+  "recall": 1,
+  "f1": 1,
+  "threshold": 0.9,
+  "pass": true,
+  "predictions": [
+    { "id": "p1",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p2",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p3",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p4",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p5",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p6",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p7",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p8",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p9",  "expected": true,  "fire": true,  "correct": true },
+    { "id": "p10", "expected": true,  "fire": true,  "correct": true },
+    { "id": "p11", "expected": true,  "fire": true,  "correct": true },
+    { "id": "p12", "expected": true,  "fire": true,  "correct": true },
+    { "id": "n1",  "expected": false, "fire": false, "correct": true },
+    { "id": "n2",  "expected": false, "fire": false, "correct": true },
+    { "id": "n3",  "expected": false, "fire": false, "correct": true },
+    { "id": "n4",  "expected": false, "fire": false, "correct": true },
+    { "id": "n5",  "expected": false, "fire": false, "correct": true },
+    { "id": "n6",  "expected": false, "fire": false, "correct": true }
+  ]
+}

package/plugins/toolu/skills/deep-research/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: deep-research
+description: "Use when the ask is deep research that must end in a multi-source cited report — tells: \"deep research\", \"research report\", \"cited report\", \"survey the state of the art\", \"investigate thoroughly\". Picks guiding questions, then fans out per-question researchers combining exa-search and context7. NOT for quick single-fact or API lookups — the research-agent subagent handles those internally — and NOT for local codebase questions (the deep-explore subagent). Standalone knowledge workflow — not part of the build chain."
+---
+
+# Deep Research
+
+A standalone knowledge workflow — outside the build chain; its reports can feed `brainstorm` or `spec`. It exists because the expensive failure in research is not weak sources — it is aiming a whole fan-out at a misunderstood question. So the target is written down first, then the pipeline spends tokens. Do not wait for approval.
+
+Use the mandatory [Jev workflow](../../workflows/semantic-judgments.md) to rank
+retrieved excerpts, detect no answer, and judge claim/source support. Verify quotes and provenance with tools.
+
+## When this fires
+
+The user wants a real research deliverable: multi-source, verified, cited. Not a quick fact or API lookup — that stays with `research-agent` — and not a question about this codebase — that is `deep-explore`'s job. Every run is multi-agent by design; if the fan-out isn't warranted, the ask wasn't deep research.
+
+## How to run it
+
+Four phases, driven from the main thread. Workers run on sonnet, synthesis stays on the frontier tier — rubric: `plugins/toolu/skills/orchestrator/references/model-routing.md`.
+
+1. **Target (main thread).** Restate the topic in one sentence. Decompose it into guiding questions with sub-questions — 5 is the typical fan-out, 7 the hard cap (the orchestrator skill's parallel-agent guardrail is the reason). Name the assumptions and what is out of scope. Print the numbered question set, then run it immediately without waiting for approval. Do not open the host mapping's user-choice interface ([host-mapping.md](../../workflows/host-mapping.md)).
+2. **Research fan-out.** One `research-agent` (sonnet) per question, launched in parallel. Each researcher combines both engines per its routing table — `context7` for library/API/docs-shaped questions, `exa-search` for general web, topics, and URL crawls — with native fallback inherited. Override the agent's default depth per call: ask for a 10–15 sentence synthesis, up to 8 sources, and `Claim → source URL` pairs for the 2–3 load-bearing claims.
+3. **Verification wave.** One `research-agent` (sonnet) per finding set, prompted as an adversarial verifier: re-crawl up to 2 cited URLs per load-bearing claim (exa-search, native fallback) and return a per-claim verdict — confirmed / unsupported / source-unreachable. Unsupported claims are dropped or flagged in the report — never silently kept. If every researcher answered from training knowledge only (`Tools used: none`), skip the wave — nothing is crawlable — and banner the report "unverified — no live sources".
+4. **Synthesis + delivery (main thread).** Merge the verified findings into the report format below, write it under `docs/research/`, and give the user a TLDR in chat.
+
+**Failure semantics** — nothing fails silently: a researcher or verifier that returns nothing, errors, or is killed renders its section as `⚠ no findings returned` and is named as degraded in Reliability notes — never silently dropped, no automatic retry. Worst-case fan-out: 7 researchers + 7 verifiers = 14 subagents; typical ~10.
+
+## Report format
+
+Destination `docs/research/<slug>.md` — kebab-case slug from the topic. Create the directory if absent. On collision append a numeric suffix (`<slug>-2.md`); never overwrite an existing report unless the user explicitly asks.
+
+```markdown
+# <Topic>: Research Report
+
+> Date: <YYYY-MM-DD> · Questions: <n> · Scope: <one line>
+
+## TL;DR
+<the answer in ≤5 bullets>
+
+## <Guiding question 1>
+<verified synthesis; flagged claims marked ⚠ unverified>
+
+## Sources
+- <title> — <url>
+
+> Reliability notes: <per-claim verdicts; degraded workers; the unverified banner if no live sources were reachable>
+```
+
+## What "done" looks like
+
+A report at `docs/research/<slug>.md` with a TL;DR, one section per guiding question, real source URLs, and Reliability notes carrying the verification verdicts — plus the TLDR in chat. If targeting produced zero questions, "done" is: nothing ran and nothing was written.

package/plugins/toolu/skills/execution/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: execution
+description: Use when you have a reviewed plan to implement and, when delivery is authorized, carry verified changes through a PR handoff. Drives the plan step by step with evidence checkpoints and respects the quality gate. Native toolu workflow: spec → spec-review → plan → plan-review → execution → pr-babysit.
+---
+
+# Execution
+
+The execution phase comes after `plan-review`. It carries out a reviewed plan with discipline: small steps, evidence before claims, and no skipped gate. `brainstorm` is optional upstream triage when the shape is not settled; `test` is the execution-time method for producing high-signal evidence, not a final workflow phase.
+
+**Trigger phrases:** execute the plan, implement this, start building, work through the plan.
+
+## Precondition
+
+A reviewed plan exists (`plan` + `plan-review` ran for non-trivial work). If there's no plan, write one first; if the plan hasn't been pressure-tested, run `plan-review` before sinking time into code built on a shaky plan.
+
+## Loop (per step)
+
+Use the mandatory [Jev workflow](../../workflows/semantic-judgments.md) to triage
+evidence, including local review. Correctness requires the checks below.
+
+For ledger-tracked work, **before the first step** run `bash plugins/toolu/hooks/lib/plan-ledger.sh preflight` — it refuses to start unless the plan is `Approved` and its declared spec (if any) is `Approved`. Then read progress with `bash plugins/toolu/hooks/lib/plan-ledger.sh status` to find the next non-fresh-green step, do the loop below for it, then record it with `bash plugins/toolu/hooks/lib/plan-ledger.sh run <plan_doc> --step <id>` — the engine requires the plan-doc positional arg, and stamps green from mechanical truth, you cannot claim it. On plan deviation, edit the steps block and note it under `## Deviations`, then re-run. Re-run any stale step (a `green` step whose diff has since changed) before calling the plan done. `status` also prints an AC-coverage report (report-only): read it to confirm every spec `AC-<n>` is covered by a fresh-green step — an uncovered AC is surfaced, not yet a push blocker, but it means the goal isn't proven done.
+
+1. **Take one step** from the plan — the smallest shippable unit.
+2. **Produce per-step real-data evidence** (use `test`) — map the relevant AC or risk to a representative real input/fixture, observable result, applicable boundary/failure case, and runner command. For a bugfix, reproduce first; record the passing output before the ledger step is stamped green.
+3. **Handle errors in code, never suppress them.** Every fallible call gets a real handler — propagate (`?`, rethrow), match, or convert; never swallow, never silence with a disable comment (`@ts-ignore`, `eslint-disable`, `#[allow]`). The gate enforces this on every edit; write it right the first time.
+4. **Land it clean.** A PostToolUse quality gate runs on every TS/Rust edit. If it reports a violation the gate goes **failing** and blocks further edits until fixed — fix immediately; do not pile on more changes.
+5. **Verify, don't assume.** Run the command, read the output. "Done" requires evidence (test pass, log, runtime check), never a guess.
+6. **Checkpoint** with the user at meaningful boundaries, or after each independent workstream.
+
+## Rules
+
+- **Global gate** — do NOT move to the next step while any error/warning/test failure stands, even in unrelated files.
+- **Delegate to stay compact** — push exploration, large reads, and parallelizable work to subagents; keep the main context lean.
+- **Delegate at the step's tier** — `status` prints `model=<alias>` for the next step when the plan declared one; hand that step to a subagent on that model (`toolu:quick-task` / `toolu:implementer` / `toolu:architect`, or an explicit `model:`). No declared tier, or a step that turns out harder than planned? Fall back to the rubric and escalate one tier rather than retrying the same tier: `plugins/toolu/skills/orchestrator/references/model-routing.md`.
+- **No scope creep** — do only what the plan calls for. New needs go back to `plan` (and `plan-review`), not into this step.
+- **Honor the layout** — files named after their export, one responsibility each, under the line limit, docs present and concise.
+- **Docs in sync** — when a step changes a user-facing surface (behavior, interfaces, CLI flags, commands, config), update the prose docs that describe it (README, `docs/` guides, `SKILL.md` triggers, release notes) in the same step; it's part of "done", not a follow-up.
+- **Same approach failed twice? Stop.** Change the hypothesis (`systematic-debugging`), don't retry harder.
+
+## What "done" looks like
+
+Working, verified increments that match the plan, with real error handling and per-step real-data evidence, landed under a green gate. Execution owns the final local review; do not hand work to a separate review or terminal-test phase.
+
+## Authorized delivery preflight
+
+Only perform delivery when the user's request includes delivery authorization.
+Before committing, pushing, creating a PR, or starting a durable babysitting
+goal, check every prerequisite and stop before delivery with the exact unmet
+prerequisite if any applies:
+
+- delivery authorization is absent;
+- GitHub auth is unavailable (`gh auth status` fails);
+- the current branch is the repository default branch, detached, or otherwise not a non-default branch;
+- the optional `pr-babysit` plugin is not installed and its `$pr-babysit:babysit` skill is unavailable.
+
+When the per-step direct checks, documentation work, and prerequisites pass,
+commit the scoped changes using the repository's conventions. Do not include
+unrelated work.
+
+## Local release-readiness audit
+
+After that scoped commit and before pushing, establish all of the following
+against the committed branch diff with command output, not assertion:
+
+1. Re-run each affected step's real-data runner and ensure its AC/risk evidence is current. Read `plan-ledger.sh status` and resolve every missing or stale AC coverage entry.
+2. Run `bash plugins/toolu/hooks/lib/plan-ledger.sh run <plan_doc> --verify`. This is the supported branch-wide verification command: it validates every step against the final diff and stamps the ledger only when all steps are fresh-green.
+3. Confirm user-facing documentation is synchronized for every changed behavior, interface, CLI, command, or configuration surface. Treat a missing applicable doc update as a blocker.
+4. Run `$toolu-review:review` (or the host's installed `toolu-review:review` invocation) against the committed branch diff. Its resulting push-review state must be v2 (`version: 2`) and cover every changed file; open findings or stale/incomplete coverage are blockers.
+5. Run `bash plugins/toolu/hooks/lib/verdict.sh status`. Advance only when it reports `overall: green`; quality, plan, review, and docs must each be green.
+
+## PR delivery
+
+When the committed-diff audit and every prerequisite pass:
+
+1. Push the non-default feature branch to its configured remote.
+2. Discover the repository default branch, then locate or create a pull request for the current branch targeting that repository default branch. Verify that PR's number and head/base branches.
+3. Invoke `$pr-babysit:babysit` with no arguments. The verified execution handoff plus this delivery authorization is sufficient authorization for its durable PR-clearing goal; do not add a handoff argument or weaken its isolated-worktree, strict-clearance, or durable-goal rules.