@webpresso/codex-plugin 3.1.12 → 3.1.14

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-kit",
-  "version": "3.1.12",
+  "version": "3.1.14",
   "description": "Webpresso agent-kit: blueprints, skills, hooks, and MCP server",
   "author": {
     "name": "Webpresso",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/codex-plugin",
-  "version": "3.1.12",
+  "version": "3.1.14",
   "private": false,
   "description": "Codex plugin adapter for Webpresso agent-kit skills, hooks, and MCP runtime.",
   "homepage": "https://github.com/webpresso/agent-kit#readme",

package/plugin-skill-ownership.json

@@ -2,15 +2,15 @@
   "schemaVersion": 1,
   "host": "codex",
   "packageName": "@webpresso/codex-plugin",
-  "packageVersion": "3.1.12",
-  "runtimeDirs": [
-    ".codex/skills",
-    ".agents/skills"
-  ],
+  "packageVersion": "3.1.14",
+  "runtimeDirs": [".codex/skills", ".agents/skills"],
   "skills": {
     "autopilot": {
       "digest": "sha256:7fc1fe9f5fb5b8a3e755f8e3ac4b807e4f140288544ffcf39e4cbfdea984014d"
     },
+    "autoresearch": {
+      "digest": "sha256:b4d51cd53beb4a3271827172dfbd0b1d27bd58761ca07a35d49a5d6324b87fdf"
+    },
     "best-practice-research": {
       "digest": "sha256:b0d355c7f4afe9c38be83e293788bf582bea068c1db2fa5c45400441e315735d"
     },
@@ -18,10 +18,10 @@
       "digest": "sha256:21fd24862e7f7c8a1feadea6bc376492b136b99fc381cf1b8927c9db80615431"
     },
     "claude": {
-      "digest": "sha256:b75a472594d78bd9452c07fd791a426864848a2c9c726454dc72daf3813ae22b"
+      "digest": "sha256:2af483ef80c5e0cf3d6d3da94d54b5bd1e9cecc9b2bd05e085499c2745c2c238"
     },
     "codex": {
-      "digest": "sha256:803cea9c1b37406d7bdc8e44e9d5e9f3988218277500d8d6cb0d955c933c3302"
+      "digest": "sha256:e8289cb51d023d8b20c1bfb2e349ee89c4d04cdfd5a03c7681328b3e60aab554"
     },
     "deep-research": {
       "digest": "sha256:01dafd194066a2936db0b437fd5c3beef6d7ff82478d0d995393093d89496f18"
@@ -45,7 +45,7 @@
       "digest": "sha256:a80fbacc765e8b886437b9fdf7dd71e1ceb1b98b939078ec90fc88d06a8b4c69"
     },
     "opencode-go": {
-      "digest": "sha256:ccb2bcf09cc1c5c0d54027b84f580e688f5f5cf624e6cdc19870bd3ce99940fc"
+      "digest": "sha256:8bbfad8273c526c563ceef3c8b98efbc60c3b24dc6b0a2a25d8efd9e83788860"
     },
     "plan-ceo-review": {
       "digest": "sha256:4d426158518dd71f8998770e8d4037bcbfa3c65d7265a93a4a78a9b015ba881e"
@@ -62,6 +62,12 @@
     "plan-refine": {
       "digest": "sha256:891e84ff8592b8489b59e8642f6a602c9558fd57edd171af98499c94e2f62f13"
     },
+    "ralplan": {
+      "digest": "sha256:db285d477f43ed23df990d4c03750d9916cdc7809356c1bf025efdf6a9add9ed"
+    },
+    "team": {
+      "digest": "sha256:151ef81df917435073a2d7b41173d33c45cb8aa1e5fdf34a70043bb3a2e746ff"
+    },
     "tech-debt": {
       "digest": "sha256:8b1f30e55ec6e5ab185ff19ecf15384438dbd619f675c2c65f2e53cedecbae5c"
     },
@@ -72,7 +78,7 @@
       "digest": "sha256:bed3684a850651534f315d355cdeae50d951c429817df0f105cccdb7f4e1561b"
     },
     "verify": {
-      "digest": "sha256:b088b138a985f94e29970edac1bcae70b29b15b5b3573787652ad590b789c9c7"
+      "digest": "sha256:ce0dd3a77508d1bf11c805dec2de04e75b689201d376b2ff0fa957604d584500"
     }
   }
-}
+}

package/skills/autoresearch/SKILL.md

@@ -0,0 +1,49 @@
+---
+type: skill
+slug: autoresearch
+title: Autoresearch
+status: active
+scope: repo
+applies_to: [agents]
+related: [deep-research, best-practice-research, plan-refine, verify]
+created: "2026-07-13"
+last_reviewed: "2026-07-13"
+name: autoresearch
+description: "Artifact-gated research loop with explicit validation."
+argument-hint: "<research mission and validator>"
+---
+
+# Autoresearch
+
+Use when the user wants research to continue until a concrete validator accepts the result. This is for bounded research deliverables, not quick factual lookup or ordinary planning context.
+
+## Boundary
+
+- Use `deep-research` for one-pass citation-backed reports.
+- Use `best-practice-research` for focused upstream guidance.
+- Use `autoresearch` when completion depends on an explicit evaluator, benchmark, review rubric, or acceptance artifact.
+
+## Workflow
+
+1. Define the research mission, output artifact path, validator, and stop condition.
+2. Choose one validation mode:
+   - command validator: a repo command or script must pass and write the result.
+   - review validator: an independent review must approve the produced artifact against the mission.
+3. Create or update the durable research artifact before iterating.
+4. Gather sources and repo context until the artifact addresses the mission and cites material claims.
+5. Run the validator. If it fails, preserve the failure evidence, revise the artifact, and repeat.
+6. Stop only when the validator passes or a blocker prevents more evidence-gathering.
+
+## Output
+
+Return:
+
+- mission
+- artifact path
+- validation mode
+- validator command or review rubric
+- evidence gathered
+- pass/fail result
+- remaining gaps or blocker
+
+Do not treat elapsed turns, model confidence, or a draft report as completion evidence. Completion requires the declared validator to pass.

package/skills/claude/SKILL.md

@@ -57,7 +57,7 @@ Claude's managed native subagent lifecycle does not provide a reliable parent-li
 
 Use single-file / single-question first for any non-trivial diff. Do not send a whole PR unless it already fits within the bounded payload below.
 
-**Model policy:** default to `sonnet` via `CLAUDE_REVIEW_MODEL=${CLAUDE_REVIEW_MODEL:-sonnet}`. Override to `opus` only when the review is approval evidence or the user explicitly asks for Opus. Never use `fable` for Claude outside-voice review. Any review used as blueprint approval evidence MUST run with Claude Opus and record `"model": "opus"`.
+**Model policy:** default to the moving `opus` alias via `CLAUDE_REVIEW_MODEL=${CLAUDE_REVIEW_MODEL:-opus}`. Never use `fable` for Claude outside-voice review. Any review used as blueprint approval evidence MUST run with Claude Opus and record `"model": "opus"`.
 
 #### Bounded prompt payload
 
@@ -95,7 +95,7 @@ TARGET_FILE=${TARGET_FILE:?set TARGET_FILE to one changed file}
 Run both the availability probe and the full review through the typed `wp review run` owner. Skills must not embed subprocess supervision. The runtime consumes Claude's streaming JSON events, advances its idle clock only on monotonic semantic progress, and has no total wall-clock cutoff.
 
 ```bash
-CLAUDE_REVIEW_MODEL=${CLAUDE_REVIEW_MODEL:-sonnet}
+CLAUDE_REVIEW_MODEL=${CLAUDE_REVIEW_MODEL:-opus}
 CLAUDE_REVIEW_EFFORT=${CLAUDE_REVIEW_EFFORT:-medium}
 CLAUDE_REVIEW_PROBE_IDLE_SECONDS=${CLAUDE_REVIEW_PROBE_IDLE_SECONDS:-180}
 CLAUDE_REVIEW_IDLE_SECONDS=${CLAUDE_REVIEW_IDLE_SECONDS:-180}
@@ -104,7 +104,8 @@ PROBE_FILE=$(mktemp -t wp-claude-probe.XXXXXX)
 trap 'rm -f "$PROMPT_FILE" "$PROBE_FILE"' EXIT
 printf 'Reply exactly CLAUDE_OK.\n' >"$PROBE_FILE"
 
-wp review run \
+CLAUDE_REVIEW_CODE=0
+if wp review run \
   --provider claude \
   --prompt-file "$PROBE_FILE" \
   --model "$CLAUDE_REVIEW_MODEL" \
@@ -112,17 +113,20 @@ wp review run \
   --stage probe \
   --expected-marker CLAUDE_OK \
   --artifact-root "$CLAUDE_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$CLAUDE_REVIEW_PROBE_IDLE_SECONDS"
-
-wp review run \
-  --provider claude \
-  --prompt-file "$PROMPT_FILE" \
-  --model "$CLAUDE_REVIEW_MODEL" \
-  --effort "$CLAUDE_REVIEW_EFFORT" \
-  --stage review \
-  --artifact-root "$CLAUDE_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$CLAUDE_REVIEW_IDLE_SECONDS"
-CLAUDE_REVIEW_CODE=$?
+  --idle-seconds "$CLAUDE_REVIEW_PROBE_IDLE_SECONDS"; then
+  wp review run \
+    --provider claude \
+    --prompt-file "$PROMPT_FILE" \
+    --model "$CLAUDE_REVIEW_MODEL" \
+    --effort "$CLAUDE_REVIEW_EFFORT" \
+    --stage review \
+    --artifact-root "$CLAUDE_REVIEW_ARTIFACT_ROOT" \
+    --idle-seconds "$CLAUDE_REVIEW_IDLE_SECONDS"
+  CLAUDE_REVIEW_CODE=$?
+else
+  CLAUDE_REVIEW_CODE=$?
+  echo "Claude preflight failed; full review not started." >&2
+fi
 ```
 
 After the review runtime exits, emit its terminal state using the same artifact path:

package/skills/codex/SKILL.md

@@ -56,16 +56,45 @@ Codex native subagent events are not currently parent-linked in the managed life
 
 1. Capture the current branch, base branch, and `git diff --stat`.
 2. Write a concise prompt asking Codex to find correctness, security, data-loss, and maintainability risks.
-3. Run Codex non-interactively in read-only mode:
+3. Run Codex through the typed review runtime in read-only mode:
 
 ```bash
+CODEX_REVIEW_MODEL=${CODEX_REVIEW_MODEL:-gpt-5.4}
 CODEX_REVIEW_EFFORT=${CODEX_REVIEW_EFFORT:-medium}
 case "$CODEX_REVIEW_EFFORT" in
   medium|high) ;;
   *) echo "CODEX_REVIEW_EFFORT must be one of: medium, high" >&2; exit 2 ;;
 esac
+CODEX_REVIEW_PROBE_IDLE_SECONDS=${CODEX_REVIEW_PROBE_IDLE_SECONDS:-180}
+CODEX_REVIEW_IDLE_SECONDS=${CODEX_REVIEW_IDLE_SECONDS:-180}
+CODEX_REVIEW_ARTIFACT_ROOT=${CODEX_REVIEW_ARTIFACT_ROOT:-"$(pwd)/.webpresso/reviews"}
+PROBE_FILE=$(mktemp -t wp-codex-probe.XXXXXX)
+trap 'rm -f "$PROMPT_FILE" "$PROBE_FILE"' EXIT
+printf 'Reply exactly CODEX_OK.\n' >"$PROBE_FILE"
+
 CODEX_REVIEW_CODE=0
-codex exec -c model_reasoning_effort="\"$CODEX_REVIEW_EFFORT\"" --sandbox read-only --cd "$PWD" - <"$PROMPT_FILE" || CODEX_REVIEW_CODE=$?
+if wp review run \
+  --provider codex \
+  --prompt-file "$PROBE_FILE" \
+  --model "$CODEX_REVIEW_MODEL" \
+  --effort "$CODEX_REVIEW_EFFORT" \
+  --stage probe \
+  --expected-marker CODEX_OK \
+  --artifact-root "$CODEX_REVIEW_ARTIFACT_ROOT" \
+  --idle-seconds "$CODEX_REVIEW_PROBE_IDLE_SECONDS"; then
+  wp review run \
+    --provider codex \
+    --prompt-file "$PROMPT_FILE" \
+    --model "$CODEX_REVIEW_MODEL" \
+    --effort "$CODEX_REVIEW_EFFORT" \
+    --stage review \
+    --artifact-root "$CODEX_REVIEW_ARTIFACT_ROOT" \
+    --idle-seconds "$CODEX_REVIEW_IDLE_SECONDS"
+  CODEX_REVIEW_CODE=$?
+else
+  CODEX_REVIEW_CODE=$?
+  echo "Codex preflight failed; full review not started." >&2
+fi
 ```
 
 4. Summarize findings with severity, evidence, and whether you independently verified them.

package/skills/opencode-go/SKILL.md

@@ -82,7 +82,7 @@ PROBE_FILE=$(mktemp -t wp-opencode-go-probe.XXXXXX)
 trap 'rm -f "$PROMPT_FILE" "$PROBE_FILE"' EXIT
 printf 'Reply exactly OPENCODE_GO_OK.\n' >"$PROBE_FILE"
 
-wp review run \
+if ! wp review run \
   --provider opencode \
   --prompt-file "$PROBE_FILE" \
   --model "$MODEL" \
@@ -90,7 +90,10 @@ wp review run \
   --stage probe \
   --expected-marker OPENCODE_GO_OK \
   --artifact-root "$OPENCODE_GO_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$OPENCODE_GO_PROBE_IDLE_SECONDS"
+  --idle-seconds "$OPENCODE_GO_PROBE_IDLE_SECONDS"; then
+  echo "OpenCode Go preflight failed; full review not started." >&2
+  exit 1
+fi
 
 wp review run \
   --provider opencode \
@@ -103,4 +106,4 @@ wp review run \
 ```
 
 If `$MODEL` is empty, run `opencode models opencode-go` and choose a present reviewer.
-Treat `true-idle`, `protocol-unsupported`, provider failure, abort, spawn failure, or artifact failure as unavailable review evidence. Never replace them with a static timeout, arbitrary byte-growth heartbeat, or buffered-output fallback.
+Treat a provider-wide usage limit as terminal for every OpenCode Go model in the current review; do not fall back to another family. Treat `true-idle`, `protocol-unsupported`, provider failure, abort, spawn failure, or artifact failure as unavailable review evidence. Never replace them with a static timeout, arbitrary byte-growth heartbeat, or buffered-output fallback.

package/skills/ralplan/SKILL.md

@@ -0,0 +1,50 @@
+---
+type: skill
+slug: ralplan
+title: Ralplan Consensus Planning
+status: active
+scope: repo
+applies_to: [agents]
+related: [plan-refine, plan-eng-review, plan-ceo-review, plan-design-review, plan-devex-review]
+created: "2026-07-13"
+last_reviewed: "2026-07-13"
+name: ralplan
+description: "Consensus planning gate for plan-refine"
+---
+
+# Ralplan Consensus Planning
+
+Use when the user invokes `$ralplan`, asks for RALPLAN, or wants consensus planning before execution.
+
+`ralplan` is an agent-kit planning gate, not an implementation lane. It applies consensus review to a durable plan before execution starts.
+
+## Workflow
+
+1. Create or identify the durable blueprint or plan artifact that will own the work.
+2. Run the `plan-refine` methodology against that artifact: verify local code facts, verify external claims when relevant, sharpen acceptance criteria, split independent work, and lock verification gates.
+3. Apply the relevant review lenses before execution:
+   - `plan-eng-review` for architecture, sequencing, tests, and rollout risk.
+   - `plan-ceo-review` when scope, customer value, or sequencing tradeoffs matter.
+   - `plan-design-review` when UI/UX is material.
+   - `plan-devex-review` when docs, CLI/API ergonomics, onboarding, or migration risk is material.
+4. Consolidate the reviews into one decision record with:
+   - decision and drivers
+   - alternatives considered
+   - material corrections
+   - implementation tasks and dependencies
+   - verification gates
+   - residual risks or blockers
+5. Stop at an approved plan or an explicit blocker. Do not edit implementation code from this skill unless the user explicitly changes the task from planning to execution.
+
+## Output
+
+Return a concise consensus plan with:
+
+- verdict: ready / ready with edits / blocked
+- decision and rationale
+- accepted review findings
+- task breakdown
+- required verification
+- recommended execution lane, usually `goal` for durable sequential work or `autopilot` for the full autonomous pipeline
+
+Use `plan-refine` as the detailed checklist source of truth when deeper plan surgery is needed.

package/skills/team/SKILL.md

@@ -0,0 +1,60 @@
+---
+type: skill
+slug: team
+title: Team
+status: active
+scope: repo
+applies_to: [agents]
+related: [autopilot, goal, plan-refine, verify]
+created: "2026-07-13"
+last_reviewed: "2026-07-13"
+name: team
+description: "Coordinate multiple dashboard-backed agent sessions on one task."
+argument-hint: "<brief|role plan>"
+---
+
+# Team
+
+Use `team` when the work needs coordinated parallel lanes with a leader-owned
+task list, explicit handoffs, and independent verification. Prefer native
+subagents for small bounded lookups; use `team` when the parallel work should be
+visible, durable, and operator-controllable from `wp dash`.
+
+## Protocol
+
+1. Start from a grounded brief or an approved blueprint. If scope is vague, run
+   `plan-refine` first and define task lanes, shared files, and verification.
+2. Open or reuse `wp dash` and launch the provider sessions needed for the
+   lanes. Direct `wp claude`, `wp codex`, and `wp opencode` commands are
+   expected to enter the dashboard in interactive terminals.
+3. Assign one owner per lane. Include the task, allowed files or surfaces,
+   expected output, verification command, and blocker-report rule.
+4. Keep one lane or leader pass responsible for integration and evidence.
+   Workers report findings, patches, tests, and unresolved risks; they do not
+   self-approve or mark blueprint tasks complete.
+5. Integrate only after checking shared-file conflicts, updated assumptions,
+   and verification evidence. Use `wp_blueprint_task_verify` for task completion
+   when a blueprint owns the work.
+6. Stop when every lane is complete, cancelled, or explicitly blocked and the
+   leader has recorded verification evidence.
+
+## Coordination Rules
+
+- Use a single source of truth for assignments: the blueprint, goal handoff, or
+  leader-maintained task list.
+- Require ACK-style lane starts for shared files, dependency boundaries, or
+  handoffs.
+- Reassign or narrow blocked lanes instead of letting work drift.
+- Escalate changed assumptions before widening scope.
+- Never bypass review provenance, push to main, self-approve, or increase
+  timeouts to hide coordination failures.
+
+## Output
+
+Report:
+
+- lane roster and ownership
+- files or surfaces touched by each lane
+- integration decisions and conflicts resolved
+- verification commands and results
+- remaining blockers or risks

package/skills/verify/SKILL.md

@@ -7,14 +7,10 @@ scope: repo
 applies_to: [agents]
 related: [testing-philosophy, tph]
 created: "2026-05-07"
-last_reviewed: "2026-07-03"
+last_reviewed: "2026-07-13"
 name: verify
 description: "Post-implementation quality gate: run checks, TPH audit, cleanup, docs, proof."
 argument-hint: "<target> [--full] where target is: package|file|plan-slug|all"
-hooks:
-  Stop:
-    - command: wp audit agents
-      timeout: 20
 ---
 
 # Verify