@webpresso/plugin-codex 0.0.15 → 0.0.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.codex-plugin/plugin.json +1 -1
- package/.mcp.json +1 -1
- package/package.json +1 -1
- package/plugin-skill-ownership.json +18 -18
- package/skills/autopilot/SKILL.md +16 -16
- package/skills/claude/SKILL.md +11 -6
- package/skills/codex/SKILL.md +11 -6
- package/skills/deep-interview/SKILL.md +13 -13
- package/skills/delivery-program/SKILL.md +4 -4
- package/skills/fix/SKILL.md +18 -18
- package/skills/handoff/SKILL.md +42 -11
- package/skills/hooks-doctor/SKILL.md +1 -1
- package/skills/investigate/SKILL.md +9 -9
- package/skills/opencode-go/SKILL.md +11 -10
- package/skills/plan-refine/SKILL.md +1 -1
- package/skills/ralplan/SKILL.md +1 -1
- package/skills/team/SKILL.md +62 -18
- package/skills/tech-debt/SKILL.md +1 -1
- package/skills/tooling-friction/SKILL.md +11 -11
- package/skills/ultragoal/SKILL.md +52 -57
- package/skills/verify/SKILL.md +45 -42
|
@@ -11,8 +11,8 @@ until independently verified.
|
|
|
11
11
|
|
|
12
12
|
## MCP-only contract
|
|
13
13
|
|
|
14
|
-
- Call `
|
|
15
|
-
- Observe the same durable operation with `
|
|
14
|
+
- Call `review_gate` exactly once for the real plan version or delivery diff.
|
|
15
|
+
- Observe the same durable operation with `review_gate_wait` when needed.
|
|
16
16
|
- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
|
|
17
17
|
- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
|
|
18
18
|
|
|
@@ -25,8 +25,7 @@ until independently verified.
|
|
|
25
25
|
"purpose": "delivery",
|
|
26
26
|
"base_ref": "<full-base-sha>",
|
|
27
27
|
"authority_ref": "<full-head-sha>",
|
|
28
|
-
"
|
|
29
|
-
"model": "opencode-go/deepseek-v4.1-flash",
|
|
28
|
+
"caller_model": "<your own model id, exactly as your host reports it>",
|
|
30
29
|
"repository_access": "none",
|
|
31
30
|
}
|
|
32
31
|
```
|
|
@@ -37,13 +36,15 @@ verdict with no new review and no new round. A partial approval, withheld becaus
|
|
|
37
36
|
is incomplete (not every prior finding was briefed, or a briefed prior claim was marked
|
|
38
37
|
still-open without a matching finding), grants no authority and spends no round.
|
|
39
38
|
|
|
40
|
-
##
|
|
39
|
+
## Reviewer selection
|
|
41
40
|
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
credential store
|
|
41
|
+
Pass `caller_model` with your OWN model id, exactly as your host reports it, and omit
|
|
42
|
+
`provider`, `model`, and `effort`: the gate selects the reviewer route itself — a cross-family
|
|
43
|
+
reviewer chosen for capability, current provider limits, and measured daily cost — and reports
|
|
44
|
+
the choice in `policy_selection`. Never name a reviewer model, probe a provider CLI for its
|
|
45
|
+
catalog, or read a credential store to discover models at invocation time; provider catalog
|
|
46
|
+
discovery belongs to the snapshot drift workflow. An operator may still pass an explicit
|
|
47
|
+
`provider`/`model` as a human override; agents must not.
|
|
47
48
|
|
|
48
49
|
## Review quality
|
|
49
50
|
|
|
@@ -77,7 +77,7 @@ Run **1–3 (and relevant review lenses) in parallel** whenever tools allow. Do
|
|
|
77
77
|
4. **Plan-review lenses (skip when the caller already ran them).** Folded `/autoplan`: run relevant CEO/founder, design, engineering, and DevEx lenses **in parallel when independent**; consolidate keep/change/drop, unresolved taste calls, tests, go/no-go.
|
|
78
78
|
- **Skip condition.** If the caller states `plan-* reviews complete for this pass`, do **not** re-run the lenses. `ralplan` runs them before handing off, so re-running them here is duplicated spend, not a second opinion.
|
|
79
79
|
- **Re-entry.** If refinement itself **materially changes scope**, re-run only the affected lens — never the full set — then continue applying.
|
|
80
|
-
- **Re-review rounds.** `catalog/agent/rules/review-methodology-sota.md` Principle 5 sets the delta-anchored adjudication contract subsequent `
|
|
80
|
+
- **Re-review rounds.** `catalog/agent/rules/review-methodology-sota.md` Principle 5 sets the delta-anchored adjudication contract subsequent `review_gate` rounds follow.
|
|
81
81
|
|
|
82
82
|
5. **Blueprint enforcement (max parallel).**
|
|
83
83
|
- Split for independent execution; declare `Depends`; file-conflict CP = 0 per wave; TDD/proof steps; preserve acceptance criteria.
|
package/skills/ralplan/SKILL.md
CHANGED
|
@@ -126,7 +126,7 @@ Rules:
|
|
|
126
126
|
- Apply findings **into the blueprint** after each review (or once after the set if independent).
|
|
127
127
|
- Independent reviews may run in parallel **only when** they do not depend on each other's edits; if eng findings reshape scope, re-run only the affected optional reviews.
|
|
128
128
|
- Optional high-risk challenge: one sequential outside-voice pass (`codex` / `claude` / `opencode-go`) **after** eng review if the user asks or the change is auth / data-loss / public-API sensitive. Never parallel multi-host review.
|
|
129
|
-
- Any formal `
|
|
129
|
+
- Any formal `review_gate` re-review round follows `catalog/agent/rules/review-methodology-sota.md` Principle 5's delta-anchored adjudication contract, not a fresh rediscovery pass.
|
|
130
130
|
|
|
131
131
|
### 5. `/plan-refine` last (always)
|
|
132
132
|
|
package/skills/team/SKILL.md
CHANGED
|
@@ -9,7 +9,7 @@ related: [autopilot, goal, plan-refine, verify, handoff]
|
|
|
9
9
|
created: "2026-07-13"
|
|
10
10
|
last_reviewed: "2026-07-21"
|
|
11
11
|
name: team
|
|
12
|
-
description: "Coordinate multiple
|
|
12
|
+
description: "Coordinate multiple agent work lanes with a leader-owned task list."
|
|
13
13
|
argument-hint: "<brief|role plan>"
|
|
14
14
|
---
|
|
15
15
|
|
|
@@ -18,38 +18,39 @@ argument-hint: "<brief|role plan>"
|
|
|
18
18
|
Use `team` when the work needs coordinated parallel lanes with a leader-owned
|
|
19
19
|
task list, explicit handoffs, and independent verification. Prefer native
|
|
20
20
|
subagents for small bounded lookups; use `team` when the parallel work should be
|
|
21
|
-
visible
|
|
22
|
-
`/goal` (autopilot) when the
|
|
23
|
-
|
|
21
|
+
visible and durable across a larger effort. Use Webpresso Desktop to manage
|
|
22
|
+
interactive provider sessions. Prefer `ultragoal` + `/goal` (autopilot) when the
|
|
23
|
+
work is blueprint-owned and does not need separately managed work lanes.
|
|
24
24
|
|
|
25
25
|
## Tooling map
|
|
26
26
|
|
|
27
|
-
| Need | Prefer
|
|
28
|
-
| --------------------- |
|
|
29
|
-
|
|
|
30
|
-
|
|
|
31
|
-
|
|
|
32
|
-
|
|
|
33
|
-
|
|
|
34
|
-
|
|
|
35
|
-
|
|
|
27
|
+
| Need | Prefer |
|
|
28
|
+
| --------------------- | ------------------------------------------------------------ |
|
|
29
|
+
| Interactive sessions | Webpresso Desktop |
|
|
30
|
+
| Worktree visibility | `wp fleet status`, `fleet_status` |
|
|
31
|
+
| Worktrees | `worktree` per lane |
|
|
32
|
+
| Context-light handoff | `session_context` (required before spawn — no history paste) |
|
|
33
|
+
| Continuity | `session_capture` / `search` / `restore` |
|
|
34
|
+
| Blueprint tasks | `blueprint_task_verify` only for completion |
|
|
35
|
+
| QA | `qa` / targeted `test` / `lint` / `typecheck` |
|
|
36
|
+
| PR | `pr_upsert` / `pr_status` / `pr_wait` |
|
|
36
37
|
|
|
37
38
|
## Protocol
|
|
38
39
|
|
|
39
40
|
1. Start from a grounded brief or an approved blueprint. If scope is vague, run
|
|
40
41
|
`plan-refine` first and define task lanes, shared files, budgets, and verification.
|
|
41
|
-
2. Open
|
|
42
|
-
lanes.
|
|
43
|
-
|
|
42
|
+
2. Open Webpresso Desktop and launch the provider sessions needed for the
|
|
43
|
+
lanes. The `wp claude`, `wp codex`, and `wp opencode` commands
|
|
44
|
+
remain available for direct CLI launches.
|
|
44
45
|
3. Assign one owner per lane. Include the task, allowed files or surfaces,
|
|
45
46
|
expected output, verification command, and blocker-report rule.
|
|
46
|
-
4. Before each worker spawn, build a bounded manifest with `
|
|
47
|
+
4. Before each worker spawn, build a bounded manifest with `session_context`
|
|
47
48
|
(objective, constraints, evidence refs, remaining steps). Never copy parent transcripts.
|
|
48
49
|
5. Keep one lane or leader pass responsible for integration and evidence.
|
|
49
50
|
Workers report findings, patches, tests, and unresolved risks; they do not
|
|
50
51
|
self-approve or mark blueprint tasks complete.
|
|
51
52
|
6. Integrate only after checking shared-file conflicts, updated assumptions,
|
|
52
|
-
and verification evidence. Use `
|
|
53
|
+
and verification evidence. Use `blueprint_task_verify` for task completion
|
|
53
54
|
when a blueprint owns the work.
|
|
54
55
|
7. Stop when every lane is complete, cancelled, or explicitly blocked and the
|
|
55
56
|
leader has recorded verification evidence (≤40-line handoff if blocked).
|
|
@@ -66,6 +67,49 @@ multi-provider dashboard lanes.
|
|
|
66
67
|
- Never bypass review provenance, push to main, self-approve, or increase
|
|
67
68
|
timeouts to hide coordination failures.
|
|
68
69
|
|
|
70
|
+
### Capped host messaging
|
|
71
|
+
|
|
72
|
+
- Pull-first routing: routine assignment, status, and attention flow goes
|
|
73
|
+
through the durable source and the existing pull surfaces (`fleet_status`
|
|
74
|
+
role / `wp fleet status` / `worker_tail` / `session_context`);
|
|
75
|
+
cross-session sends are reserved for a blocker, a decision, a changed
|
|
76
|
+
priority, or one availability canary. Judgment sends (a decision, a
|
|
77
|
+
changed priority, a blocker escalation that changes another lane's
|
|
78
|
+
authority) ride the typed request envelope (ADR 0004; the
|
|
79
|
+
`quota-and-purpose-routing-policy` blueprint owns that surface) — until
|
|
80
|
+
it ships, name the request in the outbox or manifest entry instead of
|
|
81
|
+
free-form text.
|
|
82
|
+
- Bounded, degradable pulls: slow or degraded pull surfaces return partial
|
|
83
|
+
results plus warnings — never hang, and never raise timeouts to hide it
|
|
84
|
+
(`no-timeout-as-fix`); a degraded read is a decision input, not something
|
|
85
|
+
to spend a send on.
|
|
86
|
+
- Counted discipline: every send attempt counts, refused and queued included.
|
|
87
|
+
Warn at six, stop routine sends at eight, and reserve two control slots; the
|
|
88
|
+
canary draws from the reserve, and the reserve is strictly rationed — one
|
|
89
|
+
send per genuinely new control event. The numbers assume the observed ~10
|
|
90
|
+
sends per user turn as of 2026-10-31 (the anthropics/claude-code#94000
|
|
91
|
+
thread reports variance across builds); rescale proportionally if the
|
|
92
|
+
observed cap differs. The running count and last canary result live in the
|
|
93
|
+
outbox header and the `session_capture` record; on resume or after
|
|
94
|
+
compaction, re-read them before any send.
|
|
95
|
+
- Send overflow queues to the outbox — a durable coordinator-owned queue
|
|
96
|
+
file. Where no fleet outbox exists, create one: a single
|
|
97
|
+
coordinator-owned markdown file at a stable path (the fleet protocol's
|
|
98
|
+
outbox path where the protocol defines one, otherwise one
|
|
99
|
+
coordinator-named path recorded in the two anchor homes) whose header
|
|
100
|
+
carries owner, path, attempt count, last canary result, and timestamp;
|
|
101
|
+
name it in the `session_capture` record and the next handoff
|
|
102
|
+
manifest. The manifest is the queue of record until the outbox exists.
|
|
103
|
+
- A pause closes the channel: queue in the leader's durable outbox and never
|
|
104
|
+
route around it — no relays, peers, new sessions, schedulers, filesystem
|
|
105
|
+
push-delivery to peers, configuration changes, or
|
|
106
|
+
alternate transports/tools, including any uncapped or legacy send interface. The
|
|
107
|
+
outbox is pull-read durable state, so pull-reading it is not a route-around;
|
|
108
|
+
the next genuine user turn is the reopening test.
|
|
109
|
+
- Supersession check: before acting on a queued order, check durable state for
|
|
110
|
+
a newer arbitration — queued sends deliver late and out of order (observed
|
|
111
|
+
2026-10-24).
|
|
112
|
+
|
|
69
113
|
## Output
|
|
70
114
|
|
|
71
115
|
Report:
|
|
@@ -25,7 +25,7 @@ Manage the tech-debt lifecycle using `wp tech-debt` commands.
|
|
|
25
25
|
|
|
26
26
|
`new` (dry runs included) refuses a root that `wp audit committed-state-paths`
|
|
27
27
|
forbids adding to, such as this repository's `tech-debt/`. There, record a new
|
|
28
|
-
follow-up as a blueprint task (MCP `
|
|
28
|
+
follow-up as a blueprint task (MCP `blueprint_put`) or a draft blueprint
|
|
29
29
|
(`wp blueprint new`) instead. The examples below apply only where that audit
|
|
30
30
|
permits the resolved root.
|
|
31
31
|
|
|
@@ -63,7 +63,7 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
|
|
|
63
63
|
verb's printed path matches:
|
|
64
64
|
|
|
65
65
|
```text
|
|
66
|
-
|
|
66
|
+
tooling_friction_path({"file":"YYYY-MM-DD-<slug|pr|session>.json"})
|
|
67
67
|
→ summary: tooling-friction path: <absolute-path>
|
|
68
68
|
```
|
|
69
69
|
|
|
@@ -84,17 +84,17 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
|
|
|
84
84
|
worktree or `.agent/` path.
|
|
85
85
|
|
|
86
86
|
5. Optional `--promote` or severity `high`/`critical`: record the follow-up as
|
|
87
|
-
a blueprint task (MCP `
|
|
87
|
+
a blueprint task (MCP `blueprint_put`) or a draft blueprint
|
|
88
88
|
(`wp blueprint new`), and set `promoted_to` to that blueprint path. Do not
|
|
89
89
|
use `wp tech-debt new` here: it refuses this repository's `tech-debt/` root,
|
|
90
90
|
which `wp audit committed-state-paths` forbids adding to.
|
|
91
|
-
6. Optional one-line `
|
|
91
|
+
6. Optional one-line `session_capture` pointer to the JSON path — no paste-back walls.
|
|
92
92
|
|
|
93
93
|
**Rate limit:** at most **one** capture per verify bookend.
|
|
94
94
|
|
|
95
95
|
## Store path (SSOT)
|
|
96
96
|
|
|
97
|
-
`
|
|
97
|
+
`tooling_friction_path({"file":"<file>"})` (or the human CLI projection
|
|
98
98
|
`wp tooling-friction path --file <file>`) — a read-only projection of the pure
|
|
99
99
|
preferred state root (WP_STATE_ROOT or env-paths data; no writability fallback)
|
|
100
100
|
plus `repoIdentityV1(git-common-dir)` under `tooling-friction/<file>`. This
|
|
@@ -126,10 +126,10 @@ also include `path`, `repoKey` (16-hex), `stateRoot`, `scope: "repo"`, and
|
|
|
126
126
|
"id": "tf-status-ci-skew",
|
|
127
127
|
"severity": "high",
|
|
128
128
|
"surface": "pr",
|
|
129
|
-
"tool": "
|
|
129
|
+
"tool": "pr_status",
|
|
130
130
|
"kind": "friction",
|
|
131
131
|
"signal": "status_ci_skew",
|
|
132
|
-
"symptom": "
|
|
132
|
+
"symptom": "pr_merge blocked while GitHub CLEAN and PR Policy green.",
|
|
133
133
|
"token_waste": "high",
|
|
134
134
|
"time_waste_minutes": 25,
|
|
135
135
|
"recurrence": "session",
|
|
@@ -168,9 +168,9 @@ also include `path`, `repoKey` (16-hex), `stateRoot`, `scope: "repo"`, and
|
|
|
168
168
|
|
|
169
169
|
**Good**
|
|
170
170
|
|
|
171
|
-
- `
|
|
172
|
-
- `
|
|
173
|
-
- `
|
|
171
|
+
- `pr_merge: land readiness disagrees with GitHub CLEAN / PR Policy (status_ci_skew, high)`
|
|
172
|
+
- `review_gate: re-approve after ledger-only commits; subject binding unclear (retry_loop, medium)`
|
|
173
|
+
- `pr_upsert: bare Review model "Kimi" fails provider regex; needs "kimi reviewer" (schema_confuse, low)`
|
|
174
174
|
|
|
175
175
|
**Bad**
|
|
176
176
|
|
|
@@ -191,7 +191,7 @@ also include `path`, `repoKey` (16-hex), `stateRoot`, `scope: "repo"`, and
|
|
|
191
191
|
9. **Never invent the capture path** — no fleet folder slugs
|
|
192
192
|
(`github.com-org-repo-*`), no worktree-keyed desktop-state, no guessing
|
|
193
193
|
under `Application Support` or `~/.webpresso`. Always call
|
|
194
|
-
`
|
|
194
|
+
`tooling_friction_path` / `wp tooling-friction path` and write to the
|
|
195
195
|
absolute path it returns
|
|
196
196
|
|
|
197
197
|
## Integration
|
|
@@ -203,7 +203,7 @@ also include `path`, `repoKey` (16-hex), `stateRoot`, `scope: "repo"`, and
|
|
|
203
203
|
## Output (agent reply)
|
|
204
204
|
|
|
205
205
|
```text
|
|
206
|
-
tooling-friction: wrote desktop state <absolute-path-from-
|
|
206
|
+
tooling-friction: wrote desktop state <absolute-path-from-tooling_friction_path>
|
|
207
207
|
findings: 2 (high=1, medium=1)
|
|
208
208
|
promoted: none | blueprints/<lifecycle>/<slug> | tech-debt/...
|
|
209
209
|
```
|
|
@@ -21,13 +21,13 @@ argument-hint: "<new|status|handoff|run|cancel> [brief]"
|
|
|
21
21
|
- "spawn many in parallel", multi-blueprint ready-set execution
|
|
22
22
|
- Reject unbound "complete everything while I sleep" without stop condition / budgets
|
|
23
23
|
|
|
24
|
-
Use `wp ultragoal` / MCP `
|
|
24
|
+
Use `wp ultragoal` / MCP `ultragoal_*` as the durable controller for work spanning
|
|
25
25
|
one or more blueprints. Prefer this spine over host-local mega-sessions or ad-hoc
|
|
26
26
|
multi-agent swarms.
|
|
27
27
|
|
|
28
28
|
## Creating an ultragoal does NOT set a host stop-condition
|
|
29
29
|
|
|
30
|
-
`
|
|
30
|
+
`ultragoal_new` records a durable brief, budgets, and phase. It does **not**
|
|
31
31
|
install the session Stop hook that keeps a host working until a condition holds
|
|
32
32
|
— that hook belongs to the host's own goal surface (Claude Code's `/goal`), which
|
|
33
33
|
this skill cannot reach. The two are independent: an ultragoal can sit in `plan`
|
|
@@ -151,23 +151,23 @@ OS sandbox. Run Ultragoal only with providers, configuration, and task content y
|
|
|
151
151
|
|
|
152
152
|
## Tooling map (use these; do not reimplement with Bash)
|
|
153
153
|
|
|
154
|
-
| Phase | Prefer MCP / CLI
|
|
155
|
-
| ---------------------- |
|
|
156
|
-
| Create / resume | `
|
|
157
|
-
| Isolation | `
|
|
158
|
-
| Blueprint read | `
|
|
159
|
-
| Blueprint write | `
|
|
160
|
-
| Task done | `
|
|
161
|
-
| Parallel execute | `/goal` (autopilot) or ready-queue + host subagents
|
|
162
|
-
| Context-light delegate | `
|
|
163
|
-
| Continuity | `
|
|
164
|
-
| Large command / file | `
|
|
165
|
-
| QA | `
|
|
166
|
-
| PR / land | `
|
|
167
|
-
| Delivery programs | `
|
|
168
|
-
| Fleet / workers | `
|
|
169
|
-
| Token gain | `
|
|
170
|
-
| Advance loop | `
|
|
154
|
+
| Phase | Prefer MCP / CLI | Purpose |
|
|
155
|
+
| ---------------------- | -------------------------------------------------------------------------- | --------------------------------------------------- |
|
|
156
|
+
| Create / resume | `ultragoal_new`, `ultragoal_status` | Durable controller state |
|
|
157
|
+
| Isolation | `worktree` | Owner / lane worktrees; never primary as controller |
|
|
158
|
+
| Blueprint read | `blueprint_list`, `blueprint_get`, `blueprint_context` | Ready-set and deps |
|
|
159
|
+
| Blueprint write | `blueprint_put`, `blueprint_transition` | Spec edits (MCP-only for blueprints) |
|
|
160
|
+
| Task done | `blueprint_task_verify` only | Evidence-gated completion |
|
|
161
|
+
| Parallel execute | `/goal` (autopilot) or ready-queue + host subagents | Max parallel when deps allow |
|
|
162
|
+
| Context-light delegate | `session_context` | Manifest for subagents (no history paste) |
|
|
163
|
+
| Continuity | `session_capture`, `session_search`, `session_restore`, `session_snapshot` | Decisions / resume |
|
|
164
|
+
| Large command / file | `session_execute`, `session_batch_execute`, `session_execute_file` | Bounded output + index |
|
|
165
|
+
| QA | `qa` (or `lint` + `typecheck` + `test`) | Affected quality gates |
|
|
166
|
+
| PR / land | `pr_upsert`, `pr_status`, `pr_wait`, `pr_merge` | Open early; exact-head merge only |
|
|
167
|
+
| Delivery programs | `delivery_status` | Derive one dispatch/integration action |
|
|
168
|
+
| Fleet / workers | `fleet_status`, `worker_tail` | Multi-session visibility |
|
|
169
|
+
| Token gain | `gain` | Optional efficiency check after heavy execute |
|
|
170
|
+
| Advance loop | `ultragoal_run`, `ultragoal_handoff`, `ultragoal_cancel` | Controller steps only |
|
|
171
171
|
|
|
172
172
|
Fallback to `wp …` CLI only when the matching MCP tool is unavailable. Prefer `wp` >
|
|
173
173
|
`vp` > raw package managers. Never raise timeouts to hide hangs.
|
|
@@ -175,25 +175,25 @@ Fallback to `wp …` CLI only when the matching MCP tool is unavailable. Prefer
|
|
|
175
175
|
## Protocol
|
|
176
176
|
|
|
177
177
|
1. Create or resume the ultragoal in a **managed blueprint owner worktree**
|
|
178
|
-
(`
|
|
178
|
+
(`worktree` / `blueprint_put`). Never use `main` or the primary checkout
|
|
179
179
|
as controller.
|
|
180
180
|
2. Print the **ready-set**: tasks whose dependencies are satisfied (from blueprint tools).
|
|
181
181
|
3. Launch up to `concurrency` independent ready tasks in parallel (worktree-isolated).
|
|
182
182
|
Serialize only when file ownership overlaps or deps require it.
|
|
183
|
-
4. Execute only the current phase handoff; call `
|
|
184
|
-
5. Mark tasks done **only** via `
|
|
183
|
+
4. Execute only the current phase handoff; call `ultragoal_run` again after evidence.
|
|
184
|
+
5. Mark tasks done **only** via `blueprint_task_verify` with passing evidence.
|
|
185
185
|
6. **Opportunistic `/fix`:** at most `fix_budget` pre-existing issues per phase, each with
|
|
186
186
|
named invariant + failing proof. Excess → handoff backlog (do not expand epic).
|
|
187
|
-
7. **Validate / land:** local proof with `
|
|
187
|
+
7. **Validate / land:** local proof with `qa` / targeted tools; outside review only when
|
|
188
188
|
merge-ready and within `review_budget` — **exactly one sequential** outside voice unless
|
|
189
189
|
the user sets N (the default value lives in `workflow-skills-routing.md`).
|
|
190
190
|
Controller validation evidence is **machine-qa (prior QA phase) + N outside voices**
|
|
191
191
|
(default N=1), not two outside model reviewers at budget 1.
|
|
192
|
-
`
|
|
192
|
+
`review_gate` has one mode: purpose plan for exact-version draft plan
|
|
193
193
|
approval/auto-promotion, purpose delivery for implementation/phase outside
|
|
194
194
|
voice. Each new provider verdict is a formal round of the slug's budget and
|
|
195
195
|
an approval is authority immediately. A CLI delivery gate is explicit MCP-unavailable
|
|
196
|
-
compatibility only, not this MCP contract. Use `
|
|
196
|
+
compatibility only, not this MCP contract. Use `pr_*` for PR babysit — no
|
|
197
197
|
multi-sleep poll loops; no parallel multi-reviewer stampede.
|
|
198
198
|
8. Stop on `complete`, `cancelled`, blocked guard exhaustion, or `WP_ULTRAGOAL_DISABLE=1`.
|
|
199
199
|
|
|
@@ -206,83 +206,78 @@ primary checkout.
|
|
|
206
206
|
- Hard fail on a task → mark blocked with reason; **cascade-skip** dependents that cannot
|
|
207
207
|
proceed; continue independent ready work.
|
|
208
208
|
- Lifecycle mutation failure → stop (do not continue on stale plan state).
|
|
209
|
-
- On block: call `
|
|
210
|
-
evidence refs (`
|
|
209
|
+
- On block: call `ultragoal_handoff` and emit a **≤40-line handoff**: goal, done, blockers,
|
|
210
|
+
evidence refs (`session_*` ids if any), next 3 commands. Do not paste full transcripts.
|
|
211
211
|
|
|
212
212
|
## Outside-voice review (required for autopilot)
|
|
213
213
|
|
|
214
|
-
Autopilot and agent-driven ultragoal loops **must** request an
|
|
214
|
+
Autopilot and agent-driven ultragoal loops **must** request an outside-voice review after each **goal/phase milestone**. Use **`review_gate`** purpose plan for exact-version draft plan approval/auto-promotion and one single-shot **`review_gate`** purpose delivery call for implementation/phase outside voice. The gate has one mode: each newly executed provider review that reaches a verdict is a formal round of the slug's budget, an approval is authority immediately, and an identical-subject call replays the recorded verdict without a new round. CLI delivery gates are explicit MCP-unavailable compatibility only, not this MCP contract.
|
|
215
215
|
|
|
216
|
-
Count each milestone review against `review_budget` for merge-ready claims: **exactly one sequential** reviewer path unless the user sets N; the default value is owned by `workflow-skills-routing.md`.
|
|
216
|
+
Count each milestone review against `review_budget` for merge-ready claims: **exactly one sequential** reviewer path unless the user sets N; the default value is owned by `workflow-skills-routing.md`. Do not fan out multi-host review swarms.
|
|
217
217
|
|
|
218
218
|
### Milestones that require a review
|
|
219
219
|
|
|
220
|
-
Run `
|
|
221
|
-
single-shot `
|
|
220
|
+
Run `review_gate` purpose plan for the plan approval milestone below and one
|
|
221
|
+
single-shot `review_gate` purpose delivery call for implementation/phase
|
|
222
222
|
milestones. Each new provider verdict is one formal round of the slug's budget.
|
|
223
223
|
|
|
224
224
|
| Milestone | When |
|
|
225
225
|
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
|
|
226
|
-
| Plan gate | Before `draft` → `planned`, using the exact version returned by `
|
|
226
|
+
| Plan gate | Before `draft` → `planned`, using the exact version returned by `blueprint_put`; approval may auto-promote the same version |
|
|
227
227
|
| Phase advance | After ultragoal advances `plan` → `execute`, `execute` → `qa`, `qa` → `validate`, `validate` → `land`, or lands `complete` |
|
|
228
228
|
| Task batch handoff | After a meaningful execute batch when the phase remains `execute` (at least once per blueprint before claiming execute-complete) |
|
|
229
229
|
|
|
230
|
-
Do **not** invent ledger approvals. If
|
|
230
|
+
Do **not** invent ledger approvals. If the review provider is unavailable or hits a provider-wide usage limit, capture the failure evidence and end outside review for the window; do not hop reviewer families, substitute another host, or substitute a forged approval.
|
|
231
231
|
|
|
232
|
-
###
|
|
232
|
+
### Reviewer selection (the gate chooses, not the caller)
|
|
233
233
|
|
|
234
|
-
|
|
234
|
+
Pass `caller_model` with your own model id and omit `provider`, `model`, and
|
|
235
|
+
`effort`. The gate selects the reviewer route itself — a cross-family reviewer
|
|
236
|
+
chosen for capability, current provider limits, and measured daily cost — and
|
|
237
|
+
reports the choice in `policy_selection`. Never resolve models from a live
|
|
238
|
+
catalog at invocation time, never probe a provider CLI for its model list, and
|
|
239
|
+
never read a credential store to discover models; provider catalog discovery
|
|
240
|
+
belongs to the snapshot drift workflow. A human operator may still name an
|
|
241
|
+
explicit `provider`/`model` as an override; agents must not.
|
|
235
242
|
|
|
236
|
-
|
|
237
|
-
opencode models opencode-go
|
|
238
|
-
```
|
|
239
|
-
|
|
240
|
-
**Selection order and the purpose→family mapping live in one place: the committed
|
|
241
|
-
reviewer policy (`packages/workflow-skills/src/opencode-reviewer-policy.ts`),
|
|
242
|
-
rendered into the `opencode-go` skill and drift-gated against it.** Follow that
|
|
243
|
-
skill; do not restate the ordering here. A second copy of a preference list is a
|
|
244
|
-
second thing to update, and the copy that goes stale is the one an agent reads.
|
|
245
|
-
|
|
246
|
-
Treat a provider-wide usage limit as terminal for every OpenCode Go model in the current review window; do not hop OpenCode families to evade a usage block. There is no substitute host: the window ends with the captured failure evidence.
|
|
243
|
+
Treat a provider-wide usage limit as terminal for the current review window; do not hop reviewer families to evade a usage block. There is no substitute host: the window ends with the captured failure evidence.
|
|
247
244
|
|
|
248
245
|
### Plan gate invocation shape
|
|
249
246
|
|
|
250
247
|
```text
|
|
251
|
-
|
|
248
|
+
review_gate({
|
|
252
249
|
"project_id": "<project-id>",
|
|
253
250
|
"slug": "<blueprint-slug>",
|
|
254
251
|
"expected_version": "bpv1:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
|
|
255
252
|
"repository_access": "read-only",
|
|
256
253
|
"auto_promote": true,
|
|
257
|
-
"
|
|
258
|
-
"model": "<selected-model>",
|
|
259
|
-
"effort": "medium"
|
|
254
|
+
"caller_model": "<your own model id>"
|
|
260
255
|
})
|
|
261
256
|
```
|
|
262
257
|
|
|
263
258
|
The plan gate has no `purpose` or `target` field. Pass the exact `bpv1:` token
|
|
264
|
-
returned by `
|
|
259
|
+
returned by `blueprint_put`, never a commit hash or `HEAD`. An explicitly
|
|
265
260
|
requested CLI delivery gate is an MCP-unavailable compatibility fallback only.
|
|
266
261
|
If the MCP host returns before a terminal result, poll the same invocation with
|
|
267
|
-
`
|
|
262
|
+
`review_gate_wait`; treat in-progress, not-found, contention, waiter timeout,
|
|
268
263
|
waiter abort, and cancellation as non-verdict observation states. `not_found`
|
|
269
264
|
means no active or terminal gate exists for that subject; refresh state and
|
|
270
265
|
start the gate again instead of spinning a wait loop.
|
|
271
266
|
|
|
272
267
|
### Honesty rules (non-negotiable)
|
|
273
268
|
|
|
274
|
-
- Never self-approve or hand-edit `reviews.md` / `review-events.jsonl` / frontmatter approvals to fake
|
|
275
|
-
- Never mark blueprint tasks done except through `
|
|
269
|
+
- Never self-approve or hand-edit `reviews.md` / `review-events.jsonl` / frontmatter approvals to fake outside-review authority.
|
|
270
|
+
- Never mark blueprint tasks done except through `blueprint_task_verify` with real evidence.
|
|
276
271
|
- Never run ultragoal mutations on `main` or a primary checkout; use the managed blueprint owner worktree.
|
|
277
272
|
- Keep every loop bounded and never increase timeouts.
|
|
278
273
|
- When the controller returns `waiting` (`blueprint-promotion`, `approval-gate`, `blueprint-tasks`, …), fix the named gap; do not spin `wp ultragoal run` without progress.
|
|
279
274
|
|
|
280
275
|
## Tooling-aligned evidence (QA / land)
|
|
281
276
|
|
|
282
|
-
- **QA phase** prefers **GitHub required checks** for the worktree PR (`
|
|
283
|
-
`
|
|
277
|
+
- **QA phase** prefers **GitHub required checks** for the worktree PR (`pr_status` /
|
|
278
|
+
`pr_wait` or `gh pr checks --required`) when PR is `OPEN`/`MERGED`, checks green, and
|
|
284
279
|
PR head matches clean worktree HEAD.
|
|
285
|
-
- If no PR-bound green CI is available, fall back to local **`
|
|
280
|
+
- If no PR-bound green CI is available, fall back to local **`qa`**.
|
|
286
281
|
- Open a PR early so CI can satisfy QA. Do **not** raise timeouts.
|
|
287
282
|
- **Land** still requires a **MERGED** PR with green required checks bound to the projected
|
|
288
283
|
source snapshot. Use `/verify --merge-ready` (merge-ready `review_budget`, per
|