@webpresso/plugin-codex 0.0.9 → 0.0.11

package/skills/grok/SKILL.md

@@ -1,32 +1,44 @@
 ---
 name: grok
-description: "Grok outside-voice review."
+description: "Grok outside-voice reviewer through Webpresso MCP."
 license: MIT
 ---
 
-Use for bounded Grok Build outside-voice review.
+# Grok outside-voice review
 
-- One bounded review invocation per request.
-- No fan-out, probe, retry, account rotation, or provider switch unless the user sets `review_budget`/`N` > 1.
-- Use `wp_review_run` unless MCP is unavailable.
-- Grok review is prompt-only: gather diff excerpts and verification yourself;
-  pass that supplied artifact to Grok.
-- Call `wp_review_run` exactly once with `repository_access: "none"`. The runtime
-  owns the empty execution workspace.
-- The prompt must say "supplied artifact text only", "do not inspect a
-  workspace", "do not announce future work", and require a final `VERDICT:` line.
+Use only for a requested content-bound plan or delivery review. Treat output as external advice
+until independently verified.
+
+## MCP-only contract
+
+- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
+- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
+
+## Advisory call
 
 ```jsonc
 {
-  "prompt": "You are doing a bounded advisory code review of the supplied artifact text only. Do not inspect a workspace. Do not announce future work. <diff excerpts + verification + questions>. Final line must start with VERDICT:",
+  "project_id": "<project>",
+  "slug": "<blueprint-slug>",
+  "purpose": "delivery",
+  "base_ref": "<full-base-sha>",
+  "authority_ref": "<full-head-sha>",
   "provider": "grok",
   "repository_access": "none",
-  "skipProbe": true,
-  "stage": "review",
-  "expectedMarker": "VERDICT:",
+  "mode": "advisory",
 }
 ```
 
-`wp_review_gate` is plan-only exact-version draft approval/auto-promotion.
-Implementation/phase review uses advisory `wp_review_run` and never mutates
-blueprint approval state. CLI delivery gates are MCP-unavailable compatibility only.
+Use authoritative mode only when formal plan or delivery approval is requested.
+
+## Model policy
+
+When the user names an exact model, pass it in the MCP `model` field. Otherwise omit
+that field and let the MCP owner select the configured provider default.
+
+## Review quality
+
+Follow `catalog/agent/rules/review-methodology-sota.md`; report typed verdict, model,
+artifact, grounded findings, and independently verified conclusions.

package/skills/hooks-doctor/SKILL.md

@@ -55,34 +55,44 @@ Each check prints `[x]` (pass) or `[ ]` (fail) with a detail line:
 
 ## Failure Remediation
 
-| Check                                                | Likely Cause                                                      | Fix                                                                                          |
-| ---------------------------------------------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
-| `pretool-guard` / `post-tool` / etc. — not found     | `wp run build` not run after install                              | `wp run build`                                                                               |
-| `pretool-guard` / etc. — not executable              | `chmod +x` not persisted                                          | Re-run `wp run prepare` or `wp run build` which runs `chmod-bins`                            |
-| `plugin.json integrity` — missing                    | Claude adapter manifest absent from `@webpresso/plugin-claude`    | Re-run `wp setup --host claude` or reinstall the Claude plugin                               |
-| `MCP server liveness` — timeout                      | MCP server cold-start too slow                                    | Wait and retry, or run `wp hooks doctor --skip-mcp`                                          |
-| `host runtime MCP freshness` — WARNING missing/older | Host `dist/runtime/<target>/wp` missing or older than MCP sources | `pnpm run build:runtime-binaries -- --target host`, then reconnect webpresso MCP / quit host |
-| Any check — not found at `dist/esm/...`              | Build artifacts missing                                           | Run `wp run build` in the webpresso repo                                                     |
+| Check                                            | Likely Cause                                                   | Fix                                                               |
+| ------------------------------------------------ | -------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `pretool-guard` / `post-tool` / etc. — not found | `wp run build` not run after install                           | `wp run build`                                                    |
+| `pretool-guard` / etc. — not executable          | `chmod +x` not persisted                                       | Re-run `wp run prepare` or `wp run build` which runs `chmod-bins` |
+| `plugin.json integrity` — missing                | Claude adapter manifest absent from `@webpresso/plugin-claude` | Re-run `wp setup --host claude` or reinstall the Claude plugin    |
+| `MCP server liveness` — timeout                  | MCP server cold-start too slow                                 | Wait and retry, or run `wp hooks doctor --skip-mcp`               |
+| Any check — not found at `dist/esm/...`          | Build artifacts missing                                        | Run `wp run build` in the webpresso repo                          |
 
 ### Updating the webpresso MCP server (monorepo authors)
 
-`mcp` is **runtime-required**: hosts do not auto-JIT MCP code. After changing
-`src/mcp/**`, conversation catalog, or pretool routing that MCP hosts must run:
+`mcp` is **source-first**: in a checkout with TypeScript source the server runs
+from source, so it always serves HEAD. After changing `src/mcp/**`, conversation
+catalog, or pretool routing that MCP hosts must run:
 
-1. `pnpm run build:runtime-binaries -- --target host`
-2. Reconnect webpresso MCP in the agent host (or full host quit). Optional:
-   `pkill -f 'dist/runtime/.*/wp mcp'` if a long-lived process sticks.
-3. Smoke a tool only available in the new code.
+1. Reconnect webpresso MCP in the agent host.
+2. Smoke a tool only available in the new code.
 
-Chat-only restart is **not** enough. Doctor **MCP liveness** may spawn
-`dist/esm/mcp/cli.js` while the host still runs a stale compiled binary —
-prefer the **host runtime MCP freshness** advisory for monorepo checkouts.
+No runtime rebuild is involved, and no `pkill` is needed — every launcher layer
+owns its child's stdin, so a disconnect unwinds the whole chain. Chat-only
+restart is still **not** enough: reconnect the server itself.
+
+Managed `wp hook` and `wp hooks doctor|status|dispatch` commands are
+source-authoritative and require no post-merge runtime rebuild. Existing
+managed installations run exact `wp sync`, then rerun `wp hooks doctor` or
+`wp hooks status` until the legacy-projection warning is absent. Packed
+consumers continue to use the shipped compiled runtime and repair/reinstall that
+artifact if it is missing.
+
+**One-time upgrade step:** chains started before the source-first lane shipped
+ran no stdin relay, so quit and reopen each MCP host once to retire them. A
+`pkill` pattern is not a substitute — it misses source-launched chains and can
+kill another session's server.
 
 **Offline shell allowlist** when webpresso MCP tools are unavailable (must
 match `dev-routing-bounded-read.ts`):
 
 ```text
-rg -n pattern path | head -n 120
+rg --no-config -n pattern path 2>/dev/null | head -c 65536
 head -n 200 path/to/file
 git log --oneline -n 50
 git show --stat HEAD

package/skills/opencode-go/SKILL.md

@@ -4,94 +4,44 @@ description: "OpenCode Go aggregate outside-voice reviewer for read-only plan, c
 license: MIT
 ---
 
-# OpenCode Go aggregate reviewer via OpenCode Go
-
-Use when the user asks for an OpenCode Go aggregate reviewer / OpenCode Go review. Treat output as external advice until independently verified.
-
-## Model routing
-
-Rendered from the committed OpenCode reviewer policy. It does not hardcode model IDs; it resolves the live `opencode models opencode-go` catalog.
-Use the aggregate reviewer when the user wants an OpenCode Go review but did not specify a family. Select one available model in this order: Kimi K2.7 Code for coding quality, DeepSeek V4 Pro for deeper review depth, DeepSeek V4 Flash for cheap/high-availability coverage, then the remaining families.
-Use the aggregate reviewer for general outside-voice plan critique, implementation review, or when the user wants the current best OpenCode Go lane without naming a family.
-
-## Primary path: MCP
-
-When MCP is available, call `wp_review_run` exactly once with provider `opencode`, one selected live model, stage `review`, and a bounded prompt/marker. If no eligible model is known, call `wp_session_execute` at most once for a bounded catalog read before that single review call.
-
-Do not retry or probe, rotate accounts, or change provider within the invocation. The shell blocks below are the MCP-unavailable fallback only.
-
-## MCP-unavailable fallback: auth check
-
-```bash
-opencode providers list >/dev/null
-```
-
-## MCP-unavailable fallback: portable prompt file
-
-```bash
-PROMPT_FILE=$(mktemp -t wp-opencode-go-review.XXXXXX)
-trap 'rm -f "$PROMPT_FILE"' EXIT
-```
-
-## Dashboard helper relation
-
-When `wp dash` provides dashboard context, use the shared helper emitter around this outside-voice review. The commands leave standalone OpenCode Go reviews unchanged.
-
-```bash
-DASH_HELPER_RUN_ID=""
-if [ "${WP_DASH:-}" = "1" ] && [ -n "${WP_DASH_RUN_ID:-}" ]; then
-  DASH_HELPER_RUN_ID=$(wp dash-helper-start --provider opencode-go --role reviewer --artifact "${OPENCODE_GO_REVIEW_ARTIFACT:-}")
-fi
+# OpenCode Go aggregate outside-voice review
+
+Use only for a requested content-bound plan or delivery review. Treat output as external advice
+until independently verified.
+
+## MCP-only contract
+
+- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
+- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
+
+## Advisory call
+
+```jsonc
+{
+  "project_id": "<project>",
+  "slug": "<blueprint-slug>",
+  "purpose": "delivery",
+  "base_ref": "<full-base-sha>",
+  "authority_ref": "<full-head-sha>",
+  "provider": "opencode",
+  "model": "opencode-go/deepseek-v4-pro",
+  "repository_access": "none",
+  "mode": "advisory",
+}
 ```
 
-After the review runtime exits, record its actual result and optional artifact:
+Use authoritative mode only when formal plan or delivery approval is requested.
 
-```bash
-OPENCODE_GO_REVIEW_CODE=$?
-if [ -n "$DASH_HELPER_RUN_ID" ]; then
-  if [ "$OPENCODE_GO_REVIEW_CODE" -eq 0 ]; then
-    wp dash-helper-complete --provider opencode-go --run-id "$DASH_HELPER_RUN_ID" --role reviewer --outcome completed --artifact "${OPENCODE_GO_REVIEW_ARTIFACT:-}"
-  else
-    wp dash-helper-complete --provider opencode-go --run-id "$DASH_HELPER_RUN_ID" --role reviewer --outcome failed --artifact "${OPENCODE_GO_REVIEW_ARTIFACT:-}"
-  fi
-fi
-```
-
-The managed OpenCode plugin currently has no parent-linked native subagent completion lifecycle. This capability is explicit unsupported coverage, not an inferred dashboard relation.
-
-## MCP-unavailable fallback: review command
+## Model policy
 
-Use read-only prompts. Run from the repo directory; do NOT pass `--dir "$PWD"` because opencode already uses the current directory and the extra index can stall reviews.
-Review is advisory. `wp_review_gate` is plan-only exact-version draft approval/auto-promotion; `wp_review_run` never mutates approval state.
+Default exact model: `opencode-go/deepseek-v4-pro`.
+Committed exact options: `opencode-go/deepseek-v4-pro`, `opencode-go/deepseek-v4-flash`, `opencode-go/kimi-k2.7-code`, `opencode-go/glm-5.3`, `opencode-go/minimax-m3`, `opencode-go/mimo-v2.5-pro`, `opencode-go/qwen3.8-max`, `opencode-go/mimo-v2.5`, `opencode-go/qwen3.7-plus`, `opencode-go/qwen3.7-max`, `opencode-go/qwen3.6-plus`, `opencode-go/gpt-5.6-luna`, `opencode-go/minimax-m2.7`, `opencode-go/kimi-k3`, `opencode-go/glm-5.2`, `opencode-go/kimi-k2.6`, `opencode-go/hy3`, `opencode-go/glm-5.1`, `opencode-go/grok-4.5`.
+Use a named exact option when requested; otherwise use the default. Provider catalog discovery
+belongs to the snapshot drift workflow, never to a skill invocation.
 
-```bash
-# Aggregate reviewer: honor the canonical model-selection policy (Kimi K2.7 Code → DeepSeek V4 Pro → DeepSeek V4 Flash first, then cross-family selection fallbacks).
-CATALOG=$(opencode models opencode-go)
-MODEL=$(echo "$CATALOG" | grep '^opencode-go/kimi' | grep -- '-code$' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/deepseek' | grep -- '-pro$' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/deepseek' | grep -- '-flash$' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/qwen' | grep -- '-max$' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/glm' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/minimax' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | grep '^opencode-go/mimo' | grep -- '-pro$' | sort -V | tail -1)
-[ -z "$MODEL" ] && MODEL=$(echo "$CATALOG" | sort -V | tail -1)
-
-# Resolve one model from one bounded catalog read, then launch one review.
-[ -n "$MODEL" ] || { echo "No OpenCode Go model resolved for this reviewer." >&2; exit 2; }
-OPENCODE_GO_REVIEW_EFFORT=${OPENCODE_GO_REVIEW_EFFORT:-medium}
-[ "$OPENCODE_GO_REVIEW_EFFORT" = medium ] || [ "$OPENCODE_GO_REVIEW_EFFORT" = high ] || { echo "OPENCODE_GO_REVIEW_EFFORT must be one of: medium, high" >&2; exit 2; }
-OPENCODE_GO_REVIEW_IDLE_SECONDS=${OPENCODE_GO_REVIEW_IDLE_SECONDS:-180}
-OPENCODE_GO_REVIEW_ARTIFACT_ROOT=${OPENCODE_GO_REVIEW_ARTIFACT_ROOT:-"$(pwd)/.webpresso/reviews"}
-wp review run \
-  --provider opencode \
-  --prompt-file "$PROMPT_FILE" \
-  --model "$MODEL" \
-  --effort "$OPENCODE_GO_REVIEW_EFFORT" \
-  --stage review \
-  --artifact-root "$OPENCODE_GO_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$OPENCODE_GO_REVIEW_IDLE_SECONDS"
-```
+## Review quality
 
-The single catalog read above resolves `$MODEL`; do not perform another model-catalog command.
-The typed runtime advances its idle clock only on monotonic semantic progress and has no total wall-clock cutoff.
-OpenCode Go usage limit ends all OpenCode models this review (no family hop). Next: Grok (`--provider grok`). Gate fails over to Grok when accounts cool. Treat `true-idle`, `protocol-unsupported`, provider/abort/spawn/artifact failure as unavailable. Never replace with static timeout, byte-growth heartbeat, or buffered-output fallback.
+Follow `catalog/agent/rules/review-methodology-sota.md`; report typed verdict, model,
+artifact, grounded findings, and independently verified conclusions.

package/skills/plan-refine/SKILL.md

@@ -77,6 +77,7 @@ Run **1–3 (and relevant review lenses) in parallel** whenever tools allow. Do
 4. **Plan-review lenses (skip when the caller already ran them).** Folded `/autoplan`: run relevant CEO/founder, design, engineering, and DevEx lenses **in parallel when independent**; consolidate keep/change/drop, unresolved taste calls, tests, go/no-go.
    - **Skip condition.** If the caller states `plan-* reviews complete for this pass`, do **not** re-run the lenses. `ralplan` runs them before handing off, so re-running them here is duplicated spend, not a second opinion.
    - **Re-entry.** If refinement itself **materially changes scope**, re-run only the affected lens — never the full set — then continue applying.
+   - **Re-review rounds.** `catalog/agent/rules/review-methodology-sota.md` Principle 5 sets the delta-anchored adjudication contract subsequent `wp_review_gate` rounds follow.
 
 5. **Blueprint enforcement (max parallel).**
    - Split for independent execution; declare `Depends`; file-conflict CP = 0 per wave; TDD/proof steps; preserve acceptance criteria.

package/skills/plan-refine/references/full-methodology.md

@@ -333,18 +333,18 @@ without reading other tasks. Include: what, why, constraints, gotchas.]
 **Steps (TDD):**
 
 1. Write failing test for [specific behavior]
-2. Run: `just test --file <path/to/test-file.test.ts>` — verify FAIL
+2. Run: `wp test --files <path/to/test-file.test.ts>` — verify the current contract
 3. Implement minimal code to pass
-4. Run: `just test --file <path/to/test-file.test.ts>` — verify PASS
+4. Run: `wp test --files <path/to/test-file.test.ts>` — verify PASS
 5. Refactor if needed (complexity ≤ 8)
-6. Run: `just lint --file <changed-file.ts> <changed-test.ts>` and `just typecheck --file <changed-file.ts> <changed-test.ts>`
+6. Run: `wp lint --files <changed-file.ts> <changed-test.ts>` and `wp typecheck --files <changed-file.ts> <changed-test.ts>`
 
 **Acceptance:**
 
-- [ ] Test file created with failing test
+- [ ] Positive contract test covers the requested behavior
 - [ ] Implementation passes all tests
-- [ ] `just lint --file <changed-files...>` passes
-- [ ] `just typecheck --file <changed-files...>` passes
+- [ ] `wp lint --files <changed-files...>` passes
+- [ ] `wp typecheck --files <changed-files...>` passes
 ```
 
 Use `#### Task X.Y: ...` only when a lane prefix would add no value, but prefer lane-prefixed headers such as `[schema]`, `[backend]`, `[ui]`, `[infra]`, `[docs]`, or `[qa]`.
@@ -362,22 +362,22 @@ These are enforced project conventions (with webpresso's conventions as the exam
 
 - Task says "1 day", "3 hours", "2 weeks" → Change to t-shirt size
 - Task creates migration files or migration infrastructure when the repo prefers `db push` → Use the repo's chosen workflow
-- References `just db-migrate` when the repo uses `db push` → Use `db push` (entity YAML → schema generation → push)
+- References a retired database command when the repo uses `db push` → Use `db push` (entity YAML → schema generation → push)
 
 ### Blueprint Validation Checklist
 
 Run this audit on every task in the blueprint:
 
-| Check                             | Violation                                            | Fix                                               |
-| --------------------------------- | ---------------------------------------------------- | ------------------------------------------------- |
-| Has `**Depends:**` line?          | Missing → parallel execution can't build DAG         | Add explicit dependency or "None"                 |
-| Has `**Files:**` section?         | Missing → agents can't detect file conflicts         | List every file touched (Create/Modify)           |
-| Has `**Steps (TDD):**`?           | Missing → agents skip tests                          | Add TDD steps with exact `just` commands          |
-| Has `**Acceptance:**` checkboxes? | Missing → no completion criteria                     | Add testable acceptance criteria                  |
-| Description self-contained?       | References "see above" or "as described in Task X.Y" | Inline the context — each task runs independently |
-| Files overlap with another task?  | Two tasks modify same file → conflict in parallel    | Merge tasks or add explicit `**Depends:**`        |
-| Uses t-shirt sizing?              | Day/week estimates used                              | Replace with XS/S/M/L/XL                          |
-| Follows repo DB workflow?         | Diverges from repo's chosen workflow                 | Use repo's chosen workflow instead                |
+| Check                             | Violation                                            | Fix                                                      |
+| --------------------------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| Has `**Depends:**` line?          | Missing → parallel execution can't build DAG         | Add explicit dependency or "None"                        |
+| Has `**Files:**` section?         | Missing → agents can't detect file conflicts         | List every file touched (Create/Modify)                  |
+| Has `**Steps (TDD):**`?           | Missing → agents skip tests                          | Add positive verification steps with exact `wp` commands |
+| Has `**Acceptance:**` checkboxes? | Missing → no completion criteria                     | Add testable acceptance criteria                         |
+| Description self-contained?       | References "see above" or "as described in Task X.Y" | Inline the context — each task runs independently        |
+| Files overlap with another task?  | Two tasks modify same file → conflict in parallel    | Merge tasks or add explicit `**Depends:**`               |
+| Uses t-shirt sizing?              | Day/week estimates used                              | Replace with XS/S/M/L/XL                                 |
+| Follows repo DB workflow?         | Diverges from repo's chosen workflow                 | Use repo's chosen workflow instead                       |
 
 ### Granularity Rules
 
@@ -532,7 +532,7 @@ Rate the plan's parallelizability:
 
 ### Self-Contained Task Test
 
-For each task, ask: **"Can an agent execute this task with ONLY the task description, the codebase, and `just` commands?"**
+For each task, ask: **"Can an agent execute this task with ONLY the task description, the codebase, and the repository's `wp` commands?"**
 
 If the answer is no, the task is missing context. Common fixes:
 

package/skills/ralplan/SKILL.md

@@ -112,6 +112,7 @@ Rules:
 - Apply findings **into the blueprint** after each review (or once after the set if independent).
 - Independent reviews may run in parallel **only when** they do not depend on each other's edits; if eng findings reshape scope, re-run only the affected optional reviews.
 - Optional high-risk challenge: one sequential outside-voice pass (`codex` / `claude` / `opencode-go`) **after** eng review if the user asks or the change is auth / data-loss / public-API sensitive. Never parallel multi-host review.
+- Any formal `wp_review_gate` re-review round follows `catalog/agent/rules/review-methodology-sota.md` Principle 5's delta-anchored adjudication contract, not a fresh rediscovery pass.
 
 ### 5. `/plan-refine` last (always)
 

package/skills/tech-debt/SKILL.md

@@ -34,6 +34,12 @@ wp tech-debt new "Legacy CLI complexity" \
 # Preview without writing
 wp tech-debt new "Performance bottleneck" --severity high --category mutation --dry-run
 
+# `new` refuses on a primary-like checkout: a file written there cannot be
+# edited afterwards under worktree discipline, so the capture is left half-done.
+# Retry from a managed worktree, point --cwd at one, or override deliberately.
+wp tech-debt new "Legacy CLI complexity" --cwd /path/to/managed/worktree
+wp tech-debt new "Legacy CLI complexity" --allow-primary
+
 # List all tech-debt items (optional filters)
 wp tech-debt list
 wp tech-debt list --status accepted

package/skills/testing-philosophy/references/full-testing-philosophy.md

@@ -434,7 +434,7 @@ Before claiming a test is "done":
 - [ ] **Does it use real dependencies?** (PGlite for DB, real services)
 - [ ] **Are assertions specific?** (Not just `toBeTruthy()`)
 - [ ] **Does it test behavior, not implementation?** (No spy assertions)
-- [ ] **Mutation score ≥85%?** (Run `just test --mutation --package <pkg>`)
+- [ ] **Mutation score ≥85%?** (Run `wp test --mutation --package <pkg>`)
 - [ ] **Does it fail if the code breaks?** (Temporarily break code, verify test fails)
 - [ ] **Is it in the right file?** (`.test.ts` for unit, `.integration.test.ts` for DB)
 
@@ -450,23 +450,19 @@ Before claiming a test is "done":
 
 ## Quick Commands
 
-These assume a `just`-based task runner; substitute your own as needed.
+These use the repository's `wp` task facade.
 
 ```bash
 # Run tests
 # WARNING: Never run full suites during iteration. Use single-file verification.
-just test                    # All tests (FINAL VERIFICATION ONLY)
-just test <package>          # Specific package (FINAL VERIFICATION ONLY)
-just test path/to/test.ts    # Single file (ITERATION SAFE)
-
-# Mutation testing
-just test --mutation --package <package>  # Full mutation test
-just test --mutation-diff           # Changed packages only
+wp test                                     # All tests (FINAL VERIFICATION ONLY)
+wp test --package <package>                # Specific package (FINAL VERIFICATION ONLY)
+wp test --files path/to/test.ts             # Single file (ITERATION SAFE)
 
 # Audit quality
-just test --mutation --package <package> # Check mutation score for package
-just audit-ratios            # Check test pyramid (70/15/5/10)
-just qa                      # Full quality check
+wp audit test-smells                       # Static test-quality checks
+wp audit tph-e2e                           # Integration-first E2E review
+wp qa                                      # Full quality check
 ```
 
 ## Decision Tree

package/skills/tooling-friction/SKILL.md

@@ -7,7 +7,7 @@ scope: repo
 applies_to: [agents]
 related: [verify, ultragoal, tech-debt, devex-review, land-policy]
 created: "2026-08-03"
-last_reviewed: "2026-08-03"
+last_reviewed: "2026-08-11"
 name: tooling-friction
 description: "After land, capture MCP/CLI friction tips (optional; never blocks.)"
 argument-hint: "[--promote] [blueprint-slug|pr-number|session]"
@@ -50,26 +50,34 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
    <state-root>/<repo-key>/tooling-friction/YYYY-MM-DD-<slug|pr|session>.json
    ```
 
-   Ask the read-only MCP resolver for the exact path, then use that returned
-   absolute path for the write:
+   **Path SSOT (required):** call the read-only MCP resolver and **copy the
+   absolute path from its summary text** (hosts often omit structured details):
 
    ```text
    wp_tooling_friction_path({"file":"YYYY-MM-DD-<slug|pr|session>.json"})
+   → summary: tooling-friction path: <absolute-path>
    ```
 
-   The resolver is backed directly by
-   `getSurfacePath("tooling-friction/<file>", "repo", <project-cwd>)`. For
-   human CLI use, the equivalent read-only projection is
-   `wp tooling-friction path --file <file>`. The capture is shared by that
-   repository's worktrees but never written to any checkout. Create parent
-   dirs as needed. If the returned path already exists, choose a unique
-   session/HHMM suffix rather than overwriting it. If the surface cannot be
-   resolved or written, report `tooling-friction: skipped: no state surface`
+   Write only to that absolute path. Do **not** construct a path by hand.
+
+   - `repo-key` is a **16-hex** `repoIdentityV1(git-common-dir)` segment from
+     `repoIdentityV1` under the pure preferred state root — **not** a fleet worktree folder slug such
+     as `github.com-org-repo-<hash>` under `~/.webpresso/worktrees/repos/`.
+   - Scope is always **repo** (shared by every worktree of that git common
+     dir). Never use a worktree-keyed desktop-state surface for captures.
+   - Human CLI equivalent: `wp tooling-friction path --file <file>` (prints
+     the same absolute path on stdout).
+
+   Create parent dirs as needed. If the returned path already exists, choose a
+   unique session/HHMM suffix rather than overwriting it. If the surface cannot
+   be resolved or written, report `tooling-friction: skipped: no state surface`
    and stop; never fall back to a worktree or `.agent/` path.
 
 5. Optional `--promote` or severity `high`/`critical`:  
    `wp tech-debt new "<short title>" --severity <s> --category tooling --status accepted`  
-   Set `promoted_to` to the resulting path.
+   Set `promoted_to` to the resulting path. `new` refuses on a primary-like
+   checkout; from one, pass `--cwd <managed-worktree-path>` (or `--allow-primary`
+   to override deliberately).
 6. Optional one-line `wp_session_capture` pointer to the JSON path — no paste-back walls.
 
 **Rate limit:** at most **one** capture per verify bookend.
@@ -77,9 +85,18 @@ Optional post-land **product signal** for MCP/CLI/hooks/CI pain so Webpresso too
 ## Store path (SSOT)
 
 `wp_tooling_friction_path({"file":"<file>"})` (or the human CLI projection
-`wp tooling-friction path --file <file>`) — a read-only projection of
-`getSurfacePath("tooling-friction/<file>", "repo", <project-cwd>)`, the
-repo-scoped desktop state surface, not a path inside `planning/` or a worktree.
+`wp tooling-friction path --file <file>`) — a read-only projection of the pure
+preferred state root (WP_STATE_ROOT or env-paths data; no writability fallback)
+plus `repoIdentityV1(git-common-dir)` under `tooling-friction/<file>`. This
+intentionally does **not** follow `getStateRoot()`'s temporary fallback when the
+preferred root is unwritable — always copy the resolver output.
+
+The MCP summary embeds the absolute path (`tooling-friction path: …`). Details
+also include `path`, `repoKey` (16-hex), `stateRoot`, `scope: "repo"`, and
+`projectRoot`. Copy the path; never invent one.
+
+**Not** a path inside `planning/`, a checkout, or
+`desktop-state/repos/github.com-…` (fleet worktree layout ≠ desktop-state key).
 
 ## Schema v1
 
@@ -161,6 +178,11 @@ repo-scoped desktop state surface, not a path inside `planning/` or a worktree.
 6. No blueprint errata misuse
 7. No committing desktop-state captures
 8. No auto-open GitHub issues per tip
+9. **Never invent the capture path** — no fleet folder slugs
+   (`github.com-org-repo-*`), no worktree-keyed desktop-state, no guessing
+   under `Application Support` or `~/.webpresso`. Always call
+   `wp_tooling_friction_path` / `wp tooling-friction path` and write to the
+   absolute path it returns
 
 ## Integration
 
@@ -171,7 +193,7 @@ repo-scoped desktop state surface, not a path inside `planning/` or a worktree.
 ## Output (agent reply)
 
 ```text
-tooling-friction: wrote desktop state <state-root>/<repo-key>/tooling-friction/<file>.json
+tooling-friction: wrote desktop state <absolute-path-from-wp_tooling_friction_path>
 findings: 2 (high=1, medium=1)
 promoted: none | tech-debt/...
 ```

package/skills/ultragoal/SKILL.md

@@ -195,11 +195,11 @@ Fallback to `wp …` CLI only when the matching MCP tool is unavailable. Prefer
    the user sets N (the default value lives in `workflow-skills-routing.md`).
    Controller validation evidence is **machine-qa (prior QA phase) + N outside voices**
    (default N=1), not two outside model reviewers at budget 1.
-   Use `wp_review_gate` only for exact-version draft plan approval/auto-promotion.
-   Use advisory `wp_review_run` for implementation/phase outside voice; it never
-   mutates blueprint approval state. A CLI delivery gate is explicit
-   MCP-unavailable compatibility only, not this MCP contract. Use `wp_pr_*` for
-   PR babysit — no
+   Use `wp_review_gate` in the default authoritative mode only for exact-version
+   draft plan approval/auto-promotion. Use the same tool with `mode: "advisory"`
+   for implementation/phase outside voice; it never mutates blueprint approval
+   state on its own. A CLI delivery gate is explicit MCP-unavailable
+   compatibility only, not this MCP contract. Use `wp_pr_*` for PR babysit — no
    multi-sleep poll loops; no parallel multi-reviewer stampede.
 8. Stop on `complete`, `cancelled`, blocked guard exhaustion, or `WP_ULTRAGOAL_DISABLE=1`.
 
@@ -217,15 +217,16 @@ primary checkout.
 
 ## Outside-voice review (required for autopilot)
 
-Autopilot and agent-driven ultragoal loops **must** request an **OpenCode Go** outside-voice review after each **goal/phase milestone**, and must pick the model by purpose. Use **`wp_review_gate`** only for exact-version draft plan approval/auto-promotion. Use single-shot **`wp_review_run`** for implementation/phase outside voice; it is advisory and never mutates blueprint approval state. CLI delivery gates are explicit MCP-unavailable compatibility only, not this MCP contract.
+Autopilot and agent-driven ultragoal loops **must** request an **OpenCode Go** outside-voice review after each **goal/phase milestone**, and must pick the model by purpose. Use **`wp_review_gate`** in the default authoritative mode only for exact-version draft plan approval/auto-promotion. Use a single-shot **`wp_review_gate`** call with **`mode: "advisory"`** for implementation/phase outside voice; it never mutates blueprint approval state on its own — a later authoritative call may promote a matching advisory approval without re-invoking a provider. CLI delivery gates are explicit MCP-unavailable compatibility only, not this MCP contract.
 
 Count each milestone review against `review_budget` for merge-ready claims: **exactly one sequential** reviewer path unless the user sets N; the default value is owned by `workflow-skills-routing.md`. Prefer purpose-matched OpenCode Go first; do not fan out multi-host review swarms.
 
 ### Milestones that require a review
 
-Run `wp_review_gate` only for the plan approval milestone below. Run one
-single-shot `wp_review_run` for implementation/phase milestones; it is advisory
-and does not promote or otherwise mutate blueprint approval state.
+Run `wp_review_gate` (default authoritative mode) only for the plan approval
+milestone below. Run one single-shot `wp_review_gate` call with `mode:
+"advisory"` for implementation/phase milestones; it is advisory and does not
+promote or otherwise mutate blueprint approval state on its own.
 
 | Milestone          | When                                                                                                                             |
 | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- |